Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:84089
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.192.52 as permitted sender)
MIME-Version: 1.0
Sender: yohgaki@gmail.com
In-Reply-To: <54F209B9.5020200@googlemail.com>
References: <CAL=_i_mdb1GvYFZr1ZEqvCgZ3+um-ZYuz5xAFZuwjwBcXsEk3Q@mail.gmail.com>
 <54E5F77D.9090406@fischer.name> <CA+9eiLurXVtk0eKAuKF8uUb=6SVqZtatXSvZ9bnvW1gnb0hz4A@mail.gmail.com>
 <54E6F48A.9040906@fischer.name> <CAPwsocEiTSOM0EtFR52KNFCZNYG4dDguuyvNpk5kMKaRDwOZCA@mail.gmail.com>
 <CAL=_i_m4gUy081cMM4Aw5St4OYxVfAXK0hDZ_fSR-ChZc_UUow@mail.gmail.com>
 <54E72FE7.9030803@googlemail.com> <54E7312D.9090404@googlemail.com>
 <CAL=_i_m44Nbabgx56p_Lo9w5hCW-=MW3rvyh_2-B-bV7e3NkBQ@mail.gmail.com>
 <54E73E70.5020403@googlemail.com> <CAGa2bXZYipV0u2yOireZyrqoZY_z57cPtX_t-F6vaD3--e5U2Q@mail.gmail.com>
 <54F209B9.5020200@googlemail.com>
Date: Sun, 1 Mar 2015 11:28:43 +0900
Message-ID: <CAGa2bXbqnPcC84X4kEWMJCMXXDU+V7Zo=OJ9uz-RQrmS1vKjSQ@mail.gmail.com>
To: Crypto Compress <cryptocompress@googlemail.com>
Cc: PHP Developers Mailing List <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=001a11c067a0ae06f6051030de1a
Subject: Re: [PHP-DEV] [VOTE] Expectations
From: yohgaki@ohgaki.net (Yasuo Ohgaki)

--001a11c067a0ae06f6051030de1a
Content-Type: text/plain; charset=UTF-8

Hi Crypto,

On Sun, Mar 1, 2015 at 3:32 AM, Crypto Compress <
cryptocompress@googlemail.com> wrote:

> sorry for the late answer. My point is about throwing exceptions
> (assert.exceptions=1). I think it is wrong to allow to change code-flow by
> ini-setting and in current context it is wrong to throw exceptions
> altogether. Let's assume this code example in dev-mode with exceptions:
>
> class BankAccount {
>     function Add($amount) {
>         assert($amount > 0);
>         // ... code block ...
>     }
> }
>
> Now the programmer implementing "code block" to gracefully handle $amount
> > 0 has a problem. There is no way to (Unit)test failing path on
> development machine. Code after assertion is never called for failing
> contitions. What to do? Delete assertion is out of question. Disable
> zend.assertions on development machine seems to be the wrong way too. The
> only way to handle this is to disable exceptions (assert.exceptions=0) so
> expected code flow is restored. This, if allowed to be changed, should be
> at least the default.
>
> IMO ability to run and test code broadly outweighs "provides stacktrace by
> default" argument and for some reason i fear assert.exceptions=1 will be
> the only case soon.
>

I understand that removing assert conditions may seem to increase bugs in
code.
Wrong usage of assertion actually creates bugs. I agree.

However, assertion is not for production checks, but development time
checks.
Code example you're presented requires "caller" to make sure "$amount > 0"
condition
is met. Unit tests has to make sure "$amount > 0" condition is kept without
assertion.

Assertion (as well as DbC) helps to make sure if conditions/expectations of
"callee"
are fulfilled by "caller". Since caller must fulfill condition in the first
place, removing
assertions should not be problem under production environment and
production
codes execute faster.

Under structured programming, developers tend error condition check
responsibility
to "callee", just like your example. Use of assertion is DbC style
programming
which forces error condition checks to "caller". It changes why of thinking
and
these changes may be difficult to adopt for some developers, but the basic
idea is simple enough to be understood by all developers. I hope.

What good about DbC is it can achieve both robust development and faster
execution at the same time if it is used _properly_. I understand your
concern.

Developers must think what/where is the error condition check
responsibility.
Without this, the result can be fatal. Even if assertion/DbC has cons, its
pros
outweigh cons, IMHO.

Assertion/DbC
 - Promotes caller to validate inputs. Input validation is the most
important for secure code.
 - Underlying simple APIs that are called many times can omit various
condition checks in production. (Faster execution)
 - Prevents wrong usage of API during development by assert failure.
 - Makes developers to think where/how to implement "defense in depth"
properly. (Since no assertion checks in production, developers have to
think where/how to implement additional  systematic defense in their code.
This is good for better security.)

I fully agree that users can misuse. We must make effort that users
understand
proper usage and idea behind assertions/DbC.

Regards,

--
Yasuo Ohgaki
yohgaki@ohgaki.net

--001a11c067a0ae06f6051030de1a--