Re: High-Integrity OO and controlled types

[Robert A Duff <bobduff@shell01.TheWorld.com>]

"Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> writes:

> On Mon, 02 May 2011 12:32:53 -0400, Robert A Duff wrote:
>> Note that we're talking about pragmas Restrictions and Profile.
>
> Rather about rationale behind such restrictions.

OK.

>...You gave an example of an
> overhead caused by local access-to-controlled types.

No, all access-to-controlled types -- not just local ones.
And access to non-controlled types that contain controlled components.

And it's not just overhead (as in run-time efficiency) -- it's the complexity of
the run-time support.

And it's not access types per se -- it's heap-allocated objects
(i.e. "new") that introduces most of the complexity.

>..That has a far
> narrower scope than *any* usage of controlled types.

Yes, that's a fair point.  Perhaps the restrictions should have been
somewhat narrower.  But note that until recently, GNAT used a bunch of
run-time system calls (and linked lists) for stack-allocated controlled
objects, too.  It was a huge amount of work to fix that.

Another thing to consider: limited controlled types are simpler than
non-limited ones.

>...A restriction of such
> access types can be reasonable (as well as, and much more importantly,
> precluding dynamic accessibility checks).

Well, dynamic accessibility checks are a separate issue, but I must say:
I do NOT like dynamic accessibility checks.

>...Prohibiting all controlled types
> is just irrational.

I think "irrational" is too strong.  The people who want these sorts
of restrictions tend to like conservative rules.

- Bob