I'm looking forward to seeing where these go in the future. Can solvers prove my code correct (at least in some trivial cases)? What should happen in a unit test (sometimes I want to test that my program handles out of range values, sometimes it is expensive top check and so I put the contract in to avoid the check at runtime...) Can/should the optimizer account for contracts (same question as unit tests).
See the papers "Soft Contract Verification" and "Soft Contract Verification for Higher-Order Stateful Programs" (Nguyễn et al.) In general, there's a lot of academic work on the topic coming from the Racket community.
In short: yes, some classes of contracts can be statically proven. Not all of them, and it depends on the language's semantics, so it's probably not easy to retrofit into C++. But there's work being done on unifying types and contracts, moving back and forth between static proof and dynamic enforcement, and it's all pretty interesting. Proving contracts statically eliminates runtime overhead; generating contracts from types makes it possible for a gradually typed language to be sound.
I haven't seen those papers. The general thought seems to be that progress is good enough that a restricted subset of C++ can be proved (which is getting less restricted all the time, though probably never will be everything) and the solvers will be able to detect where they give up: if you want a solver you will have to write the code they can prove and that is an acceptable limitation.
Contracts also allow a solver to say "I can't prove this messy function, but I can at least prove everything around it". Which is to say if we prove the precondition is met, and if we assume the post conditions are met, we can prove everything else despite the messy parts we can't do. This at least lets us know where the messy code is.
The basic idea is that you generate "Verification Conditions"(VCs) by mapping the function onto a Hoare Triple viz. {Pre} Function-Body {Post} and then applying Dijkstra's WP-Calculus mechanically to step backward from the Post to the Pre thus generating a mathematical formula.
The programmer provided contracts are merged into this formula to generate the complete VC which is a logical implication viz; Pre ==> WP(contracts-from-function-body, Post).
This is then handed off to a automated solver which verifies that Post is met when Pre is True in all the paths.
I can see the appeal of having 'code as documentation' in header files, but personally I find any type of runtime asserts to be too heavy handed. Graceful error handling, in my opinion, is always preferable. This type of functionality is what is continuing to drive me away from C++. If your preconditions and postconditions matter, document them in a comment block.
You can set a "contract evaluation semantic" for contracts. One of them is "observe", which only prints a message on contract violations. With "ignore", nothing at all happens.
Graceful handling is a trade off. Sometimes the check is expensive, if everybody normally does it right you don't want to check (particularly in a tight loop), but you don't want to lose this. I work in embedded, in production our CPUs are not powerful enough to risk all those runtime checks, but I want to turn them on when I work on my workstation - in hopes that if there is a problem we catch it.
Contacts are also a guaranteed syntax. Runtime checks provide no way for tools to know if the condition is expected to never happen - this is a bug; vs this is a normal user error we need to check for. A contract means theorem provers can find code paths where a bug could happen - of course we don't have theorem provers for C++, but this is seen as a requirement to get them.
Rust is quite complicated but people like it a lot. Python too in a way - it's quite large and complicated but it exposes the complexity in a very gradual way and you can ignore so much of the language and still get things done.
I agree with you about simple languages though. I really like Go - the "there should be only one way to do things" from the Zen of Python actually applies to Go in a way that it doesn't apply to Python at all.
This is just how I've felt writing both Rust and C++. Rust's language complexity often feels like it's there so that I don't have to think about so much complexity when interfacing with the code, whereas C++'s language complexity introduces footgun after footgun and I have to think very carefully about what everything could possibly do (e.g. if destructors even get run in certain instances when I'd expect them to).
Lots of programmers match the right language to the right job, I think the zen of C++ is embracing the ugly as a feature; there are so many subsets of that language you never have to leave it.
> there are so many subsets of that language you never have to leave it.
I wouldn't call it "subsets" as much as support for "Multiple Paradigms" in the same language. They can all be used together to express powerful abstractions. James Coplien wrote "Multi-Paradigm Design for C++" in 1998 (before C++11!). Then people figured out Template metaprogramming etc. and the design space became even more wider.
Today with all the available language features and library additions you never have to leave the language at all whatever be the platform(cpu-arch+OS) you are working on. Add-in trivial interop with C and there is nothing out of bounds.
