From c13c4f3fbeae61ff152eaeeb4ae8bde9d01206be Mon Sep 17 00:00:00 2001
From: Bryan Parno <parno@microsoft.com>
Date: Wed, 13 May 2015 17:56:15 -0700
Subject: Update the configuration manager so the Debug build actually builds
 the Debug version of the projects (rather than Checked). The Checked build
 still builds the Checked version of the projects.

---
 Source/Dafny.sln | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny.sln b/Source/Dafny.sln
index 40e71952..e7ba8026 100644
--- a/Source/Dafny.sln
+++ b/Source/Dafny.sln
@@ -28,8 +28,8 @@ Global
 		{63400D1F-05B2-453E-9592-1EAB74B2C9CC}.Debug|.NET.Build.0 = Debug|Any CPU
 		{63400D1F-05B2-453E-9592-1EAB74B2C9CC}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{63400D1F-05B2-453E-9592-1EAB74B2C9CC}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{63400D1F-05B2-453E-9592-1EAB74B2C9CC}.Debug|Mixed Platforms.ActiveCfg = Checked|Any CPU
-		{63400D1F-05B2-453E-9592-1EAB74B2C9CC}.Debug|Mixed Platforms.Build.0 = Checked|Any CPU
+		{63400D1F-05B2-453E-9592-1EAB74B2C9CC}.Debug|Mixed Platforms.ActiveCfg = Debug|Any CPU
+		{63400D1F-05B2-453E-9592-1EAB74B2C9CC}.Debug|Mixed Platforms.Build.0 = Debug|Any CPU
 		{63400D1F-05B2-453E-9592-1EAB74B2C9CC}.Release|.NET.ActiveCfg = Release|Any CPU
 		{63400D1F-05B2-453E-9592-1EAB74B2C9CC}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{63400D1F-05B2-453E-9592-1EAB74B2C9CC}.Release|Any CPU.Build.0 = Release|Any CPU
@@ -45,8 +45,8 @@ Global
 		{FE44674A-1633-4917-99F4-57635E6FA740}.Debug|.NET.Build.0 = Debug|Any CPU
 		{FE44674A-1633-4917-99F4-57635E6FA740}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{FE44674A-1633-4917-99F4-57635E6FA740}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{FE44674A-1633-4917-99F4-57635E6FA740}.Debug|Mixed Platforms.ActiveCfg = Checked|Any CPU
-		{FE44674A-1633-4917-99F4-57635E6FA740}.Debug|Mixed Platforms.Build.0 = Checked|Any CPU
+		{FE44674A-1633-4917-99F4-57635E6FA740}.Debug|Mixed Platforms.ActiveCfg = Debug|Any CPU
+		{FE44674A-1633-4917-99F4-57635E6FA740}.Debug|Mixed Platforms.Build.0 = Debug|Any CPU
 		{FE44674A-1633-4917-99F4-57635E6FA740}.Release|.NET.ActiveCfg = Release|Any CPU
 		{FE44674A-1633-4917-99F4-57635E6FA740}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{FE44674A-1633-4917-99F4-57635E6FA740}.Release|Any CPU.Build.0 = Release|Any CPU
-- 
cgit v1.2.3


From 454909184e73582e425cad56a526956d91b88dcc Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Thu, 14 May 2015 15:44:39 -0700
Subject: Allow MatchExpr and MatchStmt to have nested patterns. Such as
 function last<T>(xs: List<T>): T   requires xs != Nil {   match xs   case
 Cons(y, Nil) => y   case Cons(y, Cons(z, zs)) => last(Cons(z, zs)) } And
 function minus(x: Nat, y: Nat): Nat {   match (x, y)   case (Zero, _) => Zero
   case (Suc(_), Zero) => x   case (Suc(a), Suc(b)) => minus(a, b) }

---
 Source/Dafny/Cloner.cs             |  37 +-
 Source/Dafny/Dafny.atg             |  50 ++-
 Source/Dafny/DafnyAst.cs           | 118 ++++-
 Source/Dafny/Parser.cs             | 260 ++++++-----
 Source/Dafny/Printer.cs            |  60 +--
 Source/Dafny/Resolver.cs           | 867 ++++++++++++++++++++++++++++++-------
 Source/Dafny/Rewriter.cs           |  52 +++
 Test/dafny0/NestedMatch.dfy        |  59 +++
 Test/dafny0/NestedMatch.dfy.expect |   2 +
 9 files changed, 1157 insertions(+), 348 deletions(-)
 create mode 100644 Test/dafny0/NestedMatch.dfy
 create mode 100644 Test/dafny0/NestedMatch.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index 9f83bf09..f729d411 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -300,9 +300,8 @@ namespace Microsoft.Dafny
         var e = (ExprDotName)expr;
         return new ExprDotName(Tok(e.tok), CloneExpr(e.Lhs), e.SuffixName, e.OptTypeArguments == null ? null : e.OptTypeArguments.ConvertAll(CloneType));
       } else if (expr is ApplySuffix) {
-        var e = (ApplySuffix)expr;
-        return new ApplySuffix(Tok(e.tok), CloneExpr(e.Lhs), e.Args.ConvertAll(CloneExpr));
-
+        var e = (ApplySuffix) expr;
+        return CloneApplySuffix(e);
       } else if (expr is MemberSelectExpr) {
         var e = (MemberSelectExpr)expr;
         return new MemberSelectExpr(Tok(e.tok), CloneExpr(e.Obj), e.MemberName);
@@ -411,7 +410,7 @@ namespace Microsoft.Dafny
       } else if (expr is MatchExpr) {
         var e = (MatchExpr)expr;
         return new MatchExpr(Tok(e.tok), CloneExpr(e.Source),
-          e.Cases.ConvertAll(c => new MatchCaseExpr(Tok(c.tok), c.Id, c.Arguments.ConvertAll(CloneBoundVar), CloneExpr(c.Body))), e.UsesOptionalBraces);
+          e.Cases.ConvertAll(CloneMatchCaseExpr), e.UsesOptionalBraces);
 
       } else if (expr is NegationExpression) {
         var e = (NegationExpression)expr;
@@ -422,6 +421,22 @@ namespace Microsoft.Dafny
       }
     }
 
+    public MatchCaseExpr CloneMatchCaseExpr(MatchCaseExpr c) {
+      Contract.Requires(c != null);
+      if (c.Arguments != null) {
+        Contract.Assert(c.CasePatterns == null);
+        return new MatchCaseExpr(Tok(c.tok), c.Id, c.Arguments.ConvertAll(CloneBoundVar), CloneExpr(c.Body));
+      } else {
+        Contract.Assert(c.Arguments == null);
+        Contract.Assert(c.CasePatterns != null);
+        return new MatchCaseExpr(Tok(c.tok), c.Id, c.CasePatterns.ConvertAll(CloneCasePattern), CloneExpr(c.Body));
+      }
+    }
+
+    public virtual Expression CloneApplySuffix(ApplySuffix e) {
+        return new ApplySuffix(Tok(e.tok), CloneExpr(e.Lhs), e.Args.ConvertAll(CloneExpr));
+    }
+
     public virtual CasePattern CloneCasePattern(CasePattern pat) {
       Contract.Requires(pat != null);
       if (pat.Var != null) {
@@ -530,7 +545,7 @@ namespace Microsoft.Dafny
       } else if (stmt is MatchStmt) {
         var s = (MatchStmt)stmt;
         r = new MatchStmt(Tok(s.Tok), Tok(s.EndTok), CloneExpr(s.Source),
-          s.Cases.ConvertAll(c => new MatchCaseStmt(Tok(c.tok), c.Id, c.Arguments.ConvertAll(CloneBoundVar), c.Body.ConvertAll(CloneStmt))), s.UsesOptionalBraces);
+          s.Cases.ConvertAll(CloneMatchCaseStmt), s.UsesOptionalBraces);
 
       } else if (stmt is AssignSuchThatStmt) {
         var s = (AssignSuchThatStmt)stmt;
@@ -562,6 +577,18 @@ namespace Microsoft.Dafny
       return r;
     }
 
+    public MatchCaseStmt CloneMatchCaseStmt(MatchCaseStmt c) {
+      Contract.Requires(c != null);
+      if (c.Arguments != null) {
+        Contract.Assert(c.CasePatterns == null);
+        return new MatchCaseStmt(Tok(c.tok), c.Id, c.Arguments.ConvertAll(CloneBoundVar), c.Body.ConvertAll(CloneStmt));
+      } else {
+        Contract.Assert(c.Arguments == null);
+        Contract.Assert(c.CasePatterns != null);
+        return new MatchCaseStmt(Tok(c.tok), c.Id, c.CasePatterns.ConvertAll(CloneCasePattern), c.Body.ConvertAll(CloneStmt));
+      }
+    }
+
     public CalcStmt.CalcOp CloneCalcOp(CalcStmt.CalcOp op) {
       if (op is CalcStmt.BinaryCalcOp) {
         return new CalcStmt.BinaryCalcOp(((CalcStmt.BinaryCalcOp) op).Op);
diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index c03f5ce0..3f684ff6 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -1794,17 +1794,24 @@ MatchStmt<out Statement/*!*/ s>
 CaseStatement<out MatchCaseStmt/*!*/ c>
 = (. Contract.Ensures(Contract.ValueAtReturn(out c) != null);
      IToken/*!*/ x, id;
-     List<BoundVar/*!*/> arguments = new List<BoundVar/*!*/>();
-     BoundVar/*!*/ bv;
+     List<CasePattern/*!*/> arguments = new List<CasePattern/*!*/>();
+     CasePattern/*!*/ pat;
      List<Statement/*!*/> body = new List<Statement/*!*/>();
+     string/*!*/ name = "";
   .)
   "case"                      (. x = t; .)
-  Ident<out id>
-  [ "("
-    IdentTypeOptional<out bv>        (. arguments.Add(bv); .)
-    { "," IdentTypeOptional<out bv>  (. arguments.Add(bv); .)
-    }
-  ")" ]
+  ( Ident<out id>             (. name = id.val; .)
+    [ "("
+      CasePattern<out pat>        (. arguments.Add(pat); .)
+      { "," CasePattern<out pat>  (. arguments.Add(pat); .)
+      }
+    ")" ]
+  | "("
+      CasePattern<out pat>        (. arguments.Add(pat); .)
+      { "," CasePattern<out pat>  (. arguments.Add(pat); .)
+      }
+    ")"
+  )
   "=>"
     SYNC  /* this SYNC and the one inside the loop below are used to avoid problems with the IsNotEndOfCase test. The SYNC will
            * skip until the next symbol that can legally occur here, which is either the beginning of a Stmt or whatever is allowed
@@ -1814,7 +1821,7 @@ CaseStatement<out MatchCaseStmt/*!*/ c>
       Stmt<body>
       SYNC  /* see comment about SYNC above */
     }
-  (. c = new MatchCaseStmt(x, id.val, arguments, body); .)
+  (. c = new MatchCaseStmt(x, name, arguments, body); .)
   .
 /*------------------------------------------------------------------------*/
 AssertStmt<out Statement/*!*/ s>
@@ -2584,19 +2591,26 @@ MatchExpression<out Expression e, bool allowSemi, bool allowLambda>
   .
 CaseExpression<out MatchCaseExpr c, bool allowSemi, bool allowLambda>
 = (. Contract.Ensures(Contract.ValueAtReturn(out c) != null); IToken/*!*/ x, id;
-     List<BoundVar/*!*/> arguments = new List<BoundVar/*!*/>();
-     BoundVar/*!*/ bv;
+     List<CasePattern/*!*/> arguments = new List<CasePattern/*!*/>();
+     CasePattern/*!*/ pat;
      Expression/*!*/ body;
+     string/*!*/ name = "";
   .)
   "case"                      (. x = t; .)
-  Ident<out id>
-  [ "("
-    IdentTypeOptional<out bv>        (. arguments.Add(bv); .)
-    { "," IdentTypeOptional<out bv>  (. arguments.Add(bv); .)
-    }
-  ")" ]
+  ( Ident<out id>             (. name = id.val; .)
+    [ "("
+      CasePattern<out pat>        (. arguments.Add(pat); .)
+      { "," CasePattern<out pat>  (. arguments.Add(pat); .)
+      }
+    ")" ]
+  | "("
+      CasePattern<out pat>        (. arguments.Add(pat); .)
+      { "," CasePattern<out pat>  (. arguments.Add(pat); .)
+      }
+    ")"
+  )
   "=>"
-  Expression<out body, allowSemi, allowLambda>    (. c = new MatchCaseExpr(x, id.val, arguments, body); .)
+  Expression<out body, allowSemi, allowLambda>    (. c = new MatchCaseExpr(x, name, arguments, body); .)
   .
 CasePattern<out CasePattern pat>
 = (. IToken id;  List<CasePattern> arguments;
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 99dfecd6..a94b9a1b 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -4710,8 +4710,8 @@ namespace Microsoft.Dafny {
       Contract.Invariant(cce.NonNullElements(MissingCases));
     }
 
-    public readonly Expression Source;
-    public readonly List<MatchCaseStmt> Cases;
+    private Expression source;
+    private List<MatchCaseStmt> cases;
     public readonly List<DatatypeCtor> MissingCases = new List<DatatypeCtor>();  // filled in during resolution
     public readonly bool UsesOptionalBraces;
 
@@ -4721,14 +4721,31 @@ namespace Microsoft.Dafny {
       Contract.Requires(endTok != null);
       Contract.Requires(source != null);
       Contract.Requires(cce.NonNullElements(cases));
-      this.Source = source;
-      this.Cases = cases;
+      this.source = source;
+      this.cases = cases;
       this.UsesOptionalBraces = usesOptionalBraces;
     }
 
+    public Expression Source {
+      get { return source; }
+    }
+
+    public List<MatchCaseStmt> Cases {
+      get { return cases; }
+    }
+
+    // should only be used in desugar in resolve to change the cases of the matchexpr
+    public void UpdateSource(Expression source) {
+      this.source = source;
+    }
+
+    public void UpdateCases(List<MatchCaseStmt> cases) {
+      this.cases = cases;
+    }
+
     public override IEnumerable<Statement> SubStatements {
       get {
-        foreach (var kase in Cases) {
+        foreach (var kase in cases) {
           foreach (var s in kase.Body) {
             yield return s;
           }
@@ -4745,7 +4762,7 @@ namespace Microsoft.Dafny {
 
   public class MatchCaseStmt : MatchCase
   {
-    public readonly List<Statement> Body;
+    private List<Statement> body;
 
     [ContractInvariantMethod]
     void ObjectInvariant() {
@@ -4759,7 +4776,25 @@ namespace Microsoft.Dafny {
       Contract.Requires(id != null);
       Contract.Requires(cce.NonNullElements(arguments));
       Contract.Requires(cce.NonNullElements(body));
-      this.Body = body;
+      this.body = body;
+    }
+
+    public MatchCaseStmt(IToken tok, string id, [Captured] List<CasePattern> cps, [Captured] List<Statement> body)
+      : base(tok, id, cps) {
+      Contract.Requires(tok != null);
+      Contract.Requires(id != null);
+      Contract.Requires(cce.NonNullElements(cps));
+      Contract.Requires(cce.NonNullElements(body));
+      this.body = body;
+    }
+
+    public List<Statement> Body {
+      get { return body; }
+    }
+
+    // should only be called by resolve to reset the body of the MatchCaseExpr
+    public void UpdateBody(List<Statement> body) {
+      this.body = body;
     }
   }
 
@@ -6806,8 +6841,8 @@ namespace Microsoft.Dafny {
   }
 
   public class MatchExpr : Expression {  // a MatchExpr is an "extended expression" and is only allowed in certain places
-    public readonly Expression Source;
-    public readonly List<MatchCaseExpr> Cases;
+    private Expression source;
+    private List<MatchCaseExpr> cases;
     public readonly List<DatatypeCtor> MissingCases = new List<DatatypeCtor>();  // filled in during resolution
     public readonly bool UsesOptionalBraces;
 
@@ -6823,15 +6858,32 @@ namespace Microsoft.Dafny {
       Contract.Requires(tok != null);
       Contract.Requires(source != null);
       Contract.Requires(cce.NonNullElements(cases));
-      this.Source = source;
-      this.Cases = cases;
+      this.source = source;
+      this.cases = cases;
       this.UsesOptionalBraces = usesOptionalBraces;
     }
 
+    public Expression Source {
+      get { return source; }
+    }
+
+    public List<MatchCaseExpr> Cases {
+      get { return cases; }
+    }
+
+    // should only be used in desugar in resolve to change the source and cases of the matchexpr
+    public void UpdateSource(Expression source) {
+      this.source = source;
+    }
+
+    public void UpdateCases(List<MatchCaseExpr> cases) {
+      this.cases = cases;
+    }
+
     public override IEnumerable<Expression> SubExpressions {
       get {
         yield return Source;
-        foreach (var mc in Cases) {
+        foreach (var mc in cases) {
           yield return mc.Body;
         }
       }
@@ -6913,12 +6965,13 @@ namespace Microsoft.Dafny {
     public readonly IToken tok;
     public readonly string Id;
     public DatatypeCtor Ctor;  // filled in by resolution
-    public readonly List<BoundVar> Arguments;
+    public List<BoundVar> Arguments; // created by the resolver.
+    public List<CasePattern> CasePatterns; // generated from parsers. It should be converted to List<BoundVar> during resolver. Invariant:  CasePatterns != null ==> Arguments == null
     [ContractInvariantMethod]
     void ObjectInvariant() {
       Contract.Invariant(tok != null);
       Contract.Invariant(Id != null);
-      Contract.Invariant(cce.NonNullElements(Arguments));
+      Contract.Invariant(cce.NonNullElements(Arguments) || cce.NonNullElements(CasePatterns));
     }
 
     public MatchCase(IToken tok, string id, [Captured] List<BoundVar> arguments) {
@@ -6929,24 +6982,51 @@ namespace Microsoft.Dafny {
       this.Id = id;
       this.Arguments = arguments;
     }
+
+    public MatchCase(IToken tok, string id, [Captured] List<CasePattern> cps) {
+      Contract.Requires(tok != null);
+      Contract.Requires(id != null);
+      Contract.Requires(cce.NonNullElements(cps));
+      this.tok = tok;
+      this.Id = id;
+      this.CasePatterns = cps;
+    }
   }
 
   public class MatchCaseExpr : MatchCase
   {
-    public readonly Expression Body;
+    private Expression body;
     [ContractInvariantMethod]
     void ObjectInvariant() {
-      Contract.Invariant(Body != null);
+      Contract.Invariant(body != null);
     }
 
     public MatchCaseExpr(IToken tok, string id, [Captured] List<BoundVar> arguments, Expression body)
-      : base(tok, id, arguments)
-    {
+      : base(tok, id, arguments) {
       Contract.Requires(tok != null);
       Contract.Requires(id != null);
       Contract.Requires(cce.NonNullElements(arguments));
       Contract.Requires(body != null);
-      this.Body = body;
+      this.body = body;
+    }
+
+    public MatchCaseExpr(IToken tok, string id, [Captured] List<CasePattern> cps, Expression body)
+      : base(tok, id, cps)
+    {
+      Contract.Requires(tok != null);
+      Contract.Requires(id != null);
+      Contract.Requires(cce.NonNullElements(cps));
+      Contract.Requires(body != null);
+      this.body = body;
+    }
+
+    public Expression Body {
+      get { return body; }
+    }
+
+    // should only be called by resolve to reset the body of the MatchCaseExpr
+    public void UpdateBody(Expression body) {
+      this.body = body;
     }
   }
 
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index 9e283ef5..d0924169 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -2884,31 +2884,76 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 	void CaseStatement(out MatchCaseStmt/*!*/ c) {
 		Contract.Ensures(Contract.ValueAtReturn(out c) != null);
 		IToken/*!*/ x, id;
-		List<BoundVar/*!*/> arguments = new List<BoundVar/*!*/>();
-		BoundVar/*!*/ bv;
+		List<CasePattern/*!*/> arguments = new List<CasePattern/*!*/>();
+		CasePattern/*!*/ pat;
 		List<Statement/*!*/> body = new List<Statement/*!*/>();
+		string/*!*/ name = "";
 		
 		Expect(31);
 		x = t; 
-		Ident(out id);
-		if (la.kind == 48) {
+		if (la.kind == 1) {
+			Ident(out id);
+			name = id.val; 
+			if (la.kind == 48) {
+				Get();
+				CasePattern(out pat);
+				arguments.Add(pat); 
+				while (la.kind == 21) {
+					Get();
+					CasePattern(out pat);
+					arguments.Add(pat); 
+				}
+				Expect(49);
+			}
+		} else if (la.kind == 48) {
 			Get();
-			IdentTypeOptional(out bv);
-			arguments.Add(bv); 
+			CasePattern(out pat);
+			arguments.Add(pat); 
 			while (la.kind == 21) {
 				Get();
-				IdentTypeOptional(out bv);
-				arguments.Add(bv); 
+				CasePattern(out pat);
+				arguments.Add(pat); 
 			}
 			Expect(49);
-		}
+		} else SynErr(202);
 		Expect(27);
-		while (!(StartOf(28))) {SynErr(202); Get();}
+		while (!(StartOf(28))) {SynErr(203); Get();}
 		while (IsNotEndOfCase()) {
 			Stmt(body);
-			while (!(StartOf(28))) {SynErr(203); Get();}
+			while (!(StartOf(28))) {SynErr(204); Get();}
+		}
+		c = new MatchCaseStmt(x, name, arguments, body); 
+	}
+
+	void CasePattern(out CasePattern pat) {
+		IToken id;  List<CasePattern> arguments;
+		BoundVar bv;
+		pat = null;
+		
+		if (IsIdentParen()) {
+			Ident(out id);
+			Expect(48);
+			arguments = new List<CasePattern>(); 
+			if (la.kind == 1) {
+				CasePattern(out pat);
+				arguments.Add(pat); 
+				while (la.kind == 21) {
+					Get();
+					CasePattern(out pat);
+					arguments.Add(pat); 
+				}
+			}
+			Expect(49);
+			pat = new CasePattern(id, id.val, arguments); 
+		} else if (la.kind == 1) {
+			IdentTypeOptional(out bv);
+			pat = new CasePattern(bv.tok, bv);
+			
+		} else SynErr(205);
+		if (pat == null) {
+		 pat = new CasePattern(t, "_ParseError", new List<CasePattern>());
 		}
-		c = new MatchCaseStmt(x, id.val, arguments, body); 
+		
 	}
 
 	void QuantifierDomain(out List<BoundVar> bvars, out Attributes attrs, out Expression range) {
@@ -3005,7 +3050,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  binOp = BinaryExpr.Opcode.Exp; 
 			break;
 		}
-		default: SynErr(204); break;
+		default: SynErr(206); break;
 		}
 		if (k == null) {
 		 op = new Microsoft.Dafny.CalcStmt.BinaryCalcOp(binOp);
@@ -3020,7 +3065,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 110) {
 			Get();
-		} else SynErr(205);
+		} else SynErr(207);
 	}
 
 	void ImpliesOp() {
@@ -3028,7 +3073,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 112) {
 			Get();
-		} else SynErr(206);
+		} else SynErr(208);
 	}
 
 	void ExpliesOp() {
@@ -3036,7 +3081,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 114) {
 			Get();
-		} else SynErr(207);
+		} else SynErr(209);
 	}
 
 	void AndOp() {
@@ -3044,7 +3089,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 116) {
 			Get();
-		} else SynErr(208);
+		} else SynErr(210);
 	}
 
 	void OrOp() {
@@ -3052,7 +3097,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 118) {
 			Get();
-		} else SynErr(209);
+		} else SynErr(211);
 	}
 
 	void NegOp() {
@@ -3060,7 +3105,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 120) {
 			Get();
-		} else SynErr(210);
+		} else SynErr(212);
 	}
 
 	void Forall() {
@@ -3068,7 +3113,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 121) {
 			Get();
-		} else SynErr(211);
+		} else SynErr(213);
 	}
 
 	void Exists() {
@@ -3076,7 +3121,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 123) {
 			Get();
-		} else SynErr(212);
+		} else SynErr(214);
 	}
 
 	void QSep() {
@@ -3084,7 +3129,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 24) {
 			Get();
-		} else SynErr(213);
+		} else SynErr(215);
 	}
 
 	void EquivExpression(out Expression e0, bool allowSemi, bool allowLambda) {
@@ -3118,7 +3163,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					LogicalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e0, e1); 
 				}
-			} else SynErr(214);
+			} else SynErr(216);
 		}
 	}
 
@@ -3148,7 +3193,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					RelationalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Or, e0, e1); 
 				}
-			} else SynErr(215);
+			} else SynErr(217);
 		}
 	}
 
@@ -3366,7 +3411,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  op = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		default: SynErr(216); break;
+		default: SynErr(218); break;
 		}
 	}
 
@@ -3388,7 +3433,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 126) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Sub; 
-		} else SynErr(217);
+		} else SynErr(219);
 	}
 
 	void UnaryExpression(out Expression e, bool allowSemi, bool allowLambda) {
@@ -3441,7 +3486,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (IsSuffix()) {
 				Suffix(ref e);
 			}
-		} else SynErr(218);
+		} else SynErr(220);
 	}
 
 	void MulOp(out IToken x, out BinaryExpr.Opcode op) {
@@ -3455,7 +3500,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 128) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Mod; 
-		} else SynErr(219);
+		} else SynErr(221);
 	}
 
 	void MapDisplayExpr(IToken/*!*/ mapToken, bool finite, out Expression e) {
@@ -3493,7 +3538,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			} else if (la.kind == 104) {
 				HashCall(id, out openParen, out typeArgs, out args);
 			} else if (StartOf(30)) {
-			} else SynErr(220);
+			} else SynErr(222);
 			e = new ExprDotName(id, e, id.val, typeArgs);
 			if (openParen != null) {
 			 e = new ApplySuffix(openParen, e, args);
@@ -3546,7 +3591,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 						multipleIndices.Add(ee);
 						
 					}
-				} else SynErr(221);
+				} else SynErr(223);
 			} else if (la.kind == 135) {
 				Get();
 				anyDots = true; 
@@ -3554,7 +3599,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					Expression(out ee, true, true);
 					e1 = ee; 
 				}
-			} else SynErr(222);
+			} else SynErr(224);
 			if (multipleIndices != null) {
 			 e = new MultiSelectExpr(x, e, multipleIndices);
 			 // make sure an array class with this dimensionality exists
@@ -3598,7 +3643,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			Expect(49);
 			e = new ApplySuffix(openParen, e, args); 
-		} else SynErr(223);
+		} else SynErr(225);
 	}
 
 	void LambdaExpression(out Expression e, bool allowSemi) {
@@ -3627,7 +3672,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				}
 			}
 			Expect(49);
-		} else SynErr(224);
+		} else SynErr(226);
 		while (la.kind == 42 || la.kind == 43) {
 			if (la.kind == 42) {
 				Get();
@@ -3702,7 +3747,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			NamedExpr(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(225); break;
+		default: SynErr(227); break;
 		}
 	}
 
@@ -3717,7 +3762,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 104) {
 			HashCall(id, out openParen, out typeArgs, out args);
 		} else if (StartOf(30)) {
-		} else SynErr(226);
+		} else SynErr(228);
 		e = new NameSegment(id, id.val, typeArgs);
 		if (openParen != null) {
 		 e = new ApplySuffix(openParen, e, args);
@@ -3746,7 +3791,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			e = new SeqDisplayExpr(x, elements); 
 			Expect(47);
-		} else SynErr(227);
+		} else SynErr(229);
 	}
 
 	void MultiSetExpr(out Expression e) {
@@ -3770,7 +3815,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Expression(out e, true, true);
 			e = new MultiSetFormingExpr(x, e); 
 			Expect(49);
-		} else SynErr(228);
+		} else SynErr(230);
 	}
 
 	void ConstAtomExpression(out Expression e, bool allowSemi, bool allowLambda) {
@@ -3866,7 +3911,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			ParensExpression(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(229); break;
+		default: SynErr(231); break;
 		}
 	}
 
@@ -3895,7 +3940,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 n = BigInteger.Zero;
 			}
 			
-		} else SynErr(230);
+		} else SynErr(232);
 	}
 
 	void Dec(out Basetypes.BigDec d) {
@@ -3939,7 +3984,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 28) {
 			Get();
 			oneShot = true; 
-		} else SynErr(231);
+		} else SynErr(233);
 	}
 
 	void MapLiteralExpressions(out List<ExpressionPair> elements) {
@@ -4002,7 +4047,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				CaseExpression(out c, allowSemi, allowLambda);
 				cases.Add(c); 
 			}
-		} else SynErr(232);
+		} else SynErr(234);
 		e = new MatchExpr(x, e, cases, usesOptionalBrace); 
 	}
 
@@ -4020,7 +4065,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 122 || la.kind == 123) {
 			Exists();
 			x = t; 
-		} else SynErr(233);
+		} else SynErr(235);
 		QuantifierDomain(out bvars, out attrs, out range);
 		QSep();
 		Expression(out body, allowSemi, allowLambda);
@@ -4072,7 +4117,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			AssumeStmt(out s);
 		} else if (la.kind == 30) {
 			CalcStmt(out s);
-		} else SynErr(234);
+		} else SynErr(236);
 	}
 
 	void LetExpr(out Expression e, bool allowSemi, bool allowLambda) {
@@ -4116,7 +4161,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 }
 			}
 			
-		} else SynErr(235);
+		} else SynErr(237);
 		Expression(out e, false, true);
 		letRHSs.Add(e); 
 		while (la.kind == 21) {
@@ -4143,16 +4188,20 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = new NamedExpr(x, d.val, expr); 
 	}
 
-	void CasePattern(out CasePattern pat) {
-		IToken id;  List<CasePattern> arguments;
-		BoundVar bv;
-		pat = null;
+	void CaseExpression(out MatchCaseExpr c, bool allowSemi, bool allowLambda) {
+		Contract.Ensures(Contract.ValueAtReturn(out c) != null); IToken/*!*/ x, id;
+		List<CasePattern/*!*/> arguments = new List<CasePattern/*!*/>();
+		CasePattern/*!*/ pat;
+		Expression/*!*/ body;
+		string/*!*/ name = "";
 		
-		if (IsIdentParen()) {
+		Expect(31);
+		x = t; 
+		if (la.kind == 1) {
 			Ident(out id);
-			Expect(48);
-			arguments = new List<CasePattern>(); 
-			if (la.kind == 1) {
+			name = id.val; 
+			if (la.kind == 48) {
+				Get();
 				CasePattern(out pat);
 				arguments.Add(pat); 
 				while (la.kind == 21) {
@@ -4160,43 +4209,22 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					CasePattern(out pat);
 					arguments.Add(pat); 
 				}
+				Expect(49);
 			}
-			Expect(49);
-			pat = new CasePattern(id, id.val, arguments); 
-		} else if (la.kind == 1) {
-			IdentTypeOptional(out bv);
-			pat = new CasePattern(bv.tok, bv);
-			
-		} else SynErr(236);
-		if (pat == null) {
-		 pat = new CasePattern(t, "_ParseError", new List<CasePattern>());
-		}
-		
-	}
-
-	void CaseExpression(out MatchCaseExpr c, bool allowSemi, bool allowLambda) {
-		Contract.Ensures(Contract.ValueAtReturn(out c) != null); IToken/*!*/ x, id;
-		List<BoundVar/*!*/> arguments = new List<BoundVar/*!*/>();
-		BoundVar/*!*/ bv;
-		Expression/*!*/ body;
-		
-		Expect(31);
-		x = t; 
-		Ident(out id);
-		if (la.kind == 48) {
+		} else if (la.kind == 48) {
 			Get();
-			IdentTypeOptional(out bv);
-			arguments.Add(bv); 
+			CasePattern(out pat);
+			arguments.Add(pat); 
 			while (la.kind == 21) {
 				Get();
-				IdentTypeOptional(out bv);
-				arguments.Add(bv); 
+				CasePattern(out pat);
+				arguments.Add(pat); 
 			}
 			Expect(49);
-		}
+		} else SynErr(238);
 		Expect(27);
 		Expression(out body, allowSemi, allowLambda);
-		c = new MatchCaseExpr(x, id.val, arguments, body); 
+		c = new MatchCaseExpr(x, name, arguments, body); 
 	}
 
 	void HashCall(IToken id, out IToken openParen, out List<Type> typeArgs, out List<Expression> args) {
@@ -4258,7 +4286,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 42) {
 			Get();
 			x = t; 
-		} else SynErr(237);
+		} else SynErr(239);
 	}
 
 
@@ -4532,42 +4560,44 @@ public class Errors {
 			case 199: s = "this symbol not expected in LoopSpec"; break;
 			case 200: s = "this symbol not expected in LoopSpec"; break;
 			case 201: s = "invalid LoopSpec"; break;
-			case 202: s = "this symbol not expected in CaseStatement"; break;
+			case 202: s = "invalid CaseStatement"; break;
 			case 203: s = "this symbol not expected in CaseStatement"; break;
-			case 204: s = "invalid CalcOp"; break;
-			case 205: s = "invalid EquivOp"; break;
-			case 206: s = "invalid ImpliesOp"; break;
-			case 207: s = "invalid ExpliesOp"; break;
-			case 208: s = "invalid AndOp"; break;
-			case 209: s = "invalid OrOp"; break;
-			case 210: s = "invalid NegOp"; break;
-			case 211: s = "invalid Forall"; break;
-			case 212: s = "invalid Exists"; break;
-			case 213: s = "invalid QSep"; break;
-			case 214: s = "invalid ImpliesExpliesExpression"; break;
-			case 215: s = "invalid LogicalExpression"; break;
-			case 216: s = "invalid RelOp"; break;
-			case 217: s = "invalid AddOp"; break;
-			case 218: s = "invalid UnaryExpression"; break;
-			case 219: s = "invalid MulOp"; break;
-			case 220: s = "invalid Suffix"; break;
-			case 221: s = "invalid Suffix"; break;
+			case 204: s = "this symbol not expected in CaseStatement"; break;
+			case 205: s = "invalid CasePattern"; break;
+			case 206: s = "invalid CalcOp"; break;
+			case 207: s = "invalid EquivOp"; break;
+			case 208: s = "invalid ImpliesOp"; break;
+			case 209: s = "invalid ExpliesOp"; break;
+			case 210: s = "invalid AndOp"; break;
+			case 211: s = "invalid OrOp"; break;
+			case 212: s = "invalid NegOp"; break;
+			case 213: s = "invalid Forall"; break;
+			case 214: s = "invalid Exists"; break;
+			case 215: s = "invalid QSep"; break;
+			case 216: s = "invalid ImpliesExpliesExpression"; break;
+			case 217: s = "invalid LogicalExpression"; break;
+			case 218: s = "invalid RelOp"; break;
+			case 219: s = "invalid AddOp"; break;
+			case 220: s = "invalid UnaryExpression"; break;
+			case 221: s = "invalid MulOp"; break;
 			case 222: s = "invalid Suffix"; break;
 			case 223: s = "invalid Suffix"; break;
-			case 224: s = "invalid LambdaExpression"; break;
-			case 225: s = "invalid EndlessExpression"; break;
-			case 226: s = "invalid NameSegment"; break;
-			case 227: s = "invalid DisplayExpr"; break;
-			case 228: s = "invalid MultiSetExpr"; break;
-			case 229: s = "invalid ConstAtomExpression"; break;
-			case 230: s = "invalid Nat"; break;
-			case 231: s = "invalid LambdaArrow"; break;
-			case 232: s = "invalid MatchExpression"; break;
-			case 233: s = "invalid QuantifierGuts"; break;
-			case 234: s = "invalid StmtInExpr"; break;
-			case 235: s = "invalid LetExpr"; break;
-			case 236: s = "invalid CasePattern"; break;
-			case 237: s = "invalid DotSuffix"; break;
+			case 224: s = "invalid Suffix"; break;
+			case 225: s = "invalid Suffix"; break;
+			case 226: s = "invalid LambdaExpression"; break;
+			case 227: s = "invalid EndlessExpression"; break;
+			case 228: s = "invalid NameSegment"; break;
+			case 229: s = "invalid DisplayExpr"; break;
+			case 230: s = "invalid MultiSetExpr"; break;
+			case 231: s = "invalid ConstAtomExpression"; break;
+			case 232: s = "invalid Nat"; break;
+			case 233: s = "invalid LambdaArrow"; break;
+			case 234: s = "invalid MatchExpression"; break;
+			case 235: s = "invalid QuantifierGuts"; break;
+			case 236: s = "invalid StmtInExpr"; break;
+			case 237: s = "invalid LetExpr"; break;
+			case 238: s = "invalid CaseExpression"; break;
+			case 239: s = "invalid DotSuffix"; break;
 
 			default: s = "error " + n; break;
 		}
diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index bf42c71a..0259f12c 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -901,17 +901,7 @@ namespace Microsoft.Dafny {
           wr.WriteLine();
           Indent(caseInd);
           wr.Write("case {0}", mc.Id);
-          if (mc.Arguments.Count != 0) {
-            string sep = "(";
-            foreach (BoundVar bv in mc.Arguments) {
-              wr.Write("{0}{1}", sep, bv.DisplayName);
-              if (bv.Type is NonProxyType) {
-                wr.Write(": {0}", bv.Type);
-              }
-              sep = ", ";
-            }
-            wr.Write(")");
-          }
+          PrintMatchCaseArgument(mc);
           wr.Write(" =>");
           foreach (Statement bs in mc.Body) {
             wr.WriteLine();
@@ -1199,17 +1189,7 @@ namespace Microsoft.Dafny {
           bool isLastCase = i == e.Cases.Count - 1;
           Indent(ind);
           wr.Write("case {0}", mc.Id);
-          if (mc.Arguments.Count != 0) {
-            string sep = "(";
-            foreach (BoundVar bv in mc.Arguments) {
-              wr.Write("{0}{1}", sep, bv.DisplayName);
-              if (bv.Type is NonProxyType) {
-                wr.Write(": {0}", bv.Type);
-              }
-              sep = ", ";
-            }
-            wr.Write(")");
-          }
+          PrintMatchCaseArgument(mc);          
           wr.WriteLine(" =>");
           PrintExtendedExpr(mc.Body, ind + IndentAmount, isLastCase, isLastCase && (parensNeeded || endWithCloseParen));
           i++;
@@ -1246,6 +1226,33 @@ namespace Microsoft.Dafny {
       }
     }
 
+    public void PrintMatchCaseArgument(MatchCase mc) {
+      if (mc.Arguments != null) {
+        if (mc.Arguments.Count != 0) {
+          string sep = "(";
+          foreach (BoundVar bv in mc.Arguments) {
+            wr.Write("{0}{1}", sep, bv.DisplayName);
+            if (bv.Type is NonProxyType) {
+              wr.Write(": {0}", bv.Type);
+            }
+            sep = ", ";
+          }
+          wr.Write(")");
+        }
+      } else {
+        Contract.Assert(mc.CasePatterns != null);
+        if (mc.CasePatterns.Count != 0) {
+          string sep = "(";
+          foreach (var cp in mc.CasePatterns) {
+            wr.Write(sep);
+            PrintCasePattern(cp);
+            sep = ", ";
+          }
+          wr.Write(")");
+        }
+      }
+    }
+
     public void PrintExpression(Expression expr, bool isFollowedBySemicolon) {
       Contract.Requires(expr != null);
       PrintExpr(expr, 0, false, true, isFollowedBySemicolon, -1);
@@ -1859,14 +1866,7 @@ namespace Microsoft.Dafny {
         foreach (var mc in e.Cases) {
           bool isLastCase = i == e.Cases.Count - 1;
           wr.Write(" case {0}", mc.Id);
-          if (mc.Arguments.Count != 0) {
-            string sep = "(";
-            foreach (BoundVar bv in mc.Arguments) {
-              wr.Write("{0}{1}", sep, bv.DisplayName);
-              sep = ", ";
-            }
-            wr.Write(")");
-          }
+          PrintMatchCaseArgument(mc);
           wr.Write(" => ");
           PrintExpression(mc.Body, isRightmost && isLastCase, !parensNeeded && isFollowedBySemicolon);
           i++;
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index f7ec135b..be348311 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -5185,106 +5185,381 @@ namespace Microsoft.Dafny
         Contract.Assert(prevErrorCount != ErrorCount || s.Steps.Count == s.Hints.Count);
 
       } else if (stmt is MatchStmt) {
-        MatchStmt s = (MatchStmt)stmt;
-        bool bodyIsSpecOnly = specContextOnly;
-        int prevErrorCount = ErrorCount;
-        ResolveExpression(s.Source, new ResolveOpts(codeContext, true, specContextOnly));
-        Contract.Assert(s.Source.Type != null);  // follows from postcondition of ResolveExpression
-        bool successfullyResolved = ErrorCount == prevErrorCount;
-        if (!specContextOnly && successfullyResolved) {
-          bodyIsSpecOnly = UsesSpecFeatures(s.Source);
-        }
-        UserDefinedType sourceType = null;
-        DatatypeDecl dtd = null;
-        if (s.Source.Type.IsDatatype) {
-          sourceType = (UserDefinedType)s.Source.Type.NormalizeExpand();
-          dtd = cce.NonNull((DatatypeDecl)sourceType.ResolvedClass);
+        ResolveMatchStmt(stmt, specContextOnly, codeContext);
+      } else if (stmt is SkeletonStatement) {
+        var s = (SkeletonStatement)stmt;
+        Error(s.Tok, "skeleton statements are allowed only in refining methods");
+        // nevertheless, resolve the underlying statement; hey, why not
+        if (s.S != null) {
+          ResolveStatement(s.S, specContextOnly, codeContext);
         }
-        var subst = new Dictionary<TypeParameter, Type>();
-        Dictionary<string, DatatypeCtor> ctors;
-        if (dtd == null) {
-          Error(s.Source, "the type of the match source expression must be a datatype (instead found {0})", s.Source.Type);
-          ctors = null;
-        } else {
-          Contract.Assert(sourceType != null);  // dtd and sourceType are set together above
-          ctors = datatypeCtors[dtd];
-          Contract.Assert(ctors != null);  // dtd should have been inserted into datatypeCtors during a previous resolution stage
+      } else {
+        Contract.Assert(false); throw new cce.UnreachableException();
+      }
+    }
 
