Exception safety: prepare first, then commit the state

Resource safety and state safety are not the same thing

A main thread between the two volumes is from managing responsibility with construction and destruction, toward maintaining understandable object state even when exceptions propagate. Members that own resources can clean up automatically, but if a function first changes one field and then fails while parsing another field, the destructor will not restore the previous write for you.

Therefore, first write the interface promise: successful configuration import replaces as a whole, failure retains the original configuration. This example limits the input to a set of non-empty names, without discussing file systems or cross-process transactions. This boundary allows us to clearly analyze every location that might throw an exception, rather than treating exception safety as an inherent property of all C++ objects.

The local candidate object is the preparation area

First put the new names one by one into a local vector. Empty names trigger an exception, and allocation failure may also throw; these situations all occur before the old configuration has been touched. The local container is responsible for releasing the prepared elements, and the caller only needs to decide how to handle the failure, without needing to know on which name the failure occurred.

After all checks are complete, then swap. Here a vector with the default allocator is used; the swap does not copy strings and does not need to reallocate elements; the commit step will not introduce these failure points again. The strong guarantee comes from this specific arrangement and cannot be generalized to “any two objects swapping never throws an exception”. Custom allocators and custom swap need their contracts checked separately.

Turn historical mechanisms into modern implementations

The original book uses raw pointers, auto_ptr, and handwritten resource classes to reveal how responsibility is lost. Today it is sufficient to retain its ownership ideas: containers take on sequential resources, without copying old-style reference counting or dynamic exception specifications just for demonstration. auto_ptr was removed in C++17, and throw specifications with type lists cannot be used as C++20 interfaces either.

The example verifies the behavior seen by the consumer: legal input changes the configuration, when the second item is illegal the complete old value remains unchanged, an empty list can clear it. In tests compare the entire sequence rather than just checking the length, because preserving the length does not mean preserving the content. Transactional objects may temporarily occupy extra memory; this is the explicit cost here for a clear failure guarantee.

Pitfalls

• RAII reclaiming resources is not the same as rolling back business data; modifying members first then checking may only get the basic guarantee.
• The non-throwing nature of swap requires specific type and allocator conditions; do not use this example to infer that all swaps are safe.

Minimum C++11 · complete program · Download .cpp

#include <cassert>
#include <stdexcept>
#include <string>
#include <utility>
#include <vector>
class Config {
    std::vector<std::string> names_;
public:
    const std::vector<std::string>& names() const noexcept { return names_; }
    void replace(const std::vector<std::string>& input) {
        std::vector<std::string> candidate;
        candidate.reserve(input.size());
        for (const auto& name : input) {
            if (name.empty()) throw std::invalid_argument("empty name");
            candidate.push_back(name);
        }
        names_.swap(candidate);
    }
};
int main() {
    Config config;
    config.replace({"alpha", "beta"});
    const auto before = config.names();
    bool rejected = false;
    try { config.replace({"changed", ""}); }
    catch (const std::invalid_argument&) { rejected = true; }
    assert(rejected && config.names() == before);
    config.replace({});
    assert(config.names().empty());
}

Compile locally

g++ -std=c++11 -Wall -Wextra -Wpedantic -pthread books-thinking-cpp.cpp -o example && ./example

Expected result

Expected: exit 0, no output; every assert holds.

CHECK YOUR UNDERSTANDING

Close the answer. Explain it.

Add a rule that names cannot be duplicated, still keeping failure from changing the old configuration.

Check the sources

• Thinking in C++ Vol.2 Chapter1：Resource management / Exception safety
• std::vector::swap 的分配器与异常条件

Drafts and official chapters change. The version mark is only the example’s minimum.