You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Use `--` for all occurrences of en-dashes. All UTF-8 dashes are reduced
to this convention. Let the Markdown renderer cope with the correct
expansion of such items, e.g., `pandoc --smart ...`.
Copy file name to clipboardExpand all lines: CppCoreGuidelines.md
+32-32Lines changed: 32 additions & 32 deletions
Original file line number
Diff line number
Diff line change
@@ -101,7 +101,7 @@ In other words, what would you like your code to look like in 5 years' time, giv
101
101
The guidelines are focused on relatively higher-level issues, such as interfaces, resource management, memory management, and concurrency.
102
102
Such rules affect application architecture and library design.
103
103
Following the rules will lead to code that is statically type safe, has no resource leaks, and catches many more programming logic errors than is common in code today.
104
-
And it will run fast - you can afford to do things right.
104
+
And it will run fast -- you can afford to do things right.
105
105
106
106
We are less concerned with low-level issues, such as naming conventions and indentation style.
107
107
However, no topic that can help a programmer is out of bounds.
@@ -263,18 +263,18 @@ name of a profile group-of-rules ("type", "bounds", or "lifetime"), or a specifi
263
263
264
264
Each rule (guideline, suggestion) can have several parts:
265
265
266
-
* The rule itself - e.g., **no naked `new`**
267
-
* A rule reference number - e.g., **C.7** (the 7th rule related to classes).
266
+
* The rule itself -- e.g., **no naked `new`**
267
+
* A rule reference number -- e.g., **C.7** (the 7th rule related to classes).
268
268
Since the major sections are not inherently ordered, we use a letter as the first part of a rule reference "number".
269
269
We leave gaps in the numbering to minimize "disruption" when we add or remove rules.
270
-
* **Reason**s (rationales) - because programmers find it hard to follow rules they don't understand
271
-
* **Example**s - because rules are hard to understand in the abstract; can be positive or negative
272
-
* **Alternative**s - for "don't do this" rules
273
-
* **Exception**s - we prefer simple general rules. However, many rules apply widely, but not universally, so exceptions must be listed
274
-
* **Enforcement** - ideas about how the rule might be checked "mechanically"
275
-
* **See also**s - references to related rules and/or further discussion (in this document or elsewhere)
276
-
* **Note**s (comments) - something that needs saying that doesn't fit the other classifications
277
-
* **Discussion** - references to more extensive rationale and/or examples placed outside the main lists of rules
270
+
* **Reason**s (rationales) -- because programmers find it hard to follow rules they don't understand
271
+
* **Example**s -- because rules are hard to understand in the abstract; can be positive or negative
272
+
* **Alternative**s -- for "don't do this" rules
273
+
* **Exception**s -- we prefer simple general rules. However, many rules apply widely, but not universally, so exceptions must be listed
274
+
* **Enforcement** -- ideas about how the rule might be checked "mechanically"
275
+
* **See also**s -- references to related rules and/or further discussion (in this document or elsewhere)
276
+
* **Note**s (comments) -- something that needs saying that doesn't fit the other classifications
277
+
* **Discussion** -- references to more extensive rationale and/or examples placed outside the main lists of rules
278
278
279
279
Some rules are hard to check mechanically, but they all meet the minimal criteria that an expert programmer can spot many violations without too much trouble.
280
280
We hope that "mechanical" tools will improve with time to approximate what such an expert programmer notices.
@@ -540,11 +540,11 @@ We can ban, restrain, or detect the individual problem categories separately, as
540
540
Always suggest an alternative.
541
541
For example:
542
542
543
-
* unions - use `variant`
544
-
* casts - minimize their use; templates can help
545
-
* array decay - use `span`
546
-
* range errors - use `span`
547
-
* narrowing conversions - minimize their use and use `narrow` or `narrow_cast` where they are necessary
543
+
* unions -- use `variant`
544
+
* casts -- minimize their use; templates can help
545
+
* array decay -- use `span`
546
+
* range errors -- use `span`
547
+
* narrowing conversions -- minimize their use and use `narrow` or `narrow_cast` where they are necessary
548
548
549
549
### <a name="Rp-compile-time"></a>P.5: Prefer compile-time checking to run-time checking
550
550
@@ -1156,7 +1156,7 @@ Obviously, we cannot catch all errors through the static type system
1156
1156
1157
1157
In the following example, it is not clear from the interface what `time_to_blink` means: Seconds? Milliseconds?