-          // build the type-parameter substitution map for this use of the datatype
-          for (int i = 0; i < dtd.TypeArgs.Count; i++) {
-            subst.Add(dtd.TypeArgs[i], sourceType.TypeArgs[i]);
-          }
+    void ResolveMatchStmt(Statement stmt, bool specContextOnly, ICodeContext codeContext) {
+      MatchStmt s = (MatchStmt)stmt;
+      DesugarMatchStmtWithTupleExpression(s);
+
+      bool bodyIsSpecOnly = specContextOnly;
+      int prevErrorCount = ErrorCount;
+      ResolveExpression(s.Source, new ResolveOpts(codeContext, true, specContextOnly));
+      Contract.Assert(s.Source.Type != null);  // follows from postcondition of ResolveExpression
+      bool successfullyResolved = ErrorCount == prevErrorCount;
+      if (!specContextOnly && successfullyResolved) {
+        bodyIsSpecOnly = UsesSpecFeatures(s.Source);
+      }
+      UserDefinedType sourceType = null;
+      DatatypeDecl dtd = null;
+      if (s.Source.Type.IsDatatype) {
+        sourceType = (UserDefinedType)s.Source.Type.NormalizeExpand();
+        dtd = cce.NonNull((DatatypeDecl)sourceType.ResolvedClass);
+      }
+      var subst = new Dictionary<TypeParameter, Type>();
+      Dictionary<string, DatatypeCtor> ctors;
+      if (dtd == null) {
+        Error(s.Source, "the type of the match source expression must be a datatype (instead found {0})", s.Source.Type);
+        ctors = null;
+      } else {
+        Contract.Assert(sourceType != null);  // dtd and sourceType are set together above
+        ctors = datatypeCtors[dtd];
+        Contract.Assert(ctors != null);  // dtd should have been inserted into datatypeCtors during a previous resolution stage
+
+        // build the type-parameter substitution map for this use of the datatype
+        for (int i = 0; i < dtd.TypeArgs.Count; i++) {
+          subst.Add(dtd.TypeArgs[i], sourceType.TypeArgs[i]);
         }
-        s.IsGhost = bodyIsSpecOnly;
+      }
+      s.IsGhost = bodyIsSpecOnly;
 
-        ISet<string> memberNamesUsed = new HashSet<string>();
-        foreach (MatchCaseStmt mc in s.Cases) {
-          DatatypeCtor ctor = null;
-          if (ctors != null) {
-            Contract.Assert(dtd != null);
-            if (!ctors.TryGetValue(mc.Id, out ctor)) {
-              Error(mc.tok, "member {0} does not exist in datatype {1}", mc.Id, dtd.Name);
+      // convert CasePattern in MatchCaseExpr to BoundVar and flatten the MatchCaseExpr.
+      Type type = new InferredTypeProxy();
+      string name = FreshTempVarName("_mc#", codeContext);
+      BoundVar bv = new BoundVar(s.Tok, name, type);
+      List<CasePattern> patternSubst = new List<CasePattern>();
+      DesugarMatchCaseStmt(s, dtd, bv, patternSubst);
+
+      ISet<string> memberNamesUsed = new HashSet<string>();
+      foreach (MatchCaseStmt mc in s.Cases) {
+        DatatypeCtor ctor = null;
+        if (ctors != null) {
+          Contract.Assert(dtd != null);
+          if (!ctors.TryGetValue(mc.Id, out ctor)) {
+            Error(mc.tok, "member {0} does not exist in datatype {1}", mc.Id, dtd.Name);
+          } else {
+            Contract.Assert(ctor != null);  // follows from postcondition of TryGetValue
+            mc.Ctor = ctor;
+            if (ctor.Formals.Count != mc.Arguments.Count) {
+              Error(mc.tok, "member {0} has wrong number of formals (found {1}, expected {2})", mc.Id, mc.Arguments.Count, ctor.Formals.Count);
+            }
+            if (memberNamesUsed.Contains(mc.Id)) {
+              Error(mc.tok, "member {0} appears in more than one case", mc.Id);
             } else {
-              Contract.Assert(ctor != null);  // follows from postcondition of TryGetValue
-              mc.Ctor = ctor;
-              if (ctor.Formals.Count != mc.Arguments.Count) {
-                Error(mc.tok, "member {0} has wrong number of formals (found {1}, expected {2})", mc.Id, mc.Arguments.Count, ctor.Formals.Count);
-              }
-              if (memberNamesUsed.Contains(mc.Id)) {
-                Error(mc.tok, "member {0} appears in more than one case", mc.Id);
-              } else {
-                memberNamesUsed.Add(mc.Id);  // add mc.Id to the set of names used
-              }
+              memberNamesUsed.Add(mc.Id);  // add mc.Id to the set of names used
             }
           }
-          scope.PushMarker();
-          int i = 0;
-          foreach (BoundVar v in mc.Arguments) {
-            if (!scope.Push(v.Name, v)) {
-              Error(v, "Duplicate parameter name: {0}", v.Name);
-            }
-            ResolveType(v.tok, v.Type, codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
-            if (ctor != null && i < ctor.Formals.Count) {
-              Formal formal = ctor.Formals[i];
-              Type st = SubstType(formal.Type, subst);
-              if (!UnifyTypes(v.Type, st)) {
-                Error(stmt, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
-              }
-              v.IsGhost = formal.IsGhost;
+        }
+        scope.PushMarker();
+        int i = 0;
+        foreach (BoundVar v in mc.Arguments) {
+          if (!scope.Push(v.Name, v)) {
+            Error(v, "Duplicate parameter name: {0}", v.Name);
+          }
+          ResolveType(v.tok, v.Type, codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
+          if (ctor != null && i < ctor.Formals.Count) {
+            Formal formal = ctor.Formals[i];
+            Type st = SubstType(formal.Type, subst);
+            if (!UnifyTypes(v.Type, st)) {
+              Error(stmt, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
             }
-            i++;
+            v.IsGhost = formal.IsGhost;
           }
+          i++;
+        }
+        foreach (Statement ss in mc.Body) {
+          ResolveStatement(ss, bodyIsSpecOnly, codeContext);
+        }
+        // substitute body to replace the case pat with v. This needs to happen
+        // after the body is resolved so we can scope the bv correctly.
+        if (patternSubst.Count > 0) {
+          MatchCaseExprSubstituteCloner cloner = new MatchCaseExprSubstituteCloner(patternSubst, bv);
+          List<Statement> list = new List<Statement>();
           foreach (Statement ss in mc.Body) {
-            ResolveStatement(ss, bodyIsSpecOnly, codeContext);
+            Statement clone = cloner.CloneStmt(ss);
+            // resolve it again since we just cloned it.
+            ResolveStatement(clone, bodyIsSpecOnly, codeContext);
+            list.Add(clone);
+          }
+          mc.UpdateBody(list);
+        }
+
+        scope.PopMarker();
+      }
+      if (dtd != null && memberNamesUsed.Count != dtd.Ctors.Count) {
+        // We could complain about the syntactic omission of constructors:
+        //   Error(stmt, "match statement does not cover all constructors");
+        // but instead we let the verifier do a semantic check.
+        // So, for now, record the missing constructors:
+        foreach (var ctr in dtd.Ctors) {
+          if (!memberNamesUsed.Contains(ctr.Name)) {
+            s.MissingCases.Add(ctr);
+          }
+        }
+        Contract.Assert(memberNamesUsed.Count + s.MissingCases.Count == dtd.Ctors.Count);
+      }
+      if (!s.IsGhost) {
+        s.IsGhost = s.Cases.All(cs => cs.Body.All(ss => ss.IsGhost));
+      }
+    }
+
+    /*
+     * Convert
+     *  match (x, y)
+     *    case (Zero, _) => Zero
+     *    case (Suc(_), Zero) => x
+     *    case (Suc(a), Suc(b)) => minus(a, b)
+     * To:  
+     *  match x
+     *    case Zero => match y
+     *        case _ => zero
+     *    case Suc(_) => match y
+     *        case Zero => x
+     *    case Suc(a) => match y
+      *        case (b) => minus(a,b)
+     */    
+    void DesugarMatchStmtWithTupleExpression(MatchStmt me) {
+      // (x, y) is treated as a 2-tuple constructor
+      if (me.Source is DatatypeValue) {
+        var e = (DatatypeValue)me.Source;
+        Contract.Assert(e.Arguments.Count >= 1);
+        Expression source = e.Arguments[0];
+        List<MatchCaseStmt> cases = new List<MatchCaseStmt>();
+        foreach (MatchCaseStmt mc in me.Cases) {
+          Contract.Assert(mc.CasePatterns != null);
+          Contract.Assert(mc.CasePatterns.Count == e.Arguments.Count);
+          CasePattern cp = mc.CasePatterns[0];
+          List<CasePattern> patterns;
+          if (cp.Arguments != null) {
+            patterns = cp.Arguments;
+          } else {
+            patterns = new List<CasePattern>();
+          }
+
+          List<Statement> body = mc.Body;
+          for (int i = e.Arguments.Count; 1 <= --i; ) {
+            // others go into the body
+            body = CreateMatchCaseStmtBody(mc.tok, e.Arguments[i], mc.CasePatterns[i], body);
           }
-          scope.PopMarker();
+          cases.Add(new MatchCaseStmt(cp.tok, cp.Id, patterns, body));
+        }
+        me.UpdateSource(source);
+        me.UpdateCases(cases);
+      }
+    }
+
+    List<Statement> CreateMatchCaseStmtBody(Boogie.IToken tok, Expression source, CasePattern cp, List<Statement> body) {
+      List<MatchCaseStmt> cases = new List<MatchCaseStmt>();
+      List<CasePattern> patterns;
+      if (cp.Var != null) {
+        var bv = cp.Var;
+        if (LocalVariable.HasWildcardName(bv)) {
+          return body;
+        } else {
+          patterns = new List<CasePattern>();
         }
-        if (dtd != null && memberNamesUsed.Count != dtd.Ctors.Count) {
-          // We could complain about the syntactic omission of constructors:
-          //   Error(stmt, "match statement does not cover all constructors");
-          // but instead we let the verifier do a semantic check.
-          // So, for now, record the missing constructors:
-          foreach (var ctr in dtd.Ctors) {
-            if (!memberNamesUsed.Contains(ctr.Name)) {
-              s.MissingCases.Add(ctr);
+      } else {
+        patterns = cp.Arguments;
+      }
+      cases.Add(new MatchCaseStmt(cp.tok, cp.Id, patterns, body));
+      List<Statement> list = new List<Statement>();
+      // endTok??
+      list.Add(new MatchStmt(tok, tok, source, cases, false));
+      return list;
+    }
+  
+
+    /*
+     * Convert
+     *   match xs
+     *     case Cons(y, Cons(z, zs)) => last(Cons(z, zs))
+     *     case Cons(y, Nil) => y
+     * To
+     *   match xs
+     *     case Cons(y, ys) => match ys
+     *       case Nil => y
+     *       case Cons(z, zs) => last(ys)
+     */
+    void DesugarMatchCaseStmt(MatchStmt s, DatatypeDecl dtd, BoundVar sourceVar, List<CasePattern> patterns) {
+      Contract.Assert(dtd != null);
+      Dictionary<string, DatatypeCtor> ctors = datatypeCtors[dtd];
+      foreach (MatchCaseStmt mc in s.Cases) {
+        if (mc.Arguments != null) {
+          // already desugared. This happens during the second pass resolver after cloning.
+          Contract.Assert(mc.CasePatterns == null);
+          return;
+        }
+
+        Contract.Assert(mc.Arguments == null);
+        Contract.Assert(mc.CasePatterns != null);
+        DatatypeCtor ctor = null;
+        if (ctors != null) {
+          if (!ctors.TryGetValue(mc.Id, out ctor)) {
+            Error(mc.tok, "member {0} does not exist in datatype {1}", mc.Id, dtd.Name);
+          } else {
+            Contract.Assert(ctor != null);  // follows from postcondition of TryGetValue
+            mc.Ctor = ctor;
+            if (ctor.Formals.Count != mc.CasePatterns.Count) {
+              Error(mc.tok, "member {0} has wrong number of formals (found {1}, expected {2})", mc.Id, mc.Arguments.Count, ctor.Formals.Count);
             }
           }
-          Contract.Assert(memberNamesUsed.Count + s.MissingCases.Count == dtd.Ctors.Count);
         }
-        if (!s.IsGhost) {
-          s.IsGhost = s.Cases.All(cs => cs.Body.All(ss => ss.IsGhost));
+        scope.PushMarker();
+        List<BoundVar> arguments = new List<BoundVar>();
+        foreach (CasePattern pat in mc.CasePatterns) {
+          // Find the constructor in the given datatype
+          // If what was parsed was just an identifier, we will interpret it as a datatype constructor, if possible
+          ctor = null;
+          if (pat.Var == null || (pat.Var != null && pat.Var.Type is TypeProxy && dtd != null)) {
+            if (datatypeCtors[dtd].TryGetValue(pat.Id, out ctor)) {
+              pat.Ctor = ctor;
+              pat.Var = null;
+            }
+          }
+          if (pat.Var != null) {
+            BoundVar v = pat.Var;
+            arguments.Add(v);
+            if (!scope.Push(v.Name, v)) {
+              Error(v, "Duplicate name: {0}", v.Name);
+            }
+          } else {
+            DesugarMatchCasePattern(mc, pat, sourceVar);
+            patterns.Add(pat);
+            arguments.Add(sourceVar);
+          }
         }
+        mc.Arguments = arguments;
+        mc.CasePatterns = null;
+        scope.PopMarker();
+      }
 
-      } else if (stmt is SkeletonStatement) {
-        var s = (SkeletonStatement)stmt;
-        Error(s.Tok, "skeleton statements are allowed only in refining methods");
-        // nevertheless, resolve the underlying statement; hey, why not
-        if (s.S != null) {
-          ResolveStatement(s.S, specContextOnly, codeContext);
+      List<MatchCaseStmt> newCases = new List<MatchCaseStmt>();
+
+      // need to consolidate the cases.
+      // Convert 
+      //  match xs
+      //    case Cons(y, #mc#0) => match #mc#0
+      //                case Cons((z, zs) => body
+      //    case Cons(y, #mc#0) => match #mc#0
+      //                case Nil => y
+      // into
+      //  match xs
+      //    case Cons(y, #mc#0) => match #mc#0
+      //                case Cons((z, zs) => body
+      //                case Nil => y
+      bool thingsChanged = false;
+      Dictionary<string, MatchCaseStmt> caseMap = new Dictionary<string, MatchCaseStmt>();
+      List<MatchCaseStmt> mcWithWildCard = new List<MatchCaseStmt>();
+      foreach (MatchCaseStmt mc in s.Cases) {
+        // check each CasePattern to see if it has wildcard.
+        if (CaseExprHasWildCard(mc)) {
+          mcWithWildCard.Add(mc);
+        } else {
+          thingsChanged |= CombineMatchCaseStmt(mc, newCases, caseMap);
+        }
+      }
+
+      foreach (MatchCaseStmt mc in mcWithWildCard) {
+        // now process with cases with wildcard
+        thingsChanged |= CombineMatchCaseStmt(mc, newCases, caseMap);
+      }
+
+      if (thingsChanged) {
+        s.UpdateCases(newCases);
+      }
+    }
+
+    void DesugarMatchCasePattern(MatchCaseStmt mc, CasePattern pat, BoundVar v) {
+      // convert 
+      //    case Cons(y, Cons(z, zs)) => body
+      // to
+      //    case Cons(y, #mc#) => match #mc#
+      //            case Cons(z, zs) => body
+
+      Expression source = new NameSegment(pat.tok, v.Name, null);
+      List<MatchCaseStmt> cases = new List<MatchCaseStmt>();
+      cases.Add(new MatchCaseStmt(pat.tok, pat.Id, pat.Arguments == null ? new List<CasePattern>() : pat.Arguments, mc.Body));
+      List<Statement> list = new List<Statement>();
+      // endTok??
+      list.Add(new MatchStmt(pat.tok, pat.tok, source, cases, false));
+      mc.UpdateBody(list);
+    }
+
+    bool CombineMatchCaseStmt(MatchCaseStmt mc, List<MatchCaseStmt> newCases, Dictionary<string, MatchCaseStmt> caseMap) {
+      bool thingsChanged = false;
+      MatchCaseStmt old_mc;
+      if (caseMap.TryGetValue(mc.Id, out old_mc)) {
+        // already has a case with the same ctor, try to consolidate the body.
+        List<Statement> oldBody = old_mc.Body;
+        List<Statement> body = mc.Body;
+        if ((oldBody.Count == 1) && (oldBody[0] is MatchStmt)
+            && (body.Count == 1) && (body[0] is MatchStmt)) {
+          // both only have on statement and the statement is MatchStmt
+          MatchStmt old = (MatchStmt) oldBody[0];
+          MatchStmt current = (MatchStmt) body[0];
+          if (SameMatchCase(old_mc, mc)) {
+            foreach (MatchCaseStmt c in current.Cases) {
+              old.Cases.Add(c);
+            }
+            thingsChanged = true;
+          }
+        } else {
+          // duplicate cases, do nothing for now. The error will be reported during resolving
         }
       } else {
-        Contract.Assert(false); throw new cce.UnreachableException();
+        // it is a new case.
+        newCases.Add(mc);
+        caseMap.Add(mc.Id, mc);
+      }
+      return thingsChanged;
+    }
+
+    bool SameMatchCase(MatchCaseStmt one, MatchCaseStmt other) {
+      // this method is called after all the CasePattern in the match cases are converted
+      // into BoundVars.
+      Contract.Assert(one.CasePatterns == null && one.Arguments != null);
+      Contract.Assert(other.CasePatterns == null && other.Arguments != null);
+      // In order to combine the two match cases, the bodies need to be a MatchExpr and 
+      // the arguments and the source of the body are the same. 
+      // We do string equals since they should be in the same scope.
+      if (one.Arguments.Count != other.Arguments.Count) {
+        return false;
+      }
+      List<Statement> body1 = one.Body;
+      List<Statement> body2 = other.Body;
+      if ((body1.Count != 1) || (body2.Count != 1)) {
+        return false;
+      }
+      if (!(body1[0] is MatchStmt) || !(body2[0] is MatchStmt)) {
+       return false;
+      }
+      var source1 = ((MatchStmt)body1[0]).Source;
+      var source2 = ((MatchStmt)body2[0]).Source;
+      if (!(source1 is NameSegment) || !(source2 is NameSegment)) {
+        return false;
       }
+      if (!((NameSegment)source1).Name.Equals(((NameSegment)source2).Name)) {
+        return false;
+      }
+      for (int i = 0; i < one.Arguments.Count; i++) {
+        BoundVar bv1 = one.Arguments[i];
+        BoundVar bv2 = other.Arguments[i];
+        if (!LocalVariable.HasWildcardName(bv1) && !LocalVariable.HasWildcardName(bv2) &&
+            !bv1.Name.Equals(bv2.Name)) {
+          return false;
+        }
+      }
+      return true;
     }
 
     void FillInDefaultLoopDecreases(LoopStmt loopStmt, Expression guard, List<Expression> theDecreases, ICallable enclosingMethod) {
@@ -7324,99 +7599,365 @@ namespace Microsoft.Dafny
         }
 
       } else if (expr is MatchExpr) {
-        var me = (MatchExpr)expr;
-        ResolveExpression(me.Source, opts);
-        Contract.Assert(me.Source.Type != null);  // follows from postcondition of ResolveExpression
-        UserDefinedType sourceType = null;
-        DatatypeDecl dtd = null;
-        if (me.Source.Type.IsDatatype) {
-          sourceType = (UserDefinedType)me.Source.Type.NormalizeExpand();
-          dtd = cce.NonNull((DatatypeDecl)sourceType.ResolvedClass);
-        }
-        var subst = new Dictionary<TypeParameter, Type>();
-        Dictionary<string, DatatypeCtor> ctors;
-        if (dtd == null) {
-          Error(me.Source, "the type of the match source expression must be a datatype (instead found {0})", me.Source.Type);
-          ctors = null;
-        } else {
-          Contract.Assert(sourceType != null);  // dtd and sourceType are set together above
-          ctors = datatypeCtors[dtd];
-          Contract.Assert(ctors != null);  // dtd should have been inserted into datatypeCtors during a previous resolution stage
+        ResolveMatchExpr(expr, opts);
+      } else {
+        Contract.Assert(false); throw new cce.UnreachableException();  // unexpected expression
+      }
 
-          // build the type-parameter substitution map for this use of the datatype
-          for (int i = 0; i < dtd.TypeArgs.Count; i++) {
-            subst.Add(dtd.TypeArgs[i], sourceType.TypeArgs[i]);
-          }
+      if (expr.Type == null) {
+        // some resolution error occurred
+        expr.Type = new InferredTypeProxy();
+      }
+    }
+
+    void ResolveMatchExpr(Expression expr, ResolveOpts opts) {
+      var me = (MatchExpr)expr;
+      DesugarMatchExprWithTupleExpression(me);
+
+      ResolveExpression(me.Source, opts);
+      Contract.Assert(me.Source.Type != null);  // follows from postcondition of ResolveExpression
+      UserDefinedType sourceType = null;
+      DatatypeDecl dtd = null;
+      if (me.Source.Type.IsDatatype) {
+        sourceType = (UserDefinedType)me.Source.Type.NormalizeExpand();
+        dtd = cce.NonNull((DatatypeDecl)sourceType.ResolvedClass);
+      }
+      var subst = new Dictionary<TypeParameter, Type>();
+      Dictionary<string, DatatypeCtor> ctors;
+      if (dtd == null) {
+        Error(me.Source, "the type of the match source expression must be a datatype (instead found {0})", me.Source.Type);
+        ctors = null;
+      } else {
+        Contract.Assert(sourceType != null);  // dtd and sourceType are set together above
+        ctors = datatypeCtors[dtd];
+        Contract.Assert(ctors != null);  // dtd should have been inserted into datatypeCtors during a previous resolution stage
+
+        // build the type-parameter substitution map for this use of the datatype
+        for (int i = 0; i < dtd.TypeArgs.Count; i++) {
+          subst.Add(dtd.TypeArgs[i], sourceType.TypeArgs[i]);
         }
+      }
 
-        ISet<string> memberNamesUsed = new HashSet<string>();
-        expr.Type = new InferredTypeProxy();
-        foreach (MatchCaseExpr mc in me.Cases) {
-          DatatypeCtor ctor = null;
-          if (ctors != null) {
-            Contract.Assert(dtd != null);
-            if (!ctors.TryGetValue(mc.Id, out ctor)) {
-              Error(mc.tok, "member {0} does not exist in datatype {1}", mc.Id, dtd.Name);
+      // convert CasePattern in MatchCaseExpr to BoundVar and flatten the MatchCaseExpr.
+      Type type = new InferredTypeProxy();
+      string name = FreshTempVarName("_mc#", opts.codeContext);
+      BoundVar bv = new BoundVar(me.tok, name, type);
+      List<CasePattern> patternSubst = new List<CasePattern>();
+      DesugarMatchCaseExpr(me, dtd, bv, patternSubst);
+
+      ISet<string> memberNamesUsed = new HashSet<string>();
+      expr.Type = new InferredTypeProxy();
+      foreach (MatchCaseExpr mc in me.Cases) {
+        DatatypeCtor ctor = null;
+        if (ctors != null) {
+          Contract.Assert(dtd != null);
+          if (!ctors.TryGetValue(mc.Id, out ctor)) {
+            Error(mc.tok, "member {0} does not exist in datatype {1}", mc.Id, dtd.Name);
+          } else {
+            Contract.Assert(ctor != null);  // follows from postcondition of TryGetValue
+            mc.Ctor = ctor;
+            if (ctor.Formals.Count != mc.Arguments.Count) {
+              Error(mc.tok, "member {0} has wrong number of formals (found {1}, expected {2})", mc.Id, mc.Arguments.Count, ctor.Formals.Count);
+            }
+            if (memberNamesUsed.Contains(mc.Id)) {
+              Error(mc.tok, "member {0} appears in more than one case", mc.Id);
             } else {
-              Contract.Assert(ctor != null);  // follows from postcondition of TryGetValue
-              mc.Ctor = ctor;
-              if (ctor.Formals.Count != mc.Arguments.Count) {
-                Error(mc.tok, "member {0} has wrong number of formals (found {1}, expected {2})", mc.Id, mc.Arguments.Count, ctor.Formals.Count);
-              }
-              if (memberNamesUsed.Contains(mc.Id)) {
-                Error(mc.tok, "member {0} appears in more than one case", mc.Id);
-              } else {
-                memberNamesUsed.Add(mc.Id);  // add mc.Id to the set of names used
-              }
+              memberNamesUsed.Add(mc.Id);  // add mc.Id to the set of names used
             }
           }
-          scope.PushMarker();
-          int i = 0;
-          foreach (BoundVar v in mc.Arguments) {
-            if (!scope.Push(v.Name, v)) {
-              Error(v, "Duplicate parameter name: {0}", v.Name);
-            }
-            ResolveType(v.tok, v.Type, opts.codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
-            if (ctor != null && i < ctor.Formals.Count) {
-              Formal formal = ctor.Formals[i];
-              Type st = SubstType(formal.Type, subst);
-              if (!UnifyTypes(v.Type, st)) {
-                Error(expr, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
-              }
-              v.IsGhost = formal.IsGhost;
+        }
+        scope.PushMarker();
+        int i = 0;
+        foreach (BoundVar v in mc.Arguments) {
+          if (!scope.Push(v.Name, v)) {
+            Error(v, "Duplicate parameter name: {0}", v.Name);
+          }
+          ResolveType(v.tok, v.Type, opts.codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
+          if (ctor != null && i < ctor.Formals.Count) {
+            Formal formal = ctor.Formals[i];
+            Type st = SubstType(formal.Type, subst);
+            if (!UnifyTypes(v.Type, st)) {
+              Error(expr, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
             }
-            i++;
+            v.IsGhost = formal.IsGhost;
           }
+          i++;
+        }
+        ResolveExpression(mc.Body, opts);
+        // substitute body to replace the case pat with v. This needs to happen
+        // after the body is resolved so we can scope the bv correctly.
+        if (patternSubst.Count > 0) {
+          MatchCaseExprSubstituteCloner cloner = new MatchCaseExprSubstituteCloner(patternSubst, bv);
+          mc.UpdateBody(cloner.CloneExpr(mc.Body));
+          // resolve it again since we just cloned it.
           ResolveExpression(mc.Body, opts);
-          Contract.Assert(mc.Body.Type != null);  // follows from postcondition of ResolveExpression
-          if (!UnifyTypes(expr.Type, mc.Body.Type)) {
-            Error(mc.Body.tok, "type of case bodies do not agree (found {0}, previous types {1})", mc.Body.Type, expr.Type);
+        }
+
+        Contract.Assert(mc.Body.Type != null);  // follows from postcondition of ResolveExpression
+        if (!UnifyTypes(expr.Type, mc.Body.Type)) {
+          Error(mc.Body.tok, "type of case bodies do not agree (found {0}, previous types {1})", mc.Body.Type, expr.Type);
+        }
+        scope.PopMarker();
+      }
+      if (dtd != null && memberNamesUsed.Count != dtd.Ctors.Count) {
+        // We could complain about the syntactic omission of constructors:
+        //   Error(expr, "match expression does not cover all constructors");
+        // but instead we let the verifier do a semantic check.
+        // So, for now, record the missing constructors:
+        foreach (var ctr in dtd.Ctors) {
+          if (!memberNamesUsed.Contains(ctr.Name)) {
+            me.MissingCases.Add(ctr);
+          }
+        }
+        Contract.Assert(memberNamesUsed.Count + me.MissingCases.Count == dtd.Ctors.Count);
+      }
+    }
+
+    /*
+     * Convert
+     *  match (x, y)
+     *    case (Zero, _) => Zero
+     *    case (Suc(_), Zero) => x
+     *    case (Suc(a), Suc(b)) => minus(a, b)
+     * To:  
+     *  match x
+     *    case Zero => match y
+     *        case _ => zero
+     *    case Suc(_) => match y
+     *        case Zero => x
+     *    case Suc(a) => match y
+      *        case (b) => minus(a,b)
+     */
+    private void DesugarMatchExprWithTupleExpression(MatchExpr me) {
+      // (x, y) is treated as a 2-tuple constructor
+      if (me.Source is DatatypeValue) {
+        var e = (DatatypeValue)me.Source;
+        Contract.Assert(e.Arguments.Count >= 1);
+        Expression source = e.Arguments[0];
+        List<MatchCaseExpr> cases = new List<MatchCaseExpr>();
+        foreach (MatchCaseExpr mc in me.Cases) {
+          Contract.Assert(mc.CasePatterns != null);
+          Contract.Assert(mc.CasePatterns.Count == e.Arguments.Count);
+          CasePattern cp = mc.CasePatterns[0];
+          List<CasePattern> patterns;
+          if (cp.Arguments != null) {
+            patterns = cp.Arguments;
+          } else {
+            patterns = new List<CasePattern>();
+          }
+
+          Expression body = mc.Body;
+          for (int i = e.Arguments.Count; 1 <= --i; ) {
+            // others go into the body
+            body = CreateMatchCaseExprBody(mc.tok, e.Arguments[i], mc.CasePatterns[i], body);
+          }
+          cases.Add(new MatchCaseExpr(cp.tok, cp.Id, patterns, body));
+        }
+        me.UpdateSource(source);
+        me.UpdateCases(cases);
+      }
+    }
+
+    Expression CreateMatchCaseExprBody(Boogie.IToken tok, Expression source, CasePattern cp, Expression body) {
+      List<MatchCaseExpr> cases = new List<MatchCaseExpr>();
+      List<CasePattern> patterns;
+      if (cp.Var != null) {
+        var bv = cp.Var;
+        if (LocalVariable.HasWildcardName(bv)) {
+          return body;
+        } else {
+          patterns = new List<CasePattern>();
+        }
+      } else {
+        patterns = cp.Arguments;
+      }
+      cases.Add(new MatchCaseExpr(cp.tok, cp.Id, patterns, body));
+      return new MatchExpr(tok, source, cases, false);
+    }
+
+    /*
+     * Convert
+     *   match xs
+     *     case Cons(y, Cons(z, zs)) => last(Cons(z, zs))
+     *     case Cons(y, Nil) => y
+     * To
+     *   match xs
+     *     case Cons(y, ys) => match ys
+     *       case Nil => y
+     *       case Cons(z, zs) => last(ys)
+     * */
+    void DesugarMatchCaseExpr(MatchExpr me, DatatypeDecl dtd, BoundVar sourceVar, List<CasePattern> patterns) {
+      Contract.Assert(dtd != null);
+      Dictionary<string, DatatypeCtor> ctors = datatypeCtors[dtd];
+      foreach (MatchCaseExpr mc in me.Cases) {
+        if (mc.Arguments != null) {
+          // already desugared. This happens during the second pass resolver after cloning.
+          Contract.Assert(mc.CasePatterns == null);
+          return;
+        }
+
+        Contract.Assert(mc.Arguments == null);
+        Contract.Assert(mc.CasePatterns != null);
+        DatatypeCtor ctor = null;
+        if (ctors != null) {
+          if (!ctors.TryGetValue(mc.Id, out ctor)) {
+            Error(mc.tok, "member {0} does not exist in datatype {1}", mc.Id, dtd.Name);
+          } else {
+            Contract.Assert(ctor != null);  // follows from postcondition of TryGetValue
+            mc.Ctor = ctor;
+            if (ctor.Formals.Count != mc.CasePatterns.Count) {
+              Error(mc.tok, "member {0} has wrong number of formals (found {1}, expected {2})", mc.Id, mc.CasePatterns.Count, ctor.Formals.Count);
+            }
           }
-          scope.PopMarker();
         }
-        if (dtd != null && memberNamesUsed.Count != dtd.Ctors.Count) {
-          // We could complain about the syntactic omission of constructors:
-          //   Error(expr, "match expression does not cover all constructors");
-          // but instead we let the verifier do a semantic check.
-          // So, for now, record the missing constructors:
-          foreach (var ctr in dtd.Ctors) {
-            if (!memberNamesUsed.Contains(ctr.Name)) {
-              me.MissingCases.Add(ctr);
+        scope.PushMarker();
+        List<BoundVar> arguments = new List<BoundVar>();
+        foreach (CasePattern pat in mc.CasePatterns) {
+          // Find the constructor in the given datatype
+          // If what was parsed was just an identifier, we will interpret it as a datatype constructor, if possible
+          ctor = null;
+          if (pat.Var == null || (pat.Var != null && pat.Var.Type is TypeProxy && dtd != null)) {
+            if (datatypeCtors[dtd].TryGetValue(pat.Id, out ctor)) {
+              pat.Ctor = ctor;
+              pat.Var = null;
+            }
+          }
+          if (pat.Var != null) {
+            BoundVar v = pat.Var;
+            arguments.Add(v);
+            if (!scope.Push(v.Name, v)) {
+              Error(v, "Duplicate name: {0}", v.Name);
             }
+          } else {
+            DesugarMatchCasePattern(mc, pat, sourceVar);
+            patterns.Add(pat);
+            arguments.Add(sourceVar);
           }
-          Contract.Assert(memberNamesUsed.Count + me.MissingCases.Count == dtd.Ctors.Count);
         }
 
-      } else {
-        Contract.Assert(false); throw new cce.UnreachableException();  // unexpected expression
+        mc.Arguments = arguments;
+        mc.CasePatterns = null;
+        scope.PopMarker();
       }
 
-      if (expr.Type == null) {
-        // some resolution error occurred
-        expr.Type = new InferredTypeProxy();
+      List<MatchCaseExpr> newCases = new List<MatchCaseExpr>();
+      
+      // need to consolidate the cases.
+      // Convert 
+      //  match xs
+      //    case Cons(y, #mc#0) => match #mc#0
+      //                case Cons((z, zs) => body
+      //    case Cons(y, #mc#0) => match #mc#0
+      //                case Nil => y
+      // into
+      //  match xs
+      //    case Cons(y, #mc#0) => match #mc#0
+      //                case Cons((z, zs) => body
+      //                case Nil => y
+      bool thingsChanged = false;      
+      Dictionary<string, MatchCaseExpr> caseMap = new Dictionary<string, MatchCaseExpr>();
+      List<MatchCaseExpr> mcWithWildCard = new List<MatchCaseExpr>();
+      foreach (MatchCaseExpr mc in me.Cases) {
+        // check each CasePattern to see if it has wildcard.
+        if (CaseExprHasWildCard(mc)) {
+          mcWithWildCard.Add(mc);
+        } else {
+          thingsChanged |= CombineMatchCaseExpr(mc, newCases, caseMap);
+        }
+      }
+
+      foreach (MatchCaseExpr mc in mcWithWildCard) {
+        // now process with cases with wildcard
+        thingsChanged |= CombineMatchCaseExpr(mc, newCases, caseMap);
+      }      
+
+      if (thingsChanged) {
+        me.UpdateCases(newCases);
       }
     }
 
+    void DesugarMatchCasePattern(MatchCaseExpr mc, CasePattern pat, BoundVar v) {
+      // convert 
+      //    case Cons(y, Cons(z, zs)) => body
+      // to
+      //    case Cons(y, #mc#) => match #mc#
+      //            case Cons(z, zs) => body
+
+      Expression source = new NameSegment(pat.tok, v.Name, null);
+      List<MatchCaseExpr> cases = new List<MatchCaseExpr>(); 
+      cases.Add(new MatchCaseExpr(pat.tok, pat.Id, pat.Arguments == null ? new List<CasePattern>() : pat.Arguments, mc.Body));
+      MatchExpr e = new MatchExpr(pat.tok, source, cases, false);
+      mc.UpdateBody(e);
+    }
+
+
+    bool CaseExprHasWildCard(MatchCase mc) {
+      foreach (BoundVar bv in mc.Arguments) {
+        if (LocalVariable.HasWildcardName(bv)) {
+          return true;
+        }
+      }
+      return false;
+    }
+
+    bool CombineMatchCaseExpr(MatchCaseExpr mc, List<MatchCaseExpr> newCases, Dictionary<string, MatchCaseExpr> caseMap) {
+      bool thingsChanged = false;
+      MatchCaseExpr old_mc;
+      if (caseMap.TryGetValue(mc.Id, out old_mc)) {
+        // already has a case with the same ctor, try to consolidate the body.
+        Expression oldBody = old_mc.Body;
+        Expression body = mc.Body;
+        if (SameMatchCase(old_mc, mc)) {
+          MatchExpr old = (MatchExpr)oldBody;
+          MatchExpr current = (MatchExpr)body;
+          foreach (MatchCaseExpr c in current.Cases) {
+            old.Cases.Add(c);
+          }
+          thingsChanged = true;
+        } else {
+          // duplicate cases, do nothing for now. The error will be reported during resolving
+        }
+      } else {
+        // it is a new case.
+        newCases.Add(mc);
+        caseMap.Add(mc.Id, mc);
+      }
+      return thingsChanged;
+    }
+
+    bool SameMatchCase(MatchCaseExpr one, MatchCaseExpr other) {
+      // this method is called after all the CasePattern in the match cases are converted
+      // into BoundVars.
+      Contract.Assert(one.CasePatterns == null && one.Arguments != null);
+      Contract.Assert(other.CasePatterns == null && other.Arguments != null);
+      // In order to combine the two match cases, the bodies need to be a MatchExpr and 
+      // the arguments and the source of the body are the same. 
+      // We do string equals since they should be in the same scope.
+      if (one.Arguments.Count != other.Arguments.Count) {
+        return false;
+      }
+      if (!(one.Body is MatchExpr) || !(other.Body is MatchExpr)) {
+        return false;
+      }
+      var source1 = ((MatchExpr)one.Body).Source;
+      var source2 = ((MatchExpr)other.Body).Source;
+      if (!(source1 is NameSegment) || !(source2 is NameSegment)) {
+        return false;
+      }
+      if (!((NameSegment)source1).Name.Equals(((NameSegment)source2).Name)) {
+        return false;       
+      }
+      for (int i = 0; i < one.Arguments.Count; i++) {
+        BoundVar bv1 = one.Arguments[i];
+        BoundVar bv2 = other.Arguments[i];
+        if (!LocalVariable.HasWildcardName(bv1) && !LocalVariable.HasWildcardName(bv2) &&
+            !bv1.Name.Equals(bv2.Name)) {
+          return false;
+        }
+      }
+      return true;
+    }
+
     void ResolveCasePattern(CasePattern pat, Type sourceType, ICodeContext context) {
       Contract.Requires(pat != null);
       Contract.Requires(sourceType != null);
@@ -7463,13 +8004,15 @@ namespace Microsoft.Dafny
         }
         // recursively call ResolveCasePattern on each of the arguments
         var j = 0;
-        foreach (var arg in pat.Arguments) {
-          if (j < ctor.Formals.Count) {
-            var formal = ctor.Formals[j];
-            Type st = SubstType(formal.Type, subst);
-            ResolveCasePattern(arg, st, context);
+        if (pat.Arguments != null) {
+          foreach (var arg in pat.Arguments) {
+            if (j < ctor.Formals.Count) {
+              var formal = ctor.Formals[j];
+              Type st = SubstType(formal.Type, subst);
+              ResolveCasePattern(arg, st, context);
+            }
+            j++;
           }
-          j++;
         }
         if (j == ctor.Formals.Count) {
           pat.AssembleExpr(udt.TypeArgs);
@@ -9009,8 +9552,10 @@ namespace Microsoft.Dafny
         var s = FreeVariables(e.Source);
         foreach (MatchCaseExpr mc in e.Cases) {
           var t = FreeVariables(mc.Body);
-          foreach (var bv in mc.Arguments) {
-            t.Remove(bv);
+          foreach (var cp in mc.CasePatterns) {
+            foreach (var bv in cp.Vars) {
+              t.Remove(bv);
+            }
           }
           s.UnionWith(t);
         }
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 72649b5f..1361ad85 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -1118,6 +1118,58 @@ namespace Microsoft.Dafny
     }
 
   }
+
+
+  class MatchCaseExprSubstituteCloner : Cloner
+  {
+    private List<CasePattern> patternSubst;
+    private BoundVar var;
+
+    // the cloner is called after resolving the body of matchexpr, trying
+    // to replace casepattern in the body that has been replaced by bv
+    public MatchCaseExprSubstituteCloner(List<CasePattern> subst, BoundVar var) {
+      this.patternSubst = subst;
+      this.var = var;
+    }
+
+    public override Expression CloneApplySuffix(ApplySuffix e) {
+      // if the ApplySuffix matches the CasePattern, then replace it with the BoundVar.
+      if (FindMatchingPattern(e)) {
+        return new NameSegment(e.tok, this.var.Name, null);
+      } else {
+        return new ApplySuffix(Tok(e.tok), CloneExpr(e.Lhs), e.Args.ConvertAll(CloneExpr));
+      }
+    }
+
+    private bool FindMatchingPattern(ApplySuffix e) {
+      Expression lhs = e.Lhs;
+      if (!(lhs is NameSegment)) {
+        return false;
+      }
+      string applyName = ((NameSegment)lhs).Name;
+      foreach (CasePattern cp in patternSubst) {
+        string ctorName = cp.Id;
+        if (!(applyName.Equals(ctorName)) || (e.Args.Count != cp.Arguments.Count)) {
+          continue;
+        }
+        bool found = true;
+        for (int i = 0; i < e.Args.Count; i++) {
+          var arg1 = e.Args[i];
+          var arg2 = cp.Arguments[i];
+          if (arg1.Resolved is IdentifierExpr) {
+            var bv1 = ((IdentifierExpr)arg1.Resolved).Var;
+            if (bv1 != arg2.Var) {
+              found = false;
+            }
+          }
+        }
+        if (found) {
+          return true;
+        }
+      }
+      return false;
+    }
+  }
 }
 
 
diff --git a/Test/dafny0/NestedMatch.dfy b/Test/dafny0/NestedMatch.dfy
new file mode 100644
index 00000000..e6e7c489
--- /dev/null
+++ b/Test/dafny0/NestedMatch.dfy
@@ -0,0 +1,59 @@
+// RUN: %dafny /compile:0  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+datatype Nat = Zero | Suc(Nat)
+
+predicate Even(n: Nat)
+{
+  match n
+  case Zero => true
+  case Suc(Zero) => false
+  case Suc(Suc(p)) => Even(p)
+}
+
+
+method checkEven(n: Nat) {
+  assert Even(Zero) == true;
+  assert Even(Suc(Zero)) == false;
+  assert Even(Suc(Suc(n))) == Even(n);
+}
+
+datatype List<T> = Nil | Cons(T, List<T>)
+
+function last<T>(xs: List<T>): T
+  requires xs != Nil
+{
+  match xs
+  case Cons(y, Nil) => y
+  case Cons(y, Cons(z, zs)) => last(Cons(z, zs))
+}
+
+method checkLast(y: T) {
+  assert last(Cons(y, Nil)) == y;
+  assert last(Cons(y, Cons(y, Nil))) == last(Cons(y, Nil));
+}
+
+
+function minus(x: Nat, y: Nat): Nat
+{
+  match (x, y)
+  case (Zero, _) => Zero
+  case (Suc(_), Zero) => x
+  case (Suc(a), Suc(b)) => minus(a, b)
+}
+
+method checkMinus(x:Nat, y: Nat) {
+  assert minus(Suc(x), Suc(y)) == minus(x,y);
+}
+
+
+// nested match statement
+method Last<T>(xs: List<T>) returns (x: T)
+  requires xs != Nil
+{
+ 
+  match xs {
+  	case Cons(y, Nil) => x:= y;
+  	case Cons(y, Cons(z, zs)) => x:=Last(Cons(z, zs));
+  }
+}
diff --git a/Test/dafny0/NestedMatch.dfy.expect b/Test/dafny0/NestedMatch.dfy.expect
new file mode 100644
index 00000000..f3a9c95f
--- /dev/null
+++ b/Test/dafny0/NestedMatch.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 11 verified, 0 errors
-- 
cgit v1.2.3


From be103552b0a81d48afcc7883ca48d9b5194e63f8 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Fri, 15 May 2015 11:29:44 -0700
Subject: Fix issue #79. Allow tuple pattern matching with parenthesis only.