I am very bullish on constraints based programming like this.
The main problem is code organization and syntax. Tacking stuff like this onto fuction declarations is too basic.
Ideally, I think we need better constructs, e.g. dettached constraints like to the function declaration. You can define constraints separately, in the same namespace or w/e, add notes, comments, etc. and the function declaration can be used with intellisense to jump to the constraint. You could even tag the defintions.
In modern AI-based workflows, the agent can pull up an explanation on the function, and point directly to the constraints, with strong confidence esp. if it's got explicit metadata.
Take a look at Racket (or Rhombus if allergic to parens). Support for contracts there is stellar and provides everything you mentioned. You can use `define/contract` for inline contracts, or you can attach contracts when exporting names from a module using `contract-out` declaration. Contracts are first-class, can be defined separately and attached wherever you want (importantly, this includes values (structs, classes) as well as functions). There are higher-order contracts that generate new contracts from existing ones. There's support for both static and dynamic metadata for almost all kinds of entities in code (ie. both the syntax and the semantic entity it produces can be annotated with anything). I wouldn't recommend using Racket/Rhombus in production, but it's a great preview of what might become commonplace in a decade or two :)
I've spent years avoiding lisp, I am not about to break that streak now.
All jokes aside, I genuinely think that non-algol syntax is a non-starter. We're too far along now, that it's easier for these features to come to java/rust/typescript/cpp than it is to switch completely to academic langs that have terrible tooling support.
The tooling around S-expression syntaxes is almost necessarily better than others because it's so straightforward, eg, structure-based editing operations. The "problem" with IDE integration for such languages is generally the (lack of) availability of static information, especially due to Racket's expressive arbitrarily-many-phased macro system, but that's a separate axis of language design.
That said, the parent comment explicitly pointed out Rhombus as an alternative to an S-expression syntax within that same community, so maybe you could look into that suggestion instead of being pithy about topics in which you are less well informed.
I suspect the GP might not like Rhombus because it uses indentation (like Python) for code blocks instead of braces (which isn't actually Algol-like; IIRC, Algol mostly used parentheses). In that case, even Pyret wouldn't work for them.
Personally, I'm still (25 years into programming) undecided: does syntax not matter at all, matter only a bit, or is one of a language's most important characteristics? It's incredibly hard to say, at least for me.
An anthropic employee did a talk earlier this year or last and i think it was said that yeah, they eat it up. Tools to find errors because it is visible is great
If I put them in the header, I have to include half the world because I can't forward declare `Foo foo` argument if I want to check `foo.size() > 3` or similar in a pre/post-condition. This is a non-starter, keeping headers lean is the only way to not end up with 1 hour compiles.
If I put them in the cpp, they lose their only advantage over asserts - that they also double as documentation in the headers.
Did we add 50 pages to the standard for a slightly fancier assert? I feel like this could've been one builtin and a footnote:
contract_assert(expr) - if expr evaluates to false, the behavior of the program is undefined. Implementations are encouraged to emit a runtime check for this in debug builds, or a compiler error in cases where they can statically determine, that the assert will fail.
I'm expecting to see talks (and buy books, read blogs...) in 3 years by someone who spent a lot of work adding contracts to a small but significant code base. This is the type of question they will answer.
I think the right answer is in the header, and in turn that means someone needs to answer your objection - how do you avoid long compiler times? I suspect modules is a large part of the answer, which means the guide/talk will also be how to make modules work in the real world. Remember though, that is all guesses I wouldn't be surprised if I'm wrong.
Hmm, I thought I had watched all his talks on contracts by now, but I must have missed a few (which isn't a surprise - there are a lot of conferences out there that I can't watch them all and get anything done. I end up ignoring a lot of them)
I hadn't seen that talk, but the content is just an updated rehash of this is what contracts can do.
What I want I'd : we have used contracts in the tall world. This is what works and doesn't. This catches a lot of bugs for little work. This looks the same but results in false positives. This is a lot of work for few bugs.
Of course since I don't know what works I'm guessing, but that type of thing.
