<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'>
- You can't get SIGSEGV w/o memory protection. SIGSEGV is generated by hardware.<BR>
<BR>
- Untrusted code should not be run in-process, at least unsafe untrusted code.<BR>
<BR>
- I don't have to reboot my computer for SIGSEGV, but individual processes are killed.<BR>
The damage is contained as soon as it is detected. The nice thing about safe languages<BR>
is the error is caught just before any damage is caused, i.e. array bounds checking.<BR>
<BR>
- Jay<BR><BR> <BR>
> To: jay.krell@cornell.edu<BR>> Date: Sat, 19 Feb 2011 17:51:07 -0800<BR>> From: mika@async.caltech.edu<BR>> CC: m3devel@elegosoft.com<BR>> Subject: Re: [M3devel] SEGV mapping to RuntimeError<BR>> <BR>> >But SIGSEGV I think is in another realm. It is a sign of problems that shou=<BR>> >ld generally<BR>> >be ignored.<BR>> >There is a term "fail fast" -- at a sign of problem=2C fail. Don't press on=<BR>> >.<BR>> >There are arguments either way.<BR>> >The world=2C really=2C the larger human enterprise and setting=2C is not fa=<BR>> >il fast.<BR>> >We have lots of problems=2C yet almost everything almost always goes on.<BR>> <BR>> Well, see, when you're using a Lisp interpreter, SIGSEGV in called<BR>> code is not in another realm (this is my problem). It is also not<BR>> in another realm if you are implementing an operating system without<BR>> hardware memory protection (e.g., SPIN) or if you're running untrusted<BR>> outside code in a "sandbox" (which you CAN build with Modula-3, again<BR>> without memory protection). How would you like it if you had to reboot<BR>> your computer every time you dereferenced a null pointer? Sounds a bit<BR>> like the 1950s doesn't it? Why should I have to restart my Lisp<BR>> interpreter if I slip on the keyboard?<BR>> <BR>> These are things you would never dream of doing in C but that Modula-3<BR>> is eminently suited for doing. For precisely these sorts of purposes,<BR>> there's a big distinction designed into the language between failures<BR>> in "safe" code (which mean just that the code failed) and failures in<BR>> "unsafe" code (which mean that the world ended).<BR>> <BR>> If you're not doing any of the special things listed above you're free<BR>> not to catch RuntimeError.E, in which case your program will crash on<BR>> an uncaught exception if it receives a SIGSEGV.<BR>> <BR>> <BR>> >I just don't think because the Green Book says something=2C or because it i=<BR>> >s inherent in the<BR>> >design=2C that is necessarily true or inherent in the implementation.<BR>> >There are bugs *everywhere*=2C and they gradually chip away at all aspects =<BR>> >of correctness.<BR>> <BR>> Dijkstra teaches that one should code to the specification. Coding to<BR>> the implementation is a sure path to losing one's mind.<BR>> <BR>> Mika<BR> </body>
</html>