Allowing small allocations to fail [LWN.net]

Allowing small allocations to fail

Posted Mar 11, 2015 11:24 UTC (Wed) by vbabka (subscriber, #91706)
In reply to: Allowing small allocations to fail by ewen
Parent article: Allowing small allocations to fail

I don't see the benefit of annotating all places where allocation can fail, if the default is going to change later anyway. Sounds like a lot of work that will in the end just clutter the code needlessly. What's needed is annotating (or fixing, if possible) places where allocation *cannot* fail.

to post comments

Allowing small allocations to fail

Posted Mar 11, 2015 12:01 UTC (Wed) by cesarb (subscriber, #6266) [Link]

> Sounds like a lot of work that will in the end just clutter the code needlessly.

It's a good way to change a default. In the initial state, you have a lot of code which might rely on the old default. Gradually you change each call site to explicitly state what it really needs (cannot fail, indifferent, can fail, can fail and must do so quickly), so after a while nothing depends on the default (except the ones explicitly verified as "indifferent"). Then you change the default, which will now have no effect (except for the call sites explicitly verified as "don't care"). Finally, you gradually remove the now redundant annotations corresponding to the new default.

Yes, it's more work, but it's also a safer path. Each step is small enough that it can be individually verified, and what would otherwise be a large step (the change in the default) becomes a minor step. It's similar to the concept of a "reversible process" in physics.