fix(clang-tidy): use UNREACHABLE for unreachable paths (RULE-0-0-2)

score/memory/shared/pointer_arithmetic_util.cpp

@@ -140,7 +140,10 @@ std::ptrdiff_t SubtractPointersBytes(const void* const first, const void* const
             score::mw::log::LogFatal("shm")
                 << "Could not subtract " << second_address_as_integer << "from" << first_address_as_integer
                 << ". Result does not fit into std::ptrdiff_t. Terminating.";
-            SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(false);
+            // Reachable in principle, but must not be reached in production: Two addresses further apart than
+            // std::ptrdiff_t max are possible in principle. Shared memory regions are far smaller, so such a pair of
+            // addresses must not occur in production.
+            SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
         }
         return static_cast<std::ptrdiff_t>(result_as_integer);
     }
@@ -162,7 +165,10 @@ std::ptrdiff_t SubtractPointersBytes(const void* const first, const void* const
         score::mw::log::LogFatal("shm") << "Could not subtract " << second_address_as_integer << "from"
                                         << first_address_as_integer
                                         << ". Result does not fit into std::ptrdiff_t. Terminating.";
-        SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(false);
+        // Reachable in principle, but must not be reached in production: Two addresses further apart than
+        // std::ptrdiff_t max are possible in principle. Shared memory regions are far smaller, so such a pair of
+        // addresses must not occur in production.
+        SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
     }
     return -1 * static_cast<std::ptrdiff_t>(absolute_value_result_as_integer);
 }

score/mw/com/impl/bindings/lola/messaging/message_passing_service_instance.cpp

@@ -201,8 +201,9 @@ bool IsMethodErrorRecoverable(const score::result::Error error)
     }
     else
     {
-        SCORE_LANGUAGE_FUTURECPP_PRECONDITION_PRD_MESSAGE(false,
-                                                          "Provided error is not part of subset relating to methods.");
+        // Reachable in principle, but must not be reached in production: A caller can pass an error code outside the
+        // method-related subset. Callers must only pass method-related error codes in production.
+        SCORE_LANGUAGE_FUTURECPP_UNREACHABLE_MESSAGE("Provided error is not part of subset relating to methods.");
     }
 }
 

score/mw/com/impl/bindings/lola/methods/offered_state_machine.cpp

@@ -55,12 +55,16 @@ OfferedStateMachine::State StopOfferedState::Offer()
 
 OfferedStateMachine::State StopOfferedState::StopOffer()
 {
-    SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(0);
+    // Reachable in principle, but must not be reached in production: StopOffer() can be called while in
+    // StopOfferedState. The Skeleton must not call StopOffer() twice without an Offer() in between in production.
+    SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
 }
 
 OfferedStateMachine::State ReOfferedState::Offer()
 {
-    SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(0);
+    // Reachable in principle, but must not be reached in production: Offer() can be called while in ReOfferedState. The
+    // Skeleton must not call Offer() twice without a StopOffer() in between in production.
+    SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
 }
 
 OfferedStateMachine::State ReOfferedState::StopOffer()

score/mw/com/impl/bindings/lola/shm_path_builder.cpp

@@ -64,11 +64,13 @@ void EmitControlFileName(std::ostream& out,
             [[fallthrough]];
         default:
         {
+            // Reachable in principle, but must not be reached in production: An invalid QualityType can be passed in.
+            // Callers must pass QM or ASIL-B in production.
             // Suppress "AUTOSAR C++14 M0-1-1", The rule states: "A project shall not contain unreachable code"
             // This is a false positive, this code is reachable due to fallthrough.
             // default case and break are necessary to have well-formed switch.
             // coverity[autosar_cpp14_m0_1_1_violation : FALSE]
-            SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD_MESSAGE(false, "Invalid quality type");
+            SCORE_LANGUAGE_FUTURECPP_UNREACHABLE_MESSAGE("Invalid quality type");
 
             // Rationale: This code is actually unreachable due to the assert above which will always be triggered if
             // hit. However, rule M6-4-5 says that "An unconditional throw or break statement shall terminate every

score/mw/com/impl/bindings/lola/skeleton.cpp

@@ -365,7 +365,9 @@ auto Skeleton::PrepareOffer(SkeletonEventBindings& events,
         // LCOV_EXCL_START (DetermineShmReuseStrategy always returns a valid strategy; kUnknownStrategy is unreachable)
         case ShmReuseStrategy::kUnknownStrategy:
         default:
-            SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD_MESSAGE(false, "Unknown SHM reuse strategy.");
+            // Reachable in principle, but must not be reached in production: A kUnknownStrategy is never returned by
+            // DetermineShmReuseStrategy in production.
+            SCORE_LANGUAGE_FUTURECPP_UNREACHABLE_MESSAGE("Unknown SHM reuse strategy.");
             break;
             // LCOV_EXCL_STOP
     }
@@ -511,7 +513,9 @@ auto Skeleton::PrepareStopOffer(std::optional<UnregisterShmObjectTraceCallback>
         // unreachable)
         case ShmRemovalStrategy::kUnknownStrategy:
         default:
-            SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD_MESSAGE(false, "Unknown SHM removal strategy.");
+            // Reachable in principle, but must not be reached in production: A kUnknownStrategy is never returned by
+            // DetermineShmRemovalStrategy in production.
+            SCORE_LANGUAGE_FUTURECPP_UNREACHABLE_MESSAGE("Unknown SHM removal strategy.");
             break;
             // LCOV_EXCL_STOP
     }