---
 Source/Dafny/Dafny.atg       | 13 ++++++++++++-
 Source/Dafny/Parser.cs       | 21 ++++++++++++++++++++-
 Test/dafny4/Bug79.dfy        | 10 ++++++++++
 Test/dafny4/Bug79.dfy.expect |  2 ++
 4 files changed, 44 insertions(+), 2 deletions(-)
 create mode 100644 Test/dafny4/Bug79.dfy
 create mode 100644 Test/dafny4/Bug79.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index 3f684ff6..16cc09eb 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -2625,7 +2625,18 @@ CasePattern<out CasePattern pat>
         }
       ]
     ")"                                (. pat = new CasePattern(id, id.val, arguments); .)
-
+  | "("                                (. id = t;                                                           
+                                          arguments = new List<CasePattern>(); 
+                                       .)
+      [ CasePattern<out pat>           (. arguments.Add(pat); .)
+        { "," CasePattern<out pat>     (. arguments.Add(pat); .)
+        }
+      ]
+    ")"                                (. // Parse parenthesis without an identifier as a built in tuple type.
+                                          theBuiltIns.TupleType(id, arguments.Count, true); // make sure the tuple type exists
+                                          string ctor = BuiltIns.TupleTypeCtorName;  //use the TupleTypeCtors
+                                          pat = new CasePattern(id, ctor, arguments); 
+                                       .)
   | IdentTypeOptional<out bv>          (. // This could be a BoundVar of a parameter-less constructor and we may not know until resolution.
                                           // Nevertheless, we do put the "bv" into the CasePattern here (even though it will get thrown out
                                           // later if resolution finds the CasePattern to denote a parameter-less constructor), because this
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index d0924169..162e23a3 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -2934,7 +2934,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Ident(out id);
 			Expect(48);
 			arguments = new List<CasePattern>(); 
-			if (la.kind == 1) {
+			if (la.kind == 1 || la.kind == 48) {
 				CasePattern(out pat);
 				arguments.Add(pat); 
 				while (la.kind == 21) {
@@ -2945,6 +2945,25 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			Expect(49);
 			pat = new CasePattern(id, id.val, arguments); 
+		} else if (la.kind == 48) {
+			Get();
+			id = t;                                                           
+			arguments = new List<CasePattern>(); 
+			
+			if (la.kind == 1 || la.kind == 48) {
+				CasePattern(out pat);
+				arguments.Add(pat); 
+				while (la.kind == 21) {
+					Get();
+					CasePattern(out pat);
+					arguments.Add(pat); 
+				}
+			}
+			Expect(49);
+			theBuiltIns.TupleType(id, arguments.Count, true); // make sure the tuple type exists
+			string ctor = BuiltIns.TupleTypeCtorName;  //use the TupleTypeCtors
+			pat = new CasePattern(id, ctor, arguments); 
+			
 		} else if (la.kind == 1) {
 			IdentTypeOptional(out bv);
 			pat = new CasePattern(bv.tok, bv);
diff --git a/Test/dafny4/Bug79.dfy b/Test/dafny4/Bug79.dfy
new file mode 100644
index 00000000..49f2421b
--- /dev/null
+++ b/Test/dafny4/Bug79.dfy
@@ -0,0 +1,10 @@
+// RUN: %dafny /compile:0  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+function foo(s:int) : (int, int)
+
+function bar(s:int) : bool
+{
+    var (x, rest) := foo(s);
+    x > 0
+}
\ No newline at end of file
diff --git a/Test/dafny4/Bug79.dfy.expect b/Test/dafny4/Bug79.dfy.expect
new file mode 100644
index 00000000..069e7767
--- /dev/null
+++ b/Test/dafny4/Bug79.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 2 verified, 0 errors
-- 
cgit v1.2.3


From 47e3c9e215f1c5f51d35a974fccb5bd612eaa8be Mon Sep 17 00:00:00 2001
From: wuestholz <unknown>
Date: Mon, 18 May 2015 23:41:08 +0200
Subject: DafnyExtension: Added experimental support for diagnosing timeouts.

---
 Source/DafnyExtension/DafnyDriver.cs    |  5 ++++
 Source/DafnyExtension/MenuProxy.cs      | 17 ++++++++++++
 Source/DafnyExtension/ProgressMargin.cs | 46 ++++++++++++++++++++++++---------
 Source/DafnyMenu/DafnyMenu.vsct         | 11 ++++++++
 Source/DafnyMenu/DafnyMenuPackage.cs    | 32 +++++++++++++++++++++++
 Source/DafnyMenu/PkgCmdID.cs            |  1 +
 6 files changed, 100 insertions(+), 12 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyExtension/DafnyDriver.cs b/Source/DafnyExtension/DafnyDriver.cs
index 5b8cc943..7f39fe34 100644
--- a/Source/DafnyExtension/DafnyDriver.cs
+++ b/Source/DafnyExtension/DafnyDriver.cs
@@ -239,6 +239,11 @@ namespace DafnyLanguage
       return Dafny.DafnyOptions.Clo.VerifySnapshots;
     }
 
+    public static void SetDiagnoseTimeouts(bool v)
+    {
+      Dafny.DafnyOptions.Clo.RunDiagnosticsOnTimeout = v;
+    }
+
     public static int ChangeIncrementalVerification(int mode)
     {
       var old = Dafny.DafnyOptions.Clo.VerifySnapshots;
diff --git a/Source/DafnyExtension/MenuProxy.cs b/Source/DafnyExtension/MenuProxy.cs
index 11e1287f..9ddc8344 100644
--- a/Source/DafnyExtension/MenuProxy.cs
+++ b/Source/DafnyExtension/MenuProxy.cs
@@ -67,6 +67,15 @@ namespace DafnyLanguage
       }
     }
 
+    public void DiagnoseTimeouts(IWpfTextView activeTextView)
+    {
+      DafnyLanguage.ProgressTagger tagger;
+      if (activeTextView != null && DafnyLanguage.ProgressTagger.ProgressTaggers.TryGetValue(activeTextView.TextBuffer, out tagger))
+      {
+        tagger.StartVerification(false, true);
+      }
+    }
+
     public bool MenuEnabled(IWpfTextView activeTextView)
     {
       return activeTextView != null && activeTextView.TextBuffer.ContentType.DisplayName == "dafny";
@@ -80,6 +89,14 @@ namespace DafnyLanguage
                     && resolver.Program != null;
     }
 
+    public bool DiagnoseTimeoutsCommandEnabled(IWpfTextView activeTextView)
+    {
+      ResolverTagger resolver;
+      return activeTextView != null
+                    && DafnyLanguage.ResolverTagger.ResolverTaggers.TryGetValue(activeTextView.TextBuffer, out resolver)
+                    && resolver.VerificationErrors.Any(err => err.Message.Contains("timed out"));
+    }
+
     public void Compile(IWpfTextView activeTextView)
     {
       ResolverTagger resolver;
diff --git a/Source/DafnyExtension/ProgressMargin.cs b/Source/DafnyExtension/ProgressMargin.cs
index b4e58d3d..c3f56259 100644
--- a/Source/DafnyExtension/ProgressMargin.cs
+++ b/Source/DafnyExtension/ProgressMargin.cs
@@ -197,6 +197,7 @@ namespace DafnyLanguage
     bool verificationInProgress;  // this field is protected by "this".  Invariant:  !verificationInProgress ==> bufferChangesPreVerificationStart.Count == 0
     System.Threading.Tasks.Task verificationTask;
     public bool VerificationDisabled { get; private set; }
+    bool isDiagnosingTimeouts;
     string lastRequestId;
 
     public static readonly IDictionary<ITextBuffer, ProgressTagger> ProgressTaggers = new ConcurrentDictionary<ITextBuffer, ProgressTagger>();
@@ -227,14 +228,21 @@ namespace DafnyLanguage
         if (prog == null || VerificationDisabled) return;
         // We have a successfully resolved program to verify
 
-        var resolvedVersion = snap.Version.VersionNumber;
-        if (bufferChangesPostVerificationStart.Count == 0) {
-          // Nothing new to verify.  No reason to start a new verification.
-          return;
-        } else if (!bufferChangesPostVerificationStart.TrueForAll(span => span.Snapshot.Version.VersionNumber <= resolvedVersion)) {
-          // There have been buffer changes since the program that was resolved.  Do nothing here,
-          // and instead just await the next resolved program.
-          return;
+        var dt = isDiagnosingTimeouts;
+        if (!dt)
+        {
+          var resolvedVersion = snap.Version.VersionNumber;
+          if (bufferChangesPostVerificationStart.Count == 0)
+          {
+            // Nothing new to verify.  No reason to start a new verification.
+            return;
+          }
+          else if (!bufferChangesPostVerificationStart.TrueForAll(span => span.Snapshot.Version.VersionNumber <= resolvedVersion))
+          {
+            // There have been buffer changes since the program that was resolved.  Do nothing here,
+            // and instead just await the next resolved program.
+            return;
+          }
         }
 
         // at this time, we're committed to running the verifier
@@ -254,10 +262,14 @@ namespace DafnyLanguage
         }
 
         verificationTask = System.Threading.Tasks.Task.Factory.StartNew(
-          () => RunVerifier(prog, snap, lastRequestId, resolver),
+          () => RunVerifier(prog, snap, lastRequestId, resolver, dt),
           TaskCreationOptions.LongRunning);
 
         verificationInProgress = true;
+        if (dt)
+        {
+          isDiagnosingTimeouts = false;
+        }
 
         // Change orange progress markers into yellow ones
         Contract.Assert(bufferChangesPreVerificationStart.Count == 0);  // follows from monitor invariant
@@ -293,7 +305,7 @@ namespace DafnyLanguage
       }
     }
 
-    public void StartVerification()
+    public void StartVerification(bool clearCache = true, bool diagnoseTimeouts = false)
     {
       lock (this)
       {
@@ -301,7 +313,11 @@ namespace DafnyLanguage
         bufferChangesPostVerificationStart.Clear();
         bufferChangesPostVerificationStart.Add(new SnapshotSpan(_buffer.CurrentSnapshot, 0, _buffer.CurrentSnapshot.Length));
         VerificationDisabled = false;
-        ClearCachedVerificationResults();
+        isDiagnosingTimeouts = diagnoseTimeouts;
+        if (clearCache)
+        {
+          ClearCachedVerificationResults();
+        }
         NotifyAboutChangedTags(_buffer.CurrentSnapshot);
       }
     }
@@ -314,7 +330,7 @@ namespace DafnyLanguage
       }
     }
 
-    void RunVerifier(Dafny.Program program, ITextSnapshot snapshot, string requestId, ResolverTagger errorListHolder) {
+    void RunVerifier(Dafny.Program program, ITextSnapshot snapshot, string requestId, ResolverTagger errorListHolder, bool diagnoseTimeouts) {
       Contract.Requires(program != null);
       Contract.Requires(snapshot != null);
       Contract.Requires(requestId != null);
@@ -332,6 +348,8 @@ namespace DafnyLanguage
         _version++;
       }
 
+      DafnyDriver.SetDiagnoseTimeouts(diagnoseTimeouts);
+
       try
       {
         bool success = DafnyDriver.Verify(program, errorListHolder, GetHashCode().ToString(), requestId, errorInfo =>
@@ -369,6 +387,10 @@ namespace DafnyLanguage
       {
         errorListHolder.AddError(new DafnyError("$$program$$", 0, 0, ErrorCategory.InternalError, "Verification process error: " + e.Message, snapshot, false), "$$program$$", requestId);
       }
+      finally
+      {
+        DafnyDriver.SetDiagnoseTimeouts(!diagnoseTimeouts);
+      }
 
       lock (this) {
         bufferChangesPreVerificationStart.Clear();
diff --git a/Source/DafnyMenu/DafnyMenu.vsct b/Source/DafnyMenu/DafnyMenu.vsct
index 4c4b1403..4c9a4913 100644
--- a/Source/DafnyMenu/DafnyMenu.vsct
+++ b/Source/DafnyMenu/DafnyMenu.vsct
@@ -122,6 +122,16 @@
         </Strings>
       </Button>
 
+      <Button guid="guidDafnyMenuCmdSet" id="cmdidDiagnoseTimeouts" priority="0x0106" type="Button">
+        <Parent guid="guidDafnyMenuCmdSet" id="DafnyMenuGroup" />
+        <CommandFlag>DynamicVisibility</CommandFlag>
+        <CommandFlag>DefaultInvisible</CommandFlag>
+        <CommandFlag>TextChanges</CommandFlag>
+        <Strings>
+          <ButtonText>Re-verify to diagnose timeouts</ButtonText>
+        </Strings>
+      </Button>
+
     </Buttons>
 
     <!--The bitmaps section is used to define the bitmaps that are used for the commands.-->
@@ -154,6 +164,7 @@
       <IDSymbol name="cmdidToggleSnapshotVerification" value="0x0103" />
       <IDSymbol name="cmdidToggleBVD" value="0x0104" />
       <IDSymbol name="cmdidToggleMoreAdvancedSnapshotVerification" value="0x0105" />
+      <IDSymbol name="cmdidDiagnoseTimeouts" value="0x0106" />
     </GuidSymbol>
 
     <!--
diff --git a/Source/DafnyMenu/DafnyMenuPackage.cs b/Source/DafnyMenu/DafnyMenuPackage.cs
index 0acf3554..58c8f0ab 100644
--- a/Source/DafnyMenu/DafnyMenuPackage.cs
+++ b/Source/DafnyMenu/DafnyMenuPackage.cs
@@ -53,6 +53,12 @@ namespace DafnyLanguage.DafnyMenu
 
 
     void ShowErrorModel(IWpfTextView activeTextView);
+
+
+    bool DiagnoseTimeoutsCommandEnabled(IWpfTextView activeTextView);
+
+
+    void DiagnoseTimeouts(IWpfTextView activeTextView);
   }
 
 
@@ -88,6 +94,7 @@ namespace DafnyLanguage.DafnyMenu
     private OleMenuCommand toggleSnapshotVerificationCommand;
     private OleMenuCommand toggleMoreAdvancedSnapshotVerificationCommand;
     private OleMenuCommand toggleBVDCommand;
+    private OleMenuCommand diagnoseTimeoutsCommand;
 
     bool BVDDisabled;
 
@@ -157,6 +164,12 @@ namespace DafnyLanguage.DafnyMenu
         toggleBVDCommand.BeforeQueryStatus += showErrorModelCommand_BeforeQueryStatus;
         mcs.AddCommand(toggleBVDCommand);
 
+        var diagnoseTimeoutsCommandID = new CommandID(GuidList.guidDafnyMenuCmdSet, (int)PkgCmdIDList.cmdidDiagnoseTimeouts);
+        diagnoseTimeoutsCommand = new OleMenuCommand(DiagnoseTimeoutsCallback, diagnoseTimeoutsCommandID);
+        diagnoseTimeoutsCommand.Enabled = true;
+        diagnoseTimeoutsCommand.BeforeQueryStatus += diagnoseTimeoutsCommand_BeforeQueryStatus;
+        mcs.AddCommand(diagnoseTimeoutsCommand);
+
         var menuCommandID = new CommandID(GuidList.guidDafnyMenuPkgSet, (int)PkgCmdIDList.cmdidMenu);
         menuCommand = new OleMenuCommand(new EventHandler((sender, e) => { }), menuCommandID);
         menuCommand.BeforeQueryStatus += menuCommand_BeforeQueryStatus;
@@ -301,6 +314,16 @@ namespace DafnyLanguage.DafnyMenu
       }
     }
 
+    void diagnoseTimeoutsCommand_BeforeQueryStatus(object sender, EventArgs e)
+    {
+      var atv = ActiveTextView;
+      if (MenuProxy != null && atv != null)
+      {
+        var visible = MenuProxy.DiagnoseTimeoutsCommandEnabled(atv);
+        diagnoseTimeoutsCommand.Visible = visible;
+      }
+    }
+
     private void toggleMoreAdvancedSnapshotVerificationCommand_BeforeQueryStatus(object sender, EventArgs e)
     {
       var atv = ActiveTextView;
@@ -317,6 +340,15 @@ namespace DafnyLanguage.DafnyMenu
       toggleBVDCommand.Text = (BVDDisabled ? "Enable" : "Disable") + " BVD";
     }
 
+    void DiagnoseTimeoutsCallback(object sender, EventArgs e)
+    {
+      var atv = ActiveTextView;
+      if (MenuProxy != null && atv != null)
+      {
+        MenuProxy.DiagnoseTimeouts(atv);
+      }
+    }
+
     public void ExecuteAsCompiling(Action action, TextWriter outputWriter)
     {
       IVsStatusbar statusBar = (IVsStatusbar)GetGlobalService(typeof(SVsStatusbar));
diff --git a/Source/DafnyMenu/PkgCmdID.cs b/Source/DafnyMenu/PkgCmdID.cs
index b6f30145..427dd888 100644
--- a/Source/DafnyMenu/PkgCmdID.cs
+++ b/Source/DafnyMenu/PkgCmdID.cs
@@ -13,5 +13,6 @@ namespace DafnyLanguage.DafnyMenu
     public static uint cmdidToggleSnapshotVerification = 0x103;
     public const uint cmdidToggleBVD = 0x104;
     public static uint cmdidToggleMoreAdvancedSnapshotVerification = 0x105;
+    public static uint cmdidDiagnoseTimeouts = 0x106;
   };
 }
\ No newline at end of file
-- 
cgit v1.2.3


From b4886986df62f8db3c65859bb0d34c16658b40cc Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Mon, 18 May 2015 16:07:00 -0700
Subject: Fix issue #81. Pass a call's TypeArgumentSubstitution to
 CheckCallTermination.

---
 Source/Dafny/Translator.cs   | 5 +++--
 Test/dafny4/Bug81.dfy        | 9 +++++++++
 Test/dafny4/Bug81.dfy.expect | 2 ++
 3 files changed, 14 insertions(+), 2 deletions(-)
 create mode 100644 Test/dafny4/Bug81.dfy
 create mode 100644 Test/dafny4/Bug81.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 0e83f54a..41076a65 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -8693,7 +8693,7 @@ namespace Microsoft.Dafny {
         Contract.Assert(codeContext != null);
         List<Expression> contextDecreases = codeContext.Decreases.Expressions;
         List<Expression> calleeDecreases = callee.Decreases.Expressions;
-        CheckCallTermination(tok, contextDecreases, calleeDecreases, null, receiver, substMap, etran, etran.Old, builder, codeContext.InferredDecreases, null);
+        CheckCallTermination(tok, contextDecreases, calleeDecreases, null, receiver, substMap, tySubst, etran, etran.Old, builder, codeContext.InferredDecreases, null);
       }
 
       // Create variables to hold the output parameters of the call, so that appropriate unboxes can be introduced.
@@ -8804,6 +8804,7 @@ namespace Microsoft.Dafny {
     void CheckCallTermination(IToken tok, List<Expression> contextDecreases, List<Expression> calleeDecreases,
                               Bpl.Expr allowance,
                               Expression receiverReplacement, Dictionary<IVariable,Expression> substMap,
+                              Dictionary<TypeParameter, Type> typeMap,
                               ExpressionTranslator etranCurrent, ExpressionTranslator etranInitial, Bpl.StmtListBuilder builder, bool inferredDecreases, string hint) {
       Contract.Requires(tok != null);
       Contract.Requires(cce.NonNullElements(contextDecreases));
@@ -8835,7 +8836,7 @@ namespace Microsoft.Dafny {
         tok = new ForceCheckToken(tok);
       }
       for (int i = 0; i < N; i++) {
-        Expression e0 = Substitute(calleeDecreases[i], receiverReplacement, substMap);
+        Expression e0 = Substitute(calleeDecreases[i], receiverReplacement, substMap, typeMap);
         Expression e1 = contextDecreases[i];
         if (!CompatibleDecreasesTypes(e0.Type, e1.Type)) {
           N = i;
diff --git a/Test/dafny4/Bug81.dfy b/Test/dafny4/Bug81.dfy
new file mode 100644
index 00000000..1992d666
--- /dev/null
+++ b/Test/dafny4/Bug81.dfy
@@ -0,0 +1,9 @@
+// RUN: %dafny /compile:0  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+function {:opaque} RefineSeqToSeq<T,U>(s:seq<T>, refine_func:T->U) : seq<U>
+    reads refine_func.reads;
+{
+    if |s| == 0 then []
+    else RefineSeqToSeq(s[1..], refine_func)
+}
diff --git a/Test/dafny4/Bug81.dfy.expect b/Test/dafny4/Bug81.dfy.expect
new file mode 100644
index 00000000..069e7767
--- /dev/null
+++ b/Test/dafny4/Bug81.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 2 verified, 0 errors
-- 
cgit v1.2.3


From e34a7e4fd70d1aafacb2782cbcc0354f6587d649 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Tue, 19 May 2015 09:03:43 -0700
Subject: Fix build break. Part of the change was not checked in last check-in
 somehow.

---
 Source/Dafny/Translator.cs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 41076a65..9e08b2ce 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -4985,8 +4985,8 @@ namespace Microsoft.Dafny {
                 Contract.Assert(false);  // unexpected CoCallResolution
                 goto case FunctionCallExpr.CoCallResolution.No;  // please the compiler
             }
-            CheckCallTermination(expr.tok, contextDecreases, calleeDecreases, allowance, e.Receiver, substMap, etran, etran, builder,
-              codeContext.InferredDecreases, hint);
+            CheckCallTermination(expr.tok, contextDecreases, calleeDecreases, allowance, e.Receiver, substMap, e.TypeArgumentSubstitutions,
+              etran, etran, builder, codeContext.InferredDecreases, hint);
           }
 
         }
-- 
cgit v1.2.3


From c17bdfd0330a18d20c0697394d40e0b2dc0288ec Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Fri, 29 May 2015 15:17:43 -0700
Subject: Changes to ComputeFreeVariables--bug fix as well as beautification

---
 Source/Dafny/Compiler.cs   |  5 +----
 Source/Dafny/Resolver.cs   |  8 +++-----
 Source/Dafny/Translator.cs | 32 ++++++++++++++++++--------------
 3 files changed, 22 insertions(+), 23 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 570ac30d..ef5ba69e 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -2863,11 +2863,8 @@ namespace Microsoft.Dafny {
 
       } else if (expr is LambdaExpr) {
         LambdaExpr e = (LambdaExpr)expr;
-        ISet<IVariable> fvs = new HashSet<IVariable>();
-        bool dontCare = false;
-        Type dontCareT = null;
 
-        Translator.ComputeFreeVariables(expr, fvs, ref dontCare, ref dontCare, ref dontCareT, false);
+        var fvs = Translator.ComputeFreeVariables(expr);
         var sm = new Dictionary<IVariable, Expression>();
 
         var bvars = new List<BoundVar>();
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 8bc0d838..027d43f9 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -4903,14 +4903,12 @@ namespace Microsoft.Dafny
         WhileStmt s = (WhileStmt)stmt;
         bool bodyMustBeSpecOnly = specContextOnly;
         var fvs = new HashSet<IVariable>();
-        bool usesHeap = false, usesOldHeap = false;
-        Type usesThis = null;
         if (s.Guard != null) {
           int prevErrorCount = ErrorCount;
           ResolveExpression(s.Guard, new ResolveOpts(codeContext, true, specContextOnly));
           Contract.Assert(s.Guard.Type != null);  // follows from postcondition of ResolveExpression
           bool successfullyResolved = ErrorCount == prevErrorCount;
-          Translator.ComputeFreeVariables(s.Guard, fvs, ref usesHeap, ref usesOldHeap, ref usesThis, false);
+          Translator.ComputeFreeVariables(s.Guard, fvs);
           if (!UnifyTypes(s.Guard.Type, Type.Bool)) {
             Error(s.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Guard.Type);
           }
@@ -4923,7 +4921,7 @@ namespace Microsoft.Dafny
           ResolveAttributes(inv.Attributes, new ResolveOpts(codeContext, true, true));
           ResolveExpression(inv.E, new ResolveOpts(codeContext, true, true));
           Contract.Assert(inv.E.Type != null);  // follows from postcondition of ResolveExpression
-          Translator.ComputeFreeVariables(inv.E, fvs, ref usesHeap, ref usesOldHeap, ref usesThis, false);
+          Translator.ComputeFreeVariables(inv.E, fvs);
           if (!UnifyTypes(inv.E.Type, Type.Bool)) {
             Error(inv.E, "invariant is expected to be of type {0}, but is {1}", Type.Bool, inv.E.Type);
           }
@@ -4946,7 +4944,7 @@ namespace Microsoft.Dafny
           ResolveAttributes(s.Mod.Attributes, new ResolveOpts(codeContext, true, true));
           foreach (FrameExpression fe in s.Mod.Expressions) {
             ResolveFrameExpression(fe, false, bodyMustBeSpecOnly, codeContext);
-            Translator.ComputeFreeVariables(fe.E, fvs, ref usesHeap, ref usesOldHeap, ref usesThis, false);
+            Translator.ComputeFreeVariables(fe.E, fvs);
           }
         }
         s.IsGhost = s.Body == null || bodyMustBeSpecOnly;
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 18299994..856c46a8 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -1877,10 +1877,8 @@ namespace Microsoft.Dafny {
       // danr: Let's create the literal function axioms if there is an arrow type in the signature
       if (!(f is CoPredicate) && (f.Reads.Count == 0 || f.Formals.Exists(a => a.Type.IsArrowType))) {
         var FVs = new HashSet<IVariable>();
-        bool usesHeap = false, usesOldHeap = false;
-        Type usesThis = null;
         foreach (var e in f.Decreases.Expressions) {
-          ComputeFreeVariables(e, FVs, ref usesHeap, ref usesOldHeap, ref usesThis, false);
+          ComputeFreeVariables(e, FVs);
         }
         var decs = new List<Formal>();
         foreach (var formal in f.Formals) {
@@ -9830,7 +9828,7 @@ namespace Microsoft.Dafny {
           var FVs = new HashSet<IVariable>();
           bool usesHeap = false, usesOldHeap = false;
           Type usesThis = null;
-          ComputeFreeVariables(e.RHSs[0], FVs, ref usesHeap, ref usesOldHeap, ref usesThis, false);
+          ComputeFreeVariables(e.RHSs[0], FVs, ref usesHeap, ref usesOldHeap, ref usesThis);
           foreach (var bv in e.BoundVars) {
             FVs.Remove(bv);
           }
@@ -13037,7 +13035,20 @@ namespace Microsoft.Dafny {
       ty.NormalizeExpand().TypeArgs.Iter(tt => ComputeFreeTypeVariables(tt, fvs));
     }
 
-    public static void ComputeFreeVariables(Expression expr, ISet<IVariable> fvs, ref bool usesHeap, ref bool usesOldHeap, ref Type usesThis, bool inOldContext) {
+    public static ISet<IVariable> ComputeFreeVariables(Expression expr) {
+      Contract.Requires(expr != null);
+      ISet<IVariable> fvs = new HashSet<IVariable>();
+      ComputeFreeVariables(expr, fvs);
+      return fvs;
+    }
+    public static void ComputeFreeVariables(Expression expr, ISet<IVariable> fvs) {
+      Contract.Requires(expr != null);
+      Contract.Requires(fvs != null);
+      bool dontCare0 = false, dontCare1 = false;
+      Type dontCareT = null;
+      ComputeFreeVariables(expr, fvs, ref dontCare0, ref dontCare1, ref dontCareT);
+    }
+    public static void ComputeFreeVariables(Expression expr, ISet<IVariable> fvs, ref bool usesHeap, ref bool usesOldHeap, ref Type usesThis) {
       Contract.Requires(expr != null);
 
       if (expr is ThisExpr) {
@@ -13048,13 +13059,6 @@ namespace Microsoft.Dafny {
         var e = (IdentifierExpr)expr;
         fvs.Add(e.Var);
         return;
-      } else if (expr is OldExpr) {
-        var e = (OldExpr)expr;
-        bool subUsesHeap = false;
-        ComputeFreeVariables(e.E, fvs, ref subUsesHeap, ref usesOldHeap, ref usesThis, true);
-        if (subUsesHeap) {
-          usesOldHeap = true;
-        }
       } else if (expr is MemberSelectExpr) {
         usesHeap = true;
       } else if (expr is SeqSelectExpr) {
@@ -13078,11 +13082,11 @@ namespace Microsoft.Dafny {
       // visit subexpressions
       bool uHeap = false, uOldHeap = false;
       Type uThis = null;
-      expr.SubExpressions.Iter(ee => ComputeFreeVariables(ee, fvs, ref uHeap, ref uOldHeap, ref uThis, inOldContext));
+      expr.SubExpressions.Iter(ee => ComputeFreeVariables(ee, fvs, ref uHeap, ref uOldHeap, ref uThis));
       Contract.Assert(usesThis == null || uThis == null || usesThis.Equals(uThis));
       usesThis = usesThis ?? uThis;
       usesHeap |= uHeap;
-      usesOldHeap |= uOldHeap;
+      usesOldHeap |= expr is OldExpr ? uHeap | uOldHeap : uOldHeap;
 
       if (expr is LetExpr) {
         var e = (LetExpr)expr;
-- 
cgit v1.2.3


From bd96fb95cc024dd094b23025dcfefdae56aa2f59 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Fri, 29 May 2015 15:19:46 -0700
Subject: Bug fix in type-antecedent for traits in allocation axioms

---
 Source/Dafny/Translator.cs | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 0e83f54a..eb642899 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -2505,7 +2505,6 @@ namespace Microsoft.Dafny {
     ///         ($IsAlloc(o, TClassA(G), h) // or h[o, alloc]
     ///           ==> $IsAlloc(h[o, f], TT(PP), h))
     ///       && $Is(h[o, f], TT(PP), h);
-    /// <summary>
     /// This can be optimised later to:
     ///     axiom (forall o: ref, h: Heap ::
     ///         { h[o, f] }
@@ -2513,6 +2512,7 @@ namespace Microsoft.Dafny {
     ///       ==>
     ///         (h[o, alloc] ==> $IsAlloc(h[o, f], TT(TClassA_Inv_i(dtype(o)),..), h))
     ///       && $Is(h[o, f], TT(TClassA_Inv_i(dtype(o)),..), h);
+    /// <summary>
     void AddAllocationAxiom(Field f, ClassDecl c, bool is_array = false)
     {
       // IFF you're adding the array axioms, then the field should be null
@@ -2547,12 +2547,7 @@ namespace Microsoft.Dafny {
       var tyvars = MkTyParamBinders(GetTypeParams(c), out tyexprs);
 
       Bpl.Expr o_ty = ClassTyCon(c, tyexprs);
-
-      // Bpl.Expr is_o      = MkIs(o, o_ty);         // $Is(o, ..)
-      // Changed to use dtype(o) == o_ty instead:
-      Bpl.Expr is_o      = DType(o, o_ty);
-      // Bpl.Expr isalloc_o = MkIsAlloc(o, o_ty, h); // $IsAlloc(o, ..)
-      // Changed to use h[o,alloc] instead:
+      Bpl.Expr is_o = c is TraitDecl ? MkIs(o, o_ty) : DType(o, o_ty);  // $Is(o, ..)  or  dtype(o) == o_ty
       Bpl.Expr isalloc_o = IsAlloced(c.tok, h, o);
 
       Bpl.Expr is_hf, isalloc_hf;
-- 
cgit v1.2.3


From 10a8896ae40fd918abbb8caa616ac6ee0876ac1d Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Fri, 29 May 2015 16:29:15 -0700
Subject: Add an infinite set collection type.

---
 Binaries/DafnyPrelude.bpl             |   91 ++
 Source/Dafny/Cloner.cs                |    9 +-
 Source/Dafny/Dafny.atg                |   42 +-
 Source/Dafny/DafnyAst.cs              |   51 +-
 Source/Dafny/Parser.cs                | 1852 +++++++++++++++++----------------
 Source/Dafny/Printer.cs               |    6 +-
 Source/Dafny/RefinementTransformer.cs |    3 +-
 Source/Dafny/Resolver.cs              |  111 +-
 Source/Dafny/Rewriter.cs              |   12 +-
 Source/Dafny/Scanner.cs               |  300 +++---
 Source/Dafny/Translator.cs            |  160 ++-
 Source/DafnyExtension/TokenTagger.cs  |    1 +
 Test/dafny0/ISets.dfy                 |   40 +
 Test/dafny0/ISets.dfy.expect          |    2 +
 Util/Emacs/dafny-mode.el              |    2 +-
 Util/latex/dafny.sty                  |    2 +-
 Util/vim/dafny.vim                    |    2 +-
 17 files changed, 1508 insertions(+), 1178 deletions(-)
 create mode 100644 Test/dafny0/ISets.dfy
 create mode 100644 Test/dafny0/ISets.dfy.expect

(limited to 'Source')

diff --git a/Binaries/DafnyPrelude.bpl b/Binaries/DafnyPrelude.bpl
index 74bdb63e..5ee8b845 100644
--- a/Binaries/DafnyPrelude.bpl
+++ b/Binaries/DafnyPrelude.bpl
@@ -20,6 +20,7 @@ const unique TInt  : Ty;
 const unique TNat  : Ty;
 const unique TReal : Ty;
 function TSet(Ty)      : Ty;
+function TISet(Ty)     : Ty;
 function TMultiSet(Ty) : Ty;
 function TSeq(Ty)      : Ty;
 function TMap(Ty, Ty)  : Ty;
@@ -27,6 +28,8 @@ function TIMap(Ty, Ty) : Ty;
 
 function Inv0_TSet(Ty) : Ty;
 axiom (forall t: Ty :: { TSet(t) } Inv0_TSet(TSet(t)) == t);
+function Inv0_TISet(Ty) : Ty;
+axiom (forall t: Ty :: { TISet(t) } Inv0_TISet(TISet(t)) == t);
 function Inv0_TSeq(Ty) : Ty;
 axiom (forall t: Ty :: { TSeq(t) } Inv0_TSeq(TSeq(t)) == t);
 function Inv0_TMultiSet(Ty) : Ty;
@@ -52,6 +55,7 @@ const unique TagInt      : TyTag;
 const unique TagNat      : TyTag;
 const unique TagReal     : TyTag;
 const unique TagSet      : TyTag;
+const unique TagISet     : TyTag;
 const unique TagMultiSet : TyTag;
 const unique TagSeq      : TyTag;
 const unique TagMap      : TyTag;
@@ -64,6 +68,7 @@ axiom Tag(TInt) == TagInt;
 axiom Tag(TNat) == TagNat;
 axiom Tag(TReal) == TagReal;
 axiom (forall t: Ty    :: { TSet(t) }      Tag(TSet(t))      == TagSet);
+axiom (forall t: Ty    :: { TISet(t) }     Tag(TISet(t))     == TagISet);
 axiom (forall t: Ty    :: { TMultiSet(t) } Tag(TMultiSet(t)) == TagMultiSet);
 axiom (forall t: Ty    :: { TSeq(t) }      Tag(TSeq(t))      == TagSeq);
 axiom (forall t, u: Ty :: { TMap(t,u) }    Tag(TMap(t,u))    == TagMap);
@@ -137,6 +142,9 @@ axiom (forall bx : Box ::
 axiom (forall bx : Box, t : Ty ::
     { $IsBox(bx, TSet(t)) }
     ( $IsBox(bx, TSet(t)) ==> $Box($Unbox(bx) : Set Box) == bx && $Is($Unbox(bx) : Set Box, TSet(t))));
+axiom (forall bx : Box, t : Ty ::
+    { $IsBox(bx, TISet(t)) }
+    ( $IsBox(bx, TISet(t)) ==> $Box($Unbox(bx) : ISet Box) == bx && $Is($Unbox(bx) : ISet Box, TISet(t))));
 axiom (forall bx : Box, t : Ty ::
     { $IsBox(bx, TMultiSet(t)) }
     ( $IsBox(bx, TMultiSet(t)) ==> $Box($Unbox(bx) : MultiSet Box) == bx && $Is($Unbox(bx) : MultiSet Box, TMultiSet(t))));
@@ -187,6 +195,10 @@ axiom (forall v: Set Box, t0: Ty :: { $Is(v, TSet(t0)) }
   $Is(v, TSet(t0)) <==>
   (forall bx: Box :: { v[bx] }
     v[bx] ==> $IsBox(bx, t0)));
+axiom (forall v: ISet Box, t0: Ty :: { $Is(v, TISet(t0)) }
+  $Is(v, TISet(t0)) <==>
+  (forall bx: Box :: { v[bx] }
+    v[bx] ==> $IsBox(bx, t0)));
 axiom (forall v: MultiSet Box, t0: Ty :: { $Is(v, TMultiSet(t0)) }
   $Is(v, TMultiSet(t0)) <==>
   (forall bx: Box :: { v[bx] }
@@ -202,6 +214,10 @@ axiom (forall v: Set Box, t0: Ty, h: Heap :: { $IsAlloc(v, TSet(t0), h) }
   $IsAlloc(v, TSet(t0), h) <==>
   (forall bx: Box :: { v[bx] }
     v[bx] ==> $IsAllocBox(bx, t0, h)));
+axiom (forall v: ISet Box, t0: Ty, h: Heap :: { $IsAlloc(v, TISet(t0), h) }
+  $IsAlloc(v, TISet(t0), h) <==>
+  (forall bx: Box :: { v[bx] }
+    v[bx] ==> $IsAllocBox(bx, t0, h)));
 axiom (forall v: MultiSet Box, t0: Ty, h: Heap :: { $IsAlloc(v, TMultiSet(t0), h) }
   $IsAlloc(v, TMultiSet(t0), h) <==>
   (forall bx: Box :: { v[bx] }
@@ -544,6 +560,81 @@ function Set#Disjoint<T>(Set T, Set T): bool;
 axiom (forall<T> a: Set T, b: Set T :: { Set#Disjoint(a,b) }
   Set#Disjoint(a,b) <==> (forall o: T :: {a[o]} {b[o]} !a[o] || !b[o]));
 
