5 ms·

All this and handling overflow still doesn't make the list. Had it been the case that easy considerations for overflow were baked into C back then, we probably

All this and handling overflow still doesn't make the list. Had it been the case that easy considerations for overflow were baked into C back then, we probably wouldn't be dealing with hardware where handling overflow is even more difficult than it would have been on the PDP-11. (On the PDP-11, overflow would have trapped.) At the very least, it would be the norm for compilers to emulate it whether there was efficient machine-level support or not. However, that didn't happen, and because of that, even Rust finds it acceptable to punt on overflow for performance reasons.

Animats 9y ago
On the PDP-11, overflow would have trapped. On the DEC VAX, overflow could be set to trap, based on a bit mask at the beginning of each function, but that was not the case on the PDP-11. Nobody used that feature. I once modified the C compiler for the VAX to make integer overflow trap, and rebuilt standard utilities. Most of them trapped on integer overflow. If you want arithmetic to wrap, you should have to write something like n := (n + 1) mod (2^32); Let the optimizer figure out there's a cheap way to do that.
- deleted 9y ago
  [deleted]
legulere 9y ago
As a clarification, I guess you are speaking about integer overflows. Your comment confused me a bit as I thought that you speak about buffer overflows at first.
naasking 9y ago
> All this and handling overflow still doesn't make the list. Because it's either a solved problem if you just use infinite precision numbers, or it's encompassed by other things the article lists, like refinement types/extended static checking and errors.
VHRanger 9y ago
Designing a "checkedInt" class is not trivial
- carussell 9y ago
  I don't want a specialized class—if you want to special case for checked overflow in Rust, you can already do that today. What I want is for all of the ordinary integer types to guard the programmer/program/user against overflow, without having to take extra effort to do so. Because if that's what your language requires, then you end up with what we have today: nobody takes the effort to opt in, and the compiler writers point to the existence of your ability to opt in as an excuse not to implement it at baseline where it should be.
mcguire 9y ago
Check Ada/SPARK 2014 and Frama-C (with the WP and WP-RTE plugins[1]). Both are good at ensuring your code won't overflow (and Ada checks it, IIRC), although I don't know the story about allowing overflow in the cases where you want it. [1] I've been told the Value plugin is better for these safety issues, but I haven't figured out how so.

Animats 9y ago

On the PDP-11, overflow would have trapped. On the DEC VAX, overflow could be set to trap, based on a bit mask at the beginning of each function, but that was not the case on the PDP-11. Nobody used that feature. I once modified the C compiler for the VAX to make integer overflow trap, and rebuilt standard utilities. Most of them trapped on integer overflow. If you want arithmetic to wrap, you should have to write something like n := (n + 1) mod (2^32); Let the optimizer figure out there's a cheap way to do that.

deleted 9y ago
[deleted]

legulere 9y ago

As a clarification, I guess you are speaking about integer overflows. Your comment confused me a bit as I thought that you speak about buffer overflows at first.

naasking 9y ago

> All this and handling overflow still doesn't make the list. Because it's either a solved problem if you just use infinite precision numbers, or it's encompassed by other things the article lists, like refinement types/extended static checking and errors.

VHRanger 9y ago

Designing a "checkedInt" class is not trivial

carussell 9y ago
I don't want a specialized class—if you want to special case for checked overflow in Rust, you can already do that today. What I want is for all of the ordinary integer types to guard the programmer/program/user against overflow, without having to take extra effort to do so. Because if that's what your language requires, then you end up with what we have today: nobody takes the effort to opt in, and the compiler writers point to the existence of your ability to opt in as an excuse not to implement it at baseline where it should be.

mcguire 9y ago

Check Ada/SPARK 2014 and Frama-C (with the WP and WP-RTE plugins[1]). Both are good at ensuring your code won't overflow (and Ada checks it, IIRC), although I don't know the story about allowing overflow in the cases where you want it. [1] I've been told the Value plugin is better for these safety issues, but I haven't figured out how so.