1. Writing “Exception Safe” C++ Alan Griffiths (alan.griffiths@experian.com) –Work: Experian Limited Senior Systems Consultant Mentoring & development OOA/OOD/C++ –Play: WWW, Java –ACCU chairman

2. Overview This talk breaks down into the following sections: –What we mean by “exception safety” –The problems of a naïve approach –Guidelines and a rewrite –Applying these techniques

3. Timeline 1990 - ARM: Exceptions (experimental) 1995Q1 CD1: Exceptions in language but... 1996Q4 CD2: …library not exception safe 1997ish - Many exception-safety articles 1998 - ISO Standard - “Exceptions safe”

4. Some of the articles  H Muller - “Ten rules for handling exception handling successfully” – C++ Report Jan.’96  H Sutter - “Designing exception-safe Generic Containers” – C++ Report Sept.’97  H Sutter - “More exception-safe Generic Containers” – C++ Report Nov-Dec.’97  K Henney – “Creating Stable Assignments” – C++ Report June’98

5. Writing “Exception Safe” C++  What we mean by “exception safety” –The problems of a naïve approach –Guidelines and a rewrite –Applying these techniques

6. Call stack: a() to x() a() calls b() … e() calls f() f() calls g() … x() throws an exception [handled by a()]. x() line 1... g() line 183 + 8 bytes f() line 195 + 8 bytes e() line 209 + 8 bytes... a() line 324 + 8 bytes main() line 360 mainCRTStartup() line 257 + 25 bytes

7. f() is exception safe if... The weak exception safety guarantee –No resources are leaked –The system state remains valid The strong exception safety guarantee –If f() terminates by propagating an exception then it makes no change to the state of the program.

8. Divide and conquer f() relies on g(), h(), …, x() Objects isolate changes

9. Other definitions There are other definitions of exception safe. –For example “deleteable” –You may have encountered others… –Some references in the notes

10. Recap: “exception safety” The “weak exception safety guarantee” requires: –Resources are not leaked –The system state remains valid In addition the “strong exception safety guarantee” requires: –There is no change to the system state

11. Writing “Exception Safe” C++  What we mean by “exception safety”  The problems of a naïve approach –Guidelines and a rewrite –Applying these techniques

12. How do we write f()?

13. class PartOne { /* omitted */ }; class PartTwo { /* omitted */ }; class Whole { public: //...Lots omitted... Whole& operator=(const Whole& rhs); private: PartOne*p1; PartTwo*p2; };

14. Assignment operator Whole& Whole::operator=(const Whole& rhs){ if (&rhs != this) { delete p1; delete p2; p1 = new PartOne(*rhs.p1); p2 = new PartTwo(*rhs.p2); } return *this; } Don’t do it this way!!!

15. Whole& Whole::operator=(const Whole& rhs) { if (&rhs != this) { PartOne* t1 = new PartOne(*rhs.p1); try { PartTwo* t2 = new PartTwo(*rhs.p2); delete p1; delete p2; p1 = t1; p2 = t2; } catch (...) { delete t1; throw; } } return *this; } The naïve approach PartOne* t1 = new PartOne(*rhs.p1); try { PartTwo* t2 = new PartTwo(*rhs.p2); delete p1; delete p2; p1 = t1; p2 = t2; } catch (...) { delete t1; throw; }

16. naïve approach - assessment Good software engineering: –So simple that there are “obviously no errors” This approach: –So complex that there are “no obvious errors”

17. Writing “Exception Safe” C++  What we mean by “exception safety”  The problems of a naïve approach  Guidelines and a rewrite –Applying these techniques

18. The guidelines There are three rules: –Destructors may not propagate exceptions –States may be swapped without an exception being thrown –An object may own at most one resource

19. The revised example class Whole { public: //...Lots omitted... Whole& operator=(const Whole& rhs); private: std::auto_ptr p1; std::auto_ptr p2; };

20. revised assignment operator Whole& Whole::operator=(const Whole& rhs) { std::auto_ptr t1(new PartOne(*rhs.p1)); std::auto_ptr t2(new PartTwo(*rhs.p2)); swap(p1, t1); swap(p2, t2); return *this; }