+// ---------------------------------------------------------------
+// -- Axiomatization of isets -------------------------------------
+// ---------------------------------------------------------------
+
+type ISet T = [T]bool;
+
+function ISet#Empty<T>(): Set T;
+axiom (forall<T> o: T :: { ISet#Empty()[o] } !ISet#Empty()[o]);
+
+// the empty set could be of anything
+//axiom (forall<T> t: Ty :: { $Is(ISet#Empty() : [T]bool, TISet(t)) } $Is(ISet#Empty() : [T]bool, TISet(t)));
+
+
+function ISet#UnionOne<T>(ISet T, T): ISet T;
+axiom (forall<T> a: ISet T, x: T, o: T :: { ISet#UnionOne(a,x)[o] }
+  ISet#UnionOne(a,x)[o] <==> o == x || a[o]);
+axiom (forall<T> a: ISet T, x: T :: { ISet#UnionOne(a, x) }
+  ISet#UnionOne(a, x)[x]);
+axiom (forall<T> a: ISet T, x: T, y: T :: { ISet#UnionOne(a, x), a[y] }
+  a[y] ==> ISet#UnionOne(a, x)[y]);
+
+function ISet#Union<T>(ISet T, ISet T): ISet T;
+axiom (forall<T> a: ISet T, b: ISet T, o: T :: { ISet#Union(a,b)[o] }
+  ISet#Union(a,b)[o] <==> a[o] || b[o]);
+axiom (forall<T> a, b: ISet T, y: T :: { ISet#Union(a, b), a[y] }
+  a[y] ==> ISet#Union(a, b)[y]);
+axiom (forall<T> a, b: Set T, y: T :: { ISet#Union(a, b), b[y] }
+  b[y] ==> ISet#Union(a, b)[y]);
+axiom (forall<T> a, b: ISet T :: { ISet#Union(a, b) }
+  ISet#Disjoint(a, b) ==>
+    ISet#Difference(ISet#Union(a, b), a) == b &&
+    ISet#Difference(ISet#Union(a, b), b) == a);
+// Follows from the general union axiom, but might be still worth including, because disjoint union is a common case:
+// axiom (forall<T> a, b: ISet T :: { ISet#Card(ISet#Union(a, b)) }
+//   ISet#Disjoint(a, b) ==>
+//     ISet#Card(ISet#Union(a, b)) == ISet#Card(a) + ISet#Card(b));
+
+function ISet#Intersection<T>(ISet T, ISet T): ISet T;
+axiom (forall<T> a: ISet T, b: ISet T, o: T :: { ISet#Intersection(a,b)[o] }
+  ISet#Intersection(a,b)[o] <==> a[o] && b[o]);
+
+axiom (forall<T> a, b: ISet T :: { ISet#Union(ISet#Union(a, b), b) }
+  ISet#Union(ISet#Union(a, b), b) == ISet#Union(a, b));
+axiom (forall<T> a, b: Set T :: { ISet#Union(a, ISet#Union(a, b)) }
+  ISet#Union(a, ISet#Union(a, b)) == ISet#Union(a, b));
+axiom (forall<T> a, b: ISet T :: { ISet#Intersection(ISet#Intersection(a, b), b) }
+  ISet#Intersection(ISet#Intersection(a, b), b) == ISet#Intersection(a, b));
+axiom (forall<T> a, b: ISet T :: { ISet#Intersection(a, ISet#Intersection(a, b)) }
+  ISet#Intersection(a, ISet#Intersection(a, b)) == ISet#Intersection(a, b));
+
+
+function ISet#Difference<T>(ISet T, ISet T): ISet T;
+axiom (forall<T> a: ISet T, b: ISet T, o: T :: { ISet#Difference(a,b)[o] }
+  ISet#Difference(a,b)[o] <==> a[o] && !b[o]);
+axiom (forall<T> a, b: ISet T, y: T :: { ISet#Difference(a, b), b[y] }
+  b[y] ==> !ISet#Difference(a, b)[y] );
+
+function ISet#Subset<T>(ISet T, ISet T): bool;
+axiom(forall<T> a: ISet T, b: ISet T :: { ISet#Subset(a,b) }
+  ISet#Subset(a,b) <==> (forall o: T :: {a[o]} {b[o]} a[o] ==> b[o]));
+// axiom(forall<T> a: ISet T, b: ISet T ::
+//   { ISet#Subset(a,b), ISet#Card(a), ISet#Card(b) }  // very restrictive trigger
+//   ISet#Subset(a,b) ==> ISet#Card(a) <= ISet#Card(b));
+
+
+function ISet#Equal<T>(ISet T, ISet T): bool;
+axiom(forall<T> a: ISet T, b: ISet T :: { ISet#Equal(a,b) }
+  ISet#Equal(a,b) <==> (forall o: T :: {a[o]} {b[o]} a[o] <==> b[o]));
+axiom(forall<T> a: ISet T, b: ISet T :: { ISet#Equal(a,b) }  // extensionality axiom for sets
+  ISet#Equal(a,b) ==> a == b);
+
+function ISet#Disjoint<T>(ISet T, ISet T): bool;
+axiom (forall<T> a: ISet T, b: ISet T :: { ISet#Disjoint(a,b) }
+  ISet#Disjoint(a,b) <==> (forall o: T :: {a[o]} {b[o]} !a[o] || !b[o]));
+
 // ---------------------------------------------------------------
 // -- Axiomatization of multisets --------------------------------
 // ---------------------------------------------------------------
diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index f729d411..9b7bb12e 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -160,7 +160,7 @@ namespace Microsoft.Dafny
         return t;
       } else if (t is SetType) {
         var tt = (SetType)t;
-        return new SetType(CloneType(tt.Arg));
+        return new SetType(tt.Finite, CloneType(tt.Arg));
       } else if (t is SeqType) {
         var tt = (SeqType)t;
         return new SeqType(CloneType(tt.Arg));
@@ -187,7 +187,7 @@ namespace Microsoft.Dafny
         return new InferredTypeProxy();
       } else if (t is OperationTypeProxy) {
         var p = (OperationTypeProxy)t;
-        return new OperationTypeProxy(p.AllowInts, p.AllowReals, p.AllowChar, p.AllowSeq, p.AllowSetVarieties);
+        return new OperationTypeProxy(p.AllowInts, p.AllowReals, p.AllowChar, p.AllowSeq, p.AllowSetVarieties, p.AllowISet);
       } else if (t is ParamTypeProxy) {
         return new ParamTypeProxy(CloneTypeParam(((ParamTypeProxy)t).orig));
       } else {
@@ -277,7 +277,7 @@ namespace Microsoft.Dafny
       } else if (expr is DisplayExpression) {
         DisplayExpression e = (DisplayExpression)expr;
         if (expr is SetDisplayExpr) {
-          return new SetDisplayExpr(Tok(e.tok), e.Elements.ConvertAll(CloneExpr));
+          return new SetDisplayExpr(Tok(e.tok), ((SetDisplayExpr)expr).Finite, e.Elements.ConvertAll(CloneExpr));
         } else if (expr is MultiSetDisplayExpr) {
           return new MultiSetDisplayExpr(Tok(e.tok), e.Elements.ConvertAll(CloneExpr));
         } else {
@@ -384,7 +384,8 @@ namespace Microsoft.Dafny
           return new LambdaExpr(tk, l.OneShot, bvs, range, l.Reads.ConvertAll(CloneFrameExpr), term);
         } else {
           Contract.Assert(e is SetComprehension);
-          return new SetComprehension(tk, bvs, range, term, CloneAttributes(e.Attributes));
+          var tt = (SetComprehension)e;
+          return new SetComprehension(tk, tt.Finite, bvs, range, term, CloneAttributes(e.Attributes));
         }
 
       } else if (expr is WildcardExpr) {
diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index 16cc09eb..b2b40629 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -175,6 +175,9 @@ bool IsMapDisplay() {
 bool IsIMapDisplay() {
   return la.kind == _imap && scanner.Peek().kind == _lbracket;
 }
+bool IsISetDisplay() {
+  return la.kind == _iset && scanner.Peek().kind == _lbrace;
+}
 
 bool IsSuffix() {
   return la.kind == _dot || la.kind == _lbracket || la.kind == _openparen;
@@ -334,6 +337,7 @@ bool IsType(ref IToken pt) {
       return true;
     case _arrayToken:
     case _set:
+    case _iset:
     case _multiset:
     case _seq:
     case _map:
@@ -416,6 +420,7 @@ TOKENS
   object = "object".
   string = "string".
   set = "set".
+  iset = "iset".
   multiset = "multiset".
   seq = "seq".
   map = "map".
@@ -754,7 +759,7 @@ NewtypeDecl<ModuleDefinition module, out TopLevelDecl td>
   "="
   ( IF(IsIdentColonOrBar())
     NoUSIdent<out bvId>
-    [ ":" Type<out baseType> ]       (. if (baseType == null) { baseType = new OperationTypeProxy(true, true, false, false, false); } .)
+    [ ":" Type<out baseType> ]       (. if (baseType == null) { baseType = new OperationTypeProxy(true, true, false, false, false, false); } .)
     "|"
     Expression<out wh, false, true>  (. td = new NewtypeDecl(theVerifyThisFile ? id : new IncludeToken(id), id.val, module, new BoundVar(bvId, bvId.val, baseType), wh, attrs); .)
   | Type<out baseType>               (. td = new NewtypeDecl(theVerifyThisFile ? id : new IncludeToken(id), id.val, module, baseType, attrs); .)
@@ -1139,7 +1144,13 @@ TypeAndToken<out IToken tok, out Type ty>
     [ GenericInstantiation<gt> ]    (. if (gt.Count > 1) {
                                          SemErr("set type expects only one type argument");
                                        }
-                                       ty = new SetType(gt.Count == 1 ? gt[0] : null);
+                                       ty = new SetType(true, gt.Count == 1 ? gt[0] : null);
+                                    .)
+  | "iset"                          (. tok = t;  gt = new List<Type>(); .)
+    [ GenericInstantiation<gt> ]    (. if (gt.Count > 1) {
+                                         SemErr("set type expects only one type argument");
+                                       }
+                                       ty = new SetType(false, gt.Count == 1 ? gt[0] : null);
                                     .)
   | "multiset"                      (. tok = t;  gt = new List<Type>(); .)
     [ GenericInstantiation<gt> ]    (. if (gt.Count > 1) {
@@ -2324,10 +2335,13 @@ UnaryExpression<out Expression e, bool allowSemi, bool allowLambda>
     "imap"                                          (. x = t; .)
     MapDisplayExpr<x, false, out e>
     { IF(IsSuffix()) Suffix<ref e> }
+  | IF(IsISetDisplay())  /* this alternative must be checked before going into EndlessExpression, where there is another "iset" */
+    "iset"                                          (. x = t; .)
+    ISetDisplayExpr<x, false, out e>
+    { IF(IsSuffix()) Suffix<ref e> }
   | IF(IsLambda(allowLambda))
     LambdaExpression<out e, allowSemi>  /* this is an endless expression */
   | EndlessExpression<out e, allowSemi, allowLambda>
-
   | NameSegment<out e>
     { IF(IsSuffix()) Suffix<ref e> }
   | DisplayExpr<out e>
@@ -2432,13 +2446,22 @@ ParensExpression<out Expression e, bool allowSemi, bool allowLambda>
      }
   .)
   .
+ISetDisplayExpr<IToken/*!*/ setToken, bool finite, out Expression e>
+= (. Contract.Ensures(Contract.ValueAtReturn(out e) != null);
+     List<Expression> elements = new List<Expression/*!*/>();;
+     e = dummyExpr;
+  .)
+  "{"
+      [ Expressions<elements> ]                (. e = new SetDisplayExpr(setToken, finite, elements);.)
+  "}"
+  .
 DisplayExpr<out Expression e>
 = (. Contract.Ensures(Contract.ValueAtReturn(out e) != null);
      IToken x;  List<Expression> elements;
      e = dummyExpr;
   .)
   ( "{"                                        (. x = t;  elements = new List<Expression/*!*/>(); .)
-      [ Expressions<elements> ]                (. e = new SetDisplayExpr(x, elements);.)
+      [ Expressions<elements> ]                (. e = new SetDisplayExpr(x, true, elements);.)
     "}"
   | "["                                        (. x = t;  elements = new List<Expression/*!*/>(); .)
       [ Expressions<elements> ]                (. e = new SeqDisplayExpr(x, elements); .)
@@ -2503,7 +2526,10 @@ EndlessExpression<out Expression e, bool allowSemi, bool allowLambda>
     "else" Expression<out e1, allowSemi, allowLambda>    (. e = new ITEExpr(x, e, e0, e1); .)
   | MatchExpression<out e, allowSemi, allowLambda>
   | QuantifierGuts<out e, allowSemi, allowLambda>
-  | SetComprehensionExpr<out e, allowSemi, allowLambda>
+  | "set"                           (. x = t; .)
+    SetComprehensionExpr<x, true, out e, allowSemi, allowLambda>
+  | "iset"                           (. x = t; .)
+    SetComprehensionExpr<x, false, out e, allowSemi, allowLambda>
   | StmtInExpr<out s>
     Expression<out e, allowSemi, allowLambda>            (. e = new StmtExpr(s.Tok, s, e); .)
   | LetExpr<out e, allowSemi, allowLambda>
@@ -2842,16 +2868,14 @@ QuantifierDomain<.out List<BoundVar> bvars, out Attributes attrs, out Expression
   ]
   .
 
-SetComprehensionExpr<out Expression q, bool allowSemi, bool allowLambda>
+SetComprehensionExpr<IToken setToken, bool finite, out Expression q, bool allowSemi, bool allowLambda>
 = (. Contract.Ensures(Contract.ValueAtReturn(out q) != null);
-     IToken x = Token.NoToken;
      BoundVar bv;
      List<BoundVar/*!*/> bvars = new List<BoundVar>();
      Expression range;
      Expression body = null;
      Attributes attrs = null;
   .)
-  "set"                                        (. x = t; .)
   IdentTypeOptional<out bv>                    (. bvars.Add(bv); .)
   { ","
     IdentTypeOptional<out bv>                  (. bvars.Add(bv); .)
@@ -2863,7 +2887,7 @@ SetComprehensionExpr<out Expression q, bool allowSemi, bool allowLambda>
     Expression<out body, allowSemi, allowLambda>
   ]
   (. if (body == null && bvars.Count != 1) { SemErr(t, "a set comprehension with more than one bound variable must have a term expression"); }
-     q = new SetComprehension(x, bvars, range, body, attrs);
+     q = new SetComprehension(setToken, finite, bvars, range, body, attrs);
   .)
   .
 Expressions<.List<Expression> args.>
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index a94b9a1b..b8660f98 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -165,7 +165,7 @@ namespace Microsoft.Dafny {
         var argExprs = args.ConvertAll(a =>
               (Expression)new IdentifierExpr(tok, a.Name) { Var = a, Type = a.Type });
         var readsIS = new FunctionCallExpr(tok, "reads", new ImplicitThisExpr(tok), tok, argExprs) {
-          Type = new SetType(new ObjectType()),
+          Type = new SetType(true, new ObjectType()),
         };
         var readsFrame = new List<FrameExpression> { new FrameExpression(tok, readsIS, null) };
         var req = new Function(tok, "requires", false, false, true,
@@ -174,7 +174,7 @@ namespace Microsoft.Dafny {
           new Specification<Expression>(new List<Expression>(), null),
           null, null, null);
         var reads = new Function(tok, "reads", false, false, true,
-          new List<TypeParameter>(), args, new SetType(new ObjectType()),
+          new List<TypeParameter>(), args, new SetType(true, new ObjectType()),
           new List<Expression>(), readsFrame, new List<Expression>(),
           new Specification<Expression>(new List<Expression>(), null),
           null, null, null);
@@ -535,6 +535,12 @@ namespace Microsoft.Dafny {
         return t != null && !t.Finite;
       }
     }
+    public bool IsISetType {
+      get {
+        var t = NormalizeExpand() as SetType;
+        return t != null && !t.Finite;
+      }
+    }
     public NewtypeDecl AsNewtype {
       get {
         var udt = NormalizeExpand() as UserDefinedType;
@@ -633,7 +639,7 @@ namespace Microsoft.Dafny {
     /// </summary>
     public bool IsOrdered {
       get {
-        return !IsTypeParameter && !IsCoDatatype && !IsArrowType && !IsIMapType;
+        return !IsTypeParameter && !IsCoDatatype && !IsArrowType && !IsIMapType && !IsISetType;
       }
     }
 
@@ -859,17 +865,25 @@ namespace Microsoft.Dafny {
   }
 
   public class SetType : CollectionType {
-    public SetType(Type arg) : base(arg) {
+    private bool finite;
+
+    public bool Finite {
+      get { return finite; }
+      set { finite = value; }
     }
-    public override string CollectionTypeName { get { return "set"; } }
+
+    public SetType(bool finite, Type arg) : base(arg) {
+      this.finite = finite;
+    }
+    public override string CollectionTypeName { get { return finite ? "set" : "iset"; } }
     [Pure]
     public override bool Equals(Type that) {
       var t = that.NormalizeExpand() as SetType;
-      return t != null && Arg.Equals(t.Arg);
+      return t != null && Finite == t.Finite && Arg.Equals(t.Arg);
     }
     public override bool PossiblyEquals_W(Type that) {
       var t = that as SetType;
-      return t != null && Arg.PossiblyEquals(t.Arg);
+      return t != null && Finite == t.Finite && Arg.PossiblyEquals(t.Arg);
     }
   }
 
@@ -1312,20 +1326,22 @@ namespace Microsoft.Dafny {
 
   /// <summary>
   /// This proxy stands for:
-  ///     set(Arg) or multiset(Arg) or seq(Arg) or map(Arg, anyRange) or imap(Arg, anyRange)
+  ///     set(Arg) or iset(Arg) or multiset(Arg) or seq(Arg) or map(Arg, anyRange) or imap(Arg, anyRange)
   /// </summary>
   public class CollectionTypeProxy : RestrictedTypeProxy {
     public readonly Type Arg;
     public readonly bool AllowIMap;
+    public readonly bool AllowISet;
     [ContractInvariantMethod]
     void ObjectInvariant() {
       Contract.Invariant(Arg != null);
     }
 
-    public CollectionTypeProxy(Type arg, bool allowIMap) {
+    public CollectionTypeProxy(Type arg, bool allowIMap, bool allowISet) {
       Contract.Requires(arg != null);
       Arg = arg;
       AllowIMap = allowIMap;
+      AllowISet = allowISet;
     }
     public override int OrderID {
       get {
@@ -1338,6 +1354,7 @@ namespace Microsoft.Dafny {
   /// This proxy can stand for any numeric type.
   /// In addition, if AllowSeq, then it can stand for a seq.
   /// In addition, if AllowSetVarieties, it can stand for a set or multiset.
+  /// In addition, if AllowISet, then it can stand for a iset
   /// </summary>
   public class OperationTypeProxy : RestrictedTypeProxy {
     public readonly bool AllowInts;
@@ -1345,13 +1362,14 @@ namespace Microsoft.Dafny {
     public readonly bool AllowChar;
     public readonly bool AllowSeq;
     public readonly bool AllowSetVarieties;
+    public readonly bool AllowISet;
     public bool JustInts {
-      get { return AllowInts && !AllowReals && !AllowChar && !AllowSeq && !AllowSetVarieties; }
+      get { return AllowInts && !AllowReals && !AllowChar && !AllowSeq && !AllowSetVarieties && !AllowISet; }
     }
     public bool JustReals {
-      get { return !AllowInts && AllowReals && !AllowChar && !AllowSeq && !AllowSetVarieties; }
+      get { return !AllowInts && AllowReals && !AllowChar && !AllowSeq && !AllowSetVarieties && !AllowISet; }
     }
-    public OperationTypeProxy(bool allowInts, bool allowReals, bool allowChar, bool allowSeq, bool allowSetVarieties) {
+    public OperationTypeProxy(bool allowInts, bool allowReals, bool allowChar, bool allowSeq, bool allowSetVarieties, bool allowISet) {
       Contract.Requires(allowInts || allowReals || allowChar || allowSeq || allowSetVarieties);  // don't allow unsatisfiable constraint
       Contract.Requires(!(!allowInts && !allowReals && allowChar && !allowSeq && !allowSetVarieties));  // to constrain to just char, don't use a proxy
       AllowInts = allowInts;
@@ -1359,6 +1377,7 @@ namespace Microsoft.Dafny {
       AllowChar = allowChar;
       AllowSeq = allowSeq;
       AllowSetVarieties = allowSetVarieties;
+      AllowISet = allowISet;
     }
     public override int OrderID {
       get {
@@ -5691,10 +5710,12 @@ namespace Microsoft.Dafny {
   }
 
   public class SetDisplayExpr : DisplayExpression {
-    public SetDisplayExpr(IToken tok, List<Expression> elements)
+    public bool Finite;
+    public SetDisplayExpr(IToken tok, bool finite, List<Expression> elements)
       : base(tok, elements) {
       Contract.Requires(tok != null);
       Contract.Requires(cce.NonNullElements(elements));
+      Finite = finite;
     }
   }
 
@@ -6683,9 +6704,10 @@ namespace Microsoft.Dafny {
 
   public class SetComprehension : ComprehensionExpr
   {
+    public readonly bool Finite;
     public readonly bool TermIsImplicit;
 
-    public SetComprehension(IToken tok, List<BoundVar> bvars, Expression range, Expression term, Attributes attrs)
+    public SetComprehension(IToken tok, bool finite, List<BoundVar> bvars, Expression range, Expression term, Attributes attrs)
       : base(tok, bvars, range, term ?? new IdentifierExpr(tok, bvars[0].Name), attrs) {
       Contract.Requires(tok != null);
       Contract.Requires(cce.NonNullElements(bvars));
@@ -6693,6 +6715,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(range != null);
 
       TermIsImplicit = term == null;
+      Finite = finite;
     }
   }
   public class MapComprehension : ComprehensionExpr
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index 162e23a3..fa41877f 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -27,51 +27,52 @@ public class Parser {
 	public const int _object = 11;
 	public const int _string = 12;
 	public const int _set = 13;
-	public const int _multiset = 14;
-	public const int _seq = 15;
-	public const int _map = 16;
-	public const int _imap = 17;
-	public const int _charToken = 18;
-	public const int _stringToken = 19;
-	public const int _colon = 20;
-	public const int _comma = 21;
-	public const int _verticalbar = 22;
-	public const int _doublecolon = 23;
-	public const int _bullet = 24;
-	public const int _dot = 25;
-	public const int _semi = 26;
-	public const int _darrow = 27;
-	public const int _arrow = 28;
-	public const int _assume = 29;
-	public const int _calc = 30;
-	public const int _case = 31;
-	public const int _then = 32;
-	public const int _else = 33;
-	public const int _decreases = 34;
-	public const int _invariant = 35;
-	public const int _function = 36;
-	public const int _predicate = 37;
-	public const int _inductive = 38;
-	public const int _lemma = 39;
-	public const int _copredicate = 40;
-	public const int _modifies = 41;
-	public const int _reads = 42;
-	public const int _requires = 43;
-	public const int _lbrace = 44;
-	public const int _rbrace = 45;
-	public const int _lbracket = 46;
-	public const int _rbracket = 47;
-	public const int _openparen = 48;
-	public const int _closeparen = 49;
-	public const int _openAngleBracket = 50;
-	public const int _closeAngleBracket = 51;
-	public const int _eq = 52;
-	public const int _neq = 53;
-	public const int _neqAlt = 54;
-	public const int _star = 55;
-	public const int _notIn = 56;
-	public const int _ellipsis = 57;
-	public const int maxT = 136;
+	public const int _iset = 14;
+	public const int _multiset = 15;
+	public const int _seq = 16;
+	public const int _map = 17;
+	public const int _imap = 18;
+	public const int _charToken = 19;
+	public const int _stringToken = 20;
+	public const int _colon = 21;
+	public const int _comma = 22;
+	public const int _verticalbar = 23;
+	public const int _doublecolon = 24;
+	public const int _bullet = 25;
+	public const int _dot = 26;
+	public const int _semi = 27;
+	public const int _darrow = 28;
+	public const int _arrow = 29;
+	public const int _assume = 30;
+	public const int _calc = 31;
+	public const int _case = 32;
+	public const int _then = 33;
+	public const int _else = 34;
+	public const int _decreases = 35;
+	public const int _invariant = 36;
+	public const int _function = 37;
+	public const int _predicate = 38;
+	public const int _inductive = 39;
+	public const int _lemma = 40;
+	public const int _copredicate = 41;
+	public const int _modifies = 42;
+	public const int _reads = 43;
+	public const int _requires = 44;
+	public const int _lbrace = 45;
+	public const int _rbrace = 46;
+	public const int _lbracket = 47;
+	public const int _rbracket = 48;
+	public const int _openparen = 49;
+	public const int _closeparen = 50;
+	public const int _openAngleBracket = 51;
+	public const int _closeAngleBracket = 52;
+	public const int _eq = 53;
+	public const int _neq = 54;
+	public const int _neqAlt = 55;
+	public const int _star = 56;
+	public const int _notIn = 57;
+	public const int _ellipsis = 58;
+	public const int maxT = 137;
 
 	const bool _T = true;
 	const bool _x = false;
@@ -245,6 +246,9 @@ bool IsMapDisplay() {
 bool IsIMapDisplay() {
   return la.kind == _imap && scanner.Peek().kind == _lbracket;
 }
+bool IsISetDisplay() {
+  return la.kind == _iset && scanner.Peek().kind == _lbrace;
+}
 
 bool IsSuffix() {
   return la.kind == _dot || la.kind == _lbracket || la.kind == _openparen;
@@ -404,6 +408,7 @@ bool IsType(ref IToken pt) {
       return true;
     case _arrayToken:
     case _set:
+    case _iset:
     case _multiset:
     case _seq:
     case _map:
@@ -515,9 +520,9 @@ bool IsType(ref IToken pt) {
 		TraitDecl/*!*/ trait;
 		Contract.Assert(defaultModule != null);
 		
-		while (la.kind == 58) {
+		while (la.kind == 59) {
 			Get();
-			Expect(19);
+			Expect(20);
 			{
 			 string parsedFile = t.filename;
 			 bool isVerbatimString;
@@ -535,42 +540,42 @@ bool IsType(ref IToken pt) {
 		}
 		while (StartOf(1)) {
 			switch (la.kind) {
-			case 59: case 60: case 62: {
+			case 60: case 61: case 63: {
 				SubModuleDecl(defaultModule, out submodule);
 				defaultModule.TopLevelDecls.Add(submodule); 
 				break;
 			}
-			case 67: {
+			case 68: {
 				ClassDecl(defaultModule, out c);
 				defaultModule.TopLevelDecls.Add(c); 
 				break;
 			}
-			case 73: case 74: {
+			case 74: case 75: {
 				DatatypeDecl(defaultModule, out dt);
 				defaultModule.TopLevelDecls.Add(dt); 
 				break;
 			}
-			case 76: {
+			case 77: {
 				NewtypeDecl(defaultModule, out td);
 				defaultModule.TopLevelDecls.Add(td); 
 				break;
 			}
-			case 77: {
+			case 78: {
 				OtherTypeDecl(defaultModule, out td);
 				defaultModule.TopLevelDecls.Add(td); 
 				break;
 			}
-			case 78: {
+			case 79: {
 				IteratorDecl(defaultModule, out iter);
 				defaultModule.TopLevelDecls.Add(iter); 
 				break;
 			}
-			case 69: {
+			case 70: {
 				TraitDecl(defaultModule, out trait);
 				defaultModule.TopLevelDecls.Add(trait); 
 				break;
 			}
-			case 36: case 37: case 38: case 39: case 40: case 70: case 71: case 72: case 75: case 81: case 82: case 83: case 84: {
+			case 37: case 38: case 39: case 40: case 41: case 71: case 72: case 73: case 76: case 82: case 83: case 84: case 85: {
 				ClassMemberDecl(membersDefaultClass, false, !DafnyOptions.O.AllowGlobals);
 				break;
 			}
@@ -603,94 +608,94 @@ bool IsType(ref IToken pt) {
 		bool isAbstract = false;
 		bool opened = false;
 		
-		if (la.kind == 59 || la.kind == 60) {
-			if (la.kind == 59) {
+		if (la.kind == 60 || la.kind == 61) {
+			if (la.kind == 60) {
 				Get();
 				isAbstract = true; 
 			}
-			Expect(60);
-			while (la.kind == 44) {
+			Expect(61);
+			while (la.kind == 45) {
 				Attribute(ref attrs);
 			}
 			NoUSIdent(out id);
-			if (la.kind == 61) {
+			if (la.kind == 62) {
 				Get();
 				QualifiedModuleName(out idRefined);
 			}
 			module = new ModuleDefinition(id, id.val, isAbstract, false, idRefined == null ? null : idRefined, parent, attrs, false); 
-			Expect(44);
+			Expect(45);
 			module.BodyStartTok = t; 
 			while (StartOf(1)) {
 				switch (la.kind) {
-				case 59: case 60: case 62: {
+				case 60: case 61: case 63: {
 					SubModuleDecl(module, out sm);
 					module.TopLevelDecls.Add(sm); 
 					break;
 				}
-				case 67: {
+				case 68: {
 					ClassDecl(module, out c);
 					module.TopLevelDecls.Add(c); 
 					break;
 				}
-				case 69: {
+				case 70: {
 					TraitDecl(module, out trait);
 					module.TopLevelDecls.Add(trait); 
 					break;
 				}
-				case 73: case 74: {
+				case 74: case 75: {
 					DatatypeDecl(module, out dt);
 					module.TopLevelDecls.Add(dt); 
 					break;
 				}
-				case 76: {
+				case 77: {
 					NewtypeDecl(module, out td);
 					module.TopLevelDecls.Add(td); 
 					break;
 				}
-				case 77: {
+				case 78: {
 					OtherTypeDecl(module, out td);
 					module.TopLevelDecls.Add(td); 
 					break;
 				}
-				case 78: {
+				case 79: {
 					IteratorDecl(module, out iter);
 					module.TopLevelDecls.Add(iter); 
 					break;
 				}
-				case 36: case 37: case 38: case 39: case 40: case 70: case 71: case 72: case 75: case 81: case 82: case 83: case 84: {
+				case 37: case 38: case 39: case 40: case 41: case 71: case 72: case 73: case 76: case 82: case 83: case 84: case 85: {
 					ClassMemberDecl(namedModuleDefaultClassMembers, false, !DafnyOptions.O.AllowGlobals);
 					break;
 				}
 				}
 			}
-			Expect(45);
+			Expect(46);
 			module.BodyEndTok = t;
 			module.TopLevelDecls.Add(new DefaultClassDecl(module, namedModuleDefaultClassMembers));
 			submodule = new LiteralModuleDecl(module, parent); 
-		} else if (la.kind == 62) {
+		} else if (la.kind == 63) {
 			Get();
-			if (la.kind == 63) {
+			if (la.kind == 64) {
 				Get();
 				opened = true;
 			}
 			NoUSIdent(out id);
-			if (la.kind == 64 || la.kind == 65) {
-				if (la.kind == 64) {
+			if (la.kind == 65 || la.kind == 66) {
+				if (la.kind == 65) {
 					Get();
 					QualifiedModuleName(out idPath);
 					submodule = new AliasModuleDecl(idPath, id, parent, opened); 
 				} else {
 					Get();
 					QualifiedModuleName(out idPath);
-					if (la.kind == 66) {
+					if (la.kind == 67) {
 						Get();
 						QualifiedModuleName(out idAssignment);
 					}
 					submodule = new ModuleFacadeDecl(idPath, id, parent, idAssignment, opened); 
 				}
 			}
-			if (la.kind == 26) {
-				while (!(la.kind == 0 || la.kind == 26)) {SynErr(137); Get();}
+			if (la.kind == 27) {
+				while (!(la.kind == 0 || la.kind == 27)) {SynErr(138); Get();}
 				Get();
 				errors.Warning(t, "the semi-colon that used to terminate a sub-module declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 			}
@@ -700,7 +705,7 @@ bool IsType(ref IToken pt) {
 			 submodule = new AliasModuleDecl(idPath, id, parent, opened);
 			}
 			
-		} else SynErr(138);
+		} else SynErr(139);
 	}
 
 	void ClassDecl(ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c) {
@@ -714,31 +719,31 @@ bool IsType(ref IToken pt) {
 		List<MemberDecl/*!*/> members = new List<MemberDecl/*!*/>();
 		IToken bodyStart;
 		
-		while (!(la.kind == 0 || la.kind == 67)) {SynErr(139); Get();}
-		Expect(67);
-		while (la.kind == 44) {
+		while (!(la.kind == 0 || la.kind == 68)) {SynErr(140); Get();}
+		Expect(68);
+		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		if (la.kind == 50) {
+		if (la.kind == 51) {
 			GenericParameters(typeArgs);
 		}
-		if (la.kind == 68) {
+		if (la.kind == 69) {
 			Get();
 			Type(out trait);
 			traits.Add(trait); 
-			while (la.kind == 21) {
+			while (la.kind == 22) {
 				Get();
 				Type(out trait);
 				traits.Add(trait); 
 			}
 		}
-		Expect(44);
+		Expect(45);
 		bodyStart = t;  
 		while (StartOf(2)) {
 			ClassMemberDecl(members, true, false);
 		}
-		Expect(45);
+		Expect(46);
 		c = new ClassDecl(id, id.val, module, typeArgs, members, attrs, traits);
 		c.BodyStartTok = bodyStart;
 		c.BodyEndTok = t;
@@ -755,29 +760,29 @@ bool IsType(ref IToken pt) {
 		IToken bodyStart = Token.NoToken;  // dummy assignment
 		bool co = false;
 		
-		while (!(la.kind == 0 || la.kind == 73 || la.kind == 74)) {SynErr(140); Get();}
-		if (la.kind == 73) {
+		while (!(la.kind == 0 || la.kind == 74 || la.kind == 75)) {SynErr(141); Get();}
+		if (la.kind == 74) {
 			Get();
-		} else if (la.kind == 74) {
+		} else if (la.kind == 75) {
 			Get();
 			co = true; 
-		} else SynErr(141);
-		while (la.kind == 44) {
+		} else SynErr(142);
+		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		if (la.kind == 50) {
+		if (la.kind == 51) {
 			GenericParameters(typeArgs);
 		}
-		Expect(64);
+		Expect(65);
 		bodyStart = t; 
 		DatatypeMemberDecl(ctors);
-		while (la.kind == 22) {
+		while (la.kind == 23) {
 			Get();
 			DatatypeMemberDecl(ctors);
 		}
-		if (la.kind == 26) {
-			while (!(la.kind == 0 || la.kind == 26)) {SynErr(142); Get();}
+		if (la.kind == 27) {
+			while (!(la.kind == 0 || la.kind == 27)) {SynErr(143); Get();}
 			Get();
 			errors.Warning(t, "the semi-colon that used to terminate a (co)datatype declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 		}
@@ -798,26 +803,26 @@ bool IsType(ref IToken pt) {
 		Type baseType = null;
 		Expression wh;
 		
-		Expect(76);
-		while (la.kind == 44) {
+		Expect(77);
+		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		Expect(64);
+		Expect(65);
 		if (IsIdentColonOrBar()) {
 			NoUSIdent(out bvId);
-			if (la.kind == 20) {
+			if (la.kind == 21) {
 				Get();
 				Type(out baseType);
 			}
-			if (baseType == null) { baseType = new OperationTypeProxy(true, true, false, false, false); } 
-			Expect(22);
+			if (baseType == null) { baseType = new OperationTypeProxy(true, true, false, false, false, false); } 
+			Expect(23);
 			Expression(out wh, false, true);
 			td = new NewtypeDecl(theVerifyThisFile ? id : new IncludeToken(id), id.val, module, new BoundVar(bvId, bvId.val, baseType), wh, attrs); 
 		} else if (StartOf(3)) {
 			Type(out baseType);
 			td = new NewtypeDecl(theVerifyThisFile ? id : new IncludeToken(id), id.val, module, baseType, attrs); 
-		} else SynErr(143);
+		} else SynErr(144);
 	}
 
 	void OtherTypeDecl(ModuleDefinition module, out TopLevelDecl td) {
@@ -828,35 +833,35 @@ bool IsType(ref IToken pt) {
 		td = null;
 		Type ty;
 		
-		Expect(77);
-		while (la.kind == 44) {
+		Expect(78);
+		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		if (la.kind == 48) {
+		if (la.kind == 49) {
 			Get();
-			Expect(52);
-			Expect(49);
+			Expect(53);
+			Expect(50);
 			eqSupport = TypeParameter.EqualitySupportValue.Required; 
-			if (la.kind == 50) {
+			if (la.kind == 51) {
 				GenericParameters(typeArgs);
 			}
 		} else if (StartOf(4)) {
-			if (la.kind == 50) {
+			if (la.kind == 51) {
 				GenericParameters(typeArgs);
 			}
-			if (la.kind == 64) {
+			if (la.kind == 65) {
 				Get();
 				Type(out ty);
 				td = new TypeSynonymDecl(id, id.val, typeArgs, module, ty, attrs); 
 			}
-		} else SynErr(144);
+		} else SynErr(145);
 		if (td == null) {
 		 td = new OpaqueTypeDecl(id, id.val, module, eqSupport, typeArgs, attrs);
 		}
 		
-		if (la.kind == 26) {
-			while (!(la.kind == 0 || la.kind == 26)) {SynErr(145); Get();}
+		if (la.kind == 27) {
+			while (!(la.kind == 0 || la.kind == 27)) {SynErr(146); Get();}
 			Get();
 			errors.Warning(t, "the semi-colon that used to terminate an opaque-type declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 		}
@@ -885,19 +890,19 @@ bool IsType(ref IToken pt) {
 		IToken bodyStart = Token.NoToken;
 		IToken bodyEnd = Token.NoToken;
 		
-		while (!(la.kind == 0 || la.kind == 78)) {SynErr(146); Get();}
-		Expect(78);
-		while (la.kind == 44) {
+		while (!(la.kind == 0 || la.kind == 79)) {SynErr(147); Get();}
+		Expect(79);
+		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		if (la.kind == 48 || la.kind == 50) {
-			if (la.kind == 50) {
+		if (la.kind == 49 || la.kind == 51) {
+			if (la.kind == 51) {
 				GenericParameters(typeArgs);
 			}
 			Formals(true, true, ins);
-			if (la.kind == 79 || la.kind == 80) {
-				if (la.kind == 79) {
+			if (la.kind == 80 || la.kind == 81) {
+				if (la.kind == 80) {
 					Get();
 				} else {
 					Get();
@@ -905,14 +910,14 @@ bool IsType(ref IToken pt) {
 				}
 				Formals(false, true, outs);
 			}
-		} else if (la.kind == 57) {
+		} else if (la.kind == 58) {
 			Get();
 			signatureEllipsis = t; 
-		} else SynErr(147);
+		} else SynErr(148);
 		while (StartOf(5)) {
 			IteratorSpec(reads, mod, decreases, req, ens, yieldReq, yieldEns, ref readsAttrs, ref modAttrs, ref decrAttrs);
 		}
-		if (la.kind == 44) {
+		if (la.kind == 45) {
 			BlockStmt(out body, out bodyStart, out bodyEnd);
 		}
 		iter = new IteratorDecl(id, id.val, module, typeArgs, ins, outs,
@@ -935,21 +940,21 @@ bool IsType(ref IToken pt) {
 		List<MemberDecl/*!*/> members = new List<MemberDecl/*!*/>();
 		IToken bodyStart;
 		
-		while (!(la.kind == 0 || la.kind == 69)) {SynErr(148); Get();}
-		Expect(69);
-		while (la.kind == 44) {
+		while (!(la.kind == 0 || la.kind == 70)) {SynErr(149); Get();}
+		Expect(70);
+		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		if (la.kind == 50) {
+		if (la.kind == 51) {
 			GenericParameters(typeArgs);
 		}
-		Expect(44);
+		Expect(45);
 		bodyStart = t; 
 		while (StartOf(2)) {
 			ClassMemberDecl(members, true, false);
 		}
-		Expect(45);
+		Expect(46);
 		trait = new TraitDecl(id, id.val, module, typeArgs, members, attrs);
 		trait.BodyStartTok = bodyStart;
 		trait.BodyEndTok = t;
@@ -963,11 +968,11 @@ bool IsType(ref IToken pt) {
 		MemberModifiers mmod = new MemberModifiers();
 		IToken staticToken = null, protectedToken = null;
 		
-		while (la.kind == 70 || la.kind == 71 || la.kind == 72) {
-			if (la.kind == 70) {
+		while (la.kind == 71 || la.kind == 72 || la.kind == 73) {
+			if (la.kind == 71) {
 				Get();
 				mmod.IsGhost = true; 
-			} else if (la.kind == 71) {
+			} else if (la.kind == 72) {
 				Get();
 				mmod.IsStatic = true; staticToken = t; 
 			} else {
@@ -975,7 +980,7 @@ bool IsType(ref IToken pt) {
 				mmod.IsProtected = true; protectedToken = t; 
 			}
 		}
-		if (la.kind == 75) {
+		if (la.kind == 76) {
 			if (moduleLevelDecl) {
 			 SemErr(la, "fields are not allowed to be declared at the module level; instead, wrap the field in a 'class' declaration");
 			 mmod.IsStatic = false;
@@ -1003,21 +1008,21 @@ bool IsType(ref IToken pt) {
 			
 			MethodDecl(mmod, allowConstructors, out m);
 			mm.Add(m); 
-		} else SynErr(149);
+		} else SynErr(150);
 	}
 
 	void Attribute(ref Attributes attrs) {
 		string name;
 		var args = new List<Expression>();
 		
-		Expect(44);
-		Expect(20);
+		Expect(45);
+		Expect(21);
 		Expect(1);
 		name = t.val; 
 		if (StartOf(7)) {
 			Expressions(args);
 		}
-		Expect(45);
+		Expect(46);
 		attrs = new Attributes(name, args, attrs); 
 	}
 
@@ -1035,7 +1040,7 @@ bool IsType(ref IToken pt) {
 		IToken id; ids = new List<IToken>(); 
 		Ident(out id);
 		ids.Add(id); 
-		while (la.kind == 25) {
+		while (la.kind == 26) {
 			Get();
 			Ident(out id);
 			ids.Add(id); 
@@ -1053,29 +1058,29 @@ bool IsType(ref IToken pt) {
 		IToken/*!*/ id;
 		TypeParameter.EqualitySupportValue eqSupport;
 		
-		Expect(50);
+		Expect(51);
 		NoUSIdent(out id);
 		eqSupport = TypeParameter.EqualitySupportValue.Unspecified; 
-		if (la.kind == 48) {
+		if (la.kind == 49) {
 			Get();
-			Expect(52);
-			Expect(49);
+			Expect(53);
+			Expect(50);
 			eqSupport = TypeParameter.EqualitySupportValue.Required; 
 		}
 		typeArgs.Add(new TypeParameter(id, id.val, eqSupport)); 
-		while (la.kind == 21) {
+		while (la.kind == 22) {
 			Get();
 			NoUSIdent(out id);
 			eqSupport = TypeParameter.EqualitySupportValue.Unspecified; 
-			if (la.kind == 48) {
+			if (la.kind == 49) {
 				Get();
-				Expect(52);
-				Expect(49);
+				Expect(53);
+				Expect(50);
 				eqSupport = TypeParameter.EqualitySupportValue.Required; 
 			}
 			typeArgs.Add(new TypeParameter(id, id.val, eqSupport)); 
 		}
-		Expect(51);
+		Expect(52);
 	}
 
 	void Type(out Type ty) {
@@ -1088,16 +1093,16 @@ bool IsType(ref IToken pt) {
 		Attributes attrs = null;
 		IToken/*!*/ id;  Type/*!*/ ty;
 		
-		while (!(la.kind == 0 || la.kind == 75)) {SynErr(150); Get();}
-		Expect(75);
+		while (!(la.kind == 0 || la.kind == 76)) {SynErr(151); Get();}
+		Expect(76);
 		if (mmod.IsStatic) { SemErr(t, "fields cannot be declared 'static'"); }
 		
-		while (la.kind == 44) {
+		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
 		FIdentType(out id, out ty);
 		mm.Add(new Field(id, id.val, mmod.IsGhost, ty, attrs)); 
-		while (la.kind == 21) {
+		while (la.kind == 22) {
 			Get();
 			FIdentType(out id, out ty);
 			mm.Add(new Field(id, id.val, mmod.IsGhost, ty, attrs)); 
@@ -1124,111 +1129,111 @@ bool IsType(ref IToken pt) {
 		IToken signatureEllipsis = null;
 		bool missingOpenParen;
 		
-		if (la.kind == 36) {
+		if (la.kind == 37) {
 			Get();
-			if (la.kind == 81) {
+			if (la.kind == 82) {
 				Get();
 				isFunctionMethod = true; 
 			}
 			if (mmod.IsGhost) { SemErr(t, "functions cannot be declared 'ghost' (they are ghost by default)"); }
 			
