3 ms·

You realize that I am part of the standard's committee? ;-) I am programming C because Python is too slow for my use case (and too annoying and to unstable) an

by uecker 2y ago

You realize that I am part of the standard's committee? ;-) I am programming C because Python is too slow for my use case (and too annoying and to unstable) and yes, I use C's integer types as an abstraction for mathematical integers. And I would say this is the case in almost all C code I see and most programmers I talk to. How would two-complement's wrapping for int be useful for anything? It does not model anything useful IMHO. And the problem with compilers not optimizing is that people want them to optimize... Compilers not being able to to do this as well anymore would indeed be an actual problem for many people.

int_19h 2y ago
It would be extremely useful e.g. because you could perform overflow checks as easily as: if (x + 1 < x) // overflow as opposed to the much more complicated dance that you have to do today to be conformant. I don't disagree that people want compilers to optimize in general. But can you give an example of optimization that is 1) relies on compiler treating signed overflow as UB, and 2) is actually useful (i.e. makes conforming code run faster)? As far as modeling, the very fact that C ints are bounded - and lest we forget, unless you use `long long` everywhere, even `long` doesn't guarantee you more than 32 bits per the Standard, which is not all that large! - they are not a good abstraction for mathematical integers. C developers use it as such in practice because it is convenient, but consequently tend to ignore the overflow behavior, not the least because dealing with signed overflow is so inconvenient. Even today, I suspect that the vast majority of production C code out there is not actually safe wrt to signed overflow-induced UB due to overly large inputs (e.g. how many CLI tools do such validation for values that come out of argv?).
- atiedebee 2y ago
  if( x > INT_MAX - n ) // overflow for x + n Your definition of a far more complicated dance is absurd. Signed integer being undefined makes a lot of integer math faster actually: https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html?m=1 https://kristerw.blogspot.com/2016/02/how-undefined-signed-o... There's a reason zig made unsigned overflow undefined: it allows for more optimisations (Zig can also afford it thanks to their wrapping addition (+%) operator).
  - uecker 2y ago
    Yes, thanks. With C23 there are also now checked integers to do overflow checking for arithmetic operations.
  - int_19h 2y ago
    Last thing we need in this industry is more fast but incorrect code.
gavinhoward 2y ago
> I use C's integer types as an abstraction for mathematical integers. Nothing on you, but in my mind, this is a sign of just how brain dead and unprofessional our industry is. Using hardware integers as mathematical integers is like using aluminum instead of titanium for a high-stress part in a fighter aircraft. Sure, it does just fine in normal flight; what's the big deal? And then the pilot needs to pull a 10-g maneuver, putting 10 times the stress on that part. And then the pilot dies because the aircraft breaks apart in midair. If you need mathematical integers, use GMP. Or implement your own. It isn't hard. I implemented rationals using 32 bytes and no allocations when integers are no bigger than hardware integers. Adding all of that with this: > You realize that I am part of the standard's committee? ;-) makes me geuinely fear for the direction of C. I think I may need to write boringcc to rescue C from itself. https://groups.google.com/forum/m/#!msg/boring-crypto/48qa1kWignU/o8GGp2K1DAAJ https://groups.google.com/forum/m/#!msg/boring-crypto/48qa1k...
- rurban 2y ago
  tinycc is such a boringcc compiler
- uecker 2y ago
  Look at any C program. What are integers used for? Counting things, loop indexing, etc. These are all semantics of mathematical integers. Yes, it is an approximation that only works as integers do not get too big. But the limits are still bigger than most numbers people do use in their daily lives. Most people could not calculate with higher number in their head, are you saying their mental model of integers is a small integer model different from mathematical model? This misunderstands the purpose of mathematical abstractions at a fundamental level. Big number integers also has use cases, but this is has very special purposes. And also big numbers are not "true" mathematical numbers if you want to be really pedantic, because if you memory is limited also this abstraction breaks downs at some point. Models for true mathematical integers do not exist in the physical world, so that "int" isn't one, is meaningless pedantry.
  - gavinhoward 2y ago
    > Look at any C program. What are integers used for? Counting things, loop indexing, etc. Both of those should use unsigned integers, and they are limited by the size of the machine, so no, they don't need a mathematical model of integers. A good machine will have a size_t size that can hold any size of object, and by extension, any number of elements of any size, including char. So for counting things and loop indices, size_t should be used, not any signed types. In my code, I essentially use just size_t and unsigned char (because the standard did not specify the signedness of char up to at least C11). If I use something else, I am checking bounds. > Most people could not calculate with higher number in their head, are you saying their mental model of integers is a small integer model different from mathematical model? Are you seriously trying to accuse me of this? I am the one saying that hardware integers are not a sufficient abstraction for mathematical integers, yet you say that I assume that people have a small integer mental model? No, I am not. I am the one telling you that using hardware integers in place of big ints is not good. > Models for true mathematical integers do not exist in the physical world, so that "int" isn't one, is meaningless pedantry. True, every abstraction is leaky, but big integers and rationals can get so large that it doesn't matter. And yes, big ints are a leaky abstraction, but they leak so much less than hardware integers because they don't wrap and because they are not subject to 00UB when unsigned types are used.

