ATOT - Lecture 25, 30 June 2003

1

Chair of Software Engineering

Advanced Topics in Object Technology

Bertrand Meyer

ATOT - Lecture 25, 30 June 2003

2

Chair of Software Engineering

Lecture 25: Exception handling

by Karine Arnout

ATOT - Lecture 25, 30 June 2003

3

Chair of Software Engineering

Exception handling

The need for exceptions arises when the contract is broken.

Two concepts:

Failure: a routine, or other operation, is unable to fulfill its contract.

Exception: an undesirable event occurs during the execution of a routine — as a result of the failure of some operation called by the routine.

ATOT - Lecture 25, 30 June 2003

4

Chair of Software Engineering

The original strategy

r (...) isrequire

...do

op1

op2

...opi

...opn

ensure...

end

Fails, triggering an exception in r (r is recipient of exception).

ATOT - Lecture 25, 30 June 2003

5

Chair of Software Engineering

Causes of exceptions

Assertion violation Void call (x.f with no object attached to x) Operating system signal (arithmetic overflow, no

more memory, interrupt ...)

ATOT - Lecture 25, 30 June 2003

6

Chair of Software Engineering

Handling exceptions properly

Safe exception handling principle:

There are only two acceptable ways to react for the recipient of an exception:

Concede failure, and trigger an exception in the caller (Organized Panic).

Try again, using a different strategy (or repeating the same strategy) (Retrying).

ATOT - Lecture 25, 30 June 2003

7

Chair of Software Engineering

(From an Ada textbook)

sqrt (x: REAL) return REAL isbegin

if x < 0.0 thenraise Negative;

elsenormal_square_root_computation;

endexception

when Negative =>put ("Negative argument");return;

when others => end; -- sqrt

How not to do it

ATOT - Lecture 25, 30 June 2003

8

Chair of Software Engineering

The call chain

r0

r1

r2

r3

r4

Routine call

ATOT - Lecture 25, 30 June 2003

9

Chair of Software Engineering

Exception mechanism

Two constructs: A routine may contain a rescue clause. A rescue clause may contain a retry instruction.

A rescue clause that does not execute a retry leads to failure of the routine (this is the organized panic case).

ATOT - Lecture 25, 30 June 2003

10

Chair of Software Engineering

Transmitting over an unreliable line (1)

Max_attempts: INTEGER is 100

attempt_transmission (message: STRING) is-- Transmit message in at most -- Max_attempts attempts.

localfailures: INTEGER

dounsafe_transmit (message)

rescuefailures := failures + 1if failures < Max_attempts then

retryend

end

ATOT - Lecture 25, 30 June 2003

11

Chair of Software Engineering

Transmitting over an unreliable line (2)

Max_attempts: INTEGER is 100

failed: BOOLEAN

attempt_transmission (message: STRING) is-- Try to transmit message; -- if impossible in at most Max_attempts-- attempts, set failed to true.

localfailures: INTEGER

doif failures < Max_attempts then

unsafe_transmit (message)else

failed := Trueend

rescuefailures := failures + 1retry

end

ATOT - Lecture 25, 30 June 2003

12

Chair of Software Engineering

If no exception clause (1)

Absence of a rescue clause is equivalent, in first approximation, to an empty rescue clause:

f (...) isdo

...end

is an abbreviation for

f (...) isdo

...rescue

-- Nothing hereend

(This is a provisional rule; see next.)

ATOT - Lecture 25, 30 June 2003

13

Chair of Software Engineering

The correctness of a class

(1-n) For every exported routine r:

{INV and Prer} dor {Postr and INV}

(1-m) For every creation procedure cp:

{Precp} docp {Postcp and INV}

a.f (…)

a.g (…)

a.f (…)

create a.make (…)S1

S2

S3

S4

ATOT - Lecture 25, 30 June 2003

14

Chair of Software Engineering

Exception correctness: A quiz

For the normal body:

{INV and Prer} dor {Postr and INV}

For the exception clause:

{ ??? } rescuer { ??? }

ATOT - Lecture 25, 30 June 2003

15

Chair of Software Engineering

Quiz answers

For the normal body:

{INV and Prer} dor {Postr and INV}

For the exception clause:

{True} rescuer {INV}

ATOT - Lecture 25, 30 June 2003

16

Chair of Software Engineering

If no exception clause (2)

Absence of a rescue clause is equivalent to a default rescue clause:

f (...) isdo

...end

is an abbreviation for

f (...) isdo

...rescue

default_rescueend

The task of default_rescue is to restore the invariant.

ATOT - Lecture 25, 30 June 2003

17

Chair of Software Engineering

For finer-grain exception handling

Use class EXCEPTIONS from the Kernel Library.

Some features:

exception (code of last exception that was triggered).

assertion_violation, etc.

raise (“exception_name”)

ATOT - Lecture 25, 30 June 2003

18

Chair of Software Engineering

End of lecture 25