Re: Allocators and exceptions

[Simon Wright <simon.j.wright@mac.com>]

Maciej Sobczak <see.my.homepage@gmail.com> writes:

> procedure P is
>
>    type T (Init : Integer) is record
>       C : Positive := Positive (Init);
>    end record;
>
>    type T_Access is access T;
>
>    Ptr : T_Access;
>
> begin
>    Ptr := new T (-5);
> exception
>    when Constraint_Error =>
>       -- is memory leaked or deallocated?
>       null;
> end;
>
> I want to know whether the memory that was allocated for the new
> object was immediately deallocated due to the exception.  By
> "immediately" I mean before the control even goes to the exception
> part.
>
> I don't find this guarantee anywhere in the AARM and it scares me.

I'm not sure that I'd be scared, precisely.

If this was a safety-related program I would expect some serious test
effort, which would probably discover the mistake; or maybe formal
methods would be appropriate.

Even then, a safety-related _system_ ought to have some strategy for
recovering from such a runtime error. Perhaps it should reboot into a
safe mode? I would certainly expect the processor running a car's
ignition system not to just give up on an unhandled exception ...

In any case, why would the runtime system need to guarantee memory
recovery when it can hardly be expected to recover from the failed
design that led to the situation in the first place? I don't believe
there's any sensible recovery action to be taken -- the program's
state is corrupt already. Reboot, you know it makes sense!