From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=unavailable autolearn_force=no version=3.4.4 Path: eternal-september.org!reader01.eternal-september.org!reader02.eternal-september.org!news.eternal-september.org!news.eternal-september.org!feeder.eternal-september.org!aioe.org!.POSTED!not-for-mail From: "Dmitry A. Kazakov" Newsgroups: comp.lang.ada Subject: Re: Ada 2012 Constraints (WRT an Ada IR) Date: Mon, 5 Dec 2016 23:07:34 +0100 Organization: Aioe.org NNTP Server Message-ID: References: <92ed75e9-baae-455c-9e34-53348dc6eaef@googlegroups.com> <03847fd7-5699-48de-bb3c-ef5512398f26@googlegroups.com> <3ef819e8-55f7-4ef7-9f37-77e6abc33f98@googlegroups.com> <47366b42-c0a3-41bf-a44a-5241c109d60f@googlegroups.com> NNTP-Posting-Host: s3c6wwRqkurrfTZpuYYZ+w.user.gioia.aioe.org Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-Complaints-To: abuse@aioe.org User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1 X-Notice: Filtered by postfilter v. 0.8.2 Xref: news.eternal-september.org comp.lang.ada:32624 Date: 2016-12-05T23:07:34+01:00 List-Id: On 2016-12-05 12:09, Simon Wright wrote: > "Dmitry A. Kazakov" writes: > >> On 05/12/2016 09:41, Stefan.Lucks@uni-weimar.de wrote: >>> On Sun, 4 Dec 2016, Robert Eachus wrote: >> >>>> I would consider it a major bug to have a pragma Assert that could >>>> fail at run-time absent a hardware failure or some such. (Even though >>>> it would be turned off in production code.) > > Yes. Though it's really up to the system engineers to decide on system > behaviour in the presence of software failure. There is no such thing. Software failure per definition means the decided behavior didn't happen. >>> I don't quite think so. A failed Assert (or a failed pre- or >>> postcondition, which are essentially a nice way to put Asserts in >>> specifications) *may* be checked even in the productin system. What is >>> important is to always shut down when upon Assert-failure -- preferably >>> after writing diagnostic information to wherever digagnostics goe. > [...] >> Things called in Ada pre- and post-conditions if evaluated during >> run-time are merely subprogram bodies booby-trapped with unanticipated >> exceptions. Bad thing. > > Just as bad a thing as Constraint_Error. Not at all. Constraint_Error is defined and *desired* behavior. Exceptions from pre-/post-conditions is undefined behavior. > To me, there's no practical difference, at any rate from a black box > point of view, between a language-defined exception and an assertion (or > condifion) failure; just a matter of who defines what is out of the > envelope for the program. The same behavior can be wrong or good depending on the specification. That is the practical difference. -- Regards, Dmitry A. Kazakov http://www.dmitry-kazakov.de