News for hackers. Stuff that matters.
Re:Google broke a conditional statement that verifies passwo... by josefx on Friday July 23, 2021 @12:43AM (#27927287)
Reduced unit test complexity? Short circuiting implies more branches, more branches means more tests for 100% coverage.

Of course for that to be a downside someone would have to write tests for security critical code, which obviously did not happen.

Re:Google broke a conditional statement that verifies passwo... by snovv_crash on Friday July 23, 2021 @01:39AM (#27927583)
That is just gaming your coverage stats, there are still the different branches they just aren't visible now.
Re:Google broke a conditional statement that verifies passwo... by thaumasiotes on Friday July 23, 2021 @01:49AM (#27927631)
That's not true.

Compare `( a() || b() || c() ) ? yes() : no()` to `( a() | b() | c() ) ? yes() : no()`.

In the second case, there are two paths through the code:

  a()
  b()
  c()
  yes()

  a()
  b()
  c()
  no()
But in the first case, there are more paths:

  a()    /* true */
  yes()

  a()    /* false */
  b()    /* true */
  yes()

  a()    /* false */
  b()    /* false */
  c()    /* true */
  yes()

  a()    /* false */
  b()    /* false */
  c()    /* false */
  no()
That is because there are fewer branches in the second statement (just one) than there are in the first statement (three).
Re:Google broke a conditional statement that verifies passwo... by snovv_crash on Friday July 23, 2021 @09:03AM (#27930172)
So, it tests that you're running yes() and no(). But it doesn't test that your choice to use 'a()|b()|c()' for your condition was correct, instead of, for example, 'a()&b()&c()' or even '(a()&b())|c()' because you didn't test all the combinations. Using bitwise instead of logical operations hides this in your branch coverage report.
Re:Google broke a conditional statement that verifies passwo... by thaumasiotes on Friday July 23, 2021 @04:22PM (#27935167)
You are not attempting to have branch coverage; you are attempting to cover the space of possible inputs.
Re:Google broke a conditional statement that verifies passwo... by snovv_crash on Saturday July 24, 2021 @05:08PM (#27944500)
You're trying to check that all of your logic is correct. That's the point of doing tests. If your test doesn't check for certain input combinations, then you haven't tested your logic completely.

The point of branch coverage is to show when you missed input combinations for your logic. Artificially running all of the branches and then throwing away results just gives you a false sense of security about how much of your logic you covered.

I mean, technically, using bitwise instead of short-circuiting logic doesn't have branches at an assembly code level. But this is pedantry because we're actually trying to check the logic is correct, not that our compiler can correctly translate && into the same Boolean result as &.

Re:Google broke a conditional statement that verifies passwo... by GoblinSlayer on Friday July 23, 2021 @06:37AM (#27929180)
The code is correct if you hit yes() and no() correctly depending on three conditions. There are 8 possibilities in both cases and thus you need 8 tests in both cases. Shortcircuiting is optimization, it doesn't reduce complexity of the logic.
Re:Google broke a conditional statement that verifies passwo... by thaumasiotes on Friday July 23, 2021 @04:21PM (#27935153)
That is a concern, but it's not one related to how many branches exist in the code.

"How did we get here?" and "Are we in the right place?" are distinct questions.