21. assignment operator - again Whole& Whole::operator=(const Whole& rhs) { Whole(rhs).swap(*this); return *this; } void Whole::swap(Whole& that) { using std::swap; swap(p1, that.p1); swap(p2, that.p2); }

22. Recap: the guidelines Destructors may not propagate exceptions States may be swapped without an exception being thrown An object may own at most one resource

23. Writing “Exception Safe” C++  What we mean by “exception safety”  The problems of a naïve approach  Guidelines and a rewrite  Applying these techniques

24. A smart pointer arg::body_part_ptr<> –When an std::auto_ptr<> is copied ownership is transferred –body_part_ptr<> copies the object pointed to by the assigned pointer

25. Another version of Whole class Whole { public: //...Lots omitted... Whole& operator=(const Whole& rhs); void swap(Whole& that); private: arg::body_part_ptr p1; arg::body_part_ptr p2; };

26. The latest implementation Whole& Whole::operator=(const Whole& rhs) { Whole(rhs).swap(*this); return *this; } void Whole::swap(Whole& that) { using std::swap; swap(p1, that.p1); swap(p2, that.p2); }

27. Specialising std::swap namespace std { inline void swap( ::example5::Whole& lhs, ::example5::Whole& rhs) { lhs.swap(rhs); } }

28. Base classes Health warning don’t do this at home

29. Extended Whole Whole& Whole::setP1(const PartOne& value) { p1.reset(new PartOne(value)); return *this; } Whole& Whole::setP2(const PartTwo& value) { p2.reset(new PartTwo(value)); return *this; }

30. class ExtendedWhole : private Whole { public: /* Omit constructors & assignment */ void swap(const ExtendedWhole& rhs); void setParts( const PartOne& p1, const PartTwo& p2, const PartThree& p3); private: int count; PartThree body; };

31. ExtendedWhole::swap() void ExtendedWhole::swap( ExtendedWhole& rhs) { using std::swap; Whole::swap(*this); swap(count, rhs.count); swap(body, rhs.body); }

32. ExtendedWhole::setParts() void ExtendedWhole::setParts( const PartOne& p1, const PartTwo& p2, const PartThree& p3) { setP1(p1); setP2(p2); body = p3; }

33. ExtendedWhole::setParts() void ExtendedWhole::setParts( const PartOne& p1, const PartTwo& p2, const PartThree& p3) { Whole temp(*this); temp.setP1(p1).setP2(p2); body = p3; Whole::swap(temp); }

34. “Strong” or “Weak” guarantee? Choose a design when designing a function –Strong is more convenient for user –Weak requires fewer copies and temporaries Document the library, class or function Implement the design decision correctly I don’t know of automated tools

35. Writing “Exception Safe” C++  What we mean by “exception safety”  The problems of a naïve approach  Guidelines and a rewrite  Applying these techniques

36. #include int main() { struct local_file { local_file() : f(std::fopen(__FILE__, "r")) {} ~local_file() { if (f) std::fclose(f); } operator std::FILE* () const { return f; } std::FILE* f; } file; char buffer[1000]; if (file) { std::fread(buffer, sizeof buffer, 1, file); // Processing that may throw an exception } return 0; } struct local_file { local_file() : f(std::fopen(__FILE__, "r")) {} ~local_file() { if (f) std::fclose(f); } operator std::FILE* () const { return f; } std::FILE* f; } file;

37. Example for discussion counted_ptr ptr(new T()); needs a counter allocation could fail so may constructor throw? and should it delete initialiser?

38. Alan.griffiths@experian.com http://www.octopull.demon.co.uk H Muller - “Ten rules for handling exception handling successfully” – C++ Report Jan.’96 H Sutter - “Designing exception-safe Generic Containers” – C++ Report Sept.’97 H Sutter - “More exception-safe Generic Containers” – C++ Report Nov-Dec.’97 K Henney – “Creating Stable Assignments” – C++ Report June’98 D Abrahams - "Exception Safety in STLport” - http://www.stlport.org/doc/exception_safety.html