Quantcast
Channel: Dafny: An Automatic Program Verifier for Functional Correctness
Viewing all articles
Browse latest Browse all 1106

Edited Issue: LitInt appears in triggers, causes verification failures [76]

$
0
0
LitInt sometimes interferes with natural uses of forall, such as "forall i :: P(i, 3)", making programs harder to verify.

```
predicate P(x:int, y:int)

lemma L1(x:int, y:int)
requires y == 2;
requires forall i :: P(i, 3); // triggers on P(i, LitInt(3)), not P(i, 3)
{
assert P(x, y + 1); // FAILS
}

lemma L2(x:int, y:int)
requires y == 2;
requires forall i {:trigger P(i, 3)} :: P(i, 3); // triggers on P(i, LitInt(3)), not P(i, 3)
{
assert P(x, y + 1); // FAILS
}

lemma L3(x:int, y:int)
requires y == 2;
requires forall i :: P(i, 3); // triggers on P(i, LitInt(3)), not P(i, 3)
{
var dummy := 3;
assert P(x, y + 1); // SUCCEEDS
}

lemma L4(x:int, y:int)
requires y == 2;
requires forall i, j :: j == 3 ==> P(i, j); // triggers on P(i, j), no LitInt in trigger
{
assert P(x, y + 1); // SUCCEEDS
}
```


Viewing all articles
Browse latest Browse all 1106

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>