Re: contracted exceptions

[Simon Wright <simon.j.wright@mac.com>]

"Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> writes:

> On Sat, 09 Jun 2007 13:32:59 +0100, Simon Wright wrote:

>> Not a lot .. an exception is raised because some assertion made by
>> the designer/implementer of the library concerned has turned out to
>> be false (the value will be in this range; the file will be open;
>> the file is a valid XML document ...).
>
> In Ariane case the physical value was in range but assertion failed.

I thought it was a constraint check?

I was trying to make the point that some restraints on program
legality can be made in the language by defining constrained types,
others you're stuck with hand-coded checks:

   pragma Assert ({correct calling sequence}, "bad calling sequence");

or if you prefer

   if not {correct calling sequence} then
      raise Use_Error;
   end if;

All much of a muchness in terms of trying to make sure that the
program is correct and is used correctly.

> I don't think that failed run-time assertions should be converted
> into exceptions. Among many reasons, one is that this would break
> exception contracts:
>
> procedure Foo -- I don't aise Baz
> begin
>    pragma Assert (<something>); -- I raise Baz when not <something>

I had forgotten the context of this discussion, I was talking about
Ada :-)

Also, this check is about a precondition, if the caller violates the
precondition she has no right to expect me not to raise unheralded
exceptions!

> The contract would be a lie. Another reason is that you could not
> handle Baz, because that would change the program behavior with and
> without assertions checked. IMO run-time assertions is an utterly
> wrong idea.

As I said before, I see little difference between assertions &
predefined language checks in terms of where they should be
used. Clearly you shouldn't use an assertion where the thing being
checked is legitimate failure behaviour!

   pragma Assert (not Vessel_On_Firing_Range);
   Start_Test_Missile_Firing;

Of course you can suppress (some) language-defined checks, but then
you get undefined bahaviour at run time if the error condition
happens. Is it worse to get unexpected exceptions or to compute with
out-of-range data?

Best of course to prove that the error can't happen.

--S