我应该在私有/内部方法中抛出null参数吗？

Question

I'm writing a library that has several public classes and methods, as well as several private or internal classes and methods that the library itself uses.

In the public methods I have a null check and a throw like this:

public int DoSomething(int number)
{
    if (number == null)
    {
        throw new ArgumentNullException(nameof(number));
    }
}

But then this got me thinking, to what level should I be adding parameter null checks to methods? Do I also start adding them to private methods? Should I only do it for public methods?

Answer 1

Ultimately, there isn't a uniform consensus on this. So instead of giving a yes or no answer, I'll try to list the considerations for making this decision:

• Null checks bloat your code. If your procedures are concise, the null guards at the beginning of them may form a significant part of the overall size of the procedure, without expressing the purpose or behaviour of that procedure.

• Null checks expressively state a precondition. If a method is going to fail when one of the values is null, having a null check at the top is a good way to demonstrate this to a casual reader without them having to hunt for where it's dereferenced. To improve this, people often use helper methods with names like Guard.AgainstNull , instead of having to write the check each time.

• Checks in private methods are untestable. By introducing a branch in your code which you have no way of fully traversing, you make it impossible to fully test that method. This conflicts with the point of view that tests document the behaviour of a class, and that that class's code exists to provide that behaviour.

• The severity of letting a null through depends on the situation. Often, if a null does get into the method, it'll be dereferenced a few lines later and you'll get a NullReferenceException . This really isn't much less clear than throwing an ArgumentNullException . On the other hand, if that reference is passed around quite a bit before being dereferenced, or if throwing an NRE will leave things in a messy state, then throwing early is much more important.

• Some libraries, like .NET's Code Contracts, allow a degree of static analysis, which can add an extra benefit to your checks.

• If you're working on a project with others, there may be existing team or project standards covering this.

Answer 2

If you're not a library developer, don't be defensive in your code

Write unit tests instead

In fact, even if you're developing a library, throwing is most of the time: BAD

1. Testing null on int must never be done in c# :

It raises a warning CS4072 , because it's always false.

2. Throwing an Exception means it's exceptional: abnormal and rare.

It should never raise in production code. Especially because exception stack trace traversal can be a cpu intensive task. And you'll never be sure where the exception will be caught, if it's caught and logged or just simply silently ignored (after killing one of your background thread) because you don't control the user code. There is no "checked exception" in c# (like in java) which means you never know - if it's not well documented - what exceptions a given method could raise. By the way, that kind of documentation must be kept in sync with the code which is not always easy to do (increase maintenance costs).

3. Exceptions increases maintenance costs.

As exceptions are thrown at runtime and under certain conditions, they could be detected really late in the development process. As you may already know, the later an error is detected in the development process, the more expensive the fix will be. I've even seen exception raising code made its way to production code and not raise for a week, only for raising every day hereafter (killing the production. oops!).

4. Throwing on invalid input means you don't control input .

It's the case for public methods of libraries. However if you can check it at compile time with another type (for example a non nullable type like int) then it's the way to go. And of course, as they are public, it's their responsibility to check for input.

Imagine the user who uses what he thinks as valid data and then by a side effect, a method deep in the stack trace trows a ArgumentNullException .

• What will be his reaction?
• How can he cope with that?
• Will it be easy for you to provide an explanation message ?

5. Private and internal methods should never ever throw exceptions related to their input.

You may throw exceptions in your code because an external component (maybe Database, a file or else) is misbehaving and you can't guarantee that your library will continue to run correctly in its current state.

Making a method public doesn't mean that it should (only that it can) be called from outside of your library ( Look at Public versus Published from Martin Fowler ). Use IOC, interfaces, factories and publish only what's needed by the user, while making the whole library classes available for unit testing. (Or you can use the InternalsVisibleTo mechanism).

6. Throwing exceptions without any explanation message is making fun of the user

No need to remind what feelings one can have when a tool is broken, without having any clue on how to fix it. Yes, I know. You comes to SO and ask a question...

7. Invalid input means it breaks your code

If your code can produce a valid output with the value then it's not invalid and your code should manage it. Add a unit test to test this value.

8. Think in user terms:

Do you like when a library you use throws exceptions for smashing your face ? Like: "Hey, it's invalid, you should have known that!"

Even if from your point of view - with your knowledge of the library internals , the input is invalid, how you can explain it to the user ( be kind and polite ):

• Clear documentation (in Xml doc and an architecture summary may help).
• Publish the xml doc with the library.
• Clear error explanation in the exception if any.
• Give the choice :

Look at Dictionary class, what do you prefer? what call do you think is the fastest ? What call can raises exception ?

        Dictionary<string, string> dictionary = new Dictionary<string, string>();
        string res;
        dictionary.TryGetValue("key", out res);

or

        var other = dictionary["key"];

9. Why not using Code Contracts ?

It's an elegant way to avoid the ugly if then throw and isolate the contract from the implementation, permitting to reuse the contract for different implementations at the same time. You can even publish the contract to your library user to further explain him how to use the library.

As a conclusion, even if you can easily use throw , even if you can experience exceptions raising when you use .Net Framework, that doesn't mean it could be used without caution.

Answer 3

Here are my opinions:

---

General Cases

Generally speaking, it is better to check for any invalid inputs before you process them in a method for robustness reason - be it private, protected, internal, protected internal, or public methods. Although there are some performance costs paid for this approach, in most cases, this is worth doing rather than paying more time to debug and to patch the codes later.