by uecker 2y ago

int_19h 2y ago

It would be extremely useful e.g. because you could perform overflow checks as easily as: if (x + 1 < x) // overflow as opposed to the much more complicated dance that you have to do today to be conformant. I don't disagree that people want compilers to optimize in general. But can you give an example of optimization that is 1) relies on compiler treating signed overflow as UB, and 2) is actually useful (i.e. makes conforming code run faster)? As far as modeling, the very fact that C ints are bounded - and lest we forget, unless you use `long long` everywhere, even `long` doesn't guarantee you more than 32 bits per the Standard, which is not all that large! - they are not a good abstraction for mathematical integers. C developers use it as such in practice because it is convenient, but consequently tend to ignore the overflow behavior, not the least because dealing with signed overflow is so inconvenient. Even today, I suspect that the vast majority of production C code out there is not actually safe wrt to signed overflow-induced UB due to overly large inputs (e.g. how many CLI tools do such validation for values that come out of argv?).

atiedebee 2y ago
if( x > INT_MAX - n ) // overflow for x + n Your definition of a far more complicated dance is absurd. Signed integer being undefined makes a lot of integer math faster actually: https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html?m=1 https://kristerw.blogspot.com/2016/02/how-undefined-signed-o... There's a reason zig made unsigned overflow undefined: it allows for more optimisations (Zig can also afford it thanks to their wrapping addition (+%) operator).
- uecker 2y ago
  Yes, thanks. With C23 there are also now checked integers to do overflow checking for arithmetic operations.
- int_19h 2y ago
  Last thing we need in this industry is more fast but incorrect code.

gavinhoward 2y ago

> I use C's integer types as an abstraction for mathematical integers. Nothing on you, but in my mind, this is a sign of just how brain dead and unprofessional our industry is. Using hardware integers as mathematical integers is like using aluminum instead of titanium for a high-stress part in a fighter aircraft. Sure, it does just fine in normal flight; what's the big deal? And then the pilot needs to pull a 10-g maneuver, putting 10 times the stress on that part. And then the pilot dies because the aircraft breaks apart in midair. If you need mathematical integers, use GMP. Or implement your own. It isn't hard. I implemented rationals using 32 bytes and no allocations when integers are no bigger than hardware integers. Adding all of that with this: > You realize that I am part of the standard's committee? ;-) makes me geuinely fear for the direction of C. I think I may need to write boringcc to rescue C from itself. https://groups.google.com/forum/m/#!msg/boring-crypto/48qa1kWignU/o8GGp2K1DAAJ https://groups.google.com/forum/m/#!msg/boring-crypto/48qa1k...

rurban 2y ago
tinycc is such a boringcc compiler
uecker 2y ago
Look at any C program. What are integers used for? Counting things, loop indexing, etc. These are all semantics of mathematical integers. Yes, it is an approximation that only works as integers do not get too big. But the limits are still bigger than most numbers people do use in their daily lives. Most people could not calculate with higher number in their head, are you saying their mental model of integers is a small integer model different from mathematical model? This misunderstands the purpose of mathematical abstractions at a fundamental level. Big number integers also has use cases, but this is has very special purposes. And also big numbers are not "true" mathematical numbers if you want to be really pedantic, because if you memory is limited also this abstraction breaks downs at some point. Models for true mathematical integers do not exist in the physical world, so that "int" isn't one, is meaningless pedantry.
- gavinhoward 2y ago
  > Look at any C program. What are integers used for? Counting things, loop indexing, etc. Both of those should use unsigned integers, and they are limited by the size of the machine, so no, they don't need a mathematical model of integers. A good machine will have a size_t size that can hold any size of object, and by extension, any number of elements of any size, including char. So for counting things and loop indices, size_t should be used, not any signed types. In my code, I essentially use just size_t and unsigned char (because the standard did not specify the signedness of char up to at least C11). If I use something else, I am checking bounds. > Most people could not calculate with higher number in their head, are you saying their mental model of integers is a small integer model different from mathematical model? Are you seriously trying to accuse me of this? I am the one saying that hardware integers are not a sufficient abstraction for mathematical integers, yet you say that I assume that people have a small integer mental model? No, I am not. I am the one telling you that using hardware integers in place of big ints is not good. > Models for true mathematical integers do not exist in the physical world, so that "int" isn't one, is meaningless pedantry. True, every abstraction is leaky, but big integers and rationals can get so large that it doesn't matter. And yes, big ints are a leaky abstraction, but they leak so much less than hardware integers because they don't wrap and because they are not subject to 00UB when unsigned types are used.