3 ms·

> Directly using Unchecked_Deallocation is frowned upon... This is true. I admit that I didn't really acknowledge this in the article. I personally don't reall

by ajxs 2y ago

> Directly using Unchecked_Deallocation is frowned upon... This is true. I admit that I didn't really acknowledge this in the article. I personally don't really like the Ada community's consensus on this matter. In many applications 'let memory leak and let the OS sort it out' just won't cut it. It's true that you can use controlled types for everything, but isn't this just moving the Unchecked_Deallocation somewhere out of sight? Also, if I'd have written 'You can't leak memory in Ada if you stick to using collections', wouldn't that just be like saying 'You can't leak memory in C++ if you stick to using the STL'? The point of the article was to show what Ada and Rust do to outrightly prevent you from shooting yourself in the foot, at the core language level. There's a lot of misconceptions floating around the Ada community about memory being freed automatically when it goes out of scope, which I think have stemmed from the ARM leaving open the possibility for a compiler to implement its own GC. Admittedly even I was misinformed. In my defence, nearly all the Ada I write is for bare metal, and never touches the heap at all.

pjmlp 2y ago
> ...'let memory leak and let the OS sort it out'.. I wouldn't be surprise to hear this from C or C++ folks, never heard this in Ada circles, there is always that missile meme going around, and I happened in the past to occasionally drop into FOSDEM Ada's rooms. Speaking of which, "Memory Management with Ada 2012 from FOSDEM 2016" https://archive.fosdem.org/2016/schedule/event/ada_memory/ https://archive.fosdem.org/2016/schedule/event/ada_memory/ > Also, if I'd have written 'You can't leak memory in Ada if you stick to using collections', wouldn't that just be like saying 'You can't leak memory in C++ if you stick to using the STL'? The point of the article was to show what Ada and Rust do to outrightly prevent you from shooting yourself in the foot, at the core language level. A programming language is seldom used without its standard library, I don't care what a plain grammar + related semantics check offer, if there is nothing on the standard library, IDE tooling, libraries to chose from. Otherwise than you should also do a comparisasion using no_std against Ravenscar profile. And yes, unless you are using a C++ compiler that offers the option to harden its standard library, you are going to some surprises, starting by having to use at() instead of operator[]() for bounds checking, and even with hardened one, stuff like use-after-free/move only when using a good IDE like VC++/Clion or static/dynamic analysis tooling.
- randomNumber7 2y ago
  You can even "leak" memory in java if you keep references to objects you don't need anymore xD Also what is the point of .at()? try { myarray.at(invalid_index); } catch(std::exeception& e){ // how do you handle a logic error in your code? // does that even make sense philosophically? } Yet you could also enable bounds checking for debugging on operator [] or use address sanitizer.
  - pjmlp 2y ago
    Contrived examples like that can be done in any programming language.
  - Someone 2y ago
    Nitpick: the index could come from program input. For example: - if one were to write ‘ed’ in C++, that could be the code that handles going to the n-th line. - in a lzw decompressor, it could be an integer read from the to-be-decompressed data stream. In both cases, using at rather than doing a range check first can be defended because failing the range check is an exceptional case.
  - imtringued 2y ago
    Every now and then you get comments like this, that are intentionally offensive, like a burning bag of poop. The point of .at() is to check the bounds at runtime. Here is your answer. Regarding the comments. You don't necessarily know if it is a logic error and you certainly don't know if it is in your code. Now onto the how. You handle it like any error. If you don't have a specific error handling strategy, you handle the error at a higher level e.g. your HTTP server returns a 500 http status code and logs the error and the location, so that the developer can fix the bug. As to whether it makes sense philosophically. The only limitation is your lack of imagination. In C, the program would keep executing and create a security problem. The fact that the exception handler got called in the first place implies that at least the security vulnerability has been averted, meaning that you did indeed recover from the error, even if the catch block is completely empty.
    - 2y ago

by ajxs 2y ago

pjmlp 2y ago

> ...'let memory leak and let the OS sort it out'.. I wouldn't be surprise to hear this from C or C++ folks, never heard this in Ada circles, there is always that missile meme going around, and I happened in the past to occasionally drop into FOSDEM Ada's rooms. Speaking of which, "Memory Management with Ada 2012 from FOSDEM 2016" https://archive.fosdem.org/2016/schedule/event/ada_memory/ https://archive.fosdem.org/2016/schedule/event/ada_memory/ > Also, if I'd have written 'You can't leak memory in Ada if you stick to using collections', wouldn't that just be like saying 'You can't leak memory in C++ if you stick to using the STL'? The point of the article was to show what Ada and Rust do to outrightly prevent you from shooting yourself in the foot, at the core language level. A programming language is seldom used without its standard library, I don't care what a plain grammar + related semantics check offer, if there is nothing on the standard library, IDE tooling, libraries to chose from. Otherwise than you should also do a comparisasion using no_std against Ravenscar profile. And yes, unless you are using a C++ compiler that offers the option to harden its standard library, you are going to some surprises, starting by having to use at() instead of operator[]() for bounds checking, and even with hardened one, stuff like use-after-free/move only when using a good IDE like VC++/Clion or static/dynamic analysis tooling.

randomNumber7 2y ago
You can even "leak" memory in java if you keep references to objects you don't need anymore xD Also what is the point of .at()? try { myarray.at(invalid_index); } catch(std::exeception& e){ // how do you handle a logic error in your code? // does that even make sense philosophically? } Yet you could also enable bounds checking for debugging on operator [] or use address sanitizer.
- pjmlp 2y ago
  Contrived examples like that can be done in any programming language.
- Someone 2y ago
  Nitpick: the index could come from program input. For example: - if one were to write ‘ed’ in C++, that could be the code that handles going to the n-th line. - in a lzw decompressor, it could be an integer read from the to-be-decompressed data stream. In both cases, using at rather than doing a range check first can be defended because failing the range check is an exceptional case.
- imtringued 2y ago
  Every now and then you get comments like this, that are intentionally offensive, like a burning bag of poop. The point of .at() is to check the bounds at runtime. Here is your answer. Regarding the comments. You don't necessarily know if it is a logic error and you certainly don't know if it is in your code. Now onto the how. You handle it like any error. If you don't have a specific error handling strategy, you handle the error at a higher level e.g. your HTTP server returns a 500 http status code and logs the error and the location, so that the developer can fix the bug. As to whether it makes sense philosophically. The only limitation is your lack of imagination. In C, the program would keep executing and create a security problem. The fact that the exception handler got called in the first place implies that at least the security vulnerability has been averted, meaning that you did indeed recover from the error, even if the catch block is completely empty.
  - 2y ago