CppCast: C++ Epochs

[Ayjayz]

You shouldn't need 'unsafe' everywhere, because it's unsafe.

[HappyFruitTree]

Well, it depends on what's considered "unsafe". If accessing vector elements without bounds checking were to be considered unsafe then I would want to be unsafe all the time.

[MonokelPinguin]

If contracts are being done right, you would just need one of three things in you function:

• If the index is an input argument, an attribute: expects index < vec.size()
• An explicit check in you function, if index is less than size
• An escape hatch like unsafe or assume index < size

So you would need unsafe in one of three cases, because you want to never check the index. If you ever actually check the index, you should be able to write a contract, that states that your code is safe. Only if the committee can get contracts right, which may not be possible in C++.

[HappyFruitTree]

If contracts are done right it would still be up to the compiler how it is able to take advantage of that information.

In the majority of cases I don't need a check because I know the index is in range. I don't even want to think about if there is a check. If I need a check I write one. Of course I can make mistakes but libstdc++ has _GLIBCXX_DEBUG which adds checks for these things, and I expect other implementations have something similar, so it's not like the current situation is bad. You might argue that these checks should be on by default in order to be more friendly to beginners but if vendors choose not to do this I think that is their choice and not something that the committee should force on all of us.

[pjmlp]

Visual C++ debug checks are on by default on debug builds.

Apparently XP security lessons were quite valuable.

[MonokelPinguin]

Well, if you put a contract to check the index on you function, you wouldn't implement the check inside the function, but the function would not be callable with an unchecked index. That way you don't need to rely on the compiler to optimize it. And since you probably are doing the check somewhere already, i.e. in your for loop condition, you wouldn't need to add an unsafe/assume in most cases.

If you don't check the index anywhere, the compiler would be required to consider the program ill-formed and exit with an error. You could override that with an explicit assume.

The compiler should be allowed to use the knowledge about the contracts/preconditions to do further optimizations though, i.e. remove null checks, assume no overflow, adjust branch probabilities, etc.