Ideally we would have Eiffel or Ada/SPARK kind of approach, or even something like Frama-C.
However given all the technical issues with C++ semantics, and the whole politics regarding contracts since the C++20 removal, I am not sure we will ever get there.
It will be the same as with modules or concepts, the main people behind the proposals eventually move on, and there is no one left to pick the up the pieces for the follow up papers, and related implementation.
The first declaration of a function must include the contract pre/post conditions and follow-up re-declarations of the function must either not include any contract conditions or the same conditions as the initial declaration.
And you can avoid re-including the world because pre/post conditions should be externally visible behavior or call out to functions for pre/post checks on internal behavior.
Essentially you either define them using what you have in scope during the initial declaration or you call out to a function located elsewhere that can have access to more/internal scope and do more complicated checks.
I'm all for signing up for a contract if it can turn a runtime error into a compile time error. However, this looks like it just makes more runtime errors. At that point, these seem no better than `assert` except for the fact that they promise to really assert (probably).
The article also points out a big problem which is "Importantly, this aspect of Contracts is why contract assertions must not be used for error handling and input validation: If a function has in-contract requirements to report certain events as errors, that handling must be done with standard C++ control statements that are not optional, never with contract assertions."
That sort of muddy definition of what contracts are supposed to be used for is almost certainly going to make a mess. It's not input validation, but parameter validation.. but not really validation but rather checks which error out, but it's not errors we are producing.
The bit about contracts not being input valuation is no different than the case for assertions. It's basically saying that if assertions were inappropriate, so are contracts. So if you find that like blurry, the blurriness predates contracts.
That said, the distinction is actually quite clear, though not always well-explained: an assertion failure (and therefore a contract failure) indicates a bug. It must never happen, and therefore it must always be OK to suppress the validation. If you see it fire, your program needs fixing.
It’s a standard way to do pre and post conditions. Clojure pre and post conditions also behave this way. If you force these conditions into compile-time checks, well, then you are introducing a second type system with refinement types into the language. And type checking would take a long time. Imagine someone writes a precondition for a function where its integer argument x needs to satisfy collatz(x)==1; do you now expect the compiler to prove the collatz conjecture or verify it for all 64-bit integers every compilation?
My experience using pre and post conditions in Clojure makes me really like them. They are a small but meaningful improvement over plain old assertions. And yes being able to turn them off is a feature not a bug.
SPARK (Ada) has compile time pre and post conditions, and it works well. If you declare the post-condition Collatz (n) = 1, the compiler can't help you, and compilation will fail. If you've got a difficult condition, you're going to have to help the theorem prover, often by introducing "ghost" functions, or by simply softening the condition. In the latter case, you can't prove total correctness, but you can often still prove things like absence of run-time errors.
I would phrase the difference between contracts and input validation like this:
- If it can happen, but shouldn't, that's input validation (e.g. the user inputs an empty name)
- If it can't happen and shouldn't, that's a contract (e.g. I checked that this string is non-empty in the function that calls this one, so I already know it's non-empty. Also my linked list has a head and a tail because that's how my constructor made it)
Most bugs happen in the space of things that the programmer thinks shouldn't happen but happen anyways. That is why contracts are useful. But in a bug-free program they also don't do anything, so allowing you to turn them off with a compiler flag is reasonable. Just like asserts, but a bit more useful for tooling, IDEs, etc. Also with an observe mode that allows you to find bugs in production without crashing your whole process
FTFY: "Most bugs happen in the space of things that the programmer thinks can't happen but happen anyways". I'm sure we all have stories about some baffling error that simply couldn't have occurred, it's impossible, and then you spent an hour staring at the code, reading the tracing logs, and then finally finding a single-character typo responsible for it. Whoops, it's not supposed to be "if (p != nil) { return false; }", it's meant to be "if (p == nil) { return false; }"!
But yeah, that's precisely what contracts are (at least originally) intended to be, but you can quite clearly see from this comment section that this is not how they're going to be used. Well, this surely gonna be "fun" experience down the line for the C++ programmers...
If someone wants contracts in C++, now they can just keep using C++. Which is good, because a lot of people and projects are stuck with C++, so the actual question is merely: can you have contracts in your project or can’t you?
