* Added decreases clauses to functions

* If no decreases clause is given, the decreases clause defaults to the set of objects denoted by the reads clause, which was the previous Dafny behavior

* Made Dafny check loops for termination by default.  Previously, this was done only if the loop had a decreases clause.  To indicate that a loop is to be checked only for partial correctness, Dafny now allows "decreases *".

* Allow "reads *" to say that the function may read anything at all (sound, but not very useful)

* Adjusted frame axioms of functions to speak of allocated objects more liberally; and also added antecedents about the heaps being well-formed and the parameters being allocated

* Added some previously omitted well-definedness checks.

* Fixed some bugs in the resolver that caused some type errors not to be reported

* Added some messages to go with some (previously rather opaquely reported) errors

* Fixed some test cases that previously had ordered conjuncts incorrectly to prove termination and reads checks (such checks were previously omitted)

* Beefed up Test/dafny0/SchorrWaite.dfy to use datatypes to specify that no garbage gets marked.  The full-functional total-correctness verification of this Schorr-Waite method now takes about 3.2 seconds.

1 files changed, 3 insertions, 1 deletions

diff --git a/Test/dafny0/DTypes.dfy b/Test/dafny0/DTypes.dfy
index c468cff4..c6f0737c 100644
--- a/Test/dafny0/DTypes.dfy
+++ b/Test/dafny0/DTypes.dfy
@@ -58,7 +58,9 @@ class C {
   {

     var a := new CP<int,C>;

     var b := new CP<int,object>;

-    while (a != null) {

+    while (a != null)

+      decreases *;  // omit loop termination check (in fact, the loop does not terminate)

+    {

       var x: object := a;

       var y: object := b;

       assert x == y ==> x == null;