Found on Reddit: http://blog.regehr.org/archives/1054/
Some quotations from the article and its comments:
I proposed making signed left-shift work just like unsigned left-shift. In contrast, in C99, C11, and C++11, it is illegal to shift a 1 bit into, out of, or through the sign bit. Many developers are unaware of this restriction. This seemed to me like a pretty safe proposal since it isn’t clear that any existing compiler implements anything other than two’s complement semantics for signed left shifts in the first place<
Reasoning about function preconditions is hard even for experienced developers. In my opinion, some of these libraries could have used a lot more assertions to go along with their (generally perfectly adequate) test suites.<
D contract programming helps. From the comments:
My personal preference would be for the standards committee to mandate 2s-complement arithmetic, which would knock out a lot of these random “language doesn’t behave the way most programmers think it does” UB bugs.<
Bye, bearophile
