Quantcast
Channel: Dafny: An Automatic Program Verifier for Functional Correctness
Viewing all articles
Browse latest Browse all 1106

Created Unassigned: Matrix initialization with forall statement fails [159]

$
0
0
One primary use of the `forall` statement is to initialize arrays. This works for single-dimensional arrays, but no longer works for multi-dimensional arrays. There must have been some recent change that caused this regression (and, unfortunately, the test suite apparently didn't contain a suitable test case), because I have confirmed that this worked with the released version 1.9.6.21012. It does not work with 1.9.7.

I provide an example repro below. The correct behavior should be that everything in the program verifies. (I have tried with both `/autoTriggers:0` and `/autoTriggers:1`, but that makes no difference.)

Rustan

```
method ArrayInit(n: nat) returns (a: array<int>)
ensures a != null && a.Length == n
ensures forall i :: 0 <= i < n ==> a[i] == i
{
a := new int[n];
forall i | 0 <= i < n {
a[i] := i;
}
}

method Init(m: array2<int>)
requires m != null
modifies m
ensures forall i,j :: 0 <= i < m.Length0 && 0 <= j < m.Length1 ==> m[i,j] == 0
{
forall i,j | 0 <= i < m.Length0 && 0 <= j < m.Length1 {
m[i,j] := 0;
}
}

method Gradient(n: nat) returns (m: array2<int>)
ensures m != null && m.Length0 == m.Length1 == n
ensures forall i,j :: 0 <= i < n && 0 <= j < n ==> m[i,j] == j+i
{
m := new int[n,n];
forall i,j | 0 <= i < n && 0 <= j < n {
m[i,j] := i+j;
}
}

method M3(C: array3<real>)
requires C != null
modifies C
ensures forall i,j,k ::
0 <= i < C.Length0 && 0 <= j < C.Length1 && 0 <= k < C.Length2
==> C[i,j,k] == 0.0
{
forall i,j,k | 0 <= i < C.Length0 && 0 <= j < C.Length1 && 0 <= k < C.Length2
{
C[i,j,k] := 0.0;
}
}
```


Viewing all articles
Browse latest Browse all 1106

Trending Articles