3 ms·

Is there a C++ proposal to add mandatory bounds checks to methods like pop_back? If modern C++ is serious about getting memory safety, UB like this should be ch

by pornel 4y ago

Is there a C++ proposal to add mandatory bounds checks to methods like pop_back? If modern C++ is serious about getting memory safety, UB like this should be changed to have a run-time check and abort. This is even backwards compatible, cheap or zero cost — if it's used in a loop that checks for non-empty length, the condition could be propagated and the redundant check optimized out. I assume it won't get fixed, because from what I've seen so far if there is even slightest whiff of a performance overhead, modern C++ still chooses unsafety. If there's any inertia or backwards compatibility worry, even if it's a spacebar-heater, modern C++ still chooses to keep the old unsafety. Safety is still not a priority.

aw1621107 4y ago
At least based on this comment from the maintainer of the C++ NanoRanges library [0], it seems contracts (at one point) may be the intended method to bounds check: > I actually proposed at() for std::span as part of P1024r0. It was soundly defeated in LEWG, 0|0|4|4|5. > I wasn’t there for the meeting, but from what I understand the feeling was that contracts (which at that time seemed highly likely for ‘20) were a better way to go for bounds checking, and that we should not be throwing exceptions for programmer errors like out-of-bounds access. No idea whether that is still the case though. [0]: https://old.reddit.com/r/cpp/comments/djqdu2/why_is_stdspan_is_missing_at/f48hhb5/ https://old.reddit.com/r/cpp/comments/djqdu2/why_is_stdspan_...
- bluGill 4y ago
  I'm not sure what the current thought is, but I'm hopeful contracts makes it into C++, and over a the next years (and iterations of the language) we find ways to make C++ better by proving the whole program correct. This will need a lot of tool support, and changes in the way people write code. However mathematical proofs of the program are the only thing I have left to make my code more reliable: humans are not perfect and unit tests have limits (proofs have different limits).
  - WanderPanda 4y ago
    I don't entirely get the concept between mathematical proofs of programs. Is the basic idea that it is straight forward for humands to write down a correct NP hard specification and then let some algorithm proof the correctness of a more efficient algorithm for the same problem?
    - bluGill 4y ago
      It isn't straight forward. It is claimed to be possible and useful by advocates.
  - pjmlp 4y ago
    Keep hoping then, it looks like it won't make C++26 as well.
- gpderetta 4y ago
  There is a deep divide between those that believe that contract violations should never result in exceptions and those that believe that they should. In practice we end up with the worst of both worlds were we get inconsistent semantics on specific APIs depending on who's present on the day the feature is voted in (hence at for vector but not in span), while large changes like contracts never reach consensus. This is more and more of an issue with the c++ standardization process.
bluGill 4y ago
Bounds checking is not zero cost in all cases. So long as you can demonstrate even one example of a case where the bounds checking isn't zero cost, and yet you can prove that the bounds check isn't needed there will be push back. C++ is about don't pay for what you don't use, and if you don't need the bounds check you shouldn't have to pay for it. You cannot have high performance programing if there are various 'little' if statements added all over. Remember that when proving a program you often have more information than the C++ compiler does. The compiler never see the whole program, only the part you are building now. Thus it is easy to show the above just by having the calling function and callie function in different translations units. If high performance isn't one of your goals, then why are you writing C++ at all? Note, languages like rust do should there is opportunity to do better than C++ without a runtime cost. However they do not provide perfect protection, either there are cases where they cannot do the bounds check, or there are times where they pay the price of a not needed bounds check. All such languages prove is C++ can do better in some cases.
- pjmlp 4y ago
  Zero cost means it won't be slower if I had to manually write the bounds checking myself. > If high performance isn't one of your goals, then why are you writing C++ at all? Because high performance isn't a synonym for corrupted data. You're right, though. Those that care about high performance and correct data are better off with Fortran and Chapel.
- pornel 4y ago
  I keep hearing how Modern C++ is safe now, and all the dumb UB was just C and legacy unidiomatic C++ code (even recently argued by Bjarne). But std::vector isn't legacy, has easy UB, and there's strong pushback like yours against fixing it. I don't see Modern C++ ever getting past its safety-third design.
  - kllrnohj 4y ago
    > But std::vector isn't legacy Oh yes it is. std::vector is hella legacy. That's not a C++11 addition (where "Modern C++" began). And it has all sorts of very-legacy warts like https://en.cppreference.com/w/cpp/container/vector_bool https://en.cppreference.com/w/cpp/container/vector_bool "Modern C++" added std::array which is what you might be thinking of, but it's much more limited & targets a different usage.