1158
1158
1159
-
void blink_led(int time_to_blink) // bad - the unit is ambiguous
1159
+
void blink_led(int time_to_blink) // bad -- the unit is ambiguous
1160
1160
{
1161
1161
// ...
1162
1162
// do something with time_to_blink
@@ -1172,7 +1172,7 @@ In the following example, it is not clear from the interface what `time_to_blink
1172
1172
1173
1173
`std::chrono::duration` types introduced in C++11 helps making the unit of time duration explicit.
1174
1174
1175
-
void blink_led(milliseconds time_to_blink) // good - the unit is explicit
1175
+
void blink_led(milliseconds time_to_blink) // good -- the unit is explicit
1176
1176
{
1177
1177
// ...
1178
1178
// do something with time_to_blink
@@ -1187,7 +1187,7 @@ In the following example, it is not clear from the interface what `time_to_blink
1187
1187
The function can also be written in such a way that it will accept any time duration unit.
1188
1188
1189
1189
template<class rep, class period>
1190
-
void blink_led(duration<rep, period> time_to_blink) // good - accepts any unit
1190
+
void blink_led(duration<rep, period> time_to_blink) // good -- accepts any unit
1191
1191
{
1192
1192
// assuming that millisecond is the smallest relevant unit
1193
1193
auto milliseconds_to_blink = duration_cast<milliseconds>(time_to_blink);
@@ -3056,7 +3056,7 @@ principle of "do as the ints do."
3056
3056
##### Note
3057
3057
3058
3058
Historically there was some guidance to make the assignment operator return `const T&`.
3059
-
This was primarily to avoid code of the form `(a=b)=c` - such code is not common enough to warrant violating consistency with standard types.
3059
+
This was primarily to avoid code of the form `(a=b)=c` -- such code is not common enough to warrant violating consistency with standard types.
3060
3060
3061
3061
##### Example
3062
3062
@@ -6241,7 +6241,7 @@ Some people use `dynamic_cast` where a `typeid` would have been more appropriate
6241
6241
`dynamic_cast` is a general "is kind of" operation for discovering the best interface to an object,
6242
6242
whereas `typeid` is a "give me the exact type of this object" operation to discover the actual type of an object.
6243
6243
The latter is an inherently simpler operation that ought to be faster.
6244
-
The latter (`typeid`) is easily hand-crafted if necessary (e.g., if working on a system where RTTI is - for some reason - prohibited),
6244
+
The latter (`typeid`) is easily hand-crafted if necessary (e.g., if working on a system where RTTI is -- for some reason -- prohibited),
6245
6245
the former (`dynamic_cast`) is far harder to implement correctly in general.
6246
6246
6247
6247
Consider:
@@ -7730,7 +7730,7 @@ This makes the function's ownership sharing explicit.
@@ -8390,7 +8390,7 @@ Many such errors are introduced during maintenance years after the initial imple
8390
8390
##### Exception
8391
8391
8392
8392
It you are declaring an object that is just about to be initialized from input, initializing it would cause a double initialization.
8393
-
However, beware that this may leave uninitialized data beyond the input - and that has been a fertile source of errors and security breaches:
8393
+
However, beware that this may leave uninitialized data beyond the input -- and that has been a fertile source of errors and security breaches:
8394
8394
8395
8395
constexpr int max = 8 * 1024;
8396
8396
int buf[max]; // OK, but suspicious: uninitialized
@@ -9760,7 +9760,7 @@ This example has many more problems.
9760
9760
9761
9761
##### Reason
9762
9762
9763
-
Slicing - that is, copying only part of an object using assignment or initialization - most often leads to errors because
9763
+
Slicing -- that is, copying only part of an object using assignment or initialization -- most often leads to errors because
9764
9764
the object was meant to be considered as a whole.