-			while (la.kind == 44) {
+			while (la.kind == 45) {
 				Attribute(ref attrs);
 			}
 			NoUSIdent(out id);
-			if (la.kind == 48 || la.kind == 50) {
-				if (la.kind == 50) {
+			if (la.kind == 49 || la.kind == 51) {
+				if (la.kind == 51) {
 					GenericParameters(typeArgs);
 				}
 				Formals(true, isFunctionMethod, formals);
-				Expect(20);
+				Expect(21);
 				Type(out returnType);
-			} else if (la.kind == 57) {
+			} else if (la.kind == 58) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(151);
-		} else if (la.kind == 37) {
+			} else SynErr(152);
+		} else if (la.kind == 38) {
 			Get();
 			isPredicate = true; 
-			if (la.kind == 81) {
+			if (la.kind == 82) {
 				Get();
 				isFunctionMethod = true; 
 			}
 			if (mmod.IsGhost) { SemErr(t, "predicates cannot be declared 'ghost' (they are ghost by default)"); }
 			
-			while (la.kind == 44) {
+			while (la.kind == 45) {
 				Attribute(ref attrs);
 			}
 			NoUSIdent(out id);
 			if (StartOf(8)) {
-				if (la.kind == 50) {
+				if (la.kind == 51) {
 					GenericParameters(typeArgs);
 				}
 				missingOpenParen = true; 
-				if (la.kind == 48) {
+				if (la.kind == 49) {
 					Formals(true, isFunctionMethod, formals);
 					missingOpenParen = false; 
 				}
 				if (missingOpenParen) { errors.Warning(t, "with the new support of higher-order functions in Dafny, parentheses-less predicates are no longer supported; in the new syntax, parentheses are required for the declaration and uses of predicates, even if the predicate takes no additional arguments"); } 
-				if (la.kind == 20) {
+				if (la.kind == 21) {
 					Get();
 					SemErr(t, "predicates do not have an explicitly declared return type; it is always bool"); 
 				}
-			} else if (la.kind == 57) {
+			} else if (la.kind == 58) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(152);
-		} else if (la.kind == 38) {
+			} else SynErr(153);
+		} else if (la.kind == 39) {
 			Get();
-			Expect(37);
+			Expect(38);
 			isIndPredicate = true; 
 			if (mmod.IsGhost) { SemErr(t, "inductive predicates cannot be declared 'ghost' (they are ghost by default)"); }
 			
-			while (la.kind == 44) {
+			while (la.kind == 45) {
 				Attribute(ref attrs);
 			}
 			NoUSIdent(out id);
-			if (la.kind == 48 || la.kind == 50) {
-				if (la.kind == 50) {
+			if (la.kind == 49 || la.kind == 51) {
+				if (la.kind == 51) {
 					GenericParameters(typeArgs);
 				}
 				Formals(true, isFunctionMethod, formals);
-				if (la.kind == 20) {
+				if (la.kind == 21) {
 					Get();
 					SemErr(t, "inductive predicates do not have an explicitly declared return type; it is always bool"); 
 				}
-			} else if (la.kind == 57) {
+			} else if (la.kind == 58) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(153);
-		} else if (la.kind == 40) {
+			} else SynErr(154);
+		} else if (la.kind == 41) {
 			Get();
 			isCoPredicate = true; 
 			if (mmod.IsGhost) { SemErr(t, "copredicates cannot be declared 'ghost' (they are ghost by default)"); }
 			
-			while (la.kind == 44) {
+			while (la.kind == 45) {
 				Attribute(ref attrs);
 			}
 			NoUSIdent(out id);
-			if (la.kind == 48 || la.kind == 50) {
-				if (la.kind == 50) {
+			if (la.kind == 49 || la.kind == 51) {
+				if (la.kind == 51) {
 					GenericParameters(typeArgs);
 				}
 				Formals(true, isFunctionMethod, formals);
-				if (la.kind == 20) {
+				if (la.kind == 21) {
 					Get();
 					SemErr(t, "copredicates do not have an explicitly declared return type; it is always bool"); 
 				}
-			} else if (la.kind == 57) {
+			} else if (la.kind == 58) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(154);
-		} else SynErr(155);
+			} else SynErr(155);
+		} else SynErr(156);
 		decreases = isIndPredicate || isCoPredicate ? null : new List<Expression/*!*/>(); 
 		while (StartOf(9)) {
 			FunctionSpec(reqs, reads, ens, decreases);
 		}
-		if (la.kind == 44) {
+		if (la.kind == 45) {
 			FunctionBody(out body, out bodyStart, out bodyEnd);
 		}
 		if (DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported")) {
@@ -1282,36 +1287,36 @@ bool IsType(ref IToken pt) {
 		IToken bodyStart = Token.NoToken;
 		IToken bodyEnd = Token.NoToken;
 		
-		while (!(StartOf(10))) {SynErr(156); Get();}
+		while (!(StartOf(10))) {SynErr(157); Get();}
 		switch (la.kind) {
-		case 81: {
+		case 82: {
 			Get();
 			break;
 		}
-		case 39: {
+		case 40: {
 			Get();
 			isLemma = true; 
 			break;
 		}
-		case 82: {
+		case 83: {
 			Get();
 			isCoLemma = true; 
 			break;
 		}
-		case 83: {
+		case 84: {
 			Get();
 			isCoLemma = true;
 			errors.Warning(t, "the 'comethod' keyword has been deprecated; it has been renamed to 'colemma'");
 			
 			break;
 		}
-		case 38: {
+		case 39: {
 			Get();
-			Expect(39);
+			Expect(40);
 			isIndLemma = true; 
 			break;
 		}
-		case 84: {
+		case 85: {
 			Get();
 			if (allowConstructor) {
 			 isConstructor = true;
@@ -1321,7 +1326,7 @@ bool IsType(ref IToken pt) {
 			
 			break;
 		}
-		default: SynErr(157); break;
+		default: SynErr(158); break;
 		}
 		keywordToken = t; 
 		if (isLemma) {
@@ -1345,7 +1350,7 @@ bool IsType(ref IToken pt) {
 		 }
 		}
 		
-		while (la.kind == 44) {
+		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
 		if (la.kind == 1) {
@@ -1359,24 +1364,24 @@ bool IsType(ref IToken pt) {
 		 }
 		}
 		
-		if (la.kind == 48 || la.kind == 50) {
-			if (la.kind == 50) {
+		if (la.kind == 49 || la.kind == 51) {
+			if (la.kind == 51) {
 				GenericParameters(typeArgs);
 			}
 			Formals(true, !mmod.IsGhost, ins);
-			if (la.kind == 80) {
+			if (la.kind == 81) {
 				Get();
 				if (isConstructor) { SemErr(t, "constructors cannot have out-parameters"); } 
 				Formals(false, !mmod.IsGhost, outs);
 			}
-		} else if (la.kind == 57) {
+		} else if (la.kind == 58) {
 			Get();
 			signatureEllipsis = t; 
-		} else SynErr(158);
+		} else SynErr(159);
 		while (StartOf(11)) {
 			MethodSpec(req, mod, ens, dec, ref decAttrs, ref modAttrs);
 		}
-		if (la.kind == 44) {
+		if (la.kind == 45) {
 			BlockStmt(out body, out bodyStart, out bodyEnd);
 		}
 		if (DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported") && !Attributes.Contains(attrs, "decl") && theVerifyThisFile) {
@@ -1411,11 +1416,11 @@ bool IsType(ref IToken pt) {
 		IToken/*!*/ id;
 		List<Formal/*!*/> formals = new List<Formal/*!*/>();
 		
-		while (la.kind == 44) {
+		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		if (la.kind == 48) {
+		if (la.kind == 49) {
 			FormalsOptionalIds(formals);
 		}
 		ctors.Add(new DatatypeCtor(id, id.val, formals, attrs)); 
@@ -1423,17 +1428,17 @@ bool IsType(ref IToken pt) {
 
 	void FormalsOptionalIds(List<Formal/*!*/>/*!*/ formals) {
 		Contract.Requires(cce.NonNullElements(formals)); IToken/*!*/ id;  Type/*!*/ ty;  string/*!*/ name;  bool isGhost; 
-		Expect(48);
+		Expect(49);
 		if (StartOf(12)) {
 			TypeIdentOptional(out id, out name, out ty, out isGhost);
 			formals.Add(new Formal(id, name, ty, true, isGhost)); 
-			while (la.kind == 21) {
+			while (la.kind == 22) {
 				Get();
 				TypeIdentOptional(out id, out name, out ty, out isGhost);
 				formals.Add(new Formal(id, name, ty, true, isGhost)); 
 			}
 		}
-		Expect(49);
+		Expect(50);
 	}
 
 	void FIdentType(out IToken/*!*/ id, out Type/*!*/ ty) {
@@ -1445,14 +1450,14 @@ bool IsType(ref IToken pt) {
 		} else if (la.kind == 2) {
 			Get();
 			id = t; 
-		} else SynErr(159);
-		Expect(20);
+		} else SynErr(160);
+		Expect(21);
 		Type(out ty);
 	}
 
 	void OldSemi() {
-		if (la.kind == 26) {
-			while (!(la.kind == 0 || la.kind == 26)) {SynErr(160); Get();}
+		if (la.kind == 27) {
+			while (!(la.kind == 0 || la.kind == 27)) {SynErr(161); Get();}
 			Get();
 		}
 	}
@@ -1461,7 +1466,7 @@ bool IsType(ref IToken pt) {
 		Expression e0; IToken endTok; 
 		EquivExpression(out e, allowSemi, allowLambda);
 		if (SemiFollowsCall(allowSemi, e)) {
-			Expect(26);
+			Expect(27);
 			endTok = t; 
 			Expression(out e0, allowSemi, allowLambda);
 			e = new StmtExpr(e.tok,
@@ -1475,7 +1480,7 @@ bool IsType(ref IToken pt) {
 		Contract.Ensures(Contract.ValueAtReturn(out id)!=null);
 		Contract.Ensures(Contract.ValueAtReturn(out ty)!=null);
 		isGhost = false; 
-		if (la.kind == 70) {
+		if (la.kind == 71) {
 			Get();
 			if (allowGhostKeyword) { isGhost = true; } else { SemErr(t, "formal cannot be declared 'ghost' in this context"); } 
 		}
@@ -1485,7 +1490,7 @@ bool IsType(ref IToken pt) {
 	void IdentType(out IToken/*!*/ id, out Type/*!*/ ty, bool allowWildcardId) {
 		Contract.Ensures(Contract.ValueAtReturn(out id) != null); Contract.Ensures(Contract.ValueAtReturn(out ty) != null);
 		WildIdent(out id, allowWildcardId);
-		Expect(20);
+		Expect(21);
 		Type(out ty);
 	}
 
@@ -1501,7 +1506,7 @@ bool IsType(ref IToken pt) {
 		IToken id;  Type ty;  Type optType = null;
 		
 		WildIdent(out id, true);
-		if (la.kind == 20) {
+		if (la.kind == 21) {
 			Get();
 			Type(out ty);
 			optType = ty; 
@@ -1514,7 +1519,7 @@ bool IsType(ref IToken pt) {
 		IToken id;  Type ty;  Type optType = null;
 		
 		WildIdent(out id, true);
-		if (la.kind == 20) {
+		if (la.kind == 21) {
 			Get();
 			Type(out ty);
 			optType = ty; 
@@ -1527,13 +1532,13 @@ bool IsType(ref IToken pt) {
 		Contract.Ensures(Contract.ValueAtReturn(out ty)!=null);
 		Contract.Ensures(Contract.ValueAtReturn(out identName)!=null);
 		string name = null; id = Token.NoToken; ty = new BoolType()/*dummy*/; isGhost = false; 
-		if (la.kind == 70) {
+		if (la.kind == 71) {
 			Get();
 			isGhost = true; 
 		}
 		if (StartOf(3)) {
 			TypeAndToken(out id, out ty);
-			if (la.kind == 20) {
+			if (la.kind == 21) {
 				Get();
 				UserDefinedType udt = ty as UserDefinedType;
 				if (udt != null && udt.TypeArgs.Count == 0) {
@@ -1547,9 +1552,9 @@ bool IsType(ref IToken pt) {
 		} else if (la.kind == 2) {
 			Get();
 			id = t; name = id.val;
-			Expect(20);
+			Expect(21);
 			Type(out ty);
-		} else SynErr(161);
+		} else SynErr(162);
 		if (name != null) {
 		 identName = name;
 		} else {
@@ -1597,20 +1602,33 @@ bool IsType(ref IToken pt) {
 		case 13: {
 			Get();
 			tok = t;  gt = new List<Type>(); 
-			if (la.kind == 50) {
+			if (la.kind == 51) {
 				GenericInstantiation(gt);
 			}
 			if (gt.Count > 1) {
 			 SemErr("set type expects only one type argument");
 			}
-			ty = new SetType(gt.Count == 1 ? gt[0] : null);
+			ty = new SetType(true, gt.Count == 1 ? gt[0] : null);
 			
 			break;
 		}
 		case 14: {
 			Get();
 			tok = t;  gt = new List<Type>(); 
-			if (la.kind == 50) {
+			if (la.kind == 51) {
+				GenericInstantiation(gt);
+			}
+			if (gt.Count > 1) {
+			 SemErr("set type expects only one type argument");
+			}
+			ty = new SetType(false, gt.Count == 1 ? gt[0] : null);
+			
+			break;
+		}
+		case 15: {
+			Get();
+			tok = t;  gt = new List<Type>(); 
+			if (la.kind == 51) {
 				GenericInstantiation(gt);
 			}
 			if (gt.Count > 1) {
@@ -1620,10 +1638,10 @@ bool IsType(ref IToken pt) {
 			
 			break;
 		}
-		case 15: {
+		case 16: {
 			Get();
 			tok = t;  gt = new List<Type>(); 
-			if (la.kind == 50) {
+			if (la.kind == 51) {
 				GenericInstantiation(gt);
 			}
 			if (gt.Count > 1) {
@@ -1638,10 +1656,10 @@ bool IsType(ref IToken pt) {
 			tok = t;  ty = new UserDefinedType(tok, tok.val, null); 
 			break;
 		}
-		case 16: {
+		case 17: {
 			Get();
 			tok = t;  gt = new List<Type>(); 
-			if (la.kind == 50) {
+			if (la.kind == 51) {
 				GenericInstantiation(gt);
 			}
 			if (gt.Count == 0) {
@@ -1655,10 +1673,10 @@ bool IsType(ref IToken pt) {
 			
 			break;
 		}
-		case 17: {
+		case 18: {
 			Get();
 			tok = t;  gt = new List<Type>(); 
-			if (la.kind == 50) {
+			if (la.kind == 51) {
 				GenericInstantiation(gt);
 			}
 			if (gt.Count == 0) {
@@ -1675,7 +1693,7 @@ bool IsType(ref IToken pt) {
 		case 5: {
 			Get();
 			tok = t;  gt = null; 
-			if (la.kind == 50) {
+			if (la.kind == 51) {
 				gt = new List<Type>(); 
 				GenericInstantiation(gt);
 			}
@@ -1684,19 +1702,19 @@ bool IsType(ref IToken pt) {
 			
 			break;
 		}
-		case 48: {
+		case 49: {
 			Get();
 			tok = t; tupleArgTypes = new List<Type>(); 
 			if (StartOf(3)) {
 				Type(out ty);
 				tupleArgTypes.Add(ty); 
-				while (la.kind == 21) {
+				while (la.kind == 22) {
 					Get();
 					Type(out ty);
 					tupleArgTypes.Add(ty); 
 				}
 			}
-			Expect(49);
+			Expect(50);
 			if (tupleArgTypes.Count == 1) {
 			 // just return the type 'ty'
 			} else {
@@ -1711,11 +1729,11 @@ bool IsType(ref IToken pt) {
 			Expression e; tok = t; 
 			NameSegmentForTypeName(out e);
 			tok = t; 
-			while (la.kind == 25) {
+			while (la.kind == 26) {
 				Get();
 				Expect(1);
 				tok = t; List<Type> typeArgs = null; 
-				if (la.kind == 50) {
+				if (la.kind == 51) {
 					typeArgs = new List<Type>(); 
 					GenericInstantiation(typeArgs);
 				}
@@ -1724,9 +1742,9 @@ bool IsType(ref IToken pt) {
 			ty = new UserDefinedType(e.tok, e); 
 			break;
 		}
-		default: SynErr(162); break;
+		default: SynErr(163); break;
 		}
-		if (la.kind == 28) {
+		if (la.kind == 29) {
 			Type t2; 
 			Get();
 			tok = t; 
@@ -1744,17 +1762,17 @@ bool IsType(ref IToken pt) {
 
 	void Formals(bool incoming, bool allowGhostKeyword, List<Formal> formals) {
 		Contract.Requires(cce.NonNullElements(formals)); IToken id;  Type ty;  bool isGhost; 
-		Expect(48);
-		if (la.kind == 1 || la.kind == 70) {
+		Expect(49);
+		if (la.kind == 1 || la.kind == 71) {
 			GIdentType(allowGhostKeyword, out id, out ty, out isGhost);
 			formals.Add(new Formal(id, id.val, ty, incoming, isGhost)); 
-			while (la.kind == 21) {
+			while (la.kind == 22) {
 				Get();
 				GIdentType(allowGhostKeyword, out id, out ty, out isGhost);
 				formals.Add(new Formal(id, id.val, ty, incoming, isGhost)); 
 			}
 		}
-		Expect(49);
+		Expect(50);
 	}
 
 	void IteratorSpec(List<FrameExpression/*!*/>/*!*/ reads, List<FrameExpression/*!*/>/*!*/ mod, List<Expression/*!*/> decreases,
@@ -1763,45 +1781,45 @@ List<MaybeFreeExpression/*!*/>/*!*/ yieldReq, List<MaybeFreeExpression/*!*/>/*!*
 ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 		Expression/*!*/ e; FrameExpression/*!*/ fe; bool isFree = false; bool isYield = false; Attributes ensAttrs = null;
 		
-		while (!(StartOf(13))) {SynErr(163); Get();}
-		if (la.kind == 42) {
+		while (!(StartOf(13))) {SynErr(164); Get();}
+		if (la.kind == 43) {
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref readsAttrs);
 			}
 			FrameExpression(out fe, false, false);
 			reads.Add(fe); 
-			while (la.kind == 21) {
+			while (la.kind == 22) {
 				Get();
 				FrameExpression(out fe, false, false);
 				reads.Add(fe); 
 			}
 			OldSemi();
-		} else if (la.kind == 41) {
+		} else if (la.kind == 42) {
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref modAttrs);
 			}
 			FrameExpression(out fe, false, false);
 			mod.Add(fe); 
-			while (la.kind == 21) {
+			while (la.kind == 22) {
 				Get();
 				FrameExpression(out fe, false, false);
 				mod.Add(fe); 
 			}
 			OldSemi();
 		} else if (StartOf(14)) {
-			if (la.kind == 85) {
+			if (la.kind == 86) {
 				Get();
 				isFree = true;
 				errors.Warning(t, "the 'free' keyword is soon to be deprecated");
 				
 			}
-			if (la.kind == 87) {
+			if (la.kind == 88) {
 				Get();
 				isYield = true; 
 			}
-			if (la.kind == 43) {
+			if (la.kind == 44) {
 				Get();
 				Expression(out e, false, false);
 				OldSemi();
@@ -1811,7 +1829,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 				 req.Add(new MaybeFreeExpression(e, isFree));
 				}
 				
-			} else if (la.kind == 86) {
+			} else if (la.kind == 87) {
 				Get();
 				while (IsAttribute()) {
 					Attribute(ref ensAttrs);
@@ -1824,27 +1842,27 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 				 ens.Add(new MaybeFreeExpression(e, isFree, ensAttrs));
 				}
 				
-			} else SynErr(164);
-		} else if (la.kind == 34) {
+			} else SynErr(165);
+		} else if (la.kind == 35) {
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref decrAttrs);
 			}
 			DecreasesList(decreases, false, false);
 			OldSemi();
-		} else SynErr(165);
+		} else SynErr(166);
 	}
 
 	void BlockStmt(out BlockStmt/*!*/ block, out IToken bodyStart, out IToken bodyEnd) {
 		Contract.Ensures(Contract.ValueAtReturn(out block) != null);
 		List<Statement/*!*/> body = new List<Statement/*!*/>();
 		
-		Expect(44);
+		Expect(45);
 		bodyStart = t; 
 		while (StartOf(15)) {
 			Stmt(body);
 		}
-		Expect(45);
+		Expect(46);
 		bodyEnd = t;
 		block = new BlockStmt(bodyStart, bodyEnd, body); 
 	}
@@ -1854,33 +1872,33 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Requires(cce.NonNullElements(req)); Contract.Requires(cce.NonNullElements(mod)); Contract.Requires(cce.NonNullElements(ens)); Contract.Requires(cce.NonNullElements(decreases));
 		Expression/*!*/ e;  FrameExpression/*!*/ fe;  bool isFree = false; Attributes ensAttrs = null;
 		
-		while (!(StartOf(16))) {SynErr(166); Get();}
-		if (la.kind == 41) {
+		while (!(StartOf(16))) {SynErr(167); Get();}
+		if (la.kind == 42) {
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref modAttrs);
 			}
 			FrameExpression(out fe, false, false);
 			mod.Add(fe); 
-			while (la.kind == 21) {
+			while (la.kind == 22) {
 				Get();
 				FrameExpression(out fe, false, false);
 				mod.Add(fe); 
 			}
 			OldSemi();
-		} else if (la.kind == 43 || la.kind == 85 || la.kind == 86) {
-			if (la.kind == 85) {
+		} else if (la.kind == 44 || la.kind == 86 || la.kind == 87) {
+			if (la.kind == 86) {
 				Get();
 				isFree = true;
 				errors.Warning(t, "the 'free' keyword is soon to be deprecated");
 				
 			}
-			if (la.kind == 43) {
+			if (la.kind == 44) {
 				Get();
 				Expression(out e, false, false);
 				OldSemi();
 				req.Add(new MaybeFreeExpression(e, isFree)); 
-			} else if (la.kind == 86) {
+			} else if (la.kind == 87) {
 				Get();
 				while (IsAttribute()) {
 					Attribute(ref ensAttrs);
@@ -1888,15 +1906,15 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Expression(out e, false, false);
 				OldSemi();
 				ens.Add(new MaybeFreeExpression(e, isFree, ensAttrs)); 
-			} else SynErr(167);
-		} else if (la.kind == 34) {
+			} else SynErr(168);
+		} else if (la.kind == 35) {
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref decAttrs);
 			}
 			DecreasesList(decreases, true, false);
 			OldSemi();
-		} else SynErr(168);
+		} else SynErr(169);
 	}
 
 	void FrameExpression(out FrameExpression fe, bool allowSemi, bool allowLambda) {
@@ -1909,18 +1927,18 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (StartOf(7)) {
 			Expression(out e, allowSemi, allowLambda);
 			feTok = e.tok; 
-			if (la.kind == 88) {
+			if (la.kind == 89) {
 				Get();
 				Ident(out id);
 				fieldName = id.val;  feTok = id; 
 			}
 			fe = new FrameExpression(feTok, e, fieldName); 
-		} else if (la.kind == 88) {
+		} else if (la.kind == 89) {
 			Get();
 			Ident(out id);
 			fieldName = id.val; 
 			fe = new FrameExpression(id, new ImplicitThisExpr(id), fieldName); 
-		} else SynErr(169);
+		} else SynErr(170);
 	}
 
 	void DecreasesList(List<Expression> decreases, bool allowWildcard, bool allowLambda) {
@@ -1932,7 +1950,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		 decreases.Add(e);
 		}
 		
-		while (la.kind == 21) {
+		while (la.kind == 22) {
 			Get();
 			PossiblyWildExpression(out e, allowLambda);
 			if (!allowWildcard && e is WildcardExpr) {
@@ -1946,15 +1964,15 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void GenericInstantiation(List<Type/*!*/>/*!*/ gt) {
 		Contract.Requires(cce.NonNullElements(gt)); Type/*!*/ ty; 
-		Expect(50);
+		Expect(51);
 		Type(out ty);
 		gt.Add(ty); 
-		while (la.kind == 21) {
+		while (la.kind == 22) {
 			Get();
 			Type(out ty);
 			gt.Add(ty); 
 		}
-		Expect(51);
+		Expect(52);
 	}
 
 	void NameSegmentForTypeName(out Expression e) {
@@ -1962,7 +1980,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<Type> typeArgs = null;
 		
 		Ident(out id);
-		if (la.kind == 50) {
+		if (la.kind == 51) {
 			typeArgs = new List<Type>(); 
 			GenericInstantiation(typeArgs);
 		}
@@ -1975,28 +1993,28 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Requires(cce.NonNullElements(reads));
 		Contract.Requires(decreases == null || cce.NonNullElements(decreases));
 		Expression/*!*/ e;  FrameExpression/*!*/ fe; 
-		while (!(StartOf(17))) {SynErr(170); Get();}
-		if (la.kind == 43) {
+		while (!(StartOf(17))) {SynErr(171); Get();}
+		if (la.kind == 44) {
 			Get();
 			Expression(out e, false, false);
 			OldSemi();
 			reqs.Add(e); 
-		} else if (la.kind == 42) {
+		} else if (la.kind == 43) {
 			Get();
 			PossiblyWildFrameExpression(out fe, false);
 			reads.Add(fe); 
-			while (la.kind == 21) {
+			while (la.kind == 22) {
 				Get();
 				PossiblyWildFrameExpression(out fe, false);
 				reads.Add(fe); 
 			}
 			OldSemi();
-		} else if (la.kind == 86) {
+		} else if (la.kind == 87) {
 			Get();
 			Expression(out e, false, false);
 			OldSemi();
 			ens.Add(e); 
-		} else if (la.kind == 34) {
+		} else if (la.kind == 35) {
 			Get();
 			if (decreases == null) {
 			 SemErr(t, "'decreases' clauses are meaningless for copredicates, so they are not allowed");
@@ -2005,37 +2023,37 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			
 			DecreasesList(decreases, false, false);
 			OldSemi();
-		} else SynErr(171);
+		} else SynErr(172);
 	}
 
 	void FunctionBody(out Expression/*!*/ e, out IToken bodyStart, out IToken bodyEnd) {
 		Contract.Ensures(Contract.ValueAtReturn(out e) != null); e = dummyExpr; 
-		Expect(44);
+		Expect(45);
 		bodyStart = t; 
 		Expression(out e, true, true);
-		Expect(45);
+		Expect(46);
 		bodyEnd = t; 
 	}
 
 	void PossiblyWildFrameExpression(out FrameExpression fe, bool allowSemi) {
 		Contract.Ensures(Contract.ValueAtReturn(out fe) != null); fe = dummyFrameExpr; 
-		if (la.kind == 55) {
+		if (la.kind == 56) {
 			Get();
 			fe = new FrameExpression(t, new WildcardExpr(t), null); 
 		} else if (StartOf(18)) {
 			FrameExpression(out fe, allowSemi, false);
-		} else SynErr(172);
+		} else SynErr(173);
 	}
 
 	void PossiblyWildExpression(out Expression e, bool allowLambda) {
 		Contract.Ensures(Contract.ValueAtReturn(out e)!=null);
 		e = dummyExpr; 
-		if (la.kind == 55) {
+		if (la.kind == 56) {
 			Get();
 			e = new WildcardExpr(t); 
 		} else if (StartOf(7)) {
 			Expression(out e, false, allowLambda);
-		} else SynErr(173);
+		} else SynErr(174);
 	}
 
 	void Stmt(List<Statement/*!*/>/*!*/ ss) {
@@ -2052,92 +2070,92 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken bodyStart, bodyEnd;
 		int breakCount;
 		
-		while (!(StartOf(19))) {SynErr(174); Get();}
+		while (!(StartOf(19))) {SynErr(175); Get();}
 		switch (la.kind) {
-		case 44: {
+		case 45: {
 			BlockStmt(out bs, out bodyStart, out bodyEnd);
 			s = bs; 
 			break;
 		}
-		case 99: {
+		case 100: {
 			AssertStmt(out s);
 			break;
 		}
-		case 29: {
+		case 30: {
 			AssumeStmt(out s);
 			break;
 		}
-		case 100: {
+		case 101: {
 			PrintStmt(out s);
 			break;
 		}
-		case 1: case 2: case 3: case 4: case 8: case 10: case 18: case 19: case 22: case 48: case 129: case 130: case 131: case 132: case 133: case 134: {
+		case 1: case 2: case 3: case 4: case 8: case 10: case 19: case 20: case 23: case 49: case 130: case 131: case 132: case 133: case 134: case 135: {
 			UpdateStmt(out s);
 			break;
 		}
-		case 70: case 75: {
+		case 71: case 76: {
 			VarDeclStatement(out s);
 			break;
 		}
-		case 96: {
+		case 97: {
 			IfStmt(out s);
 			break;
 		}
-		case 97: {
+		case 98: {
 			WhileStmt(out s);
 			break;
 		}
-		case 98: {
+		case 99: {
 			MatchStmt(out s);
 			break;
 		}
-		case 101: case 102: {
+		case 102: case 103: {
 			ForallStmt(out s);
 			break;
 		}
-		case 30: {
+		case 31: {
 			CalcStmt(out s);
 			break;
 		}
-		case 103: {
+		case 104: {
 			ModifyStmt(out s);
 			break;
 		}
-		case 89: {
+		case 90: {
 			Get();
 			x = t; 
 			NoUSIdent(out id);
-			Expect(20);
+			Expect(21);
 			OneStmt(out s);
 			s.Labels = new LList<Label>(new Label(x, id.val), s.Labels); 
 			break;
 		}
-		case 90: {
+		case 91: {
 			Get();
 			x = t; breakCount = 1; label = null; 
 			if (la.kind == 1) {
 				NoUSIdent(out id);
 				label = id.val; 
-			} else if (la.kind == 26 || la.kind == 90) {
-				while (la.kind == 90) {
+			} else if (la.kind == 27 || la.kind == 91) {
+				while (la.kind == 91) {
 					Get();
 					breakCount++; 
 				}
-			} else SynErr(175);
-			while (!(la.kind == 0 || la.kind == 26)) {SynErr(176); Get();}
-			Expect(26);
+			} else SynErr(176);
+			while (!(la.kind == 0 || la.kind == 27)) {SynErr(177); Get();}
+			Expect(27);
 			s = label != null ? new BreakStmt(x, t, label) : new BreakStmt(x, t, breakCount); 
 			break;
 		}
-		case 87: case 93: {
+		case 88: case 94: {
 			ReturnStmt(out s);
 			break;
 		}
-		case 57: {
+		case 58: {
 			SkeletonStmt(out s);
 			break;
 		}
-		default: SynErr(177); break;
+		default: SynErr(178); break;
 		}
 	}
 
@@ -2146,18 +2164,18 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression e = dummyExpr; Attributes attrs = null;
 		IToken dotdotdot = null;
 		
-		Expect(99);
+		Expect(100);
 		x = t; 
 		while (IsAttribute()) {
 			Attribute(ref attrs);
 		}
 		if (StartOf(7)) {
 			Expression(out e, false, true);
-		} else if (la.kind == 57) {
+		} else if (la.kind == 58) {
 			Get();
 			dotdotdot = t; 
-		} else SynErr(178);
-		Expect(26);
+		} else SynErr(179);
+		Expect(27);
 		if (dotdotdot != null) {
 		 s = new SkeletonStatement(new AssertStmt(x, t, new LiteralExpr(x, true), attrs), dotdotdot, null);
 		} else {
@@ -2171,18 +2189,18 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression e = dummyExpr; Attributes attrs = null;
 		IToken dotdotdot = null;
 		
-		Expect(29);
+		Expect(30);
 		x = t; 
 		while (IsAttribute()) {
 			Attribute(ref attrs);
 		}
 		if (StartOf(7)) {
 			Expression(out e, false, true);
-		} else if (la.kind == 57) {
+		} else if (la.kind == 58) {
 			Get();
 			dotdotdot = t; 
-		} else SynErr(179);
-		Expect(26);
+		} else SynErr(180);
+		Expect(27);
 		if (dotdotdot != null) {
 		 s = new SkeletonStatement(new AssumeStmt(x, t, new LiteralExpr(x, true), attrs), dotdotdot, null);
 		} else {
@@ -2196,16 +2214,16 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken x;  Expression e;
 		var args = new List<Expression>();
 		
-		Expect(100);
+		Expect(101);
 		x = t; 
 		Expression(out e, false, true);
 		args.Add(e); 
-		while (la.kind == 21) {
+		while (la.kind == 22) {
 			Get();
 			Expression(out e, false, true);
 			args.Add(e); 
 		}
-		Expect(26);
+		Expect(27);
 		s = new PrintStmt(x, t, args); 
 	}
 
@@ -2220,44 +2238,44 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		
 		Lhs(out e);
 		x = e.tok; 
-		if (la.kind == 26 || la.kind == 44) {
-			while (la.kind == 44) {
+		if (la.kind == 27 || la.kind == 45) {
+			while (la.kind == 45) {
 				Attribute(ref attrs);
 			}
-			Expect(26);
+			Expect(27);
 			endTok = t; rhss.Add(new ExprRhs(e, attrs)); 
-		} else if (la.kind == 21 || la.kind == 92 || la.kind == 94) {
+		} else if (la.kind == 22 || la.kind == 93 || la.kind == 95) {
 			lhss.Add(e); 
-			while (la.kind == 21) {
+			while (la.kind == 22) {
 				Get();
 				Lhs(out e);
 				lhss.Add(e); 
 			}
-			if (la.kind == 92) {
+			if (la.kind == 93) {
 				Get();
 				x = t; 
 				Rhs(out r);
 				rhss.Add(r); 
-				while (la.kind == 21) {
+				while (la.kind == 22) {
 					Get();
 					Rhs(out r);
 					rhss.Add(r); 
 				}
-			} else if (la.kind == 94) {
+			} else if (la.kind == 95) {
 				Get();
 				x = t; 
 				if (la.kind == _assume) {
-					Expect(29);
+					Expect(30);
 					suchThatAssume = t; 
 				}
 				Expression(out suchThat, false, true);
-			} else SynErr(180);
-			Expect(26);
+			} else SynErr(181);
+			Expect(27);
 			endTok = t; 
-		} else if (la.kind == 20) {
+		} else if (la.kind == 21) {
 			Get();
 			SemErr(t, "invalid statement (did you forget the 'label' keyword?)"); 
-		} else SynErr(181);
+		} else SynErr(182);
 		if (suchThat != null) {
 		 s = new AssignSuchThatStmt(x, endTok, lhss, suchThat, suchThatAssume, null);
 		} else {
@@ -2281,51 +2299,51 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Attributes attrs = null;
 		IToken endTok;
 		
-		if (la.kind == 70) {
+		if (la.kind == 71) {
 			Get();
 			isGhost = true;  x = t; 
 		}
-		Expect(75);
+		Expect(76);
 		if (!isGhost) { x = t; } 
-		while (la.kind == 44) {
+		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
 		LocalIdentTypeOptional(out d, isGhost);
 		lhss.Add(d); d.Attributes = attrs; attrs = null; 
-		while (la.kind == 21) {
+		while (la.kind == 22) {
 			Get();
-			while (la.kind == 44) {
+			while (la.kind == 45) {
 				Attribute(ref attrs);
 			}
 			LocalIdentTypeOptional(out d, isGhost);
 			lhss.Add(d); d.Attributes = attrs; attrs = null; 
 		}
-		if (la.kind == 44 || la.kind == 92 || la.kind == 94) {
-			if (la.kind == 92) {
+		if (la.kind == 45 || la.kind == 93 || la.kind == 95) {
+			if (la.kind == 93) {
 				Get();
 				assignTok = t; 
 				Rhs(out r);
 				rhss.Add(r); 
-				while (la.kind == 21) {
+				while (la.kind == 22) {
 					Get();
 					Rhs(out r);
 					rhss.Add(r); 
 				}
 			} else {
-				while (la.kind == 44) {
+				while (la.kind == 45) {
 					Attribute(ref attrs);
 				}
-				Expect(94);
+				Expect(95);
 				assignTok = t; 
 				if (la.kind == _assume) {
-					Expect(29);
+					Expect(30);
 					suchThatAssume = t; 
 				}
 				Expression(out suchThat, false, true);
 			}
 		}
-		while (!(la.kind == 0 || la.kind == 26)) {SynErr(182); Get();}
-		Expect(26);
+		while (!(la.kind == 0 || la.kind == 27)) {SynErr(183); Get();}
+		Expect(27);
 		endTok = t; 
 		ConcreteUpdateStatement update;
 		if (suchThat != null) {
@@ -2358,7 +2376,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<GuardedAlternative> alternatives;
 		ifStmt = dummyStmt;  // to please the compiler
 		
-		Expect(96);
+		Expect(97);
 		x = t; 
 		if (IsAlternative()) {
 			AlternativeBlock(out alternatives, out endTok);
@@ -2372,15 +2390,15 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			BlockStmt(out thn, out bodyStart, out bodyEnd);
 			endTok = thn.EndTok; 
-			if (la.kind == 33) {
+			if (la.kind == 34) {
 				Get();
-				if (la.kind == 96) {
+				if (la.kind == 97) {
 					IfStmt(out s);
 					els = s; endTok = s.EndTok; 
-				} else if (la.kind == 44) {
+				} else if (la.kind == 45) {
 					BlockStmt(out bs, out bodyStart, out bodyEnd);
 					els = bs; endTok = bs.EndTok; 
-				} else SynErr(183);
+				} else SynErr(184);
 			}
 			if (guardEllipsis != null) {
 			 ifStmt = new SkeletonStatement(new IfStmt(x, endTok, guard, thn, els), guardEllipsis, null);
@@ -2388,7 +2406,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 ifStmt = new IfStmt(x, endTok, guard, thn, els);
 			}
 			
-		} else SynErr(184);
+		} else SynErr(185);
 	}
 
 	void WhileStmt(out Statement stmt) {
@@ -2407,7 +2425,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		stmt = dummyStmt;  // to please the compiler
 		bool isDirtyLoop = true;
 		
-		Expect(97);
+		Expect(98);
 		x = t; 
 		if (IsLoopSpec() || IsAlternative()) {
 			while (StartOf(22)) {
@@ -2430,10 +2448,10 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				BlockStmt(out body, out bodyStart, out bodyEnd);
 				endTok = body.EndTok; isDirtyLoop = false; 
 			} else if (la.kind == _ellipsis) {
-				Expect(57);
+				Expect(58);
 				bodyEllipsis = t; endTok = t; isDirtyLoop = false; 
 			} else if (StartOf(23)) {
-			} else SynErr(185);
+			} else SynErr(186);
 			if (guardEllipsis != null || bodyEllipsis != null) {
 			 if (mod != null) {
 			   SemErr(mod[0].E.tok, "'modifies' clauses are not allowed on refining loops");
@@ -2451,7 +2469,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 stmt = new WhileStmt(x, endTok, guard, invariants, new Specification<Expression>(decreases, decAttrs), new Specification<FrameExpression>(mod, modAttrs), body);
 			}
 			
-		} else SynErr(186);
+		} else SynErr(187);
 	}
 
 	void MatchStmt(out Statement/*!*/ s) {
@@ -2460,23 +2478,23 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<MatchCaseStmt/*!*/> cases = new List<MatchCaseStmt/*!*/>();
 		bool usesOptionalBrace = false;
 		
-		Expect(98);
+		Expect(99);
 		x = t; 
 		Expression(out e, true, true);
 		if (la.kind == _lbrace) {
-			Expect(44);
+			Expect(45);
 			usesOptionalBrace = true; 
-			while (la.kind == 31) {
+			while (la.kind == 32) {
 				CaseStatement(out c);
 				cases.Add(c); 
 			}
-			Expect(45);
+			Expect(46);
 		} else if (StartOf(23)) {
 			while (la.kind == _case) {
 				CaseStatement(out c);
 				cases.Add(c); 
 			}
-		} else SynErr(187);
+		} else SynErr(188);
 		s = new MatchStmt(x, t, e, cases, usesOptionalBrace); 
 	}
 
@@ -2493,38 +2511,38 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken bodyStart, bodyEnd;
 		IToken tok = Token.NoToken;
 		
-		if (la.kind == 101) {
+		if (la.kind == 102) {
 			Get();
 			x = t; tok = x; 
-		} else if (la.kind == 102) {
+		} else if (la.kind == 103) {
 			Get();
 			x = t;
 			errors.Warning(t, "the 'parallel' keyword has been deprecated; the comprehension statement now uses the keyword 'forall' (and the parentheses around the bound variables are now optional)");
 			
-		} else SynErr(188);
+		} else SynErr(189);
 		if (la.kind == _openparen) {
-			Expect(48);
+			Expect(49);
 			if (la.kind == 1) {
 				QuantifierDomain(out bvars, out attrs, out range);
 			}
-			Expect(49);
+			Expect(50);
 		} else if (StartOf(24)) {
 			if (la.kind == _ident) {
 				QuantifierDomain(out bvars, out attrs, out range);
 			}
-		} else SynErr(189);
+		} else SynErr(190);
 		if (bvars == null) { bvars = new List<BoundVar>(); }
 		if (range == null) { range = new LiteralExpr(x, true); }
 		
-		while (la.kind == 85 || la.kind == 86) {
+		while (la.kind == 86 || la.kind == 87) {
 			isFree = false; 
-			if (la.kind == 85) {
+			if (la.kind == 86) {
 				Get();
 				isFree = true;
 				errors.Warning(t, "the 'free' keyword is soon to be deprecated");
 				
 			}
-			Expect(86);
+			Expect(87);
 			Expression(out e, false, true);
 			ens.Add(new MaybeFreeExpression(e, isFree)); 
 			OldSemi();
@@ -2557,7 +2575,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken opTok;
 		IToken danglingOperator = null;
 		
-		Expect(30);
+		Expect(31);
 		x = t; 
 		if (StartOf(25)) {
 			CalcOp(out opTok, out calcOp);
@@ -2568,11 +2586,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			resOp = calcOp;
 			
