2N/ABIND 9 uses the "Design by Contract" idea for most function calls.
2N/AA quick summary of the idea is that a function and its caller make a
2N/Acontract. If the caller meets certain preconditions, then the
2N/Afunction promises to either fulfill its contract (
i.e. guarantee a set
2N/Aof postconditions), or to clearly fail.
2N/A"Clearly fail" means that if the function cannot succeed, then it will
2N/Anot silently fail and return a value which the caller might interpret
2N/AIf a caller doesn't meet the preconditions, then "further execution is
2N/Aundefined". The function can crash, compute a garbage result, fail silently,
2N/Aetc. Allowing the function to define preconditions greatly simplifies many
2N/AAPIs, because the API need not have a way of saying "hey caller, the values
2N/Ayou passed in are garbage".
2N/ATypically, preconditions are specified in the functions .h file, and encoded
2N/Ain its body with REQUIRE statements. The REQUIRE statements cause the program
2N/Ato dump core if they are not true, and can be used to identify callers that
2N/Aare not meeting their preconditions.
2N/APostconditions can be encoded with ENSURE statements. Within the body of
2N/Aa function, INSIST is used to assert that a particular expression must be
2N/Atrue. Assertions must not have side effects that the function relies upon,
2N/Abecause assertion checking can be turned off.