Re: Tests in a software release

["G.B." <bauhaus@notmyhomepage.invalid>]

On 15.11.17 23:17, Randy Brukardt wrote:

> ...
>> The most important thing is, designing by contract
>> is *not* programming defensively. By definition.
> 
> One *always* programs defensively.

Why would that be?

FTR, and for what the definitions are,
  http://se.ethz.ch/~meyer/publications/computer/contract.pdf

Referring to some notes from your blog, you cannot always

   - compute things at compile time, hoping to optimize;
   - perform run-time checks in a timely fashion, without
     checks causing timeouts:

     function Binary_Search (X : List_of_Things) return Thing;
     --  ... provided that elements of X are ordered by "<=".
  

     procedure Foo (X : Graph; P : Node_Process);
     --  ... provided that X is a DAG.


Is_Sorted can be expressed in Ada, but the compiler cannot
prove this at run-time, foreseeing data that are becoming
available only then. It has no say, at that point.

Similarly, Is_Dag cannot be computed at compile time.
Checking Is_Dag at run-time will be prohibitively
expensive at Foo's end. Still checking is Bad Design, as
Dmitry might possibly put it, I guess, because a DAG is
a DAG by construction. At run-time.

So, what needs to be done and what is usually done
is that clients will be sure to call subprograms
passing sorted lists and passing DAGs, resp. No checks,
no defenses, just doing what the contract says we should.

So, while no compiler can eliminate the computations for
the reasons stated ("optimize"), we can if our code abides,
by *not* having Binary_Search *check* proper ordering.

Thus, your future compiler could not "demonstrate likely
bugs" for these contracts, but if the optimizer fails at
predicting all run-time values in X and therefore adds checks,
it likely prevents efficient real-time computation for the
contracts outlined above.

> In any case, this is the exact opposite of the sort of approach that you are
> championing.

On the contrary: you write the contract's clauses of
all parties to your compiler and then, once you
know your code meets the requirements of the contracts,
you drop checking code accordingly ("optimize") and in
good conscience.

    if X /= X or else X /= X then

       --  what, at compile time,
       --  for which which kind of X?