by pornel 4y ago

aw1621107 4y ago

At least based on this comment from the maintainer of the C++ NanoRanges library [0], it seems contracts (at one point) may be the intended method to bounds check: > I actually proposed at() for std::span as part of P1024r0. It was soundly defeated in LEWG, 0|0|4|4|5. > I wasn’t there for the meeting, but from what I understand the feeling was that contracts (which at that time seemed highly likely for ‘20) were a better way to go for bounds checking, and that we should not be throwing exceptions for programmer errors like out-of-bounds access. No idea whether that is still the case though. [0]: https://old.reddit.com/r/cpp/comments/djqdu2/why_is_stdspan_is_missing_at/f48hhb5/ https://old.reddit.com/r/cpp/comments/djqdu2/why_is_stdspan_...

bluGill 4y ago
I'm not sure what the current thought is, but I'm hopeful contracts makes it into C++, and over a the next years (and iterations of the language) we find ways to make C++ better by proving the whole program correct. This will need a lot of tool support, and changes in the way people write code. However mathematical proofs of the program are the only thing I have left to make my code more reliable: humans are not perfect and unit tests have limits (proofs have different limits).
- WanderPanda 4y ago
  I don't entirely get the concept between mathematical proofs of programs. Is the basic idea that it is straight forward for humands to write down a correct NP hard specification and then let some algorithm proof the correctness of a more efficient algorithm for the same problem?
  - bluGill 4y ago
    It isn't straight forward. It is claimed to be possible and useful by advocates.
- pjmlp 4y ago
  Keep hoping then, it looks like it won't make C++26 as well.
gpderetta 4y ago
There is a deep divide between those that believe that contract violations should never result in exceptions and those that believe that they should. In practice we end up with the worst of both worlds were we get inconsistent semantics on specific APIs depending on who's present on the day the feature is voted in (hence at for vector but not in span), while large changes like contracts never reach consensus. This is more and more of an issue with the c++ standardization process.

bluGill 4y ago

Bounds checking is not zero cost in all cases. So long as you can demonstrate even one example of a case where the bounds checking isn't zero cost, and yet you can prove that the bounds check isn't needed there will be push back. C++ is about don't pay for what you don't use, and if you don't need the bounds check you shouldn't have to pay for it. You cannot have high performance programing if there are various 'little' if statements added all over. Remember that when proving a program you often have more information than the C++ compiler does. The compiler never see the whole program, only the part you are building now. Thus it is easy to show the above just by having the calling function and callie function in different translations units. If high performance isn't one of your goals, then why are you writing C++ at all? Note, languages like rust do should there is opportunity to do better than C++ without a runtime cost. However they do not provide perfect protection, either there are cases where they cannot do the bounds check, or there are times where they pay the price of a not needed bounds check. All such languages prove is C++ can do better in some cases.

pjmlp 4y ago
Zero cost means it won't be slower if I had to manually write the bounds checking myself. > If high performance isn't one of your goals, then why are you writing C++ at all? Because high performance isn't a synonym for corrupted data. You're right, though. Those that care about high performance and correct data are better off with Fortran and Chapel.
pornel 4y ago
I keep hearing how Modern C++ is safe now, and all the dumb UB was just C and legacy unidiomatic C++ code (even recently argued by Bjarne). But std::vector isn't legacy, has easy UB, and there's strong pushback like yours against fixing it. I don't see Modern C++ ever getting past its safety-third design.
- kllrnohj 4y ago
  > But std::vector isn't legacy Oh yes it is. std::vector is hella legacy. That's not a C++11 addition (where "Modern C++" began). And it has all sorts of very-legacy warts like https://en.cppreference.com/w/cpp/container/vector_bool https://en.cppreference.com/w/cpp/container/vector_bool "Modern C++" added std::array which is what you might be thinking of, but it's much more limited & targets a different usage.