"Strong typing vs. strong testing"

[Ian Collins]

On 09/30/10 02:17 PM, Seebs wrote:
> On 2010-09-30, RG<rNOSPAMon at flownet.com>  wrote:
>> That the problem is "elsewhere in the program" ought to be small
>> comfort.
>
> It is, perhaps, but it's also an important technical point:  You CAN write
> correct code for such a thing.
>
>> int maximum(int a, int b) { return a>  b ? a : b; }
>
>> int main() {
>>    long x = 8589934592;
>>    printf("Max of %ld and 1 is %d\n", x, maximum(x,1));
>
> You invoked implementation-defined behavior here by calling maximum() with
> a value which was outside the range.  The defined behavior is that the
> arguments are converted to the given type, namely int.  The conversion
> is implementation-defined and could include yielding an implementation-defined
> signal which aborts execution.
>
> Again, the maximum() function is 100% correct -- your call of it is incorrect.
> You didn't pass it the right sort of data.  That's your problem.
>
> (And no, the lack of a diagnostic doesn't necessarily prove anything; see
> the gcc documentation for details of what it does when converting an out
> of range value into a signed type, it may well have done exactly what it
> is defined to do.)

Note that the mistake can be diagnosed:

lint /tmp/u.c -m64 -errchk=all
(7) warning: passing 64-bit integer arg, expecting 32-bit integer: 
maximum(arg 1)

-- 
Ian Collins