Potential Errors

Addresses: ISO 26262-8 11.4.4.2 f

Each potential error is a way one of the analyzed nodes can deviate from what it should do. They come from applying the guide words to the nodes, so the list is meant to be systematic rather than a collection of things we happened to think of.

Every error ends up in one of two places. If we can detect it, a detection measure covers it and a test proves the detection works. If we can’t, it becomes a constraint on the integrator, because only they can rule it out.

This chapter covers the tools. The errors of the runtime are in its Safety Analysis.

Slint Compiler

Identifier	Description	Risk	Mitigation	Detectable
`slint.compiler.err.subset-not-enforced`	A construct outside the qualified subset compiles without a diagnostic.	The integrator ships code that no qualification covers, believing it’s covered.	`slint.compiler.avd.subset-check`	Yes
`slint.compiler.err.codegen-wrong`	The generated Rust doesn’t implement what the `.slint` source means.	Any display error, with no indication that anything is wrong.	`slint.compiler.avd.spec-tests`	Yes
`slint.compiler.err.binding-dropped`	A lowering pass drops or reorders a property binding.	A value stops updating, so the display shows a stale reading that looks plausible.	`slint.compiler.avd.spec-tests`	Yes
`slint.compiler.err.missing-resource`	A missing or undecodable asset isn’t reported at compile time.	The element is absent at runtime, so a warning icon may simply not appear.	`slint.compiler.avd.resource-check`	Yes

slint-sc-coverage

Identifier	Description	Risk	Mitigation	Detectable
`slint.coverage.err.false-reached`	A coverage point is reported as reached when the tests never reached it.	Untested `.slint` code passes as tested.	`slint.coverage.avd.stated-coverage`	Yes
`slint.coverage.err.point-missing`	A coverage point is left out of the report.	Untested `.slint` code doesn’t show up as a gap.	`slint.coverage.avd.stated-coverage`	Yes

Detection Measures and Usage Restrictions

A detection measure is something we do. A constraint is something we ask the integrator to do, and it exists only because no detection measure covers the error.

Identifier	Measure
`slint.compiler.avd.subset-check`	The compiler rejects any construct outside the qualified subset and reports an error naming it.
`slint.compiler.avd.opaque-window`	The compiler rejects a window whose background it can’t prove is opaque, so a frame can’t depend on what the buffer held beforehand.
`slint.compiler.avd.resource-check`	The compiler resolves every referenced asset at compile time and fails if one is missing or doesn’t decode.
`slint.compiler.avd.spec-tests`	Every paragraph of the language specification is traced to at least one test. See the Traceability Matrix.
`slint.coverage.avd.stated-coverage`	Runtime test cases state their expected coverage in the source, and fail on any difference from the measurement. The cases under `coverage/` must state it. See Coverage Tool Verification.

The errors no measure covers become compiler constraints.