Lyntale fra Computasdagen 05.05.11

1. ms code contracts eih

2. what is a code contract?

3. caller

4. callee

5. contract

6. a weakcontract bool Equals(object o)

7. what is design by contract?

8. “Unless design by contract evokes images of curly hair and a French landmark in your head, you got it wrong.”

9. invented by Bertrand Meyer

10. a better contract what does it expect? what does it guarantee? what does it maintain?

11. dbc tenets > prerequisites > postconditions > invariants

12. example stack

13. stack > Push(Tt) > T Pop() > T Top() > int Count > IsEmpty

14. dbc by hand

15. example T Pop() { return _list.RemoveLast(); }

16. precondition T Pop() { Debug.Assert(!IsEmpty); return _list.RemoveLast(); }

17. example voidPush(T t) { _list.Add(t); }

18. postcondition voidPush(T t) { try { _list.Add(t); } finally { Debug.Assert(!IsEmpty); } }

19. invariant Count >= 0

20. limitations tedious!

21. limitations clutters the code!

22. what is ms code contracts?

23. dbc.net

24. codecontracts > rewriter > verifier

25. rewriter injects runtime checks

26. example T Pop() { return _list.RemoveLast(); }

27. precondition T Pop() { Contract.Requires(!IsEmpty); return _list.RemoveLast(); }

28. rewritten to T Pop() { if (__ContractsRuntime.insideContractEvaluation <= 4) { try { __ContractsRuntime.insideContractEvaluation++; __ContractsRuntime.Requires(!this.IsEmpty, null, "!IsEmpty"); } finally { __ContractsRuntime.insideContractEvaluation--; } } return this._list.RemoveLast<T>(); }

29. example void Push(T t) { _list.Add(t); }

30. postcondition voidPush(T t) { Contract.Ensures(!IsEmpty); _list.Add(t); }

31. rewritten to void Push(T t) { this._list.Add(t); if (__ContractsRuntime.insideContractEvaluation <= 4) { try { __ContractsRuntime.insideContractEvaluation++; __ContractsRuntime.Ensures(!this.IsEmpty, null, "!IsEmpty"); } finally { __ContractsRuntime.insideContractEvaluation--; } } }

32. invariant [ContractInvariantMethod] private void Invariant() { Contract.Invariant(Count >= 0); }

33. verifier performs static checks

34. verifier vs>= premium

35. verifier

36. so far so good

37. a stricter contract T Pop() { Contract.Requires(!IsEmpty); Contract.Ensures(Count < Contract.OldValue(Count)); Contract.Ensures(Contract.Result<T>() .Equals(Contract.OldValue(Top()))); return _list.RemoveLast(); }

38. critique > ugly syntax > in method body > interface hack

39. yuck.

40. what is spec#?

41. precondition T Pop() requires !IsEmpty; { return _list.RemoveLast(); }

42. postcondition void Push(T t) ensures !IsEmpty; { _list.Add(t); }

43. a stricter contract T Pop() requires !IsEmpty; ensures Count > old(Count); ensures result == old(Top()); { return _list.RemoveLast(); }

44. muchbetter!

45. lesson syntax helps

46. conclusion

47. design by contract? yay!

48. ms code contracts? meh.

49. spec#? yay!