If a function has wrong parameters, how to prevent it from returning any value?

Question

I am sure this question has been asked already but I couldn't find the answer.

If I have a function, let's say:

int Power(int number, int degree){
    if(degree==0){
        return 1;
    }
    return number*Power(number, degree-1);
}

It works only when the degree is a non-negative int. How can I prevent this function from being called with wrong parameters?

For example, if the programmer writes cout<<Power(2, -1);, I want the compiler to refuse to compile the code and return some kind of an error message (e.g. "function Power accepts only non-negative integers").

Another alternative would be for the function to not return any value in this case. For example:

int Power(int number, unsigned int degree){
    if(degree<0){
        //return nothing
    }
    if(degree==0){
        return 1;
    }
    return number*Power(number, degree-1);
}

Answer 1

The mere fact, that C++ does implicit type conversions, leaves you no way out of the predicament, that if you write unsigned int x = -1;, no matter which warnings you turn on with your compiler, you won't see any problem with that.

The only rule coming to mind, which might help you with that, is the notorious "max zero or one implicit conversions" rule. But I doubt it can be exploited in this case. (-1 would need to be converted to unsigned int, then to another type, implicitly). But I think from what I read on the page I linked above, numeric implicit conversions do not really count under some circumstances.

This leaves you but one other, also imperfect option. In the code below, I outline the basic idea. But there is endless room to refine the idea (more on that, later). This option is to resort to optional types in combination with your own integer type. The code below also only hints to what is possible. All that could be done in some fancy monadic framework or whatnot...

Obviously, in the code, posted in the question, it is a bad idea to have argument degree as an unsigned int, because then, a negative value gets implicitly converted and the function cannot protect itself from the hostile degree 0xFFFFFFFF (max value of unsigned int). If it wanted to check, it had better chosen int. Then it could check for negative values.

The code in the question also calls for a stack overflow, given it does not implement power in a tail recursive way. But this is just an aside and not subject to the question at hand. Let's get that one quickly out of the way.

// This version at least has a chance to benefit from tail call optimizations.

int internalPower_1 (int acc, int number, int degree) {
  if (1 == degree)
    return acc * number;

  return internalPower_1(acc*number, number, degree - 1);
}

int Power_1 (int number, int degree) {
  if (degree < 0)
    throw std::invalid_argument("degree < 0");

  return internalPower_1( 1, number, degree);
}

Now, would it not be nice if we could have integer types, which depended on the valid value range? Other languages have it (e.g. Common Lisp). Unless there is already something in boost (I did not check), we have to roll such a thing ourselves.

Code first, excuses later:

#include <iostream>
#include <stdexcept>
#include <limits>
#include <optional>
#include <string>

template <int MINVAL= std::numeric_limits<int>::min(),
      int MAXVAL = std::numeric_limits<int>::max()>
struct Integer
{
  int value;
  static constexpr int MinValue() {
    return MINVAL; }
  static constexpr int MaxValue() {
    return MAXVAL; }
  using Class_t = Integer<MINVAL,MAXVAL>;
  using Maybe_t = std::optional<Class_t>;

  // Values passed in during run time get handled
  // and punished at run time.
  // No way to work around this, because we are
  // feeding our thing of beauty from the nasty
  // outside world.
  explicit Integer (int v)
    : value{v}
  {
    if (v < MINVAL || v > MAXVAL)
      throw std::invalid_argument("Value out of range.");
  }

  static Maybe_t Init (int v) {
    if (v < MINVAL || v > MAXVAL) {
      return std::nullopt;
    }
    return Maybe_t(v);
  }
};

using UInt = Integer<0>;
using Int = Integer<>;

std::ostream& operator<< (std::ostream& os,
              const typename Int::Maybe_t & v) {
  if (v) {
    os << v->value;
  } else {
    os << std::string("NIL");
  }
  return os;
}


template <class T>
auto  operator* (const T& x,
         const T& y)
  -> T {
  if (x && y)
    return T::value_type::Init(x->value * y->value);
  return std::nullopt;
}


Int::Maybe_t internalPower_3 (const Int::Maybe_t& acc,
                  const Int::Maybe_t& number,
                  const UInt::Maybe_t& degree) {
  if (!acc) return std::nullopt;
  if (!degree) return std::nullopt;
  if (1 == degree->value) {
    return Int::Init(acc->value * number->value);
  }
  return internalPower_3(acc * number,
             number,
             UInt::Init(degree->value - 1));
}

Int::Maybe_t Power_3 (const Int::Maybe_t& number,
              const UInt::Maybe_t& degree) {
  if (!number) return std::nullopt;
  return internalPower_3 (Int::Init(1),
              number,
              degree);
}
              

int main (int argc, const char* argv[]) {
  std::cout << Power_1 (2, 3) << std::endl;
  std::cout << Power_3 (Int::Init(2),
            UInt::Init(3)) << std::endl;
  std::cout << Power_3 (Int::Init(2),
            UInt::Init(-2)) << std::endl;
  std::cout << "UInt min value = "
        << UInt::MinValue() << std::endl
        << "Uint max value = "
        << UInt::MaxValue() << std::endl;
  return 0;
}

The key here is, that the function Int::Init() returns Int::Maybe_t. Thus, before the error can propagate, the user gets a std::nullopt very early, if they try to init with a value which is out of range. Using the constructor of Int, instead would result in an exception.

In order for the code to be able to check, both signed and unsigned instances of the template (e.g. Integer<-10,10> or Integer<0,20>) use a signed int as storage, thus being able to check for invalid values, sneaking in via implicit type conversions. At the expense, that our unsigned on a 32 bit system would be only 31 bit...

What this code does not show, but which could be nice, is the idea, that the resulting type of an operation with two (different instances of) Integers, could be yet another different instance of Integer. Example: auto x = Integer<0,5>::Init(3) - Integer<0,5>::Init(5) In our current implementation, this would result in a nullopt, preserving the type Integer<0,5>. In a maybe better world, though it would as well be possible, that the result would be an Integer<-2,5>.

Anyway, as it is, some might find my little Integer<,> experiment interesting. After all, using types to be more expressive is good, right? If you write a function like typename Integer<-10,0>::Maybe_t foo(Integer<0,5>::Maybe_t x) is quite self explaining as to which range of values are valid for x.

Answer 2

There is an alternative to returning a value: Throw a value. A typical example:

if(degree<0){
    throw std::invalid_argument("degree may not be negative!");
}

I want the compiler to refuse to compilate the code

In general, arguments are unknown until runtime, so this is not typically possible.

Your answer does the job for menicely. But I am curious: 'throw' terminates the program and prevents anything after Power() to be executed.

If you catch the thrown object, then you can continue immediately after the function from which the object was thrown.