[Guideline] Add do not divide by 0 #132
Conversation
✅ Deploy Preview for scrc-coding-guidelines ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Hi @vapdrs! I have already sent you a message in Zulip, but here seems like a better place to do so. I come to add a couple of things to this guideline :)
There are other such operations for division, such as And for other arithmetic operations, there are quite a few functions one can use to avoid Undefined Behavior: https://doc.rust-lang.org/std/?search=checked
This combines rather well with Option, as in Option<NonZero>, since the compiler can do some memory layout optimization due to the fact that the value being enclosed by NonZero has one bit-pattern that is known to not be possible (the 000...000 pattern) I will review the PR shortly :3 |
| :status: draft | ||
| :release: latest | ||
| :fls: fls_Q9dhNiICGIfr | ||
| :decidability: Undecidable |
There was a problem hiding this comment.
Whether the program is or isn't dividing by zero is indeed Undecidable.
But whether the program is performing checked arithmetic or not is Decidable. So... perhaps this guideline should be changed to enforce checked arithmetic?
By which I mean: maybe it shouldn't be "Do not divide by 0". Maybe it should always be checked arithmetic.
Let's talk about it on Zulip!
There was a problem hiding this comment.
Whether the program is or isn't dividing by zero is indeed Undecidable.
Hmm. Does that make this quite onerous to the engineer which must comply with this?
Perhaps it could be advisory to allow easy deviation.
Maybe it should always be checked arithmetic.
This might be the right choice for another guideline, perhaps required which would make every division use checked_div().
What do you think @vapdrs?
There was a problem hiding this comment.
I think this is a good suggestion. As discussed in #75 and #127, I think a good way forward would be to leave the categorization of this guideline Mandatory and Undecidable, and also create a Required, Decidable rule which enforces "Always use checked arithmetic". Compliance with the required rule would ensure compliance with the mandatory rule. I'll create that other rule in a separate PR.
The reason I think this approach makes sense is because of
Does that make this quite onerous to the engineer which must comply with this?
If you are starting off a new project with new code then it should be easy to comply with a "always used checked arithmetic" rule.
If instead you are inheriting a large project that now needs to become compliant with our guidelines, the safety engineer can pick their poison:
- do a large rewrite to comply with "always used checked arithmetic rule" to ensure you never divide by zero
- do a manual review and justification at every location where static analysis can't determine you aren't dividing by zero.
There was a problem hiding this comment.
Thanks for opening this up @vapdrs! Could you check the comments I left?
| :status: draft | ||
| :release: latest | ||
| :fls: fls_Q9dhNiICGIfr | ||
| :decidability: Undecidable |
There was a problem hiding this comment.
Whether the program is or isn't dividing by zero is indeed Undecidable.
Hmm. Does that make this quite onerous to the engineer which must comply with this?
Perhaps it could be advisory to allow easy deviation.
Maybe it should always be checked arithmetic.
This might be the right choice for another guideline, perhaps required which would make every division use checked_div().
What do you think @vapdrs?
As stated there is no compliant way to do this, so no example should be present.
While the guideline does not strictly apply to this example, it is a good suggestion for what to do instead.
Closes #131