9765
9765
In the rare cases where the slicing was deliberate the code can be surprising.
9766
9766
@@ -14140,8 +14140,8 @@ Dynamic accesses into arrays are difficult for both tools and humans to validate
14140
14140
{
14141
14141
a[pos / 2] = 1; // BAD
14142
14142
a[pos - 1] = 2; // BAD
14143
-
a[-1] = 3; // BAD - no replacement, just don't do this
14144
-
a[10] = 4; // BAD - no replacement, just don't do this
14143
+
a[-1] = 3; // BAD -- no replacement, just don't do this
14144
+
a[10] = 4; // BAD -- no replacement, just don't do this
14145
14145
}
14146
14146
14147
14147
##### Example, good
@@ -14211,7 +14211,7 @@ Issue a diagnostic for any indexing expression on an expression or variable of a
14211
14211
void f(int i, int j)
14212
14212
{
14213
14213
a[i + j] = 12; // BAD, could be rewritten as ...
14214
-
at(a, i + j) = 12; // OK - bounds-checked
14214
+
at(a, i + j) = 12; // OK -- bounds-checked
14215
14215
}
14216
14216
14217
14217
### <a name="Pro-bounds-decay"></a>Bounds.3: No array-to-pointer decay.
@@ -14242,7 +14242,7 @@ Pointers should not be used as arrays. `span` is a bounds-checked, safe alternat
14242
14242
span av = a;
14243
14243
14244
14244
g(a.data(), a.length()); // OK, if you have no choice
14245
-
g1(a); // OK - no decay here, instead use implicit span ctor
14245
+
g1(a); // OK -- no decay here, instead use implicit span ctor
14246
14246
}
14247
14247
14248
14248
##### Enforcement
@@ -15234,7 +15234,7 @@ Consider the following advice and requirements found in the C++ Standard:
15234
15234
> No destructor operation defined in the C++ Standard Library (including the destructor of any type that is used to instantiate a standard library template) will throw an exception. --[\[C++03\]](#C++03) §17.4.4.8(3)
15235
15235
15236
15236
Deallocation functions, including specifically overloaded `operator delete` and `operator delete[]`, fall into the same category, because they too are used during cleanup in general, and during exception handling in particular, to back out of partial work that needs to be undone.
15237
-
Besides destructors and deallocation functions, common error-safety techniques rely also on `swap` operations never failing--in this case, not because they are used to implement a guaranteed rollback, but because they are used to implement a guaranteed commit. For example, here is an idiomatic implementation of `operator=` for a type `T` that performs copy construction followed by a call to a no-fail `swap`:
15237
+
Besides destructors and deallocation functions, common error-safety techniques rely also on `swap` operations never failing -- in this case, not because they are used to implement a guaranteed rollback, but because they are used to implement a guaranteed commit. For example, here is an idiomatic implementation of `operator=` for a type `T` that performs copy construction followed by a call to a no-fail `swap`:
15238
15238
15239
15239
T& T::operator=(const T& other) {
15240
15240
auto temp = other;
@@ -15319,7 +15319,7 @@ If you define any of the copy constructor, copy assignment operator, or destruct
15319
15319
15320
15320
##### Note
15321
15321
15322
-
If you need to define any of these five functions, it means you need it to do more than its default behavior--and the five are asymmetrically interrelated. Here's how:
15322
+
If you need to define any of these five functions, it means you need it to do more than its default behavior -- and the five are asymmetrically interrelated. Here's how:
15323
15323
15324
15324
* If you write/disable either of the copy constructor or the copy assignment operator, you probably need to do the same for the other: If one does "special" work, probably so should the other because the two functions should have similar effects. (See Item 53, which expands on this point in isolation.)
15325
15325
* If you explicitly write the copying functions, you probably need to write the destructor: If the "special" work in the copy constructor is to allocate or duplicate some resource (e.g., memory, file, socket), you need to deallocate it in the destructor.
0 commit comments