static_assert is all you need (no leaks, no UB)

https://twitter.com/krisjusiak/status/1645360641538945025

by kris-jusiak • 3 years ago

98 69 3 years ago

With C++20 almost anything can be used in constexpr context (vector, unique_ptr, virtual, function, etc.) and as long as it's in the scope it can be tested at compile time which guarantees memory safatey, no UB, etc. Additionally, since constexpr can be executed at run-time and code has been tested at compile-time already therefore 'static_assert' is (almost) all you need - https://godbolt.org/z/P4cqboGx6.

saagarjha• 3 years ago

Have zero cost abstractions gone too far?

AshamedCaptain3• 3 years ago

I really don't think it works that way. You can for sure write code that will leak and otherwise be UB but run compile-time just fine.

kris-jusiak6• 3 years ago

constexpr has to checked for leaks and UB so as long as there is coverage at compile-time (static_assert + constexpr) I would assume there shouldn't be neither leaks nor UB. But the context is limitted where that can be applied and actually compiles. For example, there is no way to do it with global variables but with limited scope that's possible.

dgellow3• 3 years ago

https://en.cppreference.com/w/cpp/language/constant_expressi...

Point 8:

A core constant expression is any expression whose evaluation would not evaluate any one of the following:
8. an expression whose evaluation leads to any form of core language undefined behavior (including signed integer overflow, division by zero, pointer arithmetic outside array bounds, etc).

mikepurvis• 3 years ago

From an overall performance point of view, I wonder how the timing works out for the compiler to run your unit tests like this vs to produce and invoke a binary.

I bet it's mostly a wash, and the ergonomics of conventional gtest macros look way better to my eye.

ynik• 3 years ago

The idea to let the compiler run the tests only works if you constexpr everything, which means putting all code in headers. This effectively means giving up on separate compilation. Worse, if you use some mixture (most code in headers but you still have >1 compilation unit), your compile times completely explode as essentially all code is compiled repeatedly for each unit.

kris-jusiak6• 3 years ago

Hmm, there are obvisouly trade offs (it depends on the compiler how many tests, how are they written, etc.) but for apples to apples comparision the gtest binary would have to be either compiled with sanitizers (that would be probably slower to compile than static_assert tests without sanitizers) or run with valgrind or similar (execution would be much slower, static_asserts tets don't have to be executed, compiles=green).

gpderetta2• 3 years ago

Pragmatically you can write your code in such a way that you can get immediate feedback in your IDE as you write the code if a static assert fails as you are implementing your function.

You could of course set up your runtime tests in a similar way, having the ide run them back to back as you are writing code, but it is more complicated, especially if the code is in an intermediate state that it is not fully compilable.

So in the end it is not a huge breakthrough, but having compile time tests is still quite a nice feature.

zerr• 3 years ago

Depends on how you define a class. E.g. you are not using std::list in your example.

fefe23• 3 years ago

This is awesome!

I wonder what the compile time cost would be to just have this kind of unit testing in all the time.

kris-jusiak6• 3 years ago

Thanks! Most likely not yet applicable at Google's scale but smaller project can defo leverage the approach. Personally, I'm writing most of my tests this way and with TDD the red phase is always a compilation fail which is quicker than buiding and running in my experience. But that's for a medium size project. But as always it depends there are trade offs.

macgyverismo• 3 years ago

I’ve been using this technique as well, but I found that debugging static_asserts is quite hard. I often fall back to calling the failing test at runtime and stepping through. Any suggestions for a different workflow?

JTyQZSnP3cQGa8B• 3 years ago

(Offtopic but) Kris, I have used your micro unit-test library in the past and it was a pleasure to look at your code. You're the kind of crazy guy (in a good way) that gives me the motivation to learn new stuff. Thanks.

dig1• 3 years ago

This makes sense for straightforward tests, but static_assert is not all you need in general, because some things has be executed in runtime, after series of steps or after some timeframe. Good luck reproducing or testing these in compile-time.

mr_00ff00• 3 years ago

Could you not put a series of steps or something that mocks time into constexpr? A comment mentioned above that in C++20, almost all features are available at compile time now.

ovao• 3 years ago

With few limitations, yes. In C++20, you could for example test for constant evaluation[1], using that as a mechanism to fall back to a real clock during runtime.

[1] https://en.cppreference.com/w/cpp/types/is_constant_evaluate...

leni536• 3 years ago

Per standard wording if an evaluation contains an undefined operation then it is not a constant expression. It means that undefined behavior should result in compilation failure if it happens in a context where a constant expression is required, like in static_assert.

However the standard only requires this for language-level undefined behavior. For undefined behavior happening in the standard library it's unspecified whether the expression is a constant expression or not. So no, constexpr tests don't cover all possible UB.

Also even if in theory language-level undefined behavior should be caught in constant expressions, in practice compilers miss a number of undefined behaviors. They are generally good at catching out-of-range indexing, using objects outside of their lifetime, using uninitialized values, signed integer overflow and modifying const objects. However there are a number of subtle undefined behaviors that they don't catch, like unsequenced operations on the same object, invalid values for unscoped enums.

There might be some overlap with runtime tests with -fsanitize=undefined,address. For catching uninitialized values at runtime though you probably need msan, which is a pain to set up, but constexpr tests cover that. On the other hand the function you test might not be available at compile-time.

Anyway, constexpr tests are a valuable tool. It's not a silver bullet.

0xbkt• 3 years ago

What's going on in this code for someone completely alien to C++?

ksherlock• 3 years ago

The compiler is doing a bunch of complicated stuff at compile time. In fact it's both a C++ compiler and a C++ interpreter.

static_assert is a compile-time check.

[] { ... }(); is an immediately executed lambda function (IIFE in javascript parlance).

list<int> list{} is a linked list of integers (double-linked, forward and backward). push_back() allocates more memory. pop() / clean() deallocates memory.

cubancigar11• 3 years ago

It is creating a bunch of objects, modifying them, then asserting their value all at compile time. For example the first example creates a list and asserts its size is 0. List normally allocated on heap, so I am guessing they have made changes in thay area in c++20 by making it Constexpr, which is a fancy way to say an expression can be known at compile time.

tialaramex2• 3 years ago

The C++ code is a simple list type, and also a bunch of tests for that type to confirm that it works as intended. The crucial trick here is that because static asserts are used, the test values are computed during compilation, such computations are forbidden (by the standard) from having any leaks or Undefined Behaviour. Anything allocated must be freed by the time the tests complete, and no language Undefined Behaviour is permitted.

The latter is pretty normal for other languages but is a big deal in C++ where UB is a constant plague. However many languages have either forbid or have strict limits on compile time heap allocation - after all that heap isn't going to still exist at runtime. Requiring that you free everything allocated fixes that hole and means you get free leak detection.

mgaunard4• 3 years ago

New user of C++ discovers C++ has a mechanism for code to be evaluated at compile-time, and decides to share his findings on twitter.

Why is it a story? Slow day on the Internet?

gpderetta2• 3 years ago

Someone found ot interesting enough to write about this and someone else found it interesting enough to upvote.

In the end it just an excuse to have a discussion on an interesting topic.

And yes, it is a slow day.

mrlonglong• 3 years ago

You need C++ 23 to run this code. I tried it out with C++ 20 and got compile errors.

pjmlp• 3 years ago

Hence "-std=c++2b" on compiler explorer example.

static_assert is all you need (no leaks, no UB)

Related Stories