In my C compiler rcc I throw compile-time errors of course. Not a full SMT solver like z3, just a self written solver, but it works fine and fast enough. Runtime errors are just glorified asserts, lame.
This is the biggest problem with contracts, there's simply no way to actually say "please always execute this check". A lot of people replying seem to think that the critique is with the concept of contract based programming, but the C++ version of contracts is just weird
The programming model for C++ contracts as described by the authors, and spec, is that they are 'ghost code'. You must never assume that a contract check is actually executed, even if you've asked your compiler to execute your contract checks. This is because ABI/ODR problems can and will cause your contract checks to be deleted, as well as the 'observe' contract mode which is a strange one
So its hard to know what the use case for them is as a result. You can't use them for safety checks, because you must assume they won't be run. Hilariously, they actually introduce safety problems vs asset: Eg take two pieces of code:
People mistakenly transform #1 into #2 unconditionally, not realising that this is actually a misuse of the contracts feature. It can, and will lead to undefined behaviour - while being perfectly well defined with asserts
I have a feeling that in 10 years the advice will be to never use contracts in anything approaching code that needs safety, as they're generally less safe than using an assert for no real reason. So what's their use case?
Interestingly, Java had exactly that in mind when introduced `assert` keyword in very early versions (2002). It's equivalent to an `if` that can throw a runtime AssertionException, but only if the program is launched with `-enableassertions` flag.
The idea is that you use `-enableassertions` only during development, and your program should never rely on it. But it helps IDEs and static analyzers to have a contract about code.
D has a keyword prefix `debug`. So, one can write things like:
...
debug if (x) printf("x: %d\n", x);
...
So, you can throw the -debug switch on the compiler and the debug code is enabled. For asserts,
debug assert(lookMa);
and the check is only run when the -debug switch is done. It works remarkably well.
Another interesting property of `debug` is it turns off the safety checks in the target statement that follows it. Because, sometimes you just gotta do some unsafe tricks to figure out where your code went wrong.
As does .NET, with Debug class and related annotations.
.NET had DbC support for a while, but it was a Visual Studio Enterprise product, based on rewriting MSIL, and eventually was killed, as I imagine very few people bothered using contracts when such a license was required.
JVM languages like Clojure, Scala and Kotlin have DbC constructs beyond only assert.
You should check out the Racket programming language. They actually don’t have types at all in their documentation, they only have preconditions and postconditions which are very helpful in telling you if a function expects non-negative integers or something.
>I'm all for signing up for a contract if it can turn a runtime error into a compile time error.
You can get compile-time errors with static code analysis tools with it but the main goal is to direct the compiler towards optimizations for restricted case, IMHO. If you know beforehand the kind of values you are using then the only sure way to let the compiler know is to write code in such a way that the values you don't expect result in UB, which is not always possible or convenient. Contracts allow a regular way to do the same. It does not mean the compiler will use this knowledge but it will remain in your code and might be used eventually.
For example, if you want to align an integral value on x you can write something like ((value + x-1)/x)*x, however, if x is a power of 2 then you can do (value + x-1) & ~x, which is likely faster. As of now, gcc 16 does not do this optimization even with contracts, but if you recorded this in code, some future compiler might do this. Without contracts the chances for this are much lower.
From the "C++ design committee was so preoccupied with whether they could, they never stopped to think whether they should" department.
Asserts:
1. You don't like the being conditional on NDEBUG ot aborting the program - roll out your own. Will still be a one-liner.
2. You want them act as documentation of pre-conditions in headers - just add a bloody comment there.
The only somewhat reasonable development here are the post conditions in functions with multiple returns, but post/s are dramatically less common than pre/s, so their utility is also debatable.
I have seen far too many times when the comment in the implementaiton doesn't match reality to accept pre/post conditions in a comment. I want my contracts someplace where they get evaluated from time to time so that they are fixed when they are wrong.
The article makes no mention of optimisation use cases. In case anyone already knows off the top of their heads and before I start digging for the answer, is part of the intent here for these to inform the optimiser stages, perhaps similarly to what the if (!(some_condition)) { __builtin_unreachable(); } idiom can achieve?
