From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.devel Subject: Re: [Emacs-diffs] master 74f54af: Use eassume (false) for branch that's never taken. Date: Tue, 23 Apr 2019 20:19:49 +0300 Message-ID: <835zr44p1m.fsf@gnu.org> References: <83ftqecrms.fsf@gnu.org> <83ef5ycnny.fsf@gnu.org> <9b3a1717-64de-795a-2acf-0698576caf02@cs.ucla.edu> <83zholbvnb.fsf@gnu.org> <25791a2b-260e-9cee-b454-5d9f53fa33e0@cs.ucla.edu> <83r29xb3co.fsf@gnu.org> <27636c2b-549d-4e78-a1e3-af78605ebd1e@cs.ucla.edu> <837ebl5jmd.fsf@gnu.org> Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="115252"; mail-complaints-to="usenet@blaine.gmane.org" Cc: phst@google.com, p.stephani2@gmail.com, emacs-devel@gnu.org To: Paul Eggert Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Tue Apr 23 19:29:49 2019 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([209.51.188.17]) by blaine.gmane.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hIzEq-000Tr0-K1 for ged-emacs-devel@m.gmane.org; Tue, 23 Apr 2019 19:29:48 +0200 Original-Received: from localhost ([127.0.0.1]:57147 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hIzEp-0006Uf-Ke for ged-emacs-devel@m.gmane.org; Tue, 23 Apr 2019 13:29:47 -0400 Original-Received: from eggs.gnu.org ([209.51.188.92]:40034) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hIz5S-00088u-1G for emacs-devel@gnu.org; Tue, 23 Apr 2019 13:20:07 -0400 Original-Received: from fencepost.gnu.org ([2001:470:142:3::e]:38584) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hIz5M-00016T-6Y; Tue, 23 Apr 2019 13:20:03 -0400 Original-Received: from [176.228.60.248] (port=3771 helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1hIz5H-00084n-3F; Tue, 23 Apr 2019 13:19:57 -0400 In-reply-to: (message from Paul Eggert on Tue, 23 Apr 2019 09:56:15 -0700) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Original-Sender: "Emacs-devel" Xref: news.gmane.org gmane.emacs.devel:235835 Archived-At: > Cc: p.stephani2@gmail.com, phst@google.com, emacs-devel@gnu.org > From: Paul Eggert > Date: Tue, 23 Apr 2019 09:56:15 -0700 > > On 4/22/19 11:19 PM, Eli Zaretskii wrote: > > My mental model of using assertions in Emacs is slightly different. > > In my model, we use eassert for things that "cannot happen", but can > > be tolerated in some sense in a production build. "Tolerate" here > > means that the result could be incorrect display or some strange error > > message or a crash in some unrelated place. > > This is not a model I'm familiar with, and many (most?) executions of > eassert don't behave that way. For example, when XCAR (via XCONS) uses > eassert to check that its argument is tagged as a cons, any assertion > failure means Emacs is in a seriously bad state. Quite possibly Emacs > will crash immediately; You just said in different words what I described. > but even if Emacs lucks out and doesn't crash immediately it's not > something that should be tolerated. My model disagrees with "should" there. IMO, it's a judgment call when to tolerate that and when not. > For example, string_bytes has such a test, even though string_bytes > won't crash immediately if the test is omitted. I didn't say my model is followed consistently throughout our sources. It's possible that string_bytes needs to be changed (assuming that I will convince you to adopt my model ;-). > In practice, I think the more accurate characterization is that we use > eassert for runtime checks done in testing but not in production, and we > use emacs_abort for runtime checks always done even in production. That is also consistent with what I said. > We're more likely to prefer emacs_abort to eassert if the runtime > check is cheap or is rarely needed, or if the failure is more likely > or has worse effects. Whether the failure would occur immediately > after the check is not that relevant. Like I said, it's a judgment call. What you describe are all valid considerations, but they don't contradict my model. > > And it doesn't help > > that with current build machinery one needs to manually specify all > > the compiler switches, instead of using some simple configure switch > > that automatically does that for us. Using one more switch increases > > that burden slightly. > > We could have --enable-checking default to -fsanitize=undefined on > platforms that support it. If it doesn't tremendously slow down Emacs, I think we should, yes.