MSVC SAL vs. C++2a Contract

Question

In MSVC, there is SAL feature, which can be used to describe the parameter, result and so on, and it works well, and portable is also good, C++2a Contract feature seems to do the same thing, can somebody give some diffs between them?

Answer 1

There is no real overlap between SAL and contracts. SAL is about annotating parameters and return values for describing some aspects of how the function uses them. Contracts about about describing what the function requires of its parameters and what the caller can expect of the return value. These sound similar, but they are very different.

For example, SAL has notions of whether a parameter is an input, output, or in/out parameter. That is a matter of what the function does with the parameters. Contracts have no such notion because they don't care what the function does with the parameter.

Now there is some overlap. Sometimes, what a function expects and what a function does align. For example, if a function expects a pointer parameter to not be nullptr, you would apply an [[pre: param != nullptr]] contract to that function. However, the SAL notion of _In_ pointer parameter annotations covers the same general idea: if the function uses the parameter as a valid pointer to an object, then naturally it cannot be nullptr. So _In_ protects from that.

SAL is ultimately about describing how the function uses the data; contracts are about the function's interface with the calling code.

Also, SAL is extremely limited in what you can express. It has a few complex statements like "is a null-terminated string", but it has no foundation on which you can build your own. Contracts are C++ expressions, and they therefore can verify anything that a C++ expression can verify.