Against enforce()

[Jonathan M Davis]

On Friday, March 18, 2011 09:08:38 Kagamin wrote:
> Steven Schveighoffer Wrote:
> > This is a good example of why it's difficult to decide what "user input"
> > is.  One could consider that the 'user' in this case is the developer
> > using the library, but I don't think that's the right choice.
> > 
> > I'd say it's a bug, this is clearly a contract, since the data being
> > passed into the ctor can easily not be user input (i.e. it's most likely
> > two literals that will never depend on a user).  If it is user input, the
> > caller of the ctor should enforce the user input before passing it to
> > iota.
> 
> You can't validate all user input, so external data ends up spead across
> your entire application. So I don't understand obsession with -release
> switch, because contracts most of the time do validate user input. If we
> think about -release switch as a HP-hack for exotic code, there will be no
> ideological difference between assert and enforce.

The idea is that if an assertion fails, there is a bug in your program. You 
_cannot_ rely on an assertion being run, because it could be compiled out. It is 
_only_ for verifying that your code is correct.

Exceptions, on the other hand, are used for handling errors. If something which 
results in an error but which is _not_ a logic bug in your program, then it 
should be handled by an exception. User input would be a classic example of 
this. If you get bad user input, that's not the program's fault. It can verify 
that the user input is valid and then assume that it's valid after that (at 
which point, using assert would make sense, because it's supposed to be 
guaranteed that the values are valid, since they were validated). But in 
handling the user input, it would throw on error, not assert.

enforce is merely a shorthand way of testing and throw exceptions on failure. It 
makes exception handling look like assertions. But it is an _entirely_ different 
thing.

As has been point out, the problem is in cases where it's not clear whether you 
should treat input as user input (and therefore needs to _always_ be checked and 
have exceptions thrown on error) or whether you should treat input as being from 
your program and guaranteed to be valid (at which point you use assert to check 
that that guarantee actually holds).

Assertions are _not_ for error handling. They _kill_ your program on failure 
(since they throw an Assert_Error_, not an exception). Exceptions (and therefore 
enforce) are for error handling. There is a _clear_ and _distinct_ difference 
between the two. The confusion is not between assert and enforce. The confusion 
is when you have a situation where whether assert or enforce is appropriate 
depends on how the function is being used.

- Jonathan M Davis