 		}
-		Expect(44);
+		Expect(45);
 		while (StartOf(7)) {
 			Expression(out e, false, true);
 			lines.Add(e); stepOp = calcOp; danglingOperator = null; 
-			Expect(26);
+			Expect(27);
 			if (StartOf(25)) {
 				CalcOp(out opTok, out op);
 				maybeOp = resOp.ResultOp(op);
@@ -2592,20 +2610,20 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			BlockStmt subBlock; Statement subCalc;
 			
 			while (la.kind == _lbrace || la.kind == _calc) {
-				if (la.kind == 44) {
+				if (la.kind == 45) {
 					BlockStmt(out subBlock, out t0, out t1);
 					hintEnd = subBlock.EndTok; subhints.Add(subBlock); 
-				} else if (la.kind == 30) {
+				} else if (la.kind == 31) {
 					CalcStmt(out subCalc);
 					hintEnd = subCalc.EndTok; subhints.Add(subCalc); 
-				} else SynErr(190);
+				} else SynErr(191);
 			}
 			var h = new BlockStmt(hintStart, hintEnd, subhints); // if the hint is empty, hintStart is the first token of the next line, but it doesn't matter because the block statement is just used as a container
 			hints.Add(h);
 			if (h.Body.Count != 0) { danglingOperator = null; }
 			
 		}
-		Expect(45);
+		Expect(46);
 		if (danglingOperator != null) {
 		 SemErr(danglingOperator, "a calculation cannot end with an operator");
 		}
@@ -2624,7 +2642,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		BlockStmt body = null;  IToken bodyStart;
 		IToken ellipsisToken = null;
 		
-		Expect(103);
+		Expect(104);
 		tok = t; 
 		while (IsAttribute()) {
 			Attribute(ref attrs);
@@ -2632,22 +2650,22 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (StartOf(18)) {
 			FrameExpression(out fe, false, true);
 			mod.Add(fe); 
-			while (la.kind == 21) {
+			while (la.kind == 22) {
 				Get();
 				FrameExpression(out fe, false, true);
 				mod.Add(fe); 
 			}
-		} else if (la.kind == 57) {
+		} else if (la.kind == 58) {
 			Get();
 			ellipsisToken = t; 
-		} else SynErr(191);
-		if (la.kind == 44) {
+		} else SynErr(192);
+		if (la.kind == 45) {
 			BlockStmt(out body, out bodyStart, out endTok);
-		} else if (la.kind == 26) {
-			while (!(la.kind == 0 || la.kind == 26)) {SynErr(192); Get();}
+		} else if (la.kind == 27) {
+			while (!(la.kind == 0 || la.kind == 27)) {SynErr(193); Get();}
 			Get();
 			endTok = t; 
-		} else SynErr(193);
+		} else SynErr(194);
 		s = new ModifyStmt(tok, endTok, mod, attrs, body);
 		if (ellipsisToken != null) {
 		 s = new SkeletonStatement(s, ellipsisToken, null);
@@ -2661,23 +2679,23 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		AssignmentRhs r;
 		bool isYield = false;
 		
-		if (la.kind == 93) {
+		if (la.kind == 94) {
 			Get();
 			returnTok = t; 
-		} else if (la.kind == 87) {
+		} else if (la.kind == 88) {
 			Get();
 			returnTok = t; isYield = true; 
-		} else SynErr(194);
+		} else SynErr(195);
 		if (StartOf(26)) {
 			Rhs(out r);
 			rhss = new List<AssignmentRhs>(); rhss.Add(r); 
-			while (la.kind == 21) {
+			while (la.kind == 22) {
 				Get();
 				Rhs(out r);
 				rhss.Add(r); 
 			}
 		}
-		Expect(26);
+		Expect(27);
 		if (isYield) {
 		 s = new YieldStmt(returnTok, t, rhss);
 		} else {
@@ -2691,22 +2709,22 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<Expression> exprs = null;
 		IToken tok, dotdotdot, whereTok;
 		Expression e; 
-		Expect(57);
+		Expect(58);
 		dotdotdot = t; 
-		if (la.kind == 91) {
+		if (la.kind == 92) {
 			Get();
 			names = new List<IToken>(); exprs = new List<Expression>(); whereTok = t;
 			Ident(out tok);
 			names.Add(tok); 
-			while (la.kind == 21) {
+			while (la.kind == 22) {
 				Get();
 				Ident(out tok);
 				names.Add(tok); 
 			}
-			Expect(92);
+			Expect(93);
 			Expression(out e, false, true);
 			exprs.Add(e); 
-			while (la.kind == 21) {
+			while (la.kind == 22) {
 				Get();
 				Expression(out e, false, true);
 				exprs.Add(e); 
@@ -2717,7 +2735,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			
 		}
-		Expect(26);
+		Expect(27);
 		s = new SkeletonStatement(dotdotdot, t, names, exprs); 
 	}
 
@@ -2730,16 +2748,16 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		r = dummyRhs;  // to please compiler
 		Attributes attrs = null;
 		
-		if (la.kind == 95) {
+		if (la.kind == 96) {
 			Get();
 			newToken = t; 
 			TypeAndToken(out x, out ty);
-			if (la.kind == 46 || la.kind == 48) {
-				if (la.kind == 46) {
+			if (la.kind == 47 || la.kind == 49) {
+				if (la.kind == 47) {
 					Get();
 					ee = new List<Expression>(); 
 					Expressions(ee);
-					Expect(47);
+					Expect(48);
 					var tmp = theBuiltIns.ArrayType(ee.Count, new IntType(), true);
 					
 				} else {
@@ -2748,7 +2766,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					if (StartOf(7)) {
 						Expressions(args);
 					}
-					Expect(49);
+					Expect(50);
 				}
 			}
 			if (ee != null) {
@@ -2759,14 +2777,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 r = new TypeRhs(newToken, ty);
 			}
 			
-		} else if (la.kind == 55) {
+		} else if (la.kind == 56) {
 			Get();
 			r = new HavocRhs(t); 
 		} else if (StartOf(7)) {
 			Expression(out e, false, true);
 			r = new ExprRhs(e); 
-		} else SynErr(195);
-		while (la.kind == 44) {
+		} else SynErr(196);
+		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
 		r.Attributes = attrs; 
@@ -2777,23 +2795,23 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		
 		if (la.kind == 1) {
 			NameSegment(out e);
-			while (la.kind == 25 || la.kind == 46 || la.kind == 48) {
+			while (la.kind == 26 || la.kind == 47 || la.kind == 49) {
 				Suffix(ref e);
 			}
 		} else if (StartOf(27)) {
 			ConstAtomExpression(out e, false, false);
 			Suffix(ref e);
-			while (la.kind == 25 || la.kind == 46 || la.kind == 48) {
+			while (la.kind == 26 || la.kind == 47 || la.kind == 49) {
 				Suffix(ref e);
 			}
-		} else SynErr(196);
+		} else SynErr(197);
 	}
 
 	void Expressions(List<Expression> args) {
 		Expression e; 
 		Expression(out e, true, true);
 		args.Add(e); 
-		while (la.kind == 21) {
+		while (la.kind == 22) {
 			Get();
 			Expression(out e, true, true);
 			args.Add(e); 
@@ -2806,65 +2824,65 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression e;
 		List<Statement> body;
 		
-		Expect(44);
-		while (la.kind == 31) {
+		Expect(45);
+		while (la.kind == 32) {
 			Get();
 			x = t; 
 			Expression(out e, true, false);
-			Expect(27);
+			Expect(28);
 			body = new List<Statement>(); 
 			while (StartOf(15)) {
 				Stmt(body);
 			}
 			alternatives.Add(new GuardedAlternative(x, e, body)); 
 		}
-		Expect(45);
+		Expect(46);
 		endTok = t; 
 	}
 
 	void Guard(out Expression e) {
 		Expression/*!*/ ee;  e = null; 
-		if (la.kind == 55) {
+		if (la.kind == 56) {
 			Get();
 			e = null; 
 		} else if (IsParenStar()) {
-			Expect(48);
-			Expect(55);
 			Expect(49);
+			Expect(56);
+			Expect(50);
 			e = null; 
 		} else if (StartOf(7)) {
 			Expression(out ee, true, true);
 			e = ee; 
-		} else SynErr(197);
+		} else SynErr(198);
 	}
 
 	void LoopSpec(List<MaybeFreeExpression> invariants, List<Expression> decreases, ref List<FrameExpression> mod, ref Attributes decAttrs, ref Attributes modAttrs) {
 		Expression e; FrameExpression fe;
 		bool isFree = false; Attributes attrs = null;
 		
-		if (la.kind == 35 || la.kind == 85) {
-			while (!(la.kind == 0 || la.kind == 35 || la.kind == 85)) {SynErr(198); Get();}
-			if (la.kind == 85) {
+		if (la.kind == 36 || la.kind == 86) {
+			while (!(la.kind == 0 || la.kind == 36 || la.kind == 86)) {SynErr(199); Get();}
+			if (la.kind == 86) {
 				Get();
 				isFree = true; errors.Warning(t, "the 'free' keyword is soon to be deprecated"); 
 			}
-			Expect(35);
+			Expect(36);
 			while (IsAttribute()) {
 				Attribute(ref attrs);
 			}
 			Expression(out e, false, true);
 			invariants.Add(new MaybeFreeExpression(e, isFree, attrs)); 
 			OldSemi();
-		} else if (la.kind == 34) {
-			while (!(la.kind == 0 || la.kind == 34)) {SynErr(199); Get();}
+		} else if (la.kind == 35) {
+			while (!(la.kind == 0 || la.kind == 35)) {SynErr(200); Get();}
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref decAttrs);
 			}
 			DecreasesList(decreases, true, true);
 			OldSemi();
-		} else if (la.kind == 41) {
-			while (!(la.kind == 0 || la.kind == 41)) {SynErr(200); Get();}
+		} else if (la.kind == 42) {
+			while (!(la.kind == 0 || la.kind == 42)) {SynErr(201); Get();}
 			Get();
 			mod = mod ?? new List<FrameExpression>(); 
 			while (IsAttribute()) {
@@ -2872,13 +2890,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			FrameExpression(out fe, false, true);
 			mod.Add(fe); 
-			while (la.kind == 21) {
+			while (la.kind == 22) {
 				Get();
 				FrameExpression(out fe, false, true);
 				mod.Add(fe); 
 			}
 			OldSemi();
-		} else SynErr(201);
+		} else SynErr(202);
 	}
 
 	void CaseStatement(out MatchCaseStmt/*!*/ c) {
@@ -2889,38 +2907,38 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<Statement/*!*/> body = new List<Statement/*!*/>();
 		string/*!*/ name = "";
 		
-		Expect(31);
+		Expect(32);
 		x = t; 
 		if (la.kind == 1) {
 			Ident(out id);
 			name = id.val; 
-			if (la.kind == 48) {
+			if (la.kind == 49) {
 				Get();
 				CasePattern(out pat);
 				arguments.Add(pat); 
-				while (la.kind == 21) {
+				while (la.kind == 22) {
 					Get();
 					CasePattern(out pat);
 					arguments.Add(pat); 
 				}
-				Expect(49);
+				Expect(50);
 			}
-		} else if (la.kind == 48) {
+		} else if (la.kind == 49) {
 			Get();
 			CasePattern(out pat);
 			arguments.Add(pat); 
-			while (la.kind == 21) {
+			while (la.kind == 22) {
 				Get();
 				CasePattern(out pat);
 				arguments.Add(pat); 
 			}
-			Expect(49);
-		} else SynErr(202);
-		Expect(27);
-		while (!(StartOf(28))) {SynErr(203); Get();}
+			Expect(50);
+		} else SynErr(203);
+		Expect(28);
+		while (!(StartOf(28))) {SynErr(204); Get();}
 		while (IsNotEndOfCase()) {
 			Stmt(body);
-			while (!(StartOf(28))) {SynErr(204); Get();}
+			while (!(StartOf(28))) {SynErr(205); Get();}
 		}
 		c = new MatchCaseStmt(x, name, arguments, body); 
 	}
@@ -2932,34 +2950,34 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		
 		if (IsIdentParen()) {
 			Ident(out id);
-			Expect(48);
+			Expect(49);
 			arguments = new List<CasePattern>(); 
-			if (la.kind == 1 || la.kind == 48) {
+			if (la.kind == 1 || la.kind == 49) {
 				CasePattern(out pat);
 				arguments.Add(pat); 
-				while (la.kind == 21) {
+				while (la.kind == 22) {
 					Get();
 					CasePattern(out pat);
 					arguments.Add(pat); 
 				}
 			}
-			Expect(49);
+			Expect(50);
 			pat = new CasePattern(id, id.val, arguments); 
-		} else if (la.kind == 48) {
+		} else if (la.kind == 49) {
 			Get();
 			id = t;                                                           
 			arguments = new List<CasePattern>(); 
 			
-			if (la.kind == 1 || la.kind == 48) {
+			if (la.kind == 1 || la.kind == 49) {
 				CasePattern(out pat);
 				arguments.Add(pat); 
-				while (la.kind == 21) {
+				while (la.kind == 22) {
 					Get();
 					CasePattern(out pat);
 					arguments.Add(pat); 
 				}
 			}
-			Expect(49);
+			Expect(50);
 			theBuiltIns.TupleType(id, arguments.Count, true); // make sure the tuple type exists
 			string ctor = BuiltIns.TupleTypeCtorName;  //use the TupleTypeCtors
 			pat = new CasePattern(id, ctor, arguments); 
@@ -2968,7 +2986,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			IdentTypeOptional(out bv);
 			pat = new CasePattern(bv.tok, bv);
 			
-		} else SynErr(205);
+		} else SynErr(206);
 		if (pat == null) {
 		 pat = new CasePattern(t, "_ParseError", new List<CasePattern>());
 		}
@@ -2983,7 +3001,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		
 		IdentTypeOptional(out bv);
 		bvars.Add(bv); 
-		while (la.kind == 21) {
+		while (la.kind == 22) {
 			Get();
 			IdentTypeOptional(out bv);
 			bvars.Add(bv); 
@@ -2992,7 +3010,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Attribute(ref attrs);
 		}
 		if (la.kind == _verticalbar) {
-			Expect(22);
+			Expect(23);
 			Expression(out range, true, true);
 		}
 	}
@@ -3003,73 +3021,73 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		x = null;
 		
 		switch (la.kind) {
-		case 52: {
+		case 53: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Eq; 
-			if (la.kind == 104) {
+			if (la.kind == 105) {
 				Get();
-				Expect(46);
-				Expression(out k, true, true);
 				Expect(47);
+				Expression(out k, true, true);
+				Expect(48);
 			}
 			break;
 		}
-		case 50: {
+		case 51: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Lt; 
 			break;
 		}
-		case 51: {
+		case 52: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Gt; 
 			break;
 		}
-		case 105: {
+		case 106: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 106: {
+		case 107: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		case 53: {
+		case 54: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Neq; 
 			break;
 		}
-		case 54: {
+		case 55: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Neq; 
 			break;
 		}
-		case 107: {
+		case 108: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 108: {
+		case 109: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		case 109: case 110: {
+		case 110: case 111: {
 			EquivOp();
 			x = t;  binOp = BinaryExpr.Opcode.Iff; 
 			break;
 		}
-		case 111: case 112: {
+		case 112: case 113: {
 			ImpliesOp();
 			x = t;  binOp = BinaryExpr.Opcode.Imp; 
 			break;
 		}
-		case 113: case 114: {
+		case 114: case 115: {
 			ExpliesOp();
 			x = t;  binOp = BinaryExpr.Opcode.Exp; 
 			break;
 		}
-		default: SynErr(206); break;
+		default: SynErr(207); break;
 		}
 		if (k == null) {
 		 op = new Microsoft.Dafny.CalcStmt.BinaryCalcOp(binOp);
@@ -3080,75 +3098,75 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 	}
 
 	void EquivOp() {
-		if (la.kind == 109) {
+		if (la.kind == 110) {
 			Get();
-		} else if (la.kind == 110) {
+		} else if (la.kind == 111) {
 			Get();
-		} else SynErr(207);
+		} else SynErr(208);
 	}
 
 	void ImpliesOp() {
-		if (la.kind == 111) {
+		if (la.kind == 112) {
 			Get();
-		} else if (la.kind == 112) {
+		} else if (la.kind == 113) {
 			Get();
-		} else SynErr(208);
+		} else SynErr(209);
 	}
 
 	void ExpliesOp() {
-		if (la.kind == 113) {
+		if (la.kind == 114) {
 			Get();
-		} else if (la.kind == 114) {
+		} else if (la.kind == 115) {
 			Get();
-		} else SynErr(209);
+		} else SynErr(210);
 	}
 
 	void AndOp() {
-		if (la.kind == 115) {
+		if (la.kind == 116) {
 			Get();
-		} else if (la.kind == 116) {
+		} else if (la.kind == 117) {
 			Get();
-		} else SynErr(210);
+		} else SynErr(211);
 	}
 
 	void OrOp() {
-		if (la.kind == 117) {
+		if (la.kind == 118) {
 			Get();
-		} else if (la.kind == 118) {
+		} else if (la.kind == 119) {
 			Get();
-		} else SynErr(211);
+		} else SynErr(212);
 	}
 
 	void NegOp() {
-		if (la.kind == 119) {
+		if (la.kind == 120) {
 			Get();
-		} else if (la.kind == 120) {
+		} else if (la.kind == 121) {
 			Get();
-		} else SynErr(212);
+		} else SynErr(213);
 	}
 
 	void Forall() {
-		if (la.kind == 101) {
+		if (la.kind == 102) {
 			Get();
-		} else if (la.kind == 121) {
+		} else if (la.kind == 122) {
 			Get();
-		} else SynErr(213);
+		} else SynErr(214);
 	}
 
 	void Exists() {
-		if (la.kind == 122) {
+		if (la.kind == 123) {
 			Get();
-		} else if (la.kind == 123) {
+		} else if (la.kind == 124) {
 			Get();
-		} else SynErr(214);
+		} else SynErr(215);
 	}
 
 	void QSep() {
-		if (la.kind == 23) {
+		if (la.kind == 24) {
 			Get();
-		} else if (la.kind == 24) {
+		} else if (la.kind == 25) {
 			Get();
-		} else SynErr(215);
+		} else SynErr(216);
 	}
 
 	void EquivExpression(out Expression e0, bool allowSemi, bool allowLambda) {
@@ -3166,12 +3184,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Ensures(Contract.ValueAtReturn(out e0) != null); IToken/*!*/ x;  Expression/*!*/ e1; 
 		LogicalExpression(out e0, allowSemi, allowLambda);
 		if (IsImpliesOp() || IsExpliesOp()) {
-			if (la.kind == 111 || la.kind == 112) {
+			if (la.kind == 112 || la.kind == 113) {
 				ImpliesOp();
 				x = t; 
 				ImpliesExpression(out e1, allowSemi, allowLambda);
 				e0 = new BinaryExpr(x, BinaryExpr.Opcode.Imp, e0, e1); 
-			} else if (la.kind == 113 || la.kind == 114) {
+			} else if (la.kind == 114 || la.kind == 115) {
 				ExpliesOp();
 				x = t; 
 				LogicalExpression(out e1, allowSemi, allowLambda);
@@ -3182,7 +3200,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					LogicalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e0, e1); 
 				}
-			} else SynErr(216);
+			} else SynErr(217);
 		}
 	}
 
@@ -3190,7 +3208,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Ensures(Contract.ValueAtReturn(out e0) != null); IToken/*!*/ x;  Expression/*!*/ e1; 
 		RelationalExpression(out e0, allowSemi, allowLambda);
 		if (IsAndOp() || IsOrOp()) {
-			if (la.kind == 115 || la.kind == 116) {
+			if (la.kind == 116 || la.kind == 117) {
 				AndOp();
 				x = t; 
 				RelationalExpression(out e1, allowSemi, allowLambda);
@@ -3201,7 +3219,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					RelationalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.And, e0, e1); 
 				}
-			} else if (la.kind == 117 || la.kind == 118) {
+			} else if (la.kind == 118 || la.kind == 119) {
 				OrOp();
 				x = t; 
 				RelationalExpression(out e1, allowSemi, allowLambda);
@@ -3212,7 +3230,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					RelationalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Or, e0, e1); 
 				}
-			} else SynErr(217);
+			} else SynErr(218);
 		}
 	}
 
@@ -3345,63 +3363,63 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		k = null;
 		
 		switch (la.kind) {
-		case 52: {
+		case 53: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Eq; 
-			if (la.kind == 104) {
+			if (la.kind == 105) {
 				Get();
-				Expect(46);
-				Expression(out k, true, true);
 				Expect(47);
+				Expression(out k, true, true);
+				Expect(48);
 			}
 			break;
 		}
-		case 50: {
+		case 51: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Lt; 
 			break;
 		}
-		case 51: {
+		case 52: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Gt; 
 			break;
 		}
-		case 105: {
+		case 106: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 106: {
+		case 107: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		case 53: {
+		case 54: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Neq; 
-			if (la.kind == 104) {
+			if (la.kind == 105) {
 				Get();
-				Expect(46);
-				Expression(out k, true, true);
 				Expect(47);
+				Expression(out k, true, true);
+				Expect(48);
 			}
 			break;
 		}
-		case 124: {
+		case 125: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.In; 
 			break;
 		}
-		case 56: {
+		case 57: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.NotIn; 
 			break;
 		}
-		case 119: {
+		case 120: {
 			Get();
 			x = t;  y = Token.NoToken; 
 			if (la.val == "!") {
-				Expect(119);
+				Expect(120);
 				y = t; 
 			}
 			if (y == Token.NoToken) {
@@ -3415,22 +3433,22 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			
 			break;
 		}
-		case 54: {
+		case 55: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Neq; 
 			break;
 		}
-		case 107: {
+		case 108: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 108: {
+		case 109: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		default: SynErr(218); break;
+		default: SynErr(219); break;
 		}
 	}
 
@@ -3446,41 +3464,48 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void AddOp(out IToken x, out BinaryExpr.Opcode op) {
 		Contract.Ensures(Contract.ValueAtReturn(out x) != null); x = Token.NoToken;  op=BinaryExpr.Opcode.Add/*(dummy)*/; 
-		if (la.kind == 125) {
+		if (la.kind == 126) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Add; 
-		} else if (la.kind == 126) {
+		} else if (la.kind == 127) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Sub; 
-		} else SynErr(219);
+		} else SynErr(220);
 	}
 
 	void UnaryExpression(out Expression e, bool allowSemi, bool allowLambda) {
 		Contract.Ensures(Contract.ValueAtReturn(out e) != null); IToken/*!*/ x;  e = dummyExpr; 
-		if (la.kind == 126) {
+		if (la.kind == 127) {
 			Get();
 			x = t; 
 			UnaryExpression(out e, allowSemi, allowLambda);
 			e = new NegationExpression(x, e); 
-		} else if (la.kind == 119 || la.kind == 120) {
+		} else if (la.kind == 120 || la.kind == 121) {
 			NegOp();
 			x = t; 
 			UnaryExpression(out e, allowSemi, allowLambda);
 			e = new UnaryOpExpr(x, UnaryOpExpr.Opcode.Not, e); 
 		} else if (IsMapDisplay()) {
-			Expect(16);
+			Expect(17);
 			x = t; 
 			MapDisplayExpr(x, true, out e);
 			while (IsSuffix()) {
 				Suffix(ref e);
 			}
 		} else if (IsIMapDisplay()) {
-			Expect(17);
+			Expect(18);
 			x = t; 
 			MapDisplayExpr(x, false, out e);
 			while (IsSuffix()) {
 				Suffix(ref e);
 			}
+		} else if (IsISetDisplay()) {
+			Expect(14);
+			x = t; 
+			ISetDisplayExpr(x, false, out e);
+			while (IsSuffix()) {
+				Suffix(ref e);
+			}
 		} else if (IsLambda(allowLambda)) {
 			LambdaExpression(out e, allowSemi);
 		} else if (StartOf(29)) {
@@ -3490,12 +3515,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (IsSuffix()) {
 				Suffix(ref e);
 			}
-		} else if (la.kind == 44 || la.kind == 46) {
+		} else if (la.kind == 45 || la.kind == 47) {
 			DisplayExpr(out e);
 			while (IsSuffix()) {
 				Suffix(ref e);
 			}
-		} else if (la.kind == 14) {
+		} else if (la.kind == 15) {
 			MultiSetExpr(out e);
 			while (IsSuffix()) {
 				Suffix(ref e);
@@ -3505,21 +3530,21 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (IsSuffix()) {
 				Suffix(ref e);
 			}
-		} else SynErr(220);
+		} else SynErr(221);
 	}
 
 	void MulOp(out IToken x, out BinaryExpr.Opcode op) {
 		Contract.Ensures(Contract.ValueAtReturn(out x) != null); x = Token.NoToken;  op = BinaryExpr.Opcode.Add/*(dummy)*/; 
-		if (la.kind == 55) {
+		if (la.kind == 56) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Mul; 
-		} else if (la.kind == 127) {
+		} else if (la.kind == 128) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Div; 
-		} else if (la.kind == 128) {
+		} else if (la.kind == 129) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Mod; 
-		} else SynErr(221);
+		} else SynErr(222);
 	}
 
 	void MapDisplayExpr(IToken/*!*/ mapToken, bool finite, out Expression e) {
@@ -3527,12 +3552,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<ExpressionPair/*!*/>/*!*/ elements= new List<ExpressionPair/*!*/>() ;
 		e = dummyExpr;
 		
-		Expect(46);
+		Expect(47);
 		if (StartOf(7)) {
 			MapLiteralExpressions(out elements);
 		}
 		e = new MapDisplayExpr(mapToken, finite, elements);
-		Expect(47);
+		Expect(48);
 	}
 
 	void Suffix(ref Expression e) {
@@ -3542,7 +3567,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<Expression> multipleLengths = null; bool takeRest = false; // takeRest is relevant only if multipleLengths is non-null
 		List<Expression> multipleIndices = null;
 		
-		if (la.kind == 25) {
+		if (la.kind == 26) {
 			DotSuffix(out id, out x);
 			if (x != null) {
 			 // process id as a Suffix in its own right
@@ -3554,33 +3579,33 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			if (IsGenericInstantiation()) {
 				typeArgs = new List<Type>(); 
 				GenericInstantiation(typeArgs);
-			} else if (la.kind == 104) {
+			} else if (la.kind == 105) {
 				HashCall(id, out openParen, out typeArgs, out args);
 			} else if (StartOf(30)) {
-			} else SynErr(222);
+			} else SynErr(223);
 			e = new ExprDotName(id, e, id.val, typeArgs);
 			if (openParen != null) {
 			 e = new ApplySuffix(openParen, e, args);
 			}
 			
-		} else if (la.kind == 46) {
+		} else if (la.kind == 47) {
 			Get();
 			x = t; 
 			if (StartOf(7)) {
 				Expression(out ee, true, true);
 				e0 = ee; 
-				if (la.kind == 135) {
+				if (la.kind == 136) {
 					Get();
 					anyDots = true; 
 					if (StartOf(7)) {
 						Expression(out ee, true, true);
 						e1 = ee; 
 					}
-				} else if (la.kind == 92) {
+				} else if (la.kind == 93) {
 					Get();
 					Expression(out ee, true, true);
 					e1 = ee; 
-				} else if (la.kind == 20) {
+				} else if (la.kind == 21) {
 					Get();
 					multipleLengths = new List<Expression>();
 					multipleLengths.Add(e0);  // account for the Expression read before the colon
@@ -3590,17 +3615,17 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 						Expression(out ee, true, true);
 						multipleLengths.Add(ee); takeRest = false; 
 						while (IsNonFinalColon()) {
-							Expect(20);
+							Expect(21);
 							Expression(out ee, true, true);
 							multipleLengths.Add(ee); 
 						}
-						if (la.kind == 20) {
+						if (la.kind == 21) {
 							Get();
 							takeRest = true; 
 						}
 					}
-				} else if (la.kind == 21 || la.kind == 47) {
-					while (la.kind == 21) {
+				} else if (la.kind == 22 || la.kind == 48) {
+					while (la.kind == 22) {
 						Get();
 						Expression(out ee, true, true);
 						if (multipleIndices == null) {
@@ -3610,15 +3635,15 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 						multipleIndices.Add(ee);
 						
 					}
-				} else SynErr(223);
-			} else if (la.kind == 135) {
+				} else SynErr(224);
+			} else if (la.kind == 136) {
 				Get();
 				anyDots = true; 
 				if (StartOf(7)) {
 					Expression(out ee, true, true);
 					e1 = ee; 
 				}
-			} else SynErr(224);
+			} else SynErr(225);
 			if (multipleIndices != null) {
 			 e = new MultiSelectExpr(x, e, multipleIndices);
 			 // make sure an array class with this dimensionality exists
@@ -3653,16 +3678,29 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 }
 			}
 			
-			Expect(47);
-		} else if (la.kind == 48) {
+			Expect(48);
+		} else if (la.kind == 49) {
 			Get();
 			IToken openParen = t; var args = new List<Expression>(); 
 			if (StartOf(7)) {
 				Expressions(args);
 			}
-			Expect(49);
+			Expect(50);
 			e = new ApplySuffix(openParen, e, args); 
-		} else SynErr(225);
+		} else SynErr(226);
+	}
+
+	void ISetDisplayExpr(IToken/*!*/ setToken, bool finite, out Expression e) {
+		Contract.Ensures(Contract.ValueAtReturn(out e) != null);
+		List<Expression> elements = new List<Expression/*!*/>();;
+		e = dummyExpr;
+		
+		Expect(45);
+		if (StartOf(7)) {
+			Expressions(elements);
+		}
+		e = new SetDisplayExpr(setToken, finite, elements);
+		Expect(46);
 	}
 
 	void LambdaExpression(out Expression e, bool allowSemi) {
@@ -3678,22 +3716,22 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (la.kind == 1) {
 			WildIdent(out id, true);
 			x = t; bvs.Add(new BoundVar(id, id.val, new InferredTypeProxy())); 
-		} else if (la.kind == 48) {
+		} else if (la.kind == 49) {
 			Get();
 			x = t; 
 			if (la.kind == 1) {
 				IdentTypeOptional(out bv);
 				bvs.Add(bv); 
-				while (la.kind == 21) {
+				while (la.kind == 22) {
 					Get();
 					IdentTypeOptional(out bv);
 					bvs.Add(bv); 
 				}
 			}
-			Expect(49);
-		} else SynErr(226);
-		while (la.kind == 42 || la.kind == 43) {
-			if (la.kind == 42) {
+			Expect(50);
+		} else SynErr(227);
+		while (la.kind == 43 || la.kind == 44) {
+			if (la.kind == 43) {
 				Get();
 				PossiblyWildFrameExpression(out fe, true);
 				reads.Add(fe); 
@@ -3717,56 +3755,64 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;
 		
 		switch (la.kind) {
-		case 96: {
+		case 97: {
 			Get();
 			x = t; 
 			Expression(out e, true, true);
-			Expect(32);
-			Expression(out e0, true, true);
 			Expect(33);
+			Expression(out e0, true, true);
+			Expect(34);
 			Expression(out e1, allowSemi, allowLambda);
 			e = new ITEExpr(x, e, e0, e1); 
 			break;
 		}
-		case 98: {
+		case 99: {
 			MatchExpression(out e, allowSemi, allowLambda);
 			break;
 		}
-		case 101: case 121: case 122: case 123: {
+		case 102: case 122: case 123: case 124: {
 			QuantifierGuts(out e, allowSemi, allowLambda);
 			break;
 		}
 		case 13: {
-			SetComprehensionExpr(out e, allowSemi, allowLambda);
+			Get();
+			x = t; 
+			SetComprehensionExpr(x, true, out e, allowSemi, allowLambda);
 			break;
 		}
-		case 29: case 30: case 99: {
+		case 14: {
+			Get();
+			x = t; 
+			SetComprehensionExpr(x, false, out e, allowSemi, allowLambda);
+			break;
+		}
+		case 30: case 31: case 100: {
 			StmtInExpr(out s);
 			Expression(out e, allowSemi, allowLambda);
 			e = new StmtExpr(s.Tok, s, e); 
 			break;
 		}
-		case 70: case 75: {
+		case 71: case 76: {
 			LetExpr(out e, allowSemi, allowLambda);
 			break;
 		}
-		case 16: {
+		case 17: {
 			Get();
 			x = t; 
 			MapComprehensionExpr(x, true, out e, allowSemi, allowLambda);
 			break;
 		}
-		case 17: {
+		case 18: {
 			Get();
 			x = t; 
 			MapComprehensionExpr(x, false, out e, allowSemi, allowLambda);
 			break;
 		}
-		case 89: {
+		case 90: {
 			NamedExpr(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(227); break;
+		default: SynErr(228); break;
 		}
 	}
 
@@ -3778,10 +3824,10 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (IsGenericInstantiation()) {
 			typeArgs = new List<Type>(); 
 			GenericInstantiation(typeArgs);
-		} else if (la.kind == 104) {
+		} else if (la.kind == 105) {
 			HashCall(id, out openParen, out typeArgs, out args);
 		} else if (StartOf(30)) {
-		} else SynErr(228);
+		} else SynErr(229);
 		e = new NameSegment(id, id.val, typeArgs);
 		if (openParen != null) {
 		 e = new ApplySuffix(openParen, e, args);
@@ -3794,23 +3840,23 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken x;  List<Expression> elements;
 		e = dummyExpr;
 		
-		if (la.kind == 44) {
+		if (la.kind == 45) {
 			Get();
 			x = t;  elements = new List<Expression/*!*/>(); 
 			if (StartOf(7)) {
 				Expressions(elements);
 			}
-			e = new SetDisplayExpr(x, elements);
-			Expect(45);
-		} else if (la.kind == 46) {
+			e = new SetDisplayExpr(x, true, elements);
+			Expect(46);
+		} else if (la.kind == 47) {
 			Get();
 			x = t;  elements = new List<Expression/*!*/>(); 
 			if (StartOf(7)) {
 				Expressions(elements);
 			}
 			e = new SeqDisplayExpr(x, elements); 
-			Expect(47);
-		} else SynErr(229);
+			Expect(48);
+		} else SynErr(230);
 	}
 
 	void MultiSetExpr(out Expression e) {
@@ -3818,23 +3864,23 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken/*!*/ x = null;  List<Expression/*!*/>/*!*/ elements;
 		e = dummyExpr;
 		
-		Expect(14);
+		Expect(15);
 		x = t; 
-		if (la.kind == 44) {
+		if (la.kind == 45) {
 			Get();
 			elements = new List<Expression/*!*/>(); 
 			if (StartOf(7)) {
 				Expressions(elements);
 			}
 			e = new MultiSetDisplayExpr(x, elements);
-			Expect(45);
-		} else if (la.kind == 48) {
+			Expect(46);
+		} else if (la.kind == 49) {
 			Get();
 			x = t;  elements = new List<Expression/*!*/>(); 
 			Expression(out e, true, true);
 			e = new MultiSetFormingExpr(x, e); 
-			Expect(49);
-		} else SynErr(230);
+			Expect(50);
+		} else SynErr(231);
 	}
 
 	void ConstAtomExpression(out Expression e, bool allowSemi, bool allowLambda) {
@@ -3843,17 +3889,17 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;  Type toType = null;
 		
 		switch (la.kind) {
-		case 129: {
+		case 130: {
 			Get();
 			e = new LiteralExpr(t, false); 
 			break;
 		}
-		case 130: {
+		case 131: {
 			Get();
 			e = new LiteralExpr(t, true); 
 			break;
 		}
-		case 131: {
+		case 132: {
 			Get();
 			e = new LiteralExpr(t); 
 			break;
@@ -3868,12 +3914,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			e = new LiteralExpr(t, d); 
 			break;
 		}
-		case 18: {
+		case 19: {
 			Get();
 			e = new CharLiteralExpr(t, t.val.Substring(1, t.val.Length - 2)); 
 			break;
 		}
-		case 19: {
+		case 20: {
 			Get();
 			bool isVerbatimString;
 			string s = Util.RemoveParsedStringQuotes(t.val, out isVerbatimString);
@@ -3881,35 +3927,35 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			
 			break;
 		}
-		case 132: {
+		case 133: {
 			Get();
 			e = new ThisExpr(t); 
 			break;
 		}
-		case 133: {
+		case 134: {
 			Get();
 			x = t; 
-			Expect(48);
-			Expression(out e, true, true);
 			Expect(49);
+			Expression(out e, true, true);
+			Expect(50);
 			e = new UnaryOpExpr(x, UnaryOpExpr.Opcode.Fresh, e); 
 			break;
 		}
-		case 134: {
+		case 135: {
 			Get();
 			x = t; 
-			Expect(48);
-			Expression(out e, true, true);
 			Expect(49);
+			Expression(out e, true, true);
+			Expect(50);
 			e = new OldExpr(x, e); 
 			break;
 		}
-		case 22: {
+		case 23: {
 			Get();
 			x = t; 
 			Expression(out e, true, true);
 			e = new UnaryOpExpr(x, UnaryOpExpr.Opcode.Cardinality, e); 
-			Expect(22);
+			Expect(23);
 			break;
 		}
 		case 8: case 10: {
@@ -3920,17 +3966,17 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Get();
 				x = t; toType = new RealType(); 
 			}
-			Expect(48);
-			Expression(out e, true, true);
 			Expect(49);
+			Expression(out e, true, true);
+			Expect(50);
 			e = new ConversionExpr(x, e, toType); 
 			break;
 		}
-		case 48: {
+		case 49: {
 			ParensExpression(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(231); break;
+		default: SynErr(232); break;
 		}
 	}
 
@@ -3959,7 +4005,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 n = BigInteger.Zero;
 			}
 			
-		} else SynErr(232);
+		} else SynErr(233);
 	}
 
 	void Dec(out Basetypes.BigDec d) {
@@ -3979,12 +4025,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken x;
 		var args = new List<Expression>();
 		
-		Expect(48);
+		Expect(49);
 		x = t; 
 		if (StartOf(7)) {
 			Expressions(args);
 		}
-		Expect(49);
+		Expect(50);
 		if (args.Count == 1) {
 		 e = new ParensExpression(x, args[0]);
 		} else {
@@ -3997,26 +4043,26 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void LambdaArrow(out bool oneShot) {
 		oneShot = true; 
-		if (la.kind == 27) {
+		if (la.kind == 28) {
 			Get();
 			oneShot = false; 
-		} else if (la.kind == 28) {
+		} else if (la.kind == 29) {
 			Get();
 			oneShot = true; 
-		} else SynErr(233);
+		} else SynErr(234);
 	}
 
 	void MapLiteralExpressions(out List<ExpressionPair> elements) {
 		Expression/*!*/ d, r;
 		elements = new List<ExpressionPair/*!*/>(); 
 		Expression(out d, true, true);
-		Expect(92);
+		Expect(93);
 		Expression(out r, true, true);
 		elements.Add(new ExpressionPair(d,r)); 
-		while (la.kind == 21) {
+		while (la.kind == 22) {
 			Get();
 			Expression(out d, true, true);
-			Expect(92);
+			Expect(93);
 			Expression(out r, true, true);
 			elements.Add(new ExpressionPair(d,r)); 
 		}
@@ -4032,10 +4078,10 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		
 		IdentTypeOptional(out bv);
 		bvars.Add(bv); 
-		while (la.kind == 44) {
+		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
-		if (la.kind == 22) {
+		if (la.kind == 23) {
 			Get();
 			Expression(out range, true, true);
 		}
@@ -4050,23 +4096,23 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<MatchCaseExpr/*!*/> cases = new List<MatchCaseExpr/*!*/>();
 		bool usesOptionalBrace = false;
 		
-		Expect(98);
+		Expect(99);
 		x = t; 
 		Expression(out e, allowSemi, allowLambda);
 		if (la.kind == _lbrace) {
-			Expect(44);
+			Expect(45);
 			usesOptionalBrace = true; 
-			while (la.kind == 31) {
+			while (la.kind == 32) {
 				CaseExpression(out c, true, true);
 				cases.Add(c); 
 			}
-			Expect(45);
+			Expect(46);
 		} else if (StartOf(31)) {
 			while (la.kind == _case) {
 				CaseExpression(out c, allowSemi, allowLambda);
 				cases.Add(c); 
 			}
-		} else SynErr(234);
+		} else SynErr(235);
 		e = new MatchExpr(x, e, cases, usesOptionalBrace); 
 	}
 
@@ -4078,13 +4124,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression range;
 		Expression/*!*/ body;
 		
-		if (la.kind == 101 || la.kind == 121) {
+		if (la.kind == 102 || la.kind == 122) {
 			Forall();
 			x = t;  univ = true; 
-		} else if (la.kind == 122 || la.kind == 123) {
+		} else if (la.kind == 123 || la.kind == 124) {
 			Exists();
 			x = t; 
-		} else SynErr(235);
+		} else SynErr(236);
 		QuantifierDomain(out bvars, out attrs, out range);
 		QSep();
 		Expression(out body, allowSemi, allowLambda);
@@ -4096,47 +4142,44 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		
 	}
 
-	void SetComprehensionExpr(out Expression q, bool allowSemi, bool allowLambda) {
+	void SetComprehensionExpr(IToken setToken, bool finite, out Expression q, bool allowSemi, bool allowLambda) {
 		Contract.Ensures(Contract.ValueAtReturn(out q) != null);
-		IToken x = Token.NoToken;
 		BoundVar bv;
 		List<BoundVar/*!*/> bvars = new List<BoundVar>();
 		Expression range;
 		Expression body = null;
 		Attributes attrs = null;
 		
-		Expect(13);
-		x = t; 
 		IdentTypeOptional(out bv);
 		bvars.Add(bv); 
-		while (la.kind == 21) {
+		while (la.kind == 22) {
 			Get();
 			IdentTypeOptional(out bv);
 			bvars.Add(bv); 
 		}
-		while (la.kind == 44) {
+		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
-		Expect(22);
+		Expect(23);
 		Expression(out range, allowSemi, allowLambda);
 		if (IsQSep()) {
 			QSep();
 			Expression(out body, allowSemi, allowLambda);
 		}
 		if (body == null && bvars.Count != 1) { SemErr(t, "a set comprehension with more than one bound variable must have a term expression"); }
-		q = new SetComprehension(x, bvars, range, body, attrs);
+		q = new SetComprehension(setToken, finite, bvars, range, body, attrs);
 		
 	}
 
 	void StmtInExpr(out Statement s) {
 		s = dummyStmt; 
-		if (la.kind == 99) {
+		if (la.kind == 100) {
 			AssertStmt(out s);
-		} else if (la.kind == 29) {
-			AssumeStmt(out s);
 		} else if (la.kind == 30) {
+			AssumeStmt(out s);
+		} else if (la.kind == 31) {
 			CalcStmt(out s);
-		} else SynErr(236);
+		} else SynErr(237);
 	}
 
 	void LetExpr(out Expression e, bool allowSemi, bool allowLambda) {
@@ -4149,30 +4192,30 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Attributes attrs = null;
 		e = dummyExpr;
 		