---

Strictly Speaking, however...

Strictly speaking, however, it is not always needed to do so . Some methods, usually private ones, can be left without any input checking provided that you have full guarantee that there isn't single call for the method with invalid inputs . This may give you some performance benefit , especially if the method is called frequently to do some basic computation/action . For such cases, doing checking for input validity may impair the performance significantly.

---

Public Methods

Now the public method is trickier. This is because, more strictly speaking, although the access modifier alone can tell who can use the methods, it cannot tell who will use the methods. More over, it also cannot tell how the methods are going to be used (that is, whether the methods are going to be called with invalid inputs in the given scopes or not).

---

The Ultimate Determining Factor

Although access modifiers for methods in the code can hint on how to use the methods, ultimately, it is humans who will use the methods, and it is up to the humans how they are going to use them and with what inputs. Thus, in some rare cases, it is possible to have a public method which is only called in some private scope and in that private scope, the inputs for the public methods are guaranteed to be valid before the public method is called.

In such cases then, even the access modifier is public , there isn't any real need to check for invalid inputs, except for robust design reason. And why is this so? Because there are humans who know completely when and how the methods shall be called!

Here we can see, there is no guarantee either that public method always require checking for invalid inputs. And if this is true for public methods, it must also be true for protected, internal, protected internal, and private methods as well.

---

Conclusions

So, in conclusion, we can say a couple of things to help us making decisions:

• Generally , it is better to have checks for any invalid inputs for robust design reason, provided that performance is not at stake. This is true for any type of access modifiers.
• The invalid inputs check could be skipped if performance gain could be significantly improved by doing so , provided that it can also be guaranteed that the scope where the methods are called are always giving the methods valid inputs.
• private method is usually where we skip such checking, but there is no guarantee that we cannot do that for public method as well
• Humans are the ones who ultimately use the methods. Regardless of how the access modifiers can hint the use of the methods, how the methods are actually used and called depend on the coders. Thus, we can only say about general/good practice, without restricting it to be the only way of doing it.

Answer 4

1. The public interface of your library deserves tight checking of preconditions, because you should expect the users of your library to make mistakes and violate the preconditions by accident. Help them understand what is going on in your library.

2. The private methods in your library do not require such runtime checking because you call them yourself. You are in full control of what you are passing. If you want to add checks because you are afraid to mess up, then use asserts. They will catch your own mistakes, but do not impede performance during runtime.

Answer 5

Though you tagged language-agnostic , it seems to me that it probably doesn't exist a general response.

Notably, in your example you hinted the argument: so with a language accepting hinting it'll fire an error as soon as entering the function, before you can take any action.
In such a case, the only solution is to have checked the argument before calling your function ... but since you're writing a library, that cannot have sense!

In the other hand, with no hinting, it remains realistic to check inside the function.
So at this step of the reflexion, I'd already suggest to give up hinting.

Now let's go back to your precise question: to what level should it be checked? For a given data piece it'd happen only at the highest level where it can "enter" (may be several occurrences for the same data), so logically it'd concern only public methods.

That's for the theory. But maybe you plan a huge, complex, library so it might be not easy to ensure having certainty about registering all "entry points".
In this case, I'd suggest the opposite: consider to merely apply your controls everywhere, then only omit it where you clearly see it's duplicate.

Hope this helps.

Answer 6

In my opinion you should ALWAYS check for "invalid" data - independent whether it is a private or public method.

Looked from the other way... why should you be able to work with something invalid just because the method is private? Doesn't make sense, right? Always try to use defensive programming and you will be happier in life ;-)

Answer 7

This is a question of preference. But consider instead why are you checking for null or rather checking for valid input. It's probably because you want to let the consumer of your library to know when he/she is using it incorrectly.

Let's imagine that we have implemented a class PersonList in a library. This list can only contain objects of the type Person . We have also on our PersonList implemented some operations and therefore we do not want it to contain any null values.

Consider the two following implementations of the Add method for this list:

Implementation 1

public void Add(Person item)
{
    if(_size == _items.Length)
    {
        EnsureCapacity(_size + 1);
    }

    _items[_size++] = item;
}

Implementation 2

public void Add(Person item)
{
    if(item == null)
    {
        throw new ArgumentNullException("Cannot add null to PersonList");
    }

    if(_size == _items.Length)
    {
        EnsureCapacity(_size + 1);
    }

    _items[_size++] = item;
}

Let's say we go with implementation 1

• Null values can now be added in the list
• All opoerations implemented on the list will have to handle theese null values
• If we should check for and throw a exception in our operation, consumer will be notified about the exception when he/she is calling one of the operations and it will at this state be very unclear what he/she has done wrong (it just wouldn't make any sense to go for this approach).

If we instead choose to go with implementation 2, we make sure input to our library has the quality that we require for our class to operate on it. This means we only need to handle this here and then we can forget about it while we are implementing our other operations.

It will also become more clear for the consumer that he/she is using the library in the wrong way when he/she gets a ArgumentNullException on .Add instead of in .Sort or similair.

To sum it up my preference is to check for valid argument when it is being supplied by the consumer and it's not being handled by the private/internal methods of the library. This basically means we have to check arguments in constructors/methods that are public and takes parameters. Our private / internal methods can only be called from our public ones and they have allready checked the input which means we are good to go!

Using Code Contracts should also be considered when verifying input.