Allegedly the pre and post conditions, in varying degrees of certainty according to the evaluation semantics selected, are propagated to the optimization passes of gcc and llvm. However, I haven’t seen any detailed blog posts or summaries of the effectiveness or reliability of this feature. Sorry it’s not a lot of info, but it was what I knew off hand based on previous reading.
...yup, looks like there's no way to get the optimisation benefit in "ignore" mode, which is the only mode that doesn't explicitly compile the runtime checks: https://godbolt.org/z/KTx1Pc3aa compare codegen for test3 (the pattern that would be useful) vs test4 (the best we actually have)
At least for this iteration of contracts, no. From the proposal (italics in original) [0]
> Features Not Proposed
> To keep the scope of this proposal minimal (while still viable), the following features are intentionally excluded from this proposal; we expect these features to be proposed as extensions at a later time, building on the foundations laid by this proposal.
> The ability to assume that an unchecked contract predicate would evaluate to true and to allow the compiler to optimize based on that assumption, i.e., the assume semantic
I dislike this. But honestly, I dislike assert statements. I mainly write code that cannot fail. And if something does go wrong, I must handle that in an appropriate way. Asserts are never the way because they terminate the program.
In strictly my opinion, I don't have a problem with pre/post condition comments in a header. They clearly describe important details. Introducing yet another way to support asserts seems very unnecessary to me, but I guess I'm not obligated to use it either.
> I mainly write code that cannot fail. And if something does go wrong, I must handle that in an appropriate way. Asserts are never the way because they terminate the program.
If your code which "cannot fail" actually fails, terminating the program seems entirely reasonable. All logic could be wrong at that point, and it's better to crash loudly and fix the issue than to try to limp along with logic that probably won't work.
Can you go into why you didn't find them to be useful? Seems if done right they should allow many cases to warn/error at compile time while providing additional information to the optimizer in release builds. Technically with whole-program builds you could get the same with regular assertions in the function implementation but I can see how having them in the function prototype could make things easier in practice.
I wonder what are the use cases in their mind when designing this.
For runtime assertions and documentations, yeah, it would work but it works without contract arguably ok.
Unless you are doing trivial boolean comparisons, I always prefer a custom assert function that will also print a useful error message. Just telling me "Assertion failed: index < container.size()" isn't very helpful. What were the values compared?
Instead, my custom asset function (in C) looks like this:
check the condition, write out the msg, maybe dump a backtrace if that works in your codebase, call abort();.
assert() is just kind of nasty, why use it?
precondition in the function sig is just "We know you don't document and nobody reads it if you do." Which is great, but not worth the control you get writing your own ASSERT_ALWAYS() and being able to s/_ALWAYS//if the performance in release matters.
For libraries there is some value in using the standard interface instead of inventing your own that users then have to deal with. I agree that assert() could be better though.
On the other hand, even the stdlib implementations have their own assert handlers so...
I'm used to libraries being release builds so NDEBUG is defined and assert() is compiled out - in debug builds of client code. I'm not understanding what you mean by "standard interface."
What is an assert handler? Is it a debugger for the dump so you can get a backtrace and examine things that way? $ gdb ./prog core
Your macro finishes by calling abort() so you have that.
The value of being able to print an arbitrary string, with whatever current variable values you like is not nothing. Printing out a backtrace (if you can with your codebase) is also really useful. Obviously your own macro will print file, line and function. assert(a == b); triggering tells you almost nothing about the failure, why the check was there, what failed etc. It really should.
96 comments
[ 0.29 ms ] story [ 20.7 ms ] threadIn short: yes, some classes of contracts can be statically proven. Not all of them, and it depends on the language's semantics, so it's probably not easy to retrofit into C++. But there's work being done on unifying types and contracts, moving back and forth between static proof and dynamic enforcement, and it's all pretty interesting. Proving contracts statically eliminates runtime overhead; generating contracts from types makes it possible for a gradually typed language to be sound.
Contracts also allow a solver to say "I can't prove this messy function, but I can at least prove everything around it". Which is to say if we prove the precondition is met, and if we assume the post conditions are met, we can prove everything else despite the messy parts we can't do. This at least lets us know where the messy code is.