-		if (la.kind == 70) {
+		if (la.kind == 71) {
 			Get();
 			isGhost = true;  x = t; 
 		}
-		Expect(75);
+		Expect(76);
 		if (!isGhost) { x = t; } 
 		CasePattern(out pat);
 		if (isGhost) { pat.Vars.Iter(bv => bv.IsGhost = true); }
 		letLHSs.Add(pat);
 		
-		while (la.kind == 21) {
+		while (la.kind == 22) {
 			Get();
 			CasePattern(out pat);
 			if (isGhost) { pat.Vars.Iter(bv => bv.IsGhost = true); }
 			letLHSs.Add(pat);
 			
 		}
-		if (la.kind == 92) {
+		if (la.kind == 93) {
 			Get();
-		} else if (la.kind == 44 || la.kind == 94) {
-			while (la.kind == 44) {
+		} else if (la.kind == 45 || la.kind == 95) {
+			while (la.kind == 45) {
 				Attribute(ref attrs);
 			}
-			Expect(94);
+			Expect(95);
 			exact = false;
 			foreach (var lhs in letLHSs) {
 			 if (lhs.Arguments != null) {
@@ -4180,15 +4223,15 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 }
 			}
 			
-		} else SynErr(237);
+		} else SynErr(238);
 		Expression(out e, false, true);
 		letRHSs.Add(e); 
-		while (la.kind == 21) {
+		while (la.kind == 22) {
 			Get();
 			Expression(out e, false, true);
 			letRHSs.Add(e); 
 		}
-		Expect(26);
+		Expect(27);
 		Expression(out e, allowSemi, allowLambda);
 		e = new LetExpr(x, letLHSs, letRHSs, e, exact, attrs); 
 	}
@@ -4198,10 +4241,10 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;
 		Expression expr;
 		
-		Expect(89);
+		Expect(90);
 		x = t; 
 		NoUSIdent(out d);
-		Expect(20);
+		Expect(21);
 		Expression(out e, allowSemi, allowLambda);
 		expr = e;
 		e = new NamedExpr(x, d.val, expr); 
@@ -4214,56 +4257,56 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression/*!*/ body;
 		string/*!*/ name = "";
 		
-		Expect(31);
+		Expect(32);
 		x = t; 
 		if (la.kind == 1) {
 			Ident(out id);
 			name = id.val; 
-			if (la.kind == 48) {
+			if (la.kind == 49) {
 				Get();
 				CasePattern(out pat);
 				arguments.Add(pat); 
-				while (la.kind == 21) {
+				while (la.kind == 22) {
 					Get();
 					CasePattern(out pat);
 					arguments.Add(pat); 
 				}
-				Expect(49);
+				Expect(50);
 			}
-		} else if (la.kind == 48) {
+		} else if (la.kind == 49) {
 			Get();
 			CasePattern(out pat);
 			arguments.Add(pat); 
-			while (la.kind == 21) {
+			while (la.kind == 22) {
 				Get();
 				CasePattern(out pat);
 				arguments.Add(pat); 
 			}
-			Expect(49);
-		} else SynErr(238);
-		Expect(27);
+			Expect(50);
+		} else SynErr(239);
+		Expect(28);
 		Expression(out body, allowSemi, allowLambda);
 		c = new MatchCaseExpr(x, name, arguments, body); 
 	}
 
 	void HashCall(IToken id, out IToken openParen, out List<Type> typeArgs, out List<Expression> args) {
 		Expression k; args = new List<Expression>(); typeArgs = null; 
-		Expect(104);
+		Expect(105);
 		id.val = id.val + "#"; 
-		if (la.kind == 50) {
+		if (la.kind == 51) {
 			typeArgs = new List<Type>(); 
 			GenericInstantiation(typeArgs);
 		}
-		Expect(46);
-		Expression(out k, true, true);
 		Expect(47);
-		args.Add(k); 
+		Expression(out k, true, true);
 		Expect(48);
+		args.Add(k); 
+		Expect(49);
 		openParen = t; 
 		if (StartOf(7)) {
 			Expressions(args);
 		}
-		Expect(49);
+		Expect(50);
 	}
 
 	void DotSuffix(out IToken x, out IToken y) {
@@ -4271,7 +4314,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		x = Token.NoToken;
 		y = null;
 		
-		Expect(25);
+		Expect(26);
 		if (la.kind == 1) {
 			Get();
 			x = t; 
@@ -4299,13 +4342,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 }
 			}
 			
-		} else if (la.kind == 43) {
+		} else if (la.kind == 44) {
 			Get();
 			x = t; 
-		} else if (la.kind == 42) {
+		} else if (la.kind == 43) {
 			Get();
 			x = t; 
-		} else SynErr(239);
+		} else SynErr(240);
 	}
 
 
@@ -4321,38 +4364,38 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 	}
 
 	static readonly bool[,]/*!*/ set = {
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_T,_x, _x,_T,_T,_T, _x,_x,_T,_T, _x,_x,_T,_T, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _x,_T,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_T,_x, _x,_x,_x,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_x,_T,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_T,_x, _T,_x,_x,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_x, _T,_T,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_x,_T,_T, _T,_T,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_T,_x, _x,_x,_x,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_T,_T,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_x, _T,_T,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_x, _T,_T,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_x, _T,_T,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_x, _T,_T,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_T, _T,_x,_T,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
-		{_x,_x,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x}
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_T, _x,_x,_T,_T, _T,_x,_x,_T, _T,_x,_x,_T, _T,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _x,_x,_T,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_T, _x,_x,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _T,_x,_x,_x, _x,_x,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_x,_T,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_T, _x,_T,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_x, _x,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_T, _x,_x,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_T,_T, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _T,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
+		{_x,_x,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x}
 
 	};
 } // end Parser
@@ -4391,232 +4434,233 @@ public class Errors {
 			case 11: s = "object expected"; break;
 			case 12: s = "string expected"; break;
 			case 13: s = "set expected"; break;
-			case 14: s = "multiset expected"; break;
-			case 15: s = "seq expected"; break;
-			case 16: s = "map expected"; break;
-			case 17: s = "imap expected"; break;
-			case 18: s = "charToken expected"; break;
-			case 19: s = "stringToken expected"; break;
-			case 20: s = "colon expected"; break;
-			case 21: s = "comma expected"; break;
-			case 22: s = "verticalbar expected"; break;
-			case 23: s = "doublecolon expected"; break;
-			case 24: s = "bullet expected"; break;
-			case 25: s = "dot expected"; break;
-			case 26: s = "semi expected"; break;
-			case 27: s = "darrow expected"; break;
-			case 28: s = "arrow expected"; break;
-			case 29: s = "assume expected"; break;
-			case 30: s = "calc expected"; break;
-			case 31: s = "case expected"; break;
-			case 32: s = "then expected"; break;
-			case 33: s = "else expected"; break;
-			case 34: s = "decreases expected"; break;
-			case 35: s = "invariant expected"; break;
-			case 36: s = "function expected"; break;
-			case 37: s = "predicate expected"; break;
-			case 38: s = "inductive expected"; break;
-			case 39: s = "lemma expected"; break;
-			case 40: s = "copredicate expected"; break;
-			case 41: s = "modifies expected"; break;
-			case 42: s = "reads expected"; break;
-			case 43: s = "requires expected"; break;
-			case 44: s = "lbrace expected"; break;
-			case 45: s = "rbrace expected"; break;
-			case 46: s = "lbracket expected"; break;
-			case 47: s = "rbracket expected"; break;
-			case 48: s = "openparen expected"; break;
-			case 49: s = "closeparen expected"; break;
-			case 50: s = "openAngleBracket expected"; break;
-			case 51: s = "closeAngleBracket expected"; break;
-			case 52: s = "eq expected"; break;
-			case 53: s = "neq expected"; break;
-			case 54: s = "neqAlt expected"; break;
-			case 55: s = "star expected"; break;
-			case 56: s = "notIn expected"; break;
-			case 57: s = "ellipsis expected"; break;
-			case 58: s = "\"include\" expected"; break;
-			case 59: s = "\"abstract\" expected"; break;
-			case 60: s = "\"module\" expected"; break;
-			case 61: s = "\"refines\" expected"; break;
-			case 62: s = "\"import\" expected"; break;
-			case 63: s = "\"opened\" expected"; break;
-			case 64: s = "\"=\" expected"; break;
-			case 65: s = "\"as\" expected"; break;
-			case 66: s = "\"default\" expected"; break;
-			case 67: s = "\"class\" expected"; break;
-			case 68: s = "\"extends\" expected"; break;
-			case 69: s = "\"trait\" expected"; break;
-			case 70: s = "\"ghost\" expected"; break;
-			case 71: s = "\"static\" expected"; break;
-			case 72: s = "\"protected\" expected"; break;
-			case 73: s = "\"datatype\" expected"; break;
-			case 74: s = "\"codatatype\" expected"; break;
-			case 75: s = "\"var\" expected"; break;
-			case 76: s = "\"newtype\" expected"; break;
-			case 77: s = "\"type\" expected"; break;
-			case 78: s = "\"iterator\" expected"; break;
-			case 79: s = "\"yields\" expected"; break;
-			case 80: s = "\"returns\" expected"; break;
-			case 81: s = "\"method\" expected"; break;
-			case 82: s = "\"colemma\" expected"; break;
-			case 83: s = "\"comethod\" expected"; break;
-			case 84: s = "\"constructor\" expected"; break;
-			case 85: s = "\"free\" expected"; break;
-			case 86: s = "\"ensures\" expected"; break;
-			case 87: s = "\"yield\" expected"; break;
-			case 88: s = "\"`\" expected"; break;
-			case 89: s = "\"label\" expected"; break;
-			case 90: s = "\"break\" expected"; break;
-			case 91: s = "\"where\" expected"; break;
-			case 92: s = "\":=\" expected"; break;
-			case 93: s = "\"return\" expected"; break;
-			case 94: s = "\":|\" expected"; break;
-			case 95: s = "\"new\" expected"; break;
-			case 96: s = "\"if\" expected"; break;
-			case 97: s = "\"while\" expected"; break;
-			case 98: s = "\"match\" expected"; break;
-			case 99: s = "\"assert\" expected"; break;
-			case 100: s = "\"print\" expected"; break;
-			case 101: s = "\"forall\" expected"; break;
-			case 102: s = "\"parallel\" expected"; break;
-			case 103: s = "\"modify\" expected"; break;
-			case 104: s = "\"#\" expected"; break;
-			case 105: s = "\"<=\" expected"; break;
-			case 106: s = "\">=\" expected"; break;
-			case 107: s = "\"\\u2264\" expected"; break;
-			case 108: s = "\"\\u2265\" expected"; break;
-			case 109: s = "\"<==>\" expected"; break;
-			case 110: s = "\"\\u21d4\" expected"; break;
-			case 111: s = "\"==>\" expected"; break;
-			case 112: s = "\"\\u21d2\" expected"; break;
-			case 113: s = "\"<==\" expected"; break;
-			case 114: s = "\"\\u21d0\" expected"; break;
-			case 115: s = "\"&&\" expected"; break;
-			case 116: s = "\"\\u2227\" expected"; break;
-			case 117: s = "\"||\" expected"; break;
-			case 118: s = "\"\\u2228\" expected"; break;
-			case 119: s = "\"!\" expected"; break;
-			case 120: s = "\"\\u00ac\" expected"; break;
-			case 121: s = "\"\\u2200\" expected"; break;
-			case 122: s = "\"exists\" expected"; break;
-			case 123: s = "\"\\u2203\" expected"; break;
-			case 124: s = "\"in\" expected"; break;
-			case 125: s = "\"+\" expected"; break;
-			case 126: s = "\"-\" expected"; break;
-			case 127: s = "\"/\" expected"; break;
-			case 128: s = "\"%\" expected"; break;
-			case 129: s = "\"false\" expected"; break;
-			case 130: s = "\"true\" expected"; break;
-			case 131: s = "\"null\" expected"; break;
-			case 132: s = "\"this\" expected"; break;
-			case 133: s = "\"fresh\" expected"; break;
-			case 134: s = "\"old\" expected"; break;
-			case 135: s = "\"..\" expected"; break;
-			case 136: s = "??? expected"; break;
-			case 137: s = "this symbol not expected in SubModuleDecl"; break;
-			case 138: s = "invalid SubModuleDecl"; break;
-			case 139: s = "this symbol not expected in ClassDecl"; break;
-			case 140: s = "this symbol not expected in DatatypeDecl"; break;
-			case 141: s = "invalid DatatypeDecl"; break;
-			case 142: s = "this symbol not expected in DatatypeDecl"; break;
-			case 143: s = "invalid NewtypeDecl"; break;
-			case 144: s = "invalid OtherTypeDecl"; break;
-			case 145: s = "this symbol not expected in OtherTypeDecl"; break;
-			case 146: s = "this symbol not expected in IteratorDecl"; break;
-			case 147: s = "invalid IteratorDecl"; break;
-			case 148: s = "this symbol not expected in TraitDecl"; break;
-			case 149: s = "invalid ClassMemberDecl"; break;
-			case 150: s = "this symbol not expected in FieldDecl"; break;
-			case 151: s = "invalid FunctionDecl"; break;
+			case 14: s = "iset expected"; break;
+			case 15: s = "multiset expected"; break;
+			case 16: s = "seq expected"; break;
+			case 17: s = "map expected"; break;
+			case 18: s = "imap expected"; break;
+			case 19: s = "charToken expected"; break;
+			case 20: s = "stringToken expected"; break;
+			case 21: s = "colon expected"; break;
+			case 22: s = "comma expected"; break;
+			case 23: s = "verticalbar expected"; break;
+			case 24: s = "doublecolon expected"; break;
+			case 25: s = "bullet expected"; break;
+			case 26: s = "dot expected"; break;
+			case 27: s = "semi expected"; break;
+			case 28: s = "darrow expected"; break;
+			case 29: s = "arrow expected"; break;
+			case 30: s = "assume expected"; break;
+			case 31: s = "calc expected"; break;
+			case 32: s = "case expected"; break;
+			case 33: s = "then expected"; break;
+			case 34: s = "else expected"; break;
+			case 35: s = "decreases expected"; break;
+			case 36: s = "invariant expected"; break;
+			case 37: s = "function expected"; break;
+			case 38: s = "predicate expected"; break;
+			case 39: s = "inductive expected"; break;
+			case 40: s = "lemma expected"; break;
+			case 41: s = "copredicate expected"; break;
+			case 42: s = "modifies expected"; break;
+			case 43: s = "reads expected"; break;
+			case 44: s = "requires expected"; break;
+			case 45: s = "lbrace expected"; break;
+			case 46: s = "rbrace expected"; break;
+			case 47: s = "lbracket expected"; break;
+			case 48: s = "rbracket expected"; break;
+			case 49: s = "openparen expected"; break;
+			case 50: s = "closeparen expected"; break;
+			case 51: s = "openAngleBracket expected"; break;
+			case 52: s = "closeAngleBracket expected"; break;
+			case 53: s = "eq expected"; break;
+			case 54: s = "neq expected"; break;
+			case 55: s = "neqAlt expected"; break;
+			case 56: s = "star expected"; break;
+			case 57: s = "notIn expected"; break;
+			case 58: s = "ellipsis expected"; break;
+			case 59: s = "\"include\" expected"; break;
+			case 60: s = "\"abstract\" expected"; break;
+			case 61: s = "\"module\" expected"; break;
+			case 62: s = "\"refines\" expected"; break;
+			case 63: s = "\"import\" expected"; break;
+			case 64: s = "\"opened\" expected"; break;
+			case 65: s = "\"=\" expected"; break;
+			case 66: s = "\"as\" expected"; break;
+			case 67: s = "\"default\" expected"; break;
+			case 68: s = "\"class\" expected"; break;
+			case 69: s = "\"extends\" expected"; break;
+			case 70: s = "\"trait\" expected"; break;
+			case 71: s = "\"ghost\" expected"; break;
+			case 72: s = "\"static\" expected"; break;
+			case 73: s = "\"protected\" expected"; break;
+			case 74: s = "\"datatype\" expected"; break;
+			case 75: s = "\"codatatype\" expected"; break;
+			case 76: s = "\"var\" expected"; break;
+			case 77: s = "\"newtype\" expected"; break;
+			case 78: s = "\"type\" expected"; break;
+			case 79: s = "\"iterator\" expected"; break;
+			case 80: s = "\"yields\" expected"; break;
+			case 81: s = "\"returns\" expected"; break;
+			case 82: s = "\"method\" expected"; break;
+			case 83: s = "\"colemma\" expected"; break;
+			case 84: s = "\"comethod\" expected"; break;
+			case 85: s = "\"constructor\" expected"; break;
+			case 86: s = "\"free\" expected"; break;
+			case 87: s = "\"ensures\" expected"; break;
+			case 88: s = "\"yield\" expected"; break;
+			case 89: s = "\"`\" expected"; break;
+			case 90: s = "\"label\" expected"; break;
+			case 91: s = "\"break\" expected"; break;
+			case 92: s = "\"where\" expected"; break;
+			case 93: s = "\":=\" expected"; break;
+			case 94: s = "\"return\" expected"; break;
+			case 95: s = "\":|\" expected"; break;
+			case 96: s = "\"new\" expected"; break;
+			case 97: s = "\"if\" expected"; break;
+			case 98: s = "\"while\" expected"; break;
+			case 99: s = "\"match\" expected"; break;
+			case 100: s = "\"assert\" expected"; break;
+			case 101: s = "\"print\" expected"; break;
+			case 102: s = "\"forall\" expected"; break;
+			case 103: s = "\"parallel\" expected"; break;
+			case 104: s = "\"modify\" expected"; break;
+			case 105: s = "\"#\" expected"; break;
+			case 106: s = "\"<=\" expected"; break;
+			case 107: s = "\">=\" expected"; break;
+			case 108: s = "\"\\u2264\" expected"; break;
+			case 109: s = "\"\\u2265\" expected"; break;
+			case 110: s = "\"<==>\" expected"; break;
+			case 111: s = "\"\\u21d4\" expected"; break;
+			case 112: s = "\"==>\" expected"; break;
+			case 113: s = "\"\\u21d2\" expected"; break;
+			case 114: s = "\"<==\" expected"; break;
+			case 115: s = "\"\\u21d0\" expected"; break;
+			case 116: s = "\"&&\" expected"; break;
+			case 117: s = "\"\\u2227\" expected"; break;
+			case 118: s = "\"||\" expected"; break;
+			case 119: s = "\"\\u2228\" expected"; break;
+			case 120: s = "\"!\" expected"; break;
+			case 121: s = "\"\\u00ac\" expected"; break;
+			case 122: s = "\"\\u2200\" expected"; break;
+			case 123: s = "\"exists\" expected"; break;
+			case 124: s = "\"\\u2203\" expected"; break;
+			case 125: s = "\"in\" expected"; break;
+			case 126: s = "\"+\" expected"; break;
+			case 127: s = "\"-\" expected"; break;
+			case 128: s = "\"/\" expected"; break;
+			case 129: s = "\"%\" expected"; break;
+			case 130: s = "\"false\" expected"; break;
+			case 131: s = "\"true\" expected"; break;
+			case 132: s = "\"null\" expected"; break;
+			case 133: s = "\"this\" expected"; break;
+			case 134: s = "\"fresh\" expected"; break;
+			case 135: s = "\"old\" expected"; break;
+			case 136: s = "\"..\" expected"; break;
+			case 137: s = "??? expected"; break;
+			case 138: s = "this symbol not expected in SubModuleDecl"; break;
+			case 139: s = "invalid SubModuleDecl"; break;
+			case 140: s = "this symbol not expected in ClassDecl"; break;
+			case 141: s = "this symbol not expected in DatatypeDecl"; break;
+			case 142: s = "invalid DatatypeDecl"; break;
+			case 143: s = "this symbol not expected in DatatypeDecl"; break;
+			case 144: s = "invalid NewtypeDecl"; break;
+			case 145: s = "invalid OtherTypeDecl"; break;
+			case 146: s = "this symbol not expected in OtherTypeDecl"; break;
+			case 147: s = "this symbol not expected in IteratorDecl"; break;
+			case 148: s = "invalid IteratorDecl"; break;
+			case 149: s = "this symbol not expected in TraitDecl"; break;
+			case 150: s = "invalid ClassMemberDecl"; break;
+			case 151: s = "this symbol not expected in FieldDecl"; break;
 			case 152: s = "invalid FunctionDecl"; break;
 			case 153: s = "invalid FunctionDecl"; break;
 			case 154: s = "invalid FunctionDecl"; break;
 			case 155: s = "invalid FunctionDecl"; break;
-			case 156: s = "this symbol not expected in MethodDecl"; break;
-			case 157: s = "invalid MethodDecl"; break;
+			case 156: s = "invalid FunctionDecl"; break;
+			case 157: s = "this symbol not expected in MethodDecl"; break;
 			case 158: s = "invalid MethodDecl"; break;
-			case 159: s = "invalid FIdentType"; break;
-			case 160: s = "this symbol not expected in OldSemi"; break;
-			case 161: s = "invalid TypeIdentOptional"; break;
-			case 162: s = "invalid TypeAndToken"; break;
-			case 163: s = "this symbol not expected in IteratorSpec"; break;
-			case 164: s = "invalid IteratorSpec"; break;
+			case 159: s = "invalid MethodDecl"; break;
+			case 160: s = "invalid FIdentType"; break;
+			case 161: s = "this symbol not expected in OldSemi"; break;
+			case 162: s = "invalid TypeIdentOptional"; break;
+			case 163: s = "invalid TypeAndToken"; break;
+			case 164: s = "this symbol not expected in IteratorSpec"; break;
 			case 165: s = "invalid IteratorSpec"; break;
-			case 166: s = "this symbol not expected in MethodSpec"; break;
-			case 167: s = "invalid MethodSpec"; break;
+			case 166: s = "invalid IteratorSpec"; break;
+			case 167: s = "this symbol not expected in MethodSpec"; break;
 			case 168: s = "invalid MethodSpec"; break;
-			case 169: s = "invalid FrameExpression"; break;
-			case 170: s = "this symbol not expected in FunctionSpec"; break;
-			case 171: s = "invalid FunctionSpec"; break;
-			case 172: s = "invalid PossiblyWildFrameExpression"; break;
-			case 173: s = "invalid PossiblyWildExpression"; break;
-			case 174: s = "this symbol not expected in OneStmt"; break;
-			case 175: s = "invalid OneStmt"; break;
-			case 176: s = "this symbol not expected in OneStmt"; break;
-			case 177: s = "invalid OneStmt"; break;
-			case 178: s = "invalid AssertStmt"; break;
-			case 179: s = "invalid AssumeStmt"; break;
-			case 180: s = "invalid UpdateStmt"; break;
+			case 169: s = "invalid MethodSpec"; break;
+			case 170: s = "invalid FrameExpression"; break;
+			case 171: s = "this symbol not expected in FunctionSpec"; break;
+			case 172: s = "invalid FunctionSpec"; break;
+			case 173: s = "invalid PossiblyWildFrameExpression"; break;
+			case 174: s = "invalid PossiblyWildExpression"; break;
+			case 175: s = "this symbol not expected in OneStmt"; break;
+			case 176: s = "invalid OneStmt"; break;
+			case 177: s = "this symbol not expected in OneStmt"; break;
+			case 178: s = "invalid OneStmt"; break;
+			case 179: s = "invalid AssertStmt"; break;
+			case 180: s = "invalid AssumeStmt"; break;
 			case 181: s = "invalid UpdateStmt"; break;
-			case 182: s = "this symbol not expected in VarDeclStatement"; break;
-			case 183: s = "invalid IfStmt"; break;
+			case 182: s = "invalid UpdateStmt"; break;
+			case 183: s = "this symbol not expected in VarDeclStatement"; break;
 			case 184: s = "invalid IfStmt"; break;
-			case 185: s = "invalid WhileStmt"; break;
+			case 185: s = "invalid IfStmt"; break;
 			case 186: s = "invalid WhileStmt"; break;
-			case 187: s = "invalid MatchStmt"; break;
-			case 188: s = "invalid ForallStmt"; break;
+			case 187: s = "invalid WhileStmt"; break;
+			case 188: s = "invalid MatchStmt"; break;
 			case 189: s = "invalid ForallStmt"; break;
-			case 190: s = "invalid CalcStmt"; break;
-			case 191: s = "invalid ModifyStmt"; break;
-			case 192: s = "this symbol not expected in ModifyStmt"; break;
-			case 193: s = "invalid ModifyStmt"; break;
-			case 194: s = "invalid ReturnStmt"; break;
-			case 195: s = "invalid Rhs"; break;
-			case 196: s = "invalid Lhs"; break;
-			case 197: s = "invalid Guard"; break;
-			case 198: s = "this symbol not expected in LoopSpec"; break;
+			case 190: s = "invalid ForallStmt"; break;
+			case 191: s = "invalid CalcStmt"; break;
+			case 192: s = "invalid ModifyStmt"; break;
+			case 193: s = "this symbol not expected in ModifyStmt"; break;
+			case 194: s = "invalid ModifyStmt"; break;
+			case 195: s = "invalid ReturnStmt"; break;
+			case 196: s = "invalid Rhs"; break;
+			case 197: s = "invalid Lhs"; break;
+			case 198: s = "invalid Guard"; break;
 			case 199: s = "this symbol not expected in LoopSpec"; break;
 			case 200: s = "this symbol not expected in LoopSpec"; break;
-			case 201: s = "invalid LoopSpec"; break;
-			case 202: s = "invalid CaseStatement"; break;
-			case 203: s = "this symbol not expected in CaseStatement"; break;
+			case 201: s = "this symbol not expected in LoopSpec"; break;
+			case 202: s = "invalid LoopSpec"; break;
+			case 203: s = "invalid CaseStatement"; break;
 			case 204: s = "this symbol not expected in CaseStatement"; break;
-			case 205: s = "invalid CasePattern"; break;
-			case 206: s = "invalid CalcOp"; break;
-			case 207: s = "invalid EquivOp"; break;
-			case 208: s = "invalid ImpliesOp"; break;
-			case 209: s = "invalid ExpliesOp"; break;
-			case 210: s = "invalid AndOp"; break;
-			case 211: s = "invalid OrOp"; break;
-			case 212: s = "invalid NegOp"; break;
-			case 213: s = "invalid Forall"; break;
-			case 214: s = "invalid Exists"; break;
-			case 215: s = "invalid QSep"; break;
-			case 216: s = "invalid ImpliesExpliesExpression"; break;
-			case 217: s = "invalid LogicalExpression"; break;
-			case 218: s = "invalid RelOp"; break;
-			case 219: s = "invalid AddOp"; break;
-			case 220: s = "invalid UnaryExpression"; break;
-			case 221: s = "invalid MulOp"; break;
-			case 222: s = "invalid Suffix"; break;
+			case 205: s = "this symbol not expected in CaseStatement"; break;
+			case 206: s = "invalid CasePattern"; break;
+			case 207: s = "invalid CalcOp"; break;
+			case 208: s = "invalid EquivOp"; break;
+			case 209: s = "invalid ImpliesOp"; break;
+			case 210: s = "invalid ExpliesOp"; break;
+			case 211: s = "invalid AndOp"; break;
+			case 212: s = "invalid OrOp"; break;
+			case 213: s = "invalid NegOp"; break;
+			case 214: s = "invalid Forall"; break;
+			case 215: s = "invalid Exists"; break;
+			case 216: s = "invalid QSep"; break;
+			case 217: s = "invalid ImpliesExpliesExpression"; break;
+			case 218: s = "invalid LogicalExpression"; break;
+			case 219: s = "invalid RelOp"; break;
+			case 220: s = "invalid AddOp"; break;
+			case 221: s = "invalid UnaryExpression"; break;
+			case 222: s = "invalid MulOp"; break;
 			case 223: s = "invalid Suffix"; break;
 			case 224: s = "invalid Suffix"; break;
 			case 225: s = "invalid Suffix"; break;
-			case 226: s = "invalid LambdaExpression"; break;
-			case 227: s = "invalid EndlessExpression"; break;
-			case 228: s = "invalid NameSegment"; break;
-			case 229: s = "invalid DisplayExpr"; break;
-			case 230: s = "invalid MultiSetExpr"; break;
-			case 231: s = "invalid ConstAtomExpression"; break;
-			case 232: s = "invalid Nat"; break;
-			case 233: s = "invalid LambdaArrow"; break;
-			case 234: s = "invalid MatchExpression"; break;
-			case 235: s = "invalid QuantifierGuts"; break;
-			case 236: s = "invalid StmtInExpr"; break;
-			case 237: s = "invalid LetExpr"; break;
-			case 238: s = "invalid CaseExpression"; break;
-			case 239: s = "invalid DotSuffix"; break;
+			case 226: s = "invalid Suffix"; break;
+			case 227: s = "invalid LambdaExpression"; break;
+			case 228: s = "invalid EndlessExpression"; break;
+			case 229: s = "invalid NameSegment"; break;
+			case 230: s = "invalid DisplayExpr"; break;
+			case 231: s = "invalid MultiSetExpr"; break;
+			case 232: s = "invalid ConstAtomExpression"; break;
+			case 233: s = "invalid Nat"; break;
+			case 234: s = "invalid LambdaArrow"; break;
+			case 235: s = "invalid MatchExpression"; break;
+			case 236: s = "invalid QuantifierGuts"; break;
+			case 237: s = "invalid StmtInExpr"; break;
+			case 238: s = "invalid LetExpr"; break;
+			case 239: s = "invalid CaseExpression"; break;
+			case 240: s = "invalid DotSuffix"; break;
 
 			default: s = "error " + n; break;
 		}
diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index 0259f12c..cdcdb9e8 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -1346,7 +1346,11 @@ namespace Microsoft.Dafny {
 
       } else if (expr is DisplayExpression) {
         DisplayExpression e = (DisplayExpression)expr;
-        if (e is MultiSetDisplayExpr) wr.Write("multiset");
+        if (e is MultiSetDisplayExpr) {
+          wr.Write("multiset");
+        } else if (e is SetDisplayExpr && !((SetDisplayExpr)e).Finite) {
+          wr.Write("iset");
+        }
         wr.Write(e is SetDisplayExpr || e is MultiSetDisplayExpr ? "{" : "[");
         PrintExpressionList(e.Elements, false);
         wr.Write(e is SetDisplayExpr || e is MultiSetDisplayExpr ? "}" : "]");
diff --git a/Source/Dafny/RefinementTransformer.cs b/Source/Dafny/RefinementTransformer.cs
index d819652d..05146b7d 100644
--- a/Source/Dafny/RefinementTransformer.cs
+++ b/Source/Dafny/RefinementTransformer.cs
@@ -452,7 +452,8 @@ namespace Microsoft.Dafny
       } else if (prev is ObjectType) {
         return next is ObjectType;
       } else if (prev is SetType) {
-        return next is SetType && ResolvedTypesAreTheSame(((SetType)prev).Arg, ((SetType)next).Arg);
+        return next is SetType && ((SetType)prev).Finite == ((SetType)next).Finite &&
+          ResolvedTypesAreTheSame(((SetType)prev).Arg, ((SetType)next).Arg);
       } else if (prev is MultiSetType) {
         return next is MultiSetType && ResolvedTypesAreTheSame(((MultiSetType)prev).Arg, ((MultiSetType)next).Arg);
       } else if (prev is MapType) {
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 033f5230..52b01d58 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -597,18 +597,18 @@ namespace Microsoft.Dafny
         bvars.Add(oVar);
 
         return
-          new SetComprehension(e.tok, bvars,
+          new SetComprehension(e.tok, true, bvars,
             new BinaryExpr(e.tok, BinaryExpr.Opcode.In, obj,
               new ApplyExpr(e.tok, e, bexprs)
               {
-                Type = new SetType(new ObjectType())
+                Type = new SetType(true, new ObjectType())
               })
             {
               ResolvedOp = BinaryExpr.ResolvedOpcode.InSet,
               Type = Type.Bool
             }, obj, null)
           {
-            Type = new SetType(new ObjectType())
+            Type = new SetType(true, new ObjectType())
           };
       } else {
         return e;
@@ -646,8 +646,8 @@ namespace Microsoft.Dafny
             var sInE = new BinaryExpr(e.tok, BinaryExpr.Opcode.In, bvIE, e);
             sInE.ResolvedOp = BinaryExpr.ResolvedOpcode.InSeq;  // resolve here
             sInE.Type = Type.Bool;  // resolve here
-            var s = new SetComprehension(e.tok, new List<BoundVar>() { bv }, sInE, bvIE, null);
-            s.Type = new SetType(new ObjectType());  // resolve here
+            var s = new SetComprehension(e.tok, true, new List<BoundVar>() { bv }, sInE, bvIE, null);
+            s.Type = new SetType(true, new ObjectType());  // resolve here
             sets.Add(s);
           } else {
             // e is already a set
@@ -657,20 +657,20 @@ namespace Microsoft.Dafny
         }
       }
       if (singletons != null) {
-        Expression display = new SetDisplayExpr(singletons[0].tok, singletons);
-        display.Type = new SetType(new ObjectType());  // resolve here
+        Expression display = new SetDisplayExpr(singletons[0].tok, true, singletons);
+        display.Type = new SetType(true, new ObjectType());  // resolve here
         sets.Add(display);
       }
       if (sets.Count == 0) {
-        Expression emptyset = new SetDisplayExpr(Token.NoToken, new List<Expression>());
-        emptyset.Type = new SetType(new ObjectType());  // resolve here
+        Expression emptyset = new SetDisplayExpr(Token.NoToken, true, new List<Expression>());
+        emptyset.Type = new SetType(true, new ObjectType());  // resolve here
         return emptyset;
       } else {
         Expression s = sets[0];
         for (int i = 1; i < sets.Count; i++) {
           BinaryExpr union = new BinaryExpr(s.tok, BinaryExpr.Opcode.Add, s, sets[i]);
           union.ResolvedOp = BinaryExpr.ResolvedOpcode.Union;  // resolve here
-          union.Type = new SetType(new ObjectType());  // resolve here
+          union.Type = new SetType(true, new ObjectType());  // resolve here
           s = union;
         }
         return s;
@@ -961,9 +961,9 @@ namespace Microsoft.Dafny
             iter.Members.Add(f);
           });
           // add the additional special variables as fields
-          iter.Member_Reads = new SpecialField(iter.tok, "_reads", "_reads",          "", "", true, false, false, new SetType(new ObjectType()), null);
-          iter.Member_Modifies = new SpecialField(iter.tok, "_modifies", "_modifies", "", "", true, false, false, new SetType(new ObjectType()), null);
-          iter.Member_New = new SpecialField(iter.tok, "_new", "_new",                "", "", true, true, true, new SetType(new ObjectType()), null);
+          iter.Member_Reads = new SpecialField(iter.tok, "_reads", "_reads",          "", "", true, false, false, new SetType(true, new ObjectType()), null);
+          iter.Member_Modifies = new SpecialField(iter.tok, "_modifies", "_modifies", "", "", true, false, false, new SetType(true, new ObjectType()), null);
+          iter.Member_New = new SpecialField(iter.tok, "_new", "_new",                "", "", true, true, true, new SetType(true, new ObjectType()), null);
           foreach (var field in new List<Field>() { iter.Member_Reads, iter.Member_Modifies, iter.Member_New }) {
             field.EnclosingClass = iter;  // resolve here
             members.Add(field.Name, field);
@@ -2711,7 +2711,11 @@ namespace Microsoft.Dafny
         if (type is BasicType) {
           // fine
         } else if (type is SetType) {
-          var argType = ((SetType)type).Arg;
+          var st = (SetType)type;
+          var argType = st.Arg;
+          if (!st.Finite) {
+            Error(tok, "isets do not support equality: {0}", st);
+          }
           if (!argType.SupportsEquality) {
             Error(tok, "set argument type must support equality (got {0}){1}", argType, TypeEqualityErrorMessageHint(argType));
           }
@@ -3339,7 +3343,8 @@ namespace Microsoft.Dafny
                 (anotherIndDt != null && anotherIndDt.EqualitySupport == IndDatatypeDecl.ES.Never) ||
                 arg.Type.IsCoDatatype ||
                 arg.Type.IsArrowType ||
-                arg.Type.IsIMapType) {
+                arg.Type.IsIMapType ||
+                arg.Type.IsISetType) {
               // arg.Type is known never to support equality
               // So, go around the entire SCC and record what we learnt
               foreach (var ddtt in scc) {
@@ -3840,7 +3845,7 @@ namespace Microsoft.Dafny
       ens.Add(new MaybeFreeExpression(valid_call));
       // ensures this._reads == old(ReadsClause);
       var modSetSingletons = new List<Expression>();
-      Expression frameSet = new SetDisplayExpr(iter.tok, modSetSingletons);
+      Expression frameSet = new SetDisplayExpr(iter.tok, true, modSetSingletons);
       foreach (var fr in iter.Reads.Expressions) {
         if (fr.FieldName != null) {
           Error(fr.tok, "sorry, a reads clause for an iterator is not allowed to designate specific fields");
@@ -3855,7 +3860,7 @@ namespace Microsoft.Dafny
         new OldExpr(iter.tok, frameSet))));
       // ensures this._modifies == old(ModifiesClause);
       modSetSingletons = new List<Expression>();
-      frameSet = new SetDisplayExpr(iter.tok, modSetSingletons);
+      frameSet = new SetDisplayExpr(iter.tok, true, modSetSingletons);
       foreach (var fr in iter.Modifies.Expressions) {
         if (fr.FieldName != null) {
           Error(fr.tok, "sorry, a modifies clause for an iterator is not allowed to designate specific fields");
@@ -3871,7 +3876,7 @@ namespace Microsoft.Dafny
       // ensures this._new == {};
       ens.Add(new MaybeFreeExpression(new BinaryExpr(iter.tok, BinaryExpr.Opcode.Eq,
         new MemberSelectExpr(iter.tok, new ThisExpr(iter.tok), "_new"),
-        new SetDisplayExpr(iter.tok, new List<Expression>()))));
+        new SetDisplayExpr(iter.tok, true, new List<Expression>()))));
       // ensures this._decreases0 == old(DecreasesClause[0]) && ...;
       Contract.Assert(iter.Decreases.Expressions.Count == iter.DecreasesFields.Count);
       for (int i = 0; i < iter.Decreases.Expressions.Count; i++) {
@@ -4233,7 +4238,8 @@ namespace Microsoft.Dafny
       } else if (a is ObjectType) {
         return b is ObjectType;
       } else if (a is SetType) {
-        return b is SetType && UnifyTypes(((SetType)a).Arg, ((SetType)b).Arg);
+        return b is SetType && ((SetType)a).Finite == ((SetType)b).Finite &&
+               UnifyTypes(((SetType)a).Arg, ((SetType)b).Arg);
       } else if (a is MultiSetType) {
         return b is MultiSetType && UnifyTypes(((MultiSetType)a).Arg, ((MultiSetType)b).Arg);
       } else if (a is MapType) {
@@ -4354,7 +4360,9 @@ namespace Microsoft.Dafny
           // fine
         } else if (opProxy.AllowChar && t is CharType) {
           // fine
-        } else if (opProxy.AllowSetVarieties && (t is SetType || t is MultiSetType)) {
+        } else if (opProxy.AllowSetVarieties && ((t is SetType && ((SetType)t).Finite) || t is MultiSetType)) {
+          // fine
+        } else if (opProxy.AllowISet && (t is SetType && !((SetType)t).Finite)) {
           // fine
         } else if (opProxy.AllowSeq && t is SeqType) {
           // fine
@@ -4365,7 +4373,7 @@ namespace Microsoft.Dafny
       } else if (proxy is IndexableTypeProxy) {
         var iProxy = (IndexableTypeProxy)proxy;
         if (t is SeqType) {
-          if (!UnifyTypes(iProxy.Domain, new OperationTypeProxy(true, false, false, false, false))) {
+          if (!UnifyTypes(iProxy.Domain, new OperationTypeProxy(true, false, false, false, false, false))) {
             return false;
           } else if (!UnifyTypes(iProxy.Range, ((SeqType)t).Arg)) {
             return false;
@@ -4374,7 +4382,7 @@ namespace Microsoft.Dafny
           }
         } else if (iProxy.AllowArray && t.IsArrayType && t.AsArrayType.Dims == 1) {
           Type elType = UserDefinedType.ArrayElementType(t);
-          if (!UnifyTypes(iProxy.Domain, new OperationTypeProxy(true, false, false, false, false))) {
+          if (!UnifyTypes(iProxy.Domain, new OperationTypeProxy(true, false, false, false, false, false))) {
             return false;
           } else if (!UnifyTypes(iProxy.Range, elType)) {
             return false;
@@ -4400,7 +4408,7 @@ namespace Microsoft.Dafny
         } else if (t is MultiSetType) {
           if (!UnifyTypes(iProxy.Domain, ((MultiSetType)t).Arg)) {
             return false;
-          } else if (!UnifyTypes(iProxy.Range, new OperationTypeProxy(true, false, false, false, false))) {
+          } else if (!UnifyTypes(iProxy.Range, new OperationTypeProxy(true, false, false, false, false, false))) {
             return false;
           } else if (!UnifyTypes(iProxy.Arg, iProxy.Domain)) {
             return false;
@@ -4485,11 +4493,11 @@ namespace Microsoft.Dafny
           return UnifyTypes(((CollectionTypeProxy)a).Arg, ((CollectionTypeProxy)b).Arg);
         } else if (b is OperationTypeProxy) {
           var proxy = (OperationTypeProxy)b;
-          if (proxy.AllowSeq && proxy.AllowSetVarieties) {
+          if (proxy.AllowSeq && proxy.AllowSetVarieties && proxy.AllowISet) {
             b.T = a;  // a is a stronger constraint than b
           } else {
             // a says set<T>,seq<T> and b says numeric,set; the intersection is set<T>
-            var c = new SetType(((CollectionTypeProxy)a).Arg);
+            var c = new SetType(true, ((CollectionTypeProxy)a).Arg);
             return AssignProxyAfterCycleCheck(a, c) && AssignProxyAfterCycleCheck(b, c);
           }
           return true;
@@ -4497,7 +4505,7 @@ namespace Microsoft.Dafny
           var pa = (CollectionTypeProxy)a;
           var ib = (IndexableTypeProxy)b;
           // pa is:
-          //   set(Arg) or multiset(Arg) or seq(Arg) or map(Arg, anyRange) or imap(Arg, anyRange)
+          //   set(Arg) or iset(Arg) or multiset(Arg) or seq(Arg) or map(Arg, anyRange) or imap(Arg, anyRange)
           // ib is:
           //   multiset(Arg) or
           //   seq(Arg) or
@@ -4525,15 +4533,16 @@ namespace Microsoft.Dafny
           var h = pa.AllowChar && pb.AllowChar;
           var q = pa.AllowSeq && pb.AllowSeq;
           var s = pa.AllowSetVarieties && pb.AllowSetVarieties;
-          if (!i && !r && !h && !q && !s) {
+          var t = pa.AllowISet && pb.AllowISet;
+          if (!i && !r && !h && !q && !s && !t) {
             // over-constrained
             return false;
-          } else if (i == pa.AllowInts && r == pa.AllowReals && h == pa.AllowChar && q == pa.AllowSeq && s == pa.AllowSetVarieties) {
+          } else if (i == pa.AllowInts && r == pa.AllowReals && h == pa.AllowChar && q == pa.AllowSeq && s == pa.AllowSetVarieties && t == pa.AllowISet) {
             b.T = a;  // a has the stronger requirement
-          } else if (i == pb.AllowInts && r == pb.AllowReals && h == pb.AllowChar && q == pb.AllowSeq && s == pb.AllowSetVarieties) {
+          } else if (i == pb.AllowInts && r == pb.AllowReals && h == pb.AllowChar && q == pb.AllowSeq && s == pb.AllowSetVarieties && t == pb.AllowISet) {
             a.T = b;  // b has the stronger requirement
           } else {
-            Type c = !i && !r && h && !q && !s ? new CharType() : (Type)new OperationTypeProxy(i, r, h, q, s);
+            Type c = !i && !r && h && !q && !s && !t? new CharType() : (Type)new OperationTypeProxy(i, r, h, q, s, t);
             // the calls to AssignProxyAfterCycleCheck are needed only when c is a non-proxy type, but it doesn't
             // hurt to do them in both cases
             return AssignProxyAfterCycleCheck(a, c) && AssignProxyAfterCycleCheck(b, c);
@@ -6321,7 +6330,7 @@ namespace Microsoft.Dafny
           foreach (Expression dim in rr.ArrayDimensions) {
             Contract.Assert(dim != null);
             ResolveExpression(dim, new ResolveOpts(codeContext, true));
-            if (!UnifyTypes(dim.Type, new OperationTypeProxy(true, false, false, false, false))) {
+            if (!UnifyTypes(dim.Type, new OperationTypeProxy(true, false, false, false, false, false))) {
               Error(stmt, "new must use an integer-based expression for the array size (got {0} for index {1})", dim.Type, i);
             }
             i++;
@@ -6538,7 +6547,8 @@ namespace Microsoft.Dafny
         if (arg == t.Arg) {
           return type;
         } else if (type is SetType) {
-          return new SetType(arg);
+          var st = (SetType)type;
+          return new SetType(st.Finite, arg);
         } else if (type is MultiSetType) {
           return new MultiSetType(arg);
         } else if (type is SeqType) {
@@ -6744,9 +6754,9 @@ namespace Microsoft.Dafny
           if (e.Value == null) {
             e.Type = new ObjectTypeProxy();
           } else if (e.Value is BigInteger) {
-            e.Type = new OperationTypeProxy(true, false, false, false, false);
+            e.Type = new OperationTypeProxy(true, false, false, false, false, false);
           } else if (e.Value is Basetypes.BigDec) {
-            e.Type = new OperationTypeProxy(false, true, false, false, false);
+            e.Type = new OperationTypeProxy(false, true, false, false, false, false);
           } else if (e.Value is bool) {
             e.Type = Type.Bool;
           } else if (e is CharLiteralExpr) {
@@ -6800,7 +6810,8 @@ namespace Microsoft.Dafny
           }
         }
         if (expr is SetDisplayExpr) {
-          expr.Type = new SetType(elementType);
+          var se = (SetDisplayExpr)expr;
+          expr.Type = new SetType(se.Finite, elementType);
         } else if (expr is MultiSetDisplayExpr) {
           expr.Type = new MultiSetType(elementType);
         } else {
@@ -6911,7 +6922,7 @@ namespace Microsoft.Dafny
           Contract.Assert(idx != null);
           ResolveExpression(idx, opts);
           Contract.Assert(idx.Type != null);  // follows from postcondition of ResolveExpression
-          if (!UnifyTypes(idx.Type, new OperationTypeProxy(true, false, false, false, false))) {
+          if (!UnifyTypes(idx.Type, new OperationTypeProxy(true, false, false, false, false, false))) {
             Error(idx, "array selection requires integer-based numeric indices (got {0} for index {1})", idx.Type, i);
           }
           i++;
@@ -6963,7 +6974,7 @@ namespace Microsoft.Dafny
             Error(e.Index, "multiset update requires domain element to be of type {0} (got {1})", elementType, e.Index.Type);
           }
           ResolveExpression(e.Value, opts);
-          if (!UnifyTypes(e.Value.Type, new OperationTypeProxy(true, false, false, false, false))) {
+          if (!UnifyTypes(e.Value.Type, new OperationTypeProxy(true, false, false, false, false, false))) {
             Error(e.Value, "multiset update requires integer-based numeric value (got {0})", e.Value.Type);
           }
           expr.Type = e.Seq.Type;
@@ -7090,7 +7101,7 @@ namespace Microsoft.Dafny
       } else if (expr is MultiSetFormingExpr) {
         MultiSetFormingExpr e = (MultiSetFormingExpr)expr;
         ResolveExpression(e.E, opts);
-        if (!UnifyTypes(e.E.Type, new SetType(new InferredTypeProxy())) && !UnifyTypes(e.E.Type, new SeqType(new InferredTypeProxy()))) {
+        if (!UnifyTypes(e.E.Type, new SetType(true, new InferredTypeProxy())) && !UnifyTypes(e.E.Type, new SeqType(new InferredTypeProxy()))) {
           Error(e.tok, "can only form a multiset from a seq or set.");
         }
         expr.Type = new MultiSetType(e.E.Type.AsCollectionType.Arg);
@@ -7107,7 +7118,7 @@ namespace Microsoft.Dafny
             expr.Type = Type.Bool;
             break;
           case UnaryOpExpr.Opcode.Cardinality:
-            if (!UnifyTypes(e.E.Type, new CollectionTypeProxy(new InferredTypeProxy(), false))) {
+            if (!UnifyTypes(e.E.Type, new CollectionTypeProxy(new InferredTypeProxy(), false, false))) {
               Error(expr, "size operator expects a collection argument (instead got {0})", e.E.Type);
             }
             expr.Type = Type.Int;
@@ -7142,11 +7153,11 @@ namespace Microsoft.Dafny
         ResolveType(e.tok, e.ToType, opts.codeContext, new ResolveTypeOption(ResolveTypeOptionEnum.DontInfer), null);
         ResolveExpression(e.E, opts);
         if (e.ToType.IsNumericBased(Type.NumericPersuation.Int)) {
-          if (!UnifyTypes(e.E.Type, new OperationTypeProxy(true, true, false, false, false))) {
+          if (!UnifyTypes(e.E.Type, new OperationTypeProxy(true, true, false, false, false, false))) {
             Error(expr, "type conversion to an int-based type is allowed only from numeric types (got {0})", e.E.Type);
           }
         } else if (e.ToType.IsNumericBased(Type.NumericPersuation.Real)) {
-          if (!UnifyTypes(e.E.Type, new OperationTypeProxy(true, true, false, false, false))) {
+          if (!UnifyTypes(e.E.Type, new OperationTypeProxy(true, true, false, false, false, false))) {
             Error(expr, "type conversion to a real-based type is allowed only from numeric types (got {0})", e.E.Type);
           }
         } else {
@@ -7201,7 +7212,7 @@ namespace Microsoft.Dafny
             if (!UnifyTypes(e.E0.Type, e.E1.Type)) {
               Error(expr, "arguments must have the same type (got {0} and {1})", e.E0.Type, e.E1.Type);
             }
-            if (!UnifyTypes(e.E0.Type, new SetType(new InferredTypeProxy())) &&
+            if (!UnifyTypes(e.E0.Type, new SetType(true, new InferredTypeProxy())) &&
                 !UnifyTypes(e.E0.Type, new MultiSetType(new InferredTypeProxy())) &&
                 !UnifyTypes(e.E0.Type, new MapType(true, new InferredTypeProxy(), new InferredTypeProxy()))) {
               Error(expr, "arguments must be of a [multi]set or map type (got {0})", e.E0.Type);
@@ -7229,7 +7240,7 @@ namespace Microsoft.Dafny
               } else {
                 bool err = false;
                 bool isComparison = e.Op != BinaryExpr.Opcode.Add;
-                if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, true, isComparison, true, true))) {
+                if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, true, isComparison, true, true, true))) {
                   Error(expr, "arguments to {0} must be of a numeric type{2} or a collection type (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type,
                     isComparison ? ", char," : "");
                   err = true;
@@ -7268,7 +7279,7 @@ namespace Microsoft.Dafny
               } else {
                 bool err = false;
                 bool isComparison = e.Op == BinaryExpr.Opcode.Gt || e.Op == BinaryExpr.Opcode.Ge;
-                if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, true, isComparison, false, true))) {
+                if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, true, isComparison, false, true, true))) {
                   Error(expr, "arguments to {0} must be of a numeric type{2} or a set type (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type,
                     isComparison ? ", char, " : "");
                   err = true;
@@ -7288,14 +7299,14 @@ namespace Microsoft.Dafny
 
