Writing correct code, part 1: whatever happened to invariants?
reprog.wordpress.com
reprog.wordpress.com
In real life, whenever I'm writing complex C functions, I always denote my preconditions, postconditions, and invariants. I also tend to denote non-obvious pre/post conditions above the functions, to optimize for the case of source-diving (when someone's just glimpsing around and trying to get the gist).
E.g. it is possible to express the Red-Black-Tree invariants in Haskell's type system.
Interesting that his code still has a (probably never triggered) bug.
EDIT: Actually, looking at the exchange in the comments, the bug I thought it has, isn't. The code is right, but for a subtle (to me) reason that isn't clear (to me) from any of the comments, the code, or the invariant. Even more interesting than I thought.