1396

1 files changed, 40 insertions, 16 deletions

diff --git a/001help.cc b/001help.cc
index 88c78d70..3e2a5944 100644
--- a/001help.cc
+++ b/001help.cc
@@ -32,32 +32,56 @@ bool is_equal(char* s, const char* lit) {
 // I'll throw some style conventions here for want of a better place for them.
 // As a rule I hate style guides. Do what you want, that's my motto. But since
 // we're dealing with C/C++, the one big thing we want to avoid is undefined
-// behavior. So, conventions:
-
-// 0. Initialize all primitive variables in methods and constructors.
-
-// 1. Avoid 'new' and 'delete' as far as possible. Rely on STL to perform
-// memory management to avoid use-after-free issues (and memory leaks).
-
-// 2. Avoid arrays to avoid out-of-bounds access. Never use operator[] except
-// with map. Use at() with STL vectors and so on.
-
+// behavior. If a compiler ever encounters undefined behavior it can make
+// your program do anything it wants.
+//
+// For reference, my checklist of undefined behaviors to watch out for:
+//   out-of-bounds access
+//   uninitialized variables
+//   use after free
+//   dereferencing invalid pointers: null, a new of size 0, others
+//
+//   casting a large number to a type too small to hold it
+//
+//   integer overflow
+//   division by zero and other undefined expressions
+//   left-shift by negative count
+//   shifting values by more than or equal to the number of bits they contain
+//   bitwise operations on signed numbers
+//
+//   Converting pointers to types of different alignment requirements
+//     T* -> void* -> T*: defined
+//     T* -> U* -> T*: defined if non-function pointers and alignment requirements are same
+//     function pointers may be cast to other function pointers
+//
+//       Casting a numeric value into a value that can't be represented by the target type (either directly or via static_cast)
+//
+// To guard against these, some conventions:
+//
+// 0. Initialize all primitive variables in functions and constructors.
+//
+// 1. Minimize use of pointers and pointer arithmetic. Avoid 'new' and
+// 'delete' as far as possible. Rely on STL to perform memory management to
+// avoid use-after-free issues (and memory leaks).
+//
+// 2. Avoid naked arrays to avoid out-of-bounds access. Never use operator[]
+// except with map. Use at() with STL vectors and so on.
+//
 // 3. Valgrind all the things.
-
+//
 // 4. Avoid unsigned numbers. Not strictly an undefined-behavior issue, but
 // the extra range doesn't matter, and it's one less confusing category of
 // interaction gotchas to worry about.
 //
-// We're screwed on overflow (undefined behavior). Use a decent compiler. But
-// we're more likely to try to subtract unsigned 2 from 1 than we are to
-// create integers that don't fit in 64 bits.
-//
 // Corollary: don't use the size() method on containers, since it returns an
 // unsigned and that'll cause warnings about mixing signed and unsigned,
 // yadda-yadda. Instead use this macro below to perform an unsafe cast to
 // signed. We'll just give up immediately if a container's every too large.
 :(before "End Includes")
-#define SIZE(X) (assert(X.size() < 1LL<<62), static_cast<long long int>(X.size()))
+#define SIZE(X) (assert(X.size() < (1LL<<62)), static_cast<long long int>(X.size()))
+//
+// 5. Integer overflow is still impossible to guard against. Maybe after
+// reading http://www.cs.utah.edu/~regehr/papers/overflow12.pdf
 
 :(before "End Includes")
 #include<assert.h>