           case BinaryExpr.Opcode.In:
           case BinaryExpr.Opcode.NotIn:
-            if (!UnifyTypes(e.E1.Type, new CollectionTypeProxy(e.E0.Type, true))) {
+            if (!UnifyTypes(e.E1.Type, new CollectionTypeProxy(e.E0.Type, true, true))) {
               Error(expr, "second argument to \"{0}\" must be a set, multiset, or sequence with elements of type {1}, or a map with domain {1} (instead got {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
             }
             expr.Type = Type.Bool;
             break;
 
           case BinaryExpr.Opcode.Div:
-            if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, true, false, false, false))) {
+            if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, true, false, false, false, false))) {
               Error(expr, "first argument to {0} must be of numeric type (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type);
             }
             if (!UnifyTypes(e.E1.Type, e.E0.Type)) {
@@ -7305,7 +7316,7 @@ namespace Microsoft.Dafny
             break;
 
           case BinaryExpr.Opcode.Mod:
-            if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, false, false, false, false))) {
+            if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, false, false, false, false, false))) {
               Error(expr, "first argument to {0} must be of type int (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type);
             }
             if (!UnifyTypes(e.E1.Type, e.E0.Type)) {
@@ -7487,7 +7498,7 @@ namespace Microsoft.Dafny
 
         ResolveAttributes(e.Attributes, new ResolveOpts(opts, true));
         scope.PopMarker();
-        expr.Type = new SetType(e.Term.Type);
+        expr.Type = new SetType(e.Finite, e.Term.Type);
 
         if (opts.DontCareAboutCompilation && (e.Term.Type.IsRefType || e.Term.Type.IsBoolType) || e.Term.Type.IsCharType) {
           // ok, term type is finite and we're in a ghost context
@@ -7561,7 +7572,7 @@ namespace Microsoft.Dafny
         scope.PopMarker();
         expr.Type = new ArrowType(e.tok, Util.Map(e.BoundVars, v => v.Type), e.Body.Type, builtIns.SystemModule);
       } else if (expr is WildcardExpr) {
-        expr.Type = new SetType(new ObjectType());
+        expr.Type = new SetType(true, new ObjectType());
       } else if (expr is StmtExpr) {
         var e = (StmtExpr)expr;
         int prevErrorCount = ErrorCount;
@@ -9645,7 +9656,7 @@ namespace Microsoft.Dafny
       if (e.E1 != null) {
         ResolveExpression(e.E1, opts);
         Contract.Assert(e.E1.Type != null);  // follows from postcondition of ResolveExpression
-        var domType = e.E0 == null ? domainType : new OperationTypeProxy(true, false, false, false, false);  // reuse 'domainType' if .E0 did not use it; otherwise, create a new proxy to allow .E1 to be any integer-based numeric type, independent of the integer-based numeric type used by .E0
+        var domType = e.E0 == null ? domainType : new OperationTypeProxy(true, false, false, false, false, false);  // reuse 'domainType' if .E0 did not use it; otherwise, create a new proxy to allow .E1 to be any integer-based numeric type, independent of the integer-based numeric type used by .E0
         if (!UnifyTypes(e.E1.Type, domType)) {
           Error(e.E1, "sequence/array/multiset/map selection requires {1} indices (got {0})", e.E1.Type, domType);
         }
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 1361ad85..962b07b9 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -89,7 +89,7 @@ namespace Microsoft.Dafny
       // Add:  ghost var Repr: set<object>;
       // ...unless a field with that name is already present
       if (!cl.Members.Exists(member => member is Field && member.Name == "Repr")) {
-        Type ty = new SetType(new ObjectType());
+        Type ty = new SetType(true, new ObjectType());
         cl.Members.Add(new Field(new AutoGeneratedToken(cl.tok), "Repr", true, ty, null));
       }
 
@@ -119,7 +119,7 @@ namespace Microsoft.Dafny
           // ensures fresh(Repr - {this});
           var freshness = new UnaryOpExpr(tok, UnaryOpExpr.Opcode.Fresh, new BinaryExpr(tok, BinaryExpr.Opcode.Sub,
             new MemberSelectExpr(tok, new ImplicitThisExpr(tok), "Repr"),
-            new SetDisplayExpr(tok, new List<Expression>() { new ThisExpr(tok) })));
+            new SetDisplayExpr(tok, true, new List<Expression>() { new ThisExpr(tok) })));
           ctor.Ens.Insert(1, new MaybeFreeExpression(freshness));
         } else if (member is Method && !member.IsStatic) {
           var m = (Method)member;
@@ -246,8 +246,8 @@ namespace Microsoft.Dafny
           if (ctor.Body != null) {
             var bodyStatements = ((BlockStmt)ctor.Body).Body;
             // Repr := {this};
-            var e = new SetDisplayExpr(tok, new List<Expression>() { self });
-            e.Type = new SetType(new ObjectType());
+            var e = new SetDisplayExpr(tok, true, new List<Expression>() { self });
+            e.Type = new SetType(true, new ObjectType());
             Statement s = new AssignStmt(tok, tok, Repr, new ExprRhs(e));
             s.IsGhost = true;
             bodyStatements.Add(s);
@@ -297,8 +297,8 @@ namespace Microsoft.Dafny
 
       foreach (var ff in subobjects) {
         var F = Resolver.NewMemberSelectExpr(tok, implicitSelf, ff.Item1, null);  // create a resolved MemberSelectExpr
-        Expression e = new SetDisplayExpr(tok, new List<Expression>() { F });
-        e.Type = new SetType(new ObjectType());  // resolve here
+        Expression e = new SetDisplayExpr(tok, true, new List<Expression>() { F });
+        e.Type = new SetType(true, new ObjectType());  // resolve here
         var rhs = new BinaryExpr(tok, BinaryExpr.Opcode.Add, Repr, e);
         rhs.ResolvedOp = BinaryExpr.ResolvedOpcode.Union;  // resolve here
         rhs.Type = Repr.Type;  // resolve here
diff --git a/Source/Dafny/Scanner.cs b/Source/Dafny/Scanner.cs
index 3427477b..4c5eedb4 100644
--- a/Source/Dafny/Scanner.cs
+++ b/Source/Dafny/Scanner.cs
@@ -211,13 +211,13 @@ public class UTF8Buffer: Buffer {
 public class Scanner {
 	const char EOL = '\n';
 	const int eofSym = 0; /* pdt */
-	const int maxT = 136;
-	const int noSym = 136;
+	const int maxT = 137;
+	const int noSym = 137;
 
 
 	[ContractInvariantMethod]
 	void objectInvariant(){
-		Contract.Invariant(buffer!=null);
+		Contract.Invariant(this._buffer != null);
 		Contract.Invariant(t != null);
 		Contract.Invariant(start != null);
 		Contract.Invariant(tokens != null);
@@ -227,7 +227,18 @@ public class Scanner {
 		Contract.Invariant(errorHandler != null);
 	}
 
-	public Buffer/*!*/ buffer; // scanner buffer
+	private Buffer/*!*/ _buffer; // scanner buffer
+
+	public Buffer/*!*/ buffer {
+		get {
+			Contract.Ensures(Contract.Result<Buffer>() != null);
+			return this._buffer;
+		}
+		set {
+			Contract.Requires(value != null);
+			this._buffer = value;
+		}
+	}
 
 	Token/*!*/ t;          // current token
 	int ch;           // current input character
@@ -307,7 +318,7 @@ public class Scanner {
 		t = new Token(); // dummy because t is a non-null field
 		try {
 			Stream stream = new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read);
-			buffer = new Buffer(stream, false);
+			this._buffer = new Buffer(stream, false);
 			Filename = useBaseName? GetBaseName(fileName): fileName;
 			Init();
 		} catch (IOException) {
@@ -322,7 +333,7 @@ public class Scanner {
 	  Contract.Requires(fileName != null);
 		pt = tokens = new Token();  // first token is a dummy
 		t = new Token(); // dummy because t is a non-null field
-		buffer = new Buffer(s, true);
+		this._buffer = new Buffer(s, true);
 		this.errorHandler = errorHandler;
 		this.Filename = useBaseName? GetBaseName(fileName) : fileName;
 		Init();
@@ -503,75 +514,76 @@ public class Scanner {
 			case "object": t.kind = 11; break;
 			case "string": t.kind = 12; break;
 			case "set": t.kind = 13; break;
-			case "multiset": t.kind = 14; break;
-			case "seq": t.kind = 15; break;
-			case "map": t.kind = 16; break;
-			case "imap": t.kind = 17; break;
-			case "assume": t.kind = 29; break;
-			case "calc": t.kind = 30; break;
-			case "case": t.kind = 31; break;
-			case "then": t.kind = 32; break;
-			case "else": t.kind = 33; break;
-			case "decreases": t.kind = 34; break;
-			case "invariant": t.kind = 35; break;
-			case "function": t.kind = 36; break;
-			case "predicate": t.kind = 37; break;
-			case "inductive": t.kind = 38; break;
-			case "lemma": t.kind = 39; break;
-			case "copredicate": t.kind = 40; break;
-			case "modifies": t.kind = 41; break;
-			case "reads": t.kind = 42; break;
-			case "requires": t.kind = 43; break;
-			case "include": t.kind = 58; break;
-			case "abstract": t.kind = 59; break;
-			case "module": t.kind = 60; break;
-			case "refines": t.kind = 61; break;
-			case "import": t.kind = 62; break;
-			case "opened": t.kind = 63; break;
-			case "as": t.kind = 65; break;
-			case "default": t.kind = 66; break;
-			case "class": t.kind = 67; break;
-			case "extends": t.kind = 68; break;
-			case "trait": t.kind = 69; break;
-			case "ghost": t.kind = 70; break;
-			case "static": t.kind = 71; break;
-			case "protected": t.kind = 72; break;
-			case "datatype": t.kind = 73; break;
-			case "codatatype": t.kind = 74; break;
-			case "var": t.kind = 75; break;
-			case "newtype": t.kind = 76; break;
-			case "type": t.kind = 77; break;
-			case "iterator": t.kind = 78; break;
-			case "yields": t.kind = 79; break;
-			case "returns": t.kind = 80; break;
-			case "method": t.kind = 81; break;
-			case "colemma": t.kind = 82; break;
-			case "comethod": t.kind = 83; break;
-			case "constructor": t.kind = 84; break;
-			case "free": t.kind = 85; break;
-			case "ensures": t.kind = 86; break;
-			case "yield": t.kind = 87; break;
-			case "label": t.kind = 89; break;
-			case "break": t.kind = 90; break;
-			case "where": t.kind = 91; break;
-			case "return": t.kind = 93; break;
-			case "new": t.kind = 95; break;
-			case "if": t.kind = 96; break;
-			case "while": t.kind = 97; break;
-			case "match": t.kind = 98; break;
-			case "assert": t.kind = 99; break;
-			case "print": t.kind = 100; break;
-			case "forall": t.kind = 101; break;
-			case "parallel": t.kind = 102; break;
-			case "modify": t.kind = 103; break;
-			case "exists": t.kind = 122; break;
-			case "in": t.kind = 124; break;
-			case "false": t.kind = 129; break;
-			case "true": t.kind = 130; break;
-			case "null": t.kind = 131; break;
-			case "this": t.kind = 132; break;
-			case "fresh": t.kind = 133; break;
-			case "old": t.kind = 134; break;
+			case "iset": t.kind = 14; break;
+			case "multiset": t.kind = 15; break;
+			case "seq": t.kind = 16; break;
+			case "map": t.kind = 17; break;
+			case "imap": t.kind = 18; break;
+			case "assume": t.kind = 30; break;
+			case "calc": t.kind = 31; break;
+			case "case": t.kind = 32; break;
+			case "then": t.kind = 33; break;
+			case "else": t.kind = 34; break;
+			case "decreases": t.kind = 35; break;
+			case "invariant": t.kind = 36; break;
+			case "function": t.kind = 37; break;
+			case "predicate": t.kind = 38; break;
+			case "inductive": t.kind = 39; break;
+			case "lemma": t.kind = 40; break;
+			case "copredicate": t.kind = 41; break;
+			case "modifies": t.kind = 42; break;
+			case "reads": t.kind = 43; break;
+			case "requires": t.kind = 44; break;
+			case "include": t.kind = 59; break;
+			case "abstract": t.kind = 60; break;
+			case "module": t.kind = 61; break;
+			case "refines": t.kind = 62; break;
+			case "import": t.kind = 63; break;
+			case "opened": t.kind = 64; break;
+			case "as": t.kind = 66; break;
+			case "default": t.kind = 67; break;
+			case "class": t.kind = 68; break;
+			case "extends": t.kind = 69; break;
+			case "trait": t.kind = 70; break;
+			case "ghost": t.kind = 71; break;
+			case "static": t.kind = 72; break;
+			case "protected": t.kind = 73; break;
+			case "datatype": t.kind = 74; break;
+			case "codatatype": t.kind = 75; break;
+			case "var": t.kind = 76; break;
+			case "newtype": t.kind = 77; break;
+			case "type": t.kind = 78; break;
+			case "iterator": t.kind = 79; break;
+			case "yields": t.kind = 80; break;
+			case "returns": t.kind = 81; break;
+			case "method": t.kind = 82; break;
+			case "colemma": t.kind = 83; break;
+			case "comethod": t.kind = 84; break;
+			case "constructor": t.kind = 85; break;
+			case "free": t.kind = 86; break;
+			case "ensures": t.kind = 87; break;
+			case "yield": t.kind = 88; break;
+			case "label": t.kind = 90; break;
+			case "break": t.kind = 91; break;
+			case "where": t.kind = 92; break;
+			case "return": t.kind = 94; break;
+			case "new": t.kind = 96; break;
+			case "if": t.kind = 97; break;
+			case "while": t.kind = 98; break;
+			case "match": t.kind = 99; break;
+			case "assert": t.kind = 100; break;
+			case "print": t.kind = 101; break;
+			case "forall": t.kind = 102; break;
+			case "parallel": t.kind = 103; break;
+			case "modify": t.kind = 104; break;
+			case "exists": t.kind = 123; break;
+			case "in": t.kind = 125; break;
+			case "false": t.kind = 130; break;
+			case "true": t.kind = 131; break;
+			case "null": t.kind = 132; break;
+			case "this": t.kind = 133; break;
+			case "fresh": t.kind = 134; break;
+			case "old": t.kind = 135; break;
 			default: break;
 		}
 	}
@@ -674,7 +686,7 @@ public class Scanner {
 				if (ch >= '0' && ch <= '9' || ch >= 'A' && ch <= 'F' || ch >= 'a' && ch <= 'f') {AddCh(); goto case 15;}
 				else {goto case 0;}
 			case 20:
-				{t.kind = 18; break;}
+				{t.kind = 19; break;}
 			case 21:
 				if (ch <= 9 || ch >= 11 && ch <= 12 || ch >= 14 && ch <= '!' || ch >= '#' && ch <= '[' || ch >= ']' && ch <= 65535) {AddCh(); goto case 21;}
 				else if (ch == '"') {AddCh(); goto case 28;}
@@ -700,37 +712,37 @@ public class Scanner {
 				else if (ch == '"') {AddCh(); goto case 55;}
 				else {goto case 0;}
 			case 28:
-				{t.kind = 19; break;}
+				{t.kind = 20; break;}
 			case 29:
-				{t.kind = 21; break;}
+				{t.kind = 22; break;}
 			case 30:
-				{t.kind = 23; break;}
-			case 31:
 				{t.kind = 24; break;}
+			case 31:
+				{t.kind = 25; break;}
 			case 32:
-				{t.kind = 26; break;}
-			case 33:
 				{t.kind = 27; break;}
-			case 34:
+			case 33:
 				{t.kind = 28; break;}
+			case 34:
+				{t.kind = 29; break;}
 			case 35:
-				{t.kind = 44; break;}
-			case 36:
 				{t.kind = 45; break;}
-			case 37:
+			case 36:
 				{t.kind = 46; break;}
-			case 38:
+			case 37:
 				{t.kind = 47; break;}
-			case 39:
+			case 38:
 				{t.kind = 48; break;}
-			case 40:
+			case 39:
 				{t.kind = 49; break;}
+			case 40:
+				{t.kind = 50; break;}
 			case 41:
-				{t.kind = 53; break;}
-			case 42:
 				{t.kind = 54; break;}
-			case 43:
+			case 42:
 				{t.kind = 55; break;}
+			case 43:
+				{t.kind = 56; break;}
 			case 44:
 				if (ch == 'n') {AddCh(); goto case 45;}
 				else {goto case 0;}
@@ -741,9 +753,9 @@ public class Scanner {
 				{
 					tlen -= apx;
 					SetScannerBehindT();
-					t.kind = 56; break;}
+					t.kind = 57; break;}
 			case 47:
-				{t.kind = 57; break;}
+				{t.kind = 58; break;}
 			case 48:
 				recEnd = pos; recKind = 2;
 				if (ch >= '0' && ch <= '9') {AddCh(); goto case 48;}
@@ -782,9 +794,9 @@ public class Scanner {
 				else if (ch == 'u') {AddCh(); goto case 22;}
 				else {goto case 0;}
 			case 55:
-				recEnd = pos; recKind = 19;
+				recEnd = pos; recKind = 20;
 				if (ch == '"') {AddCh(); goto case 27;}
-				else {t.kind = 19; break;}
+				else {t.kind = 20; break;}
 			case 56:
 				if (ch >= '0' && ch <= '9') {AddCh(); goto case 48;}
 				else {goto case 0;}
@@ -813,9 +825,9 @@ public class Scanner {
 				if (ch == 39 || ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'z') {AddCh(); goto case 8;}
 				else {t.kind = 1; t.val = new String(tval, 0, tlen); CheckLiteral(); return t;}
 			case 62:
-				recEnd = pos; recKind = 18;
+				recEnd = pos; recKind = 19;
 				if (ch == 39 || ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'z') {AddCh(); goto case 8;}
-				else {t.kind = 18; break;}
+				else {t.kind = 19; break;}
 			case 63:
 				recEnd = pos; recKind = 1;
 				if (ch == 39 || ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'x' || ch == 'z') {AddCh(); goto case 5;}
@@ -832,104 +844,104 @@ public class Scanner {
 				else if (ch >= '0' && ch <= '9') {AddCh(); goto case 65;}
 				else {t.kind = 5; break;}
 			case 66:
-				{t.kind = 88; break;}
+				{t.kind = 89; break;}
 			case 67:
-				{t.kind = 92; break;}
+				{t.kind = 93; break;}
 			case 68:
-				{t.kind = 94; break;}
+				{t.kind = 95; break;}
 			case 69:
-				{t.kind = 104; break;}
+				{t.kind = 105; break;}
 			case 70:
-				{t.kind = 106; break;}
-			case 71:
 				{t.kind = 107; break;}
-			case 72:
+			case 71:
 				{t.kind = 108; break;}
-			case 73:
+			case 72:
 				{t.kind = 109; break;}
-			case 74:
+			case 73:
 				{t.kind = 110; break;}
-			case 75:
+			case 74:
 				{t.kind = 111; break;}
-			case 76:
+			case 75:
 				{t.kind = 112; break;}
+			case 76:
+				{t.kind = 113; break;}
 			case 77:
-				{t.kind = 114; break;}
+				{t.kind = 115; break;}
 			case 78:
 				if (ch == '&') {AddCh(); goto case 79;}
 				else {goto case 0;}
 			case 79:
-				{t.kind = 115; break;}
-			case 80:
 				{t.kind = 116; break;}
-			case 81:
+			case 80:
 				{t.kind = 117; break;}
-			case 82:
+			case 81:
 				{t.kind = 118; break;}
+			case 82:
+				{t.kind = 119; break;}
 			case 83:
-				{t.kind = 120; break;}
-			case 84:
 				{t.kind = 121; break;}
+			case 84:
+				{t.kind = 122; break;}
 			case 85:
-				{t.kind = 123; break;}
+				{t.kind = 124; break;}
 			case 86:
-				{t.kind = 125; break;}
+				{t.kind = 126; break;}
 			case 87:
-				{t.kind = 127; break;}
-			case 88:
 				{t.kind = 128; break;}
+			case 88:
+				{t.kind = 129; break;}
 			case 89:
-				recEnd = pos; recKind = 20;
+				recEnd = pos; recKind = 21;
 				if (ch == ':') {AddCh(); goto case 30;}
 				else if (ch == '=') {AddCh(); goto case 67;}
 				else if (ch == '|') {AddCh(); goto case 68;}
-				else {t.kind = 20; break;}
+				else {t.kind = 21; break;}
 			case 90:
-				recEnd = pos; recKind = 22;
+				recEnd = pos; recKind = 23;
 				if (ch == '|') {AddCh(); goto case 81;}
-				else {t.kind = 22; break;}
+				else {t.kind = 23; break;}
 			case 91:
-				recEnd = pos; recKind = 25;
+				recEnd = pos; recKind = 26;
 				if (ch == '.') {AddCh(); goto case 97;}
-				else {t.kind = 25; break;}
+				else {t.kind = 26; break;}
 			case 92:
-				recEnd = pos; recKind = 64;
+				recEnd = pos; recKind = 65;
 				if (ch == '>') {AddCh(); goto case 33;}
 				else if (ch == '=') {AddCh(); goto case 98;}
-				else {t.kind = 64; break;}
+				else {t.kind = 65; break;}
 			case 93:
-				recEnd = pos; recKind = 126;
+				recEnd = pos; recKind = 127;
 				if (ch == '>') {AddCh(); goto case 34;}
-				else {t.kind = 126; break;}
+				else {t.kind = 127; break;}
 			case 94:
-				recEnd = pos; recKind = 50;
+				recEnd = pos; recKind = 51;
 				if (ch == '=') {AddCh(); goto case 99;}
-				else {t.kind = 50; break;}
+				else {t.kind = 51; break;}
 			case 95:
-				recEnd = pos; recKind = 51;
+				recEnd = pos; recKind = 52;
 				if (ch == '=') {AddCh(); goto case 70;}
-				else {t.kind = 51; break;}
+				else {t.kind = 52; break;}
 			case 96:
-				recEnd = pos; recKind = 119;
+				recEnd = pos; recKind = 120;
 				if (ch == '=') {AddCh(); goto case 41;}
 				else if (ch == 'i') {AddCh(); goto case 44;}
-				else {t.kind = 119; break;}
+				else {t.kind = 120; break;}
 			case 97:
-				recEnd = pos; recKind = 135;
+				recEnd = pos; recKind = 136;
 				if (ch == '.') {AddCh(); goto case 47;}
-				else {t.kind = 135; break;}
+				else {t.kind = 136; break;}
 			case 98:
-				recEnd = pos; recKind = 52;
+				recEnd = pos; recKind = 53;
 				if (ch == '>') {AddCh(); goto case 75;}
-				else {t.kind = 52; break;}
+				else {t.kind = 53; break;}
 			case 99:
-				recEnd = pos; recKind = 105;
+				recEnd = pos; recKind = 106;
 				if (ch == '=') {AddCh(); goto case 100;}
-				else {t.kind = 105; break;}
+				else {t.kind = 106; break;}
 			case 100:
-				recEnd = pos; recKind = 113;
+				recEnd = pos; recKind = 114;
 				if (ch == '>') {AddCh(); goto case 73;}
-				else {t.kind = 113; break;}
+				else {t.kind = 114; break;}
 
 		}
 		t.val = new String(tval, 0, tlen);
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 7664118e..aa3318bd 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -137,6 +137,7 @@ namespace Microsoft.Dafny {
       public readonly Bpl.Type BoxType;
       public readonly Bpl.Type TickType;
       private readonly Bpl.TypeSynonymDecl setTypeCtor;
+      private readonly Bpl.TypeSynonymDecl isetTypeCtor;
       private readonly Bpl.TypeSynonymDecl multiSetTypeCtor;
       private readonly Bpl.TypeCtorDecl mapTypeCtor;
       private readonly Bpl.TypeCtorDecl imapTypeCtor;
@@ -183,12 +184,12 @@ namespace Microsoft.Dafny {
         Contract.Invariant(allocField != null);
       }
 
-      public Bpl.Type SetType(IToken tok, Bpl.Type ty) {
+      public Bpl.Type SetType(IToken tok, bool finite, Bpl.Type ty) {
         Contract.Requires(tok != null);
         Contract.Requires(ty != null);
         Contract.Ensures(Contract.Result<Bpl.Type>() != null);
 
-        return new Bpl.TypeSynonymAnnotation(Token.NoToken, setTypeCtor, new List<Bpl.Type> { ty });
+        return new Bpl.TypeSynonymAnnotation(Token.NoToken, finite ? setTypeCtor : isetTypeCtor, new List<Bpl.Type> { ty });
       }
 
       public Bpl.Type MultiSetType(IToken tok, Bpl.Type ty) {
@@ -229,7 +230,7 @@ namespace Microsoft.Dafny {
       }
 
       public PredefinedDecls(Bpl.TypeCtorDecl charType, Bpl.TypeCtorDecl refType, Bpl.TypeCtorDecl boxType, Bpl.TypeCtorDecl tickType,
-                             Bpl.TypeSynonymDecl setTypeCtor, Bpl.TypeSynonymDecl multiSetTypeCtor,
+                             Bpl.TypeSynonymDecl setTypeCtor, Bpl.TypeSynonymDecl isetTypeCtor, Bpl.TypeSynonymDecl multiSetTypeCtor,
                              Bpl.TypeCtorDecl mapTypeCtor, Bpl.TypeCtorDecl imapTypeCtor,
                              Bpl.Function arrayLength, Bpl.Function realTrunc, Bpl.TypeCtorDecl seqTypeCtor, Bpl.TypeCtorDecl fieldNameType,
                              Bpl.TypeCtorDecl tyType, Bpl.TypeCtorDecl tyTagType,
@@ -242,6 +243,7 @@ namespace Microsoft.Dafny {
         Contract.Requires(boxType != null);
         Contract.Requires(tickType != null);
         Contract.Requires(setTypeCtor != null);
+        Contract.Requires(isetTypeCtor != null);
         Contract.Requires(multiSetTypeCtor != null);
         Contract.Requires(mapTypeCtor != null);
         Contract.Requires(imapTypeCtor != null);
@@ -265,6 +267,7 @@ namespace Microsoft.Dafny {
         this.BoxType = new Bpl.CtorType(Token.NoToken, boxType, new List<Bpl.Type>());
         this.TickType = new Bpl.CtorType(Token.NoToken, tickType, new List<Bpl.Type>());
         this.setTypeCtor = setTypeCtor;
+        this.isetTypeCtor = isetTypeCtor;
         this.multiSetTypeCtor = multiSetTypeCtor;
         this.mapTypeCtor = mapTypeCtor;
         this.imapTypeCtor = imapTypeCtor;
@@ -298,6 +301,7 @@ namespace Microsoft.Dafny {
       Bpl.TypeCtorDecl charType = null;
       Bpl.TypeCtorDecl refType = null;
       Bpl.TypeSynonymDecl setTypeCtor = null;
+      Bpl.TypeSynonymDecl isetTypeCtor = null;
       Bpl.TypeSynonymDecl multiSetTypeCtor = null;
       Bpl.Function arrayLength = null;
       Bpl.Function realTrunc = null;
@@ -361,6 +365,9 @@ namespace Microsoft.Dafny {
           if (dt.Name == "MultiSet") {
             multiSetTypeCtor = dt;
           }
+          if (dt.Name == "ISet") {
+            isetTypeCtor = dt;
+          }
         } else if (d is Bpl.Constant) {
           Bpl.Constant c = (Bpl.Constant)d;
           if (c.Name == "alloc") {
@@ -384,6 +391,8 @@ namespace Microsoft.Dafny {
         Console.WriteLine("Error: Dafny prelude is missing declaration of type Seq");
       } else if (setTypeCtor == null) {
         Console.WriteLine("Error: Dafny prelude is missing declaration of type Set");
+      } else if (isetTypeCtor == null) {
+        Console.WriteLine("Error: Dafny prelude is missing declaration of type ISet");
       } else if (multiSetTypeCtor == null) {
         Console.WriteLine("Error: Dafny prelude is missing declaration of type MultiSet");
       } else if (mapTypeCtor == null) {
@@ -426,7 +435,7 @@ namespace Microsoft.Dafny {
         Console.WriteLine("Error: Dafny prelude is missing declaration of constant alloc");
       } else {
         return new PredefinedDecls(charType, refType, boxType, tickType,
-                                   setTypeCtor, multiSetTypeCtor,
+                                   setTypeCtor, isetTypeCtor, multiSetTypeCtor,
                                    mapTypeCtor, imapTypeCtor,
                                    arrayLength, realTrunc, seqTypeCtor, fieldNameType,
                                    tyType, tyTagType,
@@ -4851,7 +4860,7 @@ namespace Microsoft.Dafny {
         builder.Add(Assert(expr.tok, precond, "possible violation of function precondition"));
 
         if (options.DoReadsChecks) {
-          Type objset = new SetType(new ObjectType());
+          Type objset = new SetType(true, new ObjectType());
           Expression wrap = new BoogieWrapper(
             FunctionCall(e.tok, Reads(arity), TrType(objset), args),
             objset);
@@ -5545,7 +5554,7 @@ namespace Microsoft.Dafny {
           //   =  $Frame_F(args...)
 
           var fhandle = FunctionCall(f.tok, name, predef.HandleType, SnocSelf(args));
-          Bpl.Expr lhs_inner = FunctionCall(f.tok, Reads(arity), TrType(new SetType(new ObjectType())), Concat(tyargs, Cons(fhandle, Cons(h, lhs_args))));
+          Bpl.Expr lhs_inner = FunctionCall(f.tok, Reads(arity), TrType(new SetType(true, new ObjectType())), Concat(tyargs, Cons(fhandle, Cons(h, lhs_args))));
 
           Bpl.Expr bx; var bxVar = BplBoundVar("$bx", predef.BoxType, out bx);
           Bpl.Expr unboxBx = FunctionCall(f.tok, BuiltinFunction.Unbox, predef.RefType, bx);
@@ -5582,7 +5591,7 @@ namespace Microsoft.Dafny {
       // [Heap, Box, ..., Box] Bool
       var requires_ty = new Bpl.MapType(tok, new List<Bpl.TypeVariable>(), map_args, Bpl.Type.Bool);
       // Set Box
-      var objset_ty = TrType(new SetType(new ObjectType()));
+      var objset_ty = TrType(new SetType(true, new ObjectType()));
       // [Heap, Box, ..., Box] (Set Box)
       var reads_ty = new Bpl.MapType(tok, new List<Bpl.TypeVariable>(), map_args, objset_ty);
 
@@ -6694,7 +6703,7 @@ namespace Microsoft.Dafny {
       } else if (type.IsDatatype || type is DatatypeProxy) {
         return predef.DatatypeType;
       } else if (type is SetType) {
-        return predef.SetType(Token.NoToken, predef.BoxType);
+        return predef.SetType(Token.NoToken, ((SetType)type).Finite, predef.BoxType);
       } else if (type is MultiSetType) {
         return predef.MultiSetType(Token.NoToken, predef.BoxType);
       } else if (type is MapType) {
@@ -7548,7 +7557,7 @@ namespace Microsoft.Dafny {
           }
         }
       } else if (xType is SetType) {
-        var empty = new SetDisplayExpr(x.tok, new List<Expression>());
+        var empty = new SetDisplayExpr(x.tok, ((SetType)xType).Finite, new List<Expression>());
         empty.Type = xType;
         yield return empty;
       } else if (xType is MultiSetType) {
@@ -8155,7 +8164,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(locals != null);
       Contract.Requires(etran != null);
       // Add all newly allocated objects to the set this._new
-      var updatedSet = new Bpl.LocalVariable(iter.tok, new Bpl.TypedIdent(iter.tok, CurrentIdGenerator.FreshId("$iter_newUpdate"), predef.SetType(iter.tok, predef.BoxType)));
+      var updatedSet = new Bpl.LocalVariable(iter.tok, new Bpl.TypedIdent(iter.tok, CurrentIdGenerator.FreshId("$iter_newUpdate"), predef.SetType(iter.tok, true, predef.BoxType)));
       locals.Add(updatedSet);
       var updatedSetIE = new Bpl.IdentifierExpr(iter.tok, updatedSet);
       // call $iter_newUpdate := $IterCollectNewObjects(initHeap, $Heap, this, _new);
@@ -9048,9 +9057,9 @@ namespace Microsoft.Dafny {
         less = Bpl.Expr.Gt(e0, e1);
         atmost = Bpl.Expr.Ge(e0, e1);
 
-      } else if (ty0 is SetType || (ty0 is MapType && ((MapType)ty0).Finite)) {
+      } else if ((ty0 is SetType && ((SetType)ty0).Finite) || (ty0 is MapType && