4 ms·
I am curious why you say cost-free. Using std::vector/array/string::at would literally eliminate buffer overflows and yet programmers aren't generally using th
by blub 8y ago
I am curious why you say cost-free.
Using std::vector/array/string::at would literally eliminate buffer overflows and yet programmers aren't generally using this style.
I would love it if I could prove to my colleagues that mandatory bounds-checking would not result in a noticeable performance loss, but my gut feeling is that it's not so. Interestingly Rust (and I guess D) does just that and seems to be getting away with it.
However, in the C UB thread the author of a Rust crate mentioned that a case for using unsafe is exactly this: avoiding the performance loss of bounds checking.
- WalterBright 8y agoTurning the bounds checking on/off is done with a compiler switch. There indeed is a cost for leaving it on. Most users, however, regard the cost as worth paying for the protection. It's still up to you, the programmer. With C, though, you have no choice. No checking for you! I meant cost-free in the sense that one way or another in C code you wind up passing the length anyway, or in the case of 0 terminated strings, you wind up recomputing it if you don't pass it.
- pjmlp 8y agoRegarding being worthwhile to pay for the protection, I would quote Hoare, regarding his experience with Algol compilers in production presented at the Turing Awards speech. "Many years later we asked our customers whether they wished us to provide an option to switch off these checks in the interests of efficiency on production runs. Unanimously, they urged us not to--they already knew how frequently subscript errors occur on production runs where failure to detect them could be disastrous. I note with fear and horror that even in 1980, language designers and users have not learned this lesson. In any respectable branch of engineering, failure to observe such elementary precautions would have long been against the law."
- jcelerier 8y agoI will reply with another Hoare quote, from a paper from 15 years later: > Fortunately, the problem of program correctness has turned out to be far less serious than predicted. A recent analysis by Mackenzie has shown that of several thousand deaths so far reliably attributed to dependence on computers, only ten or so can be explained by errors in the software: most of these were due to a couple of instances of incorrect dosage calculations in the treatment of cancer by radiation. https://www.gwern.net/docs/math/1996-hoare.pdf https://www.gwern.net/docs/math/1996-hoare.pdf
- pjmlp 8y agoExcept that "far less serious than predicted" is not the same as non-existent, and that quote in no way talks about bounds checking, which is the issue being discussed here. In real life, we use safety gloves, seatbelts, elbow and knee protection, helmets, chainsaw cover, gun lock, .... Naturally there are those that think such protections are only for children and an accident will never occur to them, until the day they happen to be part of the statistic. I long for the day that lawsuits for buggy software become a regular activity, only then the industry will actually care to change.
- jibal 8y ago"Except that "far less serious than predicted" is not the same as non-existent" Pure strawman. The statement was that program correctness is far less serious than predicted, not totally benign. "and that quote in no way talks about bounds checking, which is the issue being discussed here" Um, programs that exceed array bounds are not correct, so yes, it does talk about them. [further strawmen not worth addressing]
- pjmlp 8y agoSure, you made it clear where we stand regarding quality.
- jibal 8y ago"I am curious why you say cost-free." What's the cost? It's an optional feature. "Using std::vector/array/string::at would literally eliminate buffer overflows and yet programmers aren't generally using this style." C programmers don't use that because it doesn't exist in C. "I would love it if I could prove to my colleagues that mandatory bounds-checking would not result in a noticeable performance loss" Did you read his article? There's nothing in it about mandatory bounds-checking.