1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
class C {
var n: set<Node>;
method M(v: Stack)
requires v != null;
{
var o: object := v;
assert o !in n; // should be known from the types involved
}
method N(v: Stack)
/* this time without the precondition */
{
var o: object := v;
assert o !in n; // error: v may be null
}
method A0(a: CP<int,C>, b: CP<int,object>)
{
var x: object := a;
var y: object := b;
assert x == y ==> x == null;
}
method A1(a: CP<int,C>)
{
var x: object := a;
assert (forall b: CP<int,Stack> :: x == b ==> b == null); // error (we don't add a type antecedent to
// quantifiers; is that what we want?)
}
var a2x: set<CP<C,Node>>;
method A2(b: set<CP<Node,C>>)
requires null !in b;
{
var x: set<object> := a2x;
var y: set<object> := b;
assert x * y == {};
}
method A3(b: set<CP<Node,C>>)
/* this time without the precondition */
{
var x: set<object> := a2x;
var y: set<object> := b;
assert x * y <= {null};
}
method A4(b: set<CP<Node,C>>)
/* again, without the precondition */
{
var x: set<object> := a2x;
var y: set<object> := b;
assert x * y == {}; // error
}
method A5()
{
var a := new CP<int,C>;
var b := new CP<int,object>;
while (a != null)
decreases *; // omit loop termination check (in fact, the loop does not terminate)
{
var x: object := a;
var y: object := b;
assert x == y ==> x == null;
a := a; // make 'a' a loop target
}
}
}
class Stack { }
class Node { }
class CP<T,U> {
}
datatype Data {
Lemon;
Kiwi(int);
}
function G(d: Data): int
requires d != #Data.Lemon;
{
match d
case Lemon => G(d)
case Kiwi(x) => 7
}
|