More links in my previous comment here - https://news.ycombinator.com/item?id=48544022
The basic idea is that you generate "Verification Conditions"(VCs) by mapping the function onto a Hoare Triple viz. {Pre} Function-Body {Post} and then applying Dijkstra's WP-Calculus mechanically to step backward from the Post to the Pre thus generating a mathematical formula.
The programmer provided contracts are merged into this formula to generate the complete VC which is a logical implication viz; Pre ==> WP(contracts-from-function-body, Post).
This is then handed off to a automated solver which verifies that Post is met when Pre is True in all the paths.
See also Combining Tests and Proofs with Contracts for Better Software Verification - https://news.ycombinator.com/item?id=50108206
Contacts are also a guaranteed syntax. Runtime checks provide no way for tools to know if the condition is expected to never happen - this is a bug; vs this is a normal user error we need to check for. A contract means theorem provers can find code paths where a bug could happen - of course we don't have theorem provers for C++, but this is seen as a requirement to get them.
If I’m going to write code by hand, the requirement for a beautiful pleasant language is bigger than ever.
I agree with you about simple languages though. I really like Go - the "there should be only one way to do things" from the Zen of Python actually applies to Go in a way that it doesn't apply to Python at all.
I wouldn't call it "subsets" as much as support for "Multiple Paradigms" in the same language. They can all be used together to express powerful abstractions. James Coplien wrote "Multi-Paradigm Design for C++" in 1998 (before C++11!). Then people figured out Template metaprogramming etc. and the design space became even more wider.
Today with all the available language features and library additions you never have to leave the language at all whatever be the platform(cpu-arch+OS) you are working on. Add-in trivial interop with C and there is nothing out of bounds.
Doesn’t hurt that it has fantastic, minimal, navigable documentation.
You can see the entirety of the language on a single page: https://cppreference.com/
rustc is also awfully shoddy. https://github.com/rust-lang/rust/issues/164348#issuecomment...
This assertion seems rather debatable given Rust's general lack of trailblazing in the language design space.
> Rust is in many ways also significantly more complex than C++, believe it or not.
I'm a bit skeptical that "many" is the right qualifier there. "Some", perhaps, but it isn't obvious to me how you'd reach "many".
The main problem is code organization and syntax. Tacking stuff like this onto fuction declarations is too basic.
Ideally, I think we need better constructs, e.g. dettached constraints like to the function declaration. You can define constraints separately, in the same namespace or w/e, add notes, comments, etc. and the function declaration can be used with intellisense to jump to the constraint. You could even tag the defintions.
In modern AI-based workflows, the agent can pull up an explanation on the function, and point directly to the constraints, with strong confidence esp. if it's got explicit metadata.
All jokes aside, I genuinely think that non-algol syntax is a non-starter. We're too far along now, that it's easier for these features to come to java/rust/typescript/cpp than it is to switch completely to academic langs that have terrible tooling support.
That said, the parent comment explicitly pointed out Rhombus as an alternative to an S-expression syntax within that same community, so maybe you could look into that suggestion instead of being pithy about topics in which you are less well informed.
Personally, I'm still (25 years into programming) undecided: does syntax not matter at all, matter only a bit, or is one of a language's most important characteristics? It's incredibly hard to say, at least for me.
https://en.wikipedia.org/wiki/Design_by_contract
https://www.eiffel.com/values/design-by-contract/introductio...
If I put them in the header, I have to include half the world because I can't forward declare `Foo foo` argument if I want to check `foo.size() > 3` or similar in a pre/post-condition. This is a non-starter, keeping headers lean is the only way to not end up with 1 hour compiles.
If I put them in the cpp, they lose their only advantage over asserts - that they also double as documentation in the headers.
Did we add 50 pages to the standard for a slightly fancier assert? I feel like this could've been one builtin and a footnote:
contract_assert(expr) - if expr evaluates to false, the behavior of the program is undefined. Implementations are encouraged to emit a runtime check for this in debug builds, or a compiler error in cases where they can statically determine, that the assert will fail.