score/mw/com/impl/configuration/binding_service_type_deployment_impl.h

@@ -216,7 +216,10 @@ auto GetServiceElementId(
         // (we have a static_assert at the start of this function) so this branch can never be reached.
         else
         {
-            SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(0);
+            // Reachable in principle, but must not be reached in production: The else branch is compiled out for every
+            // valid service_element_type (static_assert at the start of the function). It can only be reached by an
+            // invalid template argument, which must not be used in production.
+            SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
         }
         // LCOV_EXCL_STOP
     }();
@@ -231,7 +234,9 @@ auto GetServiceElementId(
     {
         score::mw::log::LogFatal() << service_element_type << "name \"" << service_element_name
                                    << "\" does not exist in BindingServiceTypeDeployment. Terminating.";
-        SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(false);
+        // Reachable in principle, but must not be reached in production: A service element name can be requested that
+        // is not part of the deployment. In production, callers only request elements taken from the deployment.
+        SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
     }
     return service_element_id_it->second;
 }

score/mw/com/impl/configuration/configuration_common_resources.h

@@ -55,7 +55,10 @@ auto GetValueFromJson(const score::json::Object& json_object, std::string_view k
     {
         score::mw::log::LogFatal("lola") << "Failed to parse JSON configuration key '" << key
                                          << "'. Configuration parsing failed. Terminating.";
-        SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(false);
+        // Reachable in principle, but must not be reached in production: The JSON value can have a type other than T if
+        // the configuration file is malformed. A configuration that passed the schema validation must not reach this in
+        // production.
+        SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
     }
     return json_result.value();
 }
@@ -71,7 +74,10 @@ auto GetValueFromJson(const score::json::Object& json_object, std::string_view k
     {
         score::mw::log::LogFatal("lola") << "Failed to parse JSON configuration key '" << key
                                          << "'. Configuration parsing failed. Terminating.";
-        SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(false);
+        // Reachable in principle, but must not be reached in production: The JSON value can have a type other than T if
+        // the configuration file is malformed. A configuration that passed the schema validation must not reach this in
+        // production.
+        SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
     }
     return json_result.value();
 }
@@ -87,7 +93,10 @@ auto GetValueFromJson(const score::json::Object& json_object, std::string_view k
     {
         score::mw::log::LogFatal("lola") << "Failed to parse JSON configuration key '" << key
                                          << "'. Configuration parsing failed. Terminating.";
-        SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(false);
+        // Reachable in principle, but must not be reached in production: The JSON value can have a type other than
+        // std::string_view if the configuration file is malformed. A configuration that passed the schema validation
+        // must not reach this in production.
+        SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
     }
     return json_result.value();
 }
@@ -107,7 +116,10 @@ auto GetOptionalValueFromJson(const score::json::Object& json_object, std::strin
     return ResultToOptionalOrElse(val_candidate->second.As<element_type>(), [key](auto) {
         score::mw::log::LogFatal("lola") << "provided key" << key
                                          << "contains a value that can not be parsed. Terminating.\n";
-        SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(false);
+        // Reachable in principle, but must not be reached in production: The JSON value can have a type other than the
+        // requested one if the configuration file is malformed. A configuration that passed the schema validation must
+        // not reach this in production.
+        SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
     });
 }
 
@@ -155,7 +167,10 @@ auto DeserializeVariant(const score::json::Object& /* json_object */,
                         std::ptrdiff_t /* variant_index */,
                         std::string_view /* json_variant_key */) -> VariantType
 {
-    SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(false);
+    // Reachable in principle, but must not be reached in production: VariantIndex can reach the number of alternatives
+    // if the deserialized variant index is out of range. A configuration that passed the schema validation must not
+    // reach this in production.
+    SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
 }
 
 template <std::size_t VariantIndex,

score/mw/com/impl/configuration/lola_event_instance_deployment.cpp

@@ -127,7 +127,10 @@ auto LolaEventInstanceDeployment::GetNumberOfSampleSlots() const -> std::optiona
     {
         ::score::mw::log::LogFatal("lola")
             << "Number of sample slots + number of tracing slots exceeds sample slot limit. Terminating.";
-        SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(false);
+        // Reachable in principle, but must not be reached in production: The sum of sample slots and tracing slots can
+        // exceed the 16 bit limit for a misconfigured deployment. A configuration validated for production must not
+        // exceed it.
+        SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
     }
     return static_cast<std::uint16_t>(intermediate);
 }

