Re: {Pre,Post}conditions and side effects

["Randy Brukardt" <randy@rrsoftware.com>]

<Stefan.Lucks@uni-weimar.de> wrote in message 
news:alpine.DEB.2.11.1505072052570.16448@debian...
> On Thu, 7 May 2015, Randy Brukardt wrote:

...
>> You ought to fix your
>> program (probably by adding an appropriate predicate) so that the check
>> *can* be eliminated (or pushed to somewhere where the cost is 
>> irrelevant).
>
>Why do I need to fix the program, if I know it is correct? Just because
>the compiler isn't good enough at theorem proving?

Because there is no such thing. There is no real way for you to know that it 
is correct. I have plenty of examples of supposedly correct programs that 
turned out to have serious bugs.

The only way for a program to be "correct" is for it to be proven that way 
by the compiler. (And even then, the compiler algorithm might have 
problems.) Because if any other tool does it, the compiler might disagree 
(because either tool has bugs), and thus the actual code might still in fact 
be incorrect.

>>> Turning off the checks just hides the problem.
>
>*IF* there is a problem at all.

See above. There is *always* a problem; the only question is whether you are 
willing to defend against it or not.

For example, in this "Is_Sorted" example, if you are assuming that some 
object is sorted, then it should have a predicate to that effect. In such a 
case, the compiler would be able to eliminate all of the precondition checks 
on calls, the only time the predicate would be checked is when the object is 
initially created (which certainly should not be on any critical path), or 
if it is modified by a routine that doesn't include Is_Sorted in its 
postcondition (which is clearly the source of potential bugs as well).

In the absence of those sorts of things, you are just hiding potential 
flaws.

                            Randy.