I think the right answer is in the header, and in turn that means someone needs to answer your objection - how do you avoid long compiler times? I suspect modules is a large part of the answer, which means the guide/talk will also be how to make modules work in the real world. Remember though, that is all guesses I wouldn't be surprised if I'm wrong.
"Our Journey Toward a Fully Backward-Compatible, UB-Safe, ISO C++"
https://youtu.be/whFzmXXhG5g?is=jSOnYkqr5nNULGkY
What I want I'd : we have used contracts in the tall world. This is what works and doesn't. This catches a lot of bugs for little work. This looks the same but results in false positives. This is a lot of work for few bugs.
Of course since I don't know what works I'm guessing, but that type of thing.
However given all the technical issues with C++ semantics, and the whole politics regarding contracts since the C++20 removal, I am not sure we will ever get there.
It will be the same as with modules or concepts, the main people behind the proposals eventually move on, and there is no one left to pick the up the pieces for the follow up papers, and related implementation.
If new major C++ features will require modules in order to work, I may as well stop following the specs.
By the time C++26 actually becomes available, all three major compilers will already have good modules support.
Anyone using recent Office versions, is a consumer of a product that makes use of C++ modules today.
The first declaration of a function must include the contract pre/post conditions and follow-up re-declarations of the function must either not include any contract conditions or the same conditions as the initial declaration.
And you can avoid re-including the world because pre/post conditions should be externally visible behavior or call out to functions for pre/post checks on internal behavior.
Essentially you either define them using what you have in scope during the initial declaration or you call out to a function located elsewhere that can have access to more/internal scope and do more complicated checks.
I'm all for signing up for a contract if it can turn a runtime error into a compile time error. However, this looks like it just makes more runtime errors. At that point, these seem no better than `assert` except for the fact that they promise to really assert (probably).
The article also points out a big problem which is "Importantly, this aspect of Contracts is why contract assertions must not be used for error handling and input validation: If a function has in-contract requirements to report certain events as errors, that handling must be done with standard C++ control statements that are not optional, never with contract assertions."
That sort of muddy definition of what contracts are supposed to be used for is almost certainly going to make a mess. It's not input validation, but parameter validation.. but not really validation but rather checks which error out, but it's not errors we are producing.
That said, the distinction is actually quite clear, though not always well-explained: an assertion failure (and therefore a contract failure) indicates a bug. It must never happen, and therefore it must always be OK to suppress the validation. If you see it fire, your program needs fixing.
My experience using pre and post conditions in Clojure makes me really like them. They are a small but meaningful improvement over plain old assertions. And yes being able to turn them off is a feature not a bug.
- If it can happen, but shouldn't, that's input validation (e.g. the user inputs an empty name)
- If it can't happen and shouldn't, that's a contract (e.g. I checked that this string is non-empty in the function that calls this one, so I already know it's non-empty. Also my linked list has a head and a tail because that's how my constructor made it)
Most bugs happen in the space of things that the programmer thinks shouldn't happen but happen anyways. That is why contracts are useful. But in a bug-free program they also don't do anything, so allowing you to turn them off with a compiler flag is reasonable. Just like asserts, but a bit more useful for tooling, IDEs, etc. Also with an observe mode that allows you to find bugs in production without crashing your whole process
But yeah, that's precisely what contracts are (at least originally) intended to be, but you can quite clearly see from this comment section that this is not how they're going to be used. Well, this surely gonna be "fun" experience down the line for the C++ programmers...
The programming model for C++ contracts as described by the authors, and spec, is that they are 'ghost code'. You must never assume that a contract check is actually executed, even if you've asked your compiler to execute your contract checks. This is because ABI/ODR problems can and will cause your contract checks to be deleted, as well as the 'observe' contract mode which is a strange one
So its hard to know what the use case for them is as a result. You can't use them for safety checks, because you must assume they won't be run. Hilariously, they actually introduce safety problems vs asset: Eg take two pieces of code:
vs People mistakenly transform #1 into #2 unconditionally, not realising that this is actually a misuse of the contracts feature. It can, and will lead to undefined behaviour - while being perfectly well defined with assertsI have a feeling that in 10 years the advice will be to never use contracts in anything approaching code that needs safety, as they're generally less safe than using an assert for no real reason. So what's their use case?