score/mw/com/impl/configuration/lola_service_instance_deployment.h

@@ -118,7 +118,10 @@ const auto& GetServiceElementInstanceDeployment(const LolaServiceInstanceDeploym
         // EVENT, FIELD, or METHOD (we have a static_assert at the start of this function).
         else
         {
-            SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(0);
+            // Reachable in principle, but must not be reached in production: The else branch is compiled out for every
+            // valid service_element_type (static_assert at the start of the function). It can only be reached by an
+            // invalid template argument, which must not be used in production.
+            SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
         }
         // LCOV_EXCL_STOP
     }();

score/mw/com/impl/configuration/service_instance_deployment.cpp

@@ -49,7 +49,10 @@ QualityType GetQualityTypeFromJson(const score::json::Object& json_object, std::
     {
         score::mw::log::LogFatal("lola") << "Failed to parse JSON configuration key '" << key
                                          << "' to string type. Configuration parsing failed. Terminating.";
-        SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(false);
+        // Reachable in principle, but must not be reached in production: The JSON value can be no string if the
+        // configuration file is malformed. A configuration that passed the schema validation must not reach this in
+        // production.
+        SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
     }
     return FromString(json_result.value());
 }

score/mw/com/impl/plumbing/proxy_method_binding_factory_impl.cpp

@@ -55,8 +55,10 @@ LolaMethodInstanceDeployment::QueueSize GetQueueSize(const HandleType& parent_ha
     if (!contains_method)
     {
         mw::log::LogFatal("lola") << "Provided a method name which can not be found in LolaServiceInstanceDeployment";
-        SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD_MESSAGE(
-            false, "Provided a method name which can not be found in LolaServiceInstanceDeployment");
+        // Reachable in principle, but must not be reached in production: A method name can be passed that is not part
+        // of the deployment. In production, method names come from the generated proxy and are part of the deployment.
+        SCORE_LANGUAGE_FUTURECPP_UNREACHABLE_MESSAGE(
+            "Provided a method name which can not be found in LolaServiceInstanceDeployment");
     }
     const auto& lola_method_instance_deployment = method_it->second;
 
@@ -65,8 +67,10 @@ LolaMethodInstanceDeployment::QueueSize GetQueueSize(const HandleType& parent_ha
     {
         mw::log::LogFatal("lola")
             << "ProxyMethod can not be created if queue_size is not configured on the proxy side.";
-        SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD_MESSAGE(
-            false, "ProxyMethod can not be created if queue_size is not configured on the proxy side.");
+        // Reachable in principle, but must not be reached in production: A deployment without queue_size for a proxy
+        // method is possible in principle. A deployment validated for production always configures it.
+        SCORE_LANGUAGE_FUTURECPP_UNREACHABLE_MESSAGE(
+            "ProxyMethod can not be created if queue_size is not configured on the proxy side.");
     }
     return lola_method_instance_deployment.queue_size_.value();
 }

score/mw/com/impl/runtime.cpp

@@ -128,7 +128,9 @@ void Runtime::Initialize(const runtime::RuntimeConfiguration& runtime_configurat
     if (!validation_result.has_value())
     {
         ::score::mw::log::LogFatal("lola") << validation_result.error().UserMessage();
-        SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(false);
+        // Reachable in principle, but must not be reached in production: The configuration can fail validation. A
+        // configuration deployed to production must pass the validation.
+        SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
     }
     score::cpp::ignore = initialization_config_.emplace(std::move(config));
 }
@@ -297,7 +299,9 @@ Result<void> Runtime::MergeAdditionalConfiguration(const Configuration& addition
     if (!validation_result.has_value())
     {
         ::score::mw::log::LogFatal("lola") << validation_result.error().UserMessage();
-        SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(false);
+        // Reachable in principle, but must not be reached in production: The merged configuration can fail validation.
+        // A configuration deployed to production must pass the validation.
+        SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
     }
 
     return {};

score/mw/com/impl/sample_allocatee_tracker.cpp

@@ -28,7 +28,9 @@ SampleAllocateeTracker::~SampleAllocateeTracker() noexcept
     {
         score::mw::log::LogFatal("lola") << "SampleAllocateeTracker destroyed while still holding" << num_allocated
                                          << "outstanding SampleAllocateePtr instance(s), terminating.";
-        SCORE_LANGUAGE_FUTURECPP_ASSERT_PRD(false);
+        // Reachable in principle, but must not be reached in production: A SampleAllocateePtr can outlive its owner. In
+        // production all SampleAllocateePtr instances must be released before the tracker is destroyed.
+        SCORE_LANGUAGE_FUTURECPP_UNREACHABLE();
     }
 }