Skip to main content
Software Engineering

Return to Answer

replaced http://stackoverflow.com/ with https://stackoverflow.com/
Source Link
Community Bot
Community Bot
  • 1

The answers to this StackOverflow questionthis StackOverflow question gives a glimpse to the great lengths C++ programmers go to understand all of the possible failure modes that could happen to their code and try to guard the validity of program state despite failures. Line-by-line analysis of C++ code becomes a habit.

Starting with C++17, the [[nodiscard]] attribute can be used on function return values (see: http://stackoverflow.com/questions/39327028/can-a-c-function-be-declared-such-that-the-return-value-cannot-be-ignoredhttps://stackoverflow.com/questions/39327028/can-a-c-function-be-declared-such-that-the-return-value-cannot-be-ignored).

The answers to this StackOverflow question gives a glimpse to the great lengths C++ programmers go to understand all of the possible failure modes that could happen to their code and try to guard the validity of program state despite failures. Line-by-line analysis of C++ code becomes a habit.

Starting with C++17, the [[nodiscard]] attribute can be used on function return values (see: http://stackoverflow.com/questions/39327028/can-a-c-function-be-declared-such-that-the-return-value-cannot-be-ignored).

The answers to this StackOverflow question gives a glimpse to the great lengths C++ programmers go to understand all of the possible failure modes that could happen to their code and try to guard the validity of program state despite failures. Line-by-line analysis of C++ code becomes a habit.

Starting with C++17, the [[nodiscard]] attribute can be used on function return values (see: https://stackoverflow.com/questions/39327028/can-a-c-function-be-declared-such-that-the-return-value-cannot-be-ignored).

added 617 characters in body
Source Link
rwong
rwong
  • 17.2k
  • 3
  • 38
  • 82

The answers to this StackOverflow question gives a glimpse to the great lengths C++ programmers go to understand all of the possible failure modes that could happen to their code and try to guard the validity of program state despite failures. Line-by-line analysis of C++ code becomes a habit.

When developing in C++ (for production use), one cannot afford to gloss over the details. Also, binary blob (non-open-source) is the bane of C++ programmers. If I have to call some binary blob, and the blob fails, then reverse engineering is what a C++ programmer would do next.

Reference: http://en.cppreference.com/w/cpp/language/exceptions#Exception_safety - see under Exception Safety.

Reference: http://en.cppreference.com/w/cpp/language/exceptions#Exception_safety - see under Exception Safety.

The answers to this StackOverflow question gives a glimpse to the great lengths C++ programmers go to understand all of the possible failure modes that could happen to their code and try to guard the validity of program state despite failures. Line-by-line analysis of C++ code becomes a habit.

When developing in C++ (for production use), one cannot afford to gloss over the details. Also, binary blob (non-open-source) is the bane of C++ programmers. If I have to call some binary blob, and the blob fails, then reverse engineering is what a C++ programmer would do next.

Reference: http://en.cppreference.com/w/cpp/language/exceptions#Exception_safety - see under Exception Safety.

Source Link
rwong
rwong
  • 17.2k
  • 3
  • 38
  • 82

C++ programmers don't look for exception specifications. They look for exception guarantees.

Suppose a piece of code did throw an exception. What assumptions can the programmer make that will still be valid? From the way the code is written, what does the code guarantee in the aftermath of an exception?

Or is it possible that a certain piece of code can guarantee never to throw (i.e. nothing short of the OS process being terminated)?

The word "roll back" occurs frequently in discussions about exceptions. Being able to roll back to a valid state (that is explicitly documented) is an example of exception guarantee. If there is no exception guarantee, a program should be terminating on the spot because it is not even guaranteed that any code it executes thereafter will work as intended - say, if memory has corrupted, any further operation is technically undefined behavior.

Various C++ programming techniques promote exception guarantees. RAII (scope-based resource management) provides a mechanism to execute cleanup code and ensure that resources are released in both normal cases and exceptional cases. Making a copy of data before performing modifications on objects allow one to restore that object's state if the operation fails. And so on.

Reference: http://en.cppreference.com/w/cpp/language/exceptions#Exception_safety - see under Exception Safety.

C++ had a failed attempt at implementing exception specifications. Later analysis in other languages says that exception specifications simply aren't practical.

Why it is a failed attempt: to enforce it strictly, it has to be part of the type system. But it isn't. The compiler does not check for exception specification.

Why C++ chose that, and why experiences from other languages (Java) proves that exception specification is moot: As one modify the implementation of a function (for example, it needs to make a call to a different function that may throw a new kind of exception), a strict exception specification enforcement means you have to update that specification as well. This propagates - you may end up having to update the exception specifications for dozens or hundreds of functions for what is a simple change. Things get worse for abstract base classes (the C++ equivalent of interfaces). If exception specification is enforced on interfaces, implementations of interfaces will not be allowed to call functions that throw different types of exceptions.

Reference: http://www.gotw.ca/publications/mill22.htm

Starting with C++17, the [[nodiscard]] attribute can be used on function return values (see: http://stackoverflow.com/questions/39327028/can-a-c-function-be-declared-such-that-the-return-value-cannot-be-ignored).

So if I make a code change and that introduces a new kind of failure condition (i.e. a new type of exception), is it a breaking change? Should it have compelled the caller to update the code, or at least be warned about the change?

If you accept the arguments that C++ programmers look for exception guarantees instead of exception specifications, then the answer is that if the new kind of failure condition doesn't break any of the exception guarantees the code previously promises, it is not a breaking change.