This is also true of assert, though. It can be compiled out so shouldn't be used for anything that must run.
The idea is that you use `-enableassertions` only during development, and your program should never rely on it. But it helps IDEs and static analyzers to have a contract about code.
Another interesting property of `debug` is it turns off the safety checks in the target statement that follows it. Because, sometimes you just gotta do some unsafe tricks to figure out where your code went wrong.
.NET had DbC support for a while, but it was a Visual Studio Enterprise product, based on rewriting MSIL, and eventually was killed, as I imagine very few people bothered using contracts when such a license was required.
JVM languages like Clojure, Scala and Kotlin have DbC constructs beyond only assert.
There are also ways to turn runtime contract checks into static verification checks. See my other comment for details/links - https://news.ycombinator.com/item?id=50108112
You can get compile-time errors with static code analysis tools with it but the main goal is to direct the compiler towards optimizations for restricted case, IMHO. If you know beforehand the kind of values you are using then the only sure way to let the compiler know is to write code in such a way that the values you don't expect result in UB, which is not always possible or convenient. Contracts allow a regular way to do the same. It does not mean the compiler will use this knowledge but it will remain in your code and might be used eventually.
For example, if you want to align an integral value on x you can write something like ((value + x-1)/x)*x, however, if x is a power of 2 then you can do (value + x-1) & ~x, which is likely faster. As of now, gcc 16 does not do this optimization even with contracts, but if you recorded this in code, some future compiler might do this. Without contracts the chances for this are much lower.
From the "C++ design committee was so preoccupied with whether they could, they never stopped to think whether they should" department.
Asserts:
1. You don't like the being conditional on NDEBUG ot aborting the program - roll out your own. Will still be a one-liner.
2. You want them act as documentation of pre-conditions in headers - just add a bloody comment there.
The only somewhat reasonable development here are the post conditions in functions with multiple returns, but post/s are dramatically less common than pre/s, so their utility is also debatable.
https://gavinray97.github.io/blog/adding-invariant-to-cpp-de...
The post turned out to be more useful for an intro to writing GCC plugins than anything, but at least I had fun
> Features Not Proposed
> To keep the scope of this proposal minimal (while still viable), the following features are intentionally excluded from this proposal; we expect these features to be proposed as extensions at a later time, building on the foundations laid by this proposal.
> The ability to assume that an unchecked contract predicate would evaluate to true and to allow the compiler to optimize based on that assumption, i.e., the assume semantic
In strictly my opinion, I don't have a problem with pre/post condition comments in a header. They clearly describe important details. Introducing yet another way to support asserts seems very unnecessary to me, but I guess I'm not obligated to use it either.
If your code which "cannot fail" actually fails, terminating the program seems entirely reasonable. All logic could be wrong at that point, and it's better to crash loudly and fix the issue than to try to limp along with logic that probably won't work.
https://www.digitalmars.com/ctg/contract.html
I implemented it in D as well. But, it just turned out to not be very useful.
The only advantage contracts had was with inheritance hierarchies, and I don't use them enough to make it pay off.
For formal verification, the design is way off.
Instead, my custom asset function (in C) looks like this:
Example: If the first parameter is false, a detailed error message is printed:assert() is just kind of nasty, why use it?
precondition in the function sig is just "We know you don't document and nobody reads it if you do." Which is great, but not worth the control you get writing your own ASSERT_ALWAYS() and being able to s/_ALWAYS//if the performance in release matters.
For libraries there is some value in using the standard interface instead of inventing your own that users then have to deal with. I agree that assert() could be better though.
On the other hand, even the stdlib implementations have their own assert handlers so...
What is an assert handler? Is it a debugger for the dump so you can get a backtrace and examine things that way? $ gdb ./prog core Your macro finishes by calling abort() so you have that.
The value of being able to print an arbitrary string, with whatever current variable values you like is not nothing. Printing out a backtrace (if you can with your codebase) is also really useful. Obviously your own macro will print file, line and function. assert(a == b); triggering tells you almost nothing about the failure, why the check was there, what failed etc. It really should.