Lyntale: MS Code Contracts
Download as PPTX, PDF1 like371 views
Code contracts allow developers to specify expected behavior and guarantees for code through preconditions, postconditions, and invariants. Microsoft Code Contracts provides attributes and a rewriter to automatically inject runtime checks for contracts in .NET code. However, the syntax can be ugly when specifying contracts inline. Spec# is an alternative that uses a cleaner syntax, separating contracts from method bodies to make them clearer. While the concept of design by contract is good, the implementation in Code Contracts is lacking - Spec# provides a better approach.
![invariant[ContractInvariantMethod]private void Invariant(){ Contract.Invariant(Count >= 0);}](https://image.slidesharecdn.com/eih-code-contracts-110506033032-phpapp02/85/Lyntale-MS-Code-Contracts-32-320.jpg)
Lyntale: MS Code Contracts
- 2. what isa code contract?
- 3. caller
- 4. callee
- 5. contract
- 7. what isdesign by contract?
- 8. “Unless design by contract evokes images of curly hair and a French landmark in your head, you got it wrong.”
- 9. invented by Bertrand Meyer
- 10. a better contractwhat does it expect?what does it guarantee?what does it maintain?
- 11. dbc tenets> prerequisites> postconditions> invariants
- 12. examplestack
- 13. stack> Push(Tt)> T Pop()> T Top()> int Count> IsEmpty
- 14. dbc by hand
- 15. exampleT Pop(){ return _list.RemoveLast();}
- 16. preconditionT Pop(){Debug.Assert(!IsEmpty); return _list.RemoveLast();}
- 17. examplevoidPush(T t){ _list.Add(t);}
- 18. postconditionvoidPush(T t){ try { _list.Add(t);} finally { Debug.Assert(!IsEmpty); }}
- 22. what isms code contracts?
- 23. dbc.net
- 26. exampleT Pop(){ return _list.RemoveLast();}
- 27. preconditionT Pop(){Contract.Requires(!IsEmpty); return _list.RemoveLast();}
- 28. rewritten toT Pop(){if (__ContractsRuntime.insideContractEvaluation <= 4) { try { __ContractsRuntime.insideContractEvaluation++; __ContractsRuntime.Requires(!this.IsEmpty, null, "!IsEmpty"); } finally { __ContractsRuntime.insideContractEvaluation--; } } return this._list.RemoveLast<T>();}
- 29. examplevoid Push(T t){ _list.Add(t);}
- 30. postconditionvoidPush(T t){Contract.Ensures(!IsEmpty); _list.Add(t);}
- 31. rewritten tovoid Push(T t){ this._list.Add(t);if (__ContractsRuntime.insideContractEvaluation <= 4) { try {__ContractsRuntime.insideContractEvaluation++; __ContractsRuntime.Ensures(!this.IsEmpty, null, "!IsEmpty"); } finally { __ContractsRuntime.insideContractEvaluation--; } }}
- 32. invariant[ContractInvariantMethod]private void Invariant(){ Contract.Invariant(Count >= 0);}
- 35. verifier
- 36. so farso good
- 37. a stricter contractT Pop(){Contract.Requires(!IsEmpty); Contract.Ensures(Count < Contract.OldValue(Count)); Contract.Ensures(Contract.Result<T>() .Equals(Contract.OldValue(Top()))); return _list.RemoveLast();}
- 38. critique> ugly syntax> in method body> interface hack
- 39. yuck.
- 40. what isspec#?
- 41. preconditionT Pop() requires !IsEmpty;{ return _list.RemoveLast();}
- 42. postconditionvoid Push(T t) ensures !IsEmpty;{_list.Add(t);}
- 43. a stricter contractT Pop() requires !IsEmpty; ensures Count > old(Count); ensures result == old(Top()); { return _list.RemoveLast();}
- 44. muchbetter!
- 46. conclusion
- 47. design by contract? yay!
- 48. ms code contracts? meh.
- 49. spec#?yay!