Design pattern: method that checks consistency of object's internal state

It looks to be a variant of Design by Contract. DbC was described by Bertrand Meyer in his book Object-Oriented Software Construction. The basic idea of DbC is that there exist Contracts between subroutines, objects, and types, which basically guarantee that IFF the user of an abstraction fulfills their contract, THEN the provider of the abstraction guarantees that it will fulfill its contract.

Pragmatically, this allows to remove a lot of redundant error checking and defensive code, since it is very clear who is responsible for what. For example, in a subroutine, the callee does not have to check that arguments are valid because the contract says the caller is only allowed to pass valid arguments. In turn, the caller does not need to check the return value, since the contract says that if the arguments are valid, so is the return value.

If the contracts are actually recorded in the code proper, instead of just documentation, they can be automatically checked, which actually improves robustness even though the redundant checking has been removed.

Bertrand Meyer implemented DbC in his programming language Eiffel. In Eiffel, every subroutine can state its preconditions and postconditions and the compiler will automatically insert code that checks the preconditions before entering the subroutine, and the postconditions before returning from the subroutine. Likewise, classes can specify invariants about their instances, and the compiler will automatically insert checks after the postconditions checks to make sure an object always satisfies its invariants after a subroutine call. (Invariants may be violated while a subroutine is executing, but as soon as the subroutine is finished, the object must be in a valid state.)

Over time, there have been Contract Frameworks developed for many different programming languages (e.g. Boost.Contract for C++), and a few other languages with specific language-integration of DbC have appeared (e.g. D, Cobra (both also support language-integrated unit tests, and Cobra also language-integrated documentation), Spec♯, Sing♯, M♯).

Traditionally, Contract Systems, whether as libraries or integrated into the language, have worked at runtime. Microsoft's Spec♯ was, to my knowledge, the first system that tried to prove and disprove contracts at compile time. This was later extracted in the CodeContracts.NET library and shipped as part of .NET and Visual Studio.

Native language support for DbC in C++ may actually appear as early as C++2a.

This looks to me like "invariant checking" from Design By Contract. It can be extended by checking preconditions and postconditions. It is a technique which falls under the term Defensive Programming.

The only question here which arises to me is: why you actually need to check assert_good() in every class, as you wrote. Usually, I try to implement classes in a way they cannot have inconsistent states. An invariant checking like this should normally only be necessary for a few classes of a certain complexity. But your mileage may vary, maybe you are building different types of programs than me.

I'm not a C++ guru, but I know there is the <assert.h> header that provides a macro for checking and throwing assertion errors. What you have done may use that internally (I assume), but does not allow the for a purely conditional method call.

In C# and Java, there is a convention for method names that infer certain behaviors:

• check throws an exception if there is bad state
• is returns a boolean for whether the state is good or bad

If we were to utilize that convention in your example here, it allows you to have an easily removed assertion:

#include <assert.h>

void MyClass::do_something() {
    // Pre-condition (design by contract)
    assert( is_good() );

    // do some changes and processing

    // Post-condition (design by contract), also Invariant condition
    assert( is_good() );
}

Because the check is is done using the standard assert() macro, when you recompile as a release build, the assertion macro is zeroed out, and all references to the is_good() also are removed allowing the optimizer to remove the dead code.

That said, if object state is so complex that it could easily be in an invalid state, then you might have too much going on in your object. It's hard to say. I personally prefer unit tests, but I can see a place for this in certain circumstances.

I will use Programming With Assertions since that’s what I’m used to right now and since OP asked if it’s a “good practice”.

Java is not C++ and in particular does not have compile-time metaprogramming support, a feature which would make implementing different shades of assertions something that we end-users could do. But it does have assert which achieves the same thing.

You talk about assertion method. It does seem like the Java document is more about simple, inlined assert statements. But the document does call out exactly the practice that you are using: “class invariants”.

The assertion mechanism does not enforce any particular style for checking invariants. It is sometimes convenient, though, to combine the expressions that check required constraints into a single internal method that can be called by assertions. Continuing the balanced tree example, it might be appropriate to implement a private method that checked that the tree was indeed balanced as per the dictates of the data structure:

// Returns true if this tree is properly balanced
private boolean balanced() {
 ...
}

Here we cannot spread inlined assertion statements around unless they are very simple. We naturally want one or more method to run every time we want to make sure that the class invariants have not been violated. So using an “assertion method” is is completely natural.

I have also found that I tend to gravitate towards assertion methods when I want nice error reporting. Because I don’t want something like:

assert a.equals(b);

To fail with “false, not equal”. I want to see exactly how they are equal. And sure I can use this syntax:

assert a.equals(b) : a.printDiff(b);

But now it feels like I have to do a two-step process each time: assert, then recover and visualize whatever might have caused the assertion to fail.

Instead I can lean on a third-party library which can print an error about exactly what is not equal, which leads me to use a private method:

    private boolean assertSaveGetContract(...) {
        assertThat(<equals check>).isTrue();
        return true;
    }

Here I am relying on the side effect of the third-party error, so not really using assert per se. But I could always make a wrapper in order to make sure that AssertionError is thrown here if assertThat fails.

Now this last thing is not really an assertion method. It’s a helper method which is conditionally called based on whether assertions are turned on or not. And that demonstrates how you can build up more involved state conditionally (i.e. without paying the cost when assertions are off) in order to do more complex or convenient checks.

Say you have to store some state for a later post-condition check. Naturally you have to do that at the start of the method.

public void save(...) {
    Long preCount = expensiveCall();

    <do work>

    assert assertPostCount(preCount, ...);
}

But you don’t want to have to do this needless call if assertions are not on. The Java document has a solution for that:

public void save(...) {
    Long preCount = null;
    assert ((preCount = expensiveCall()) != null);

    <do work>

    assert assertPostCount(preCount, ...);
}

Here you rely on the side-effect of the assignment and the outer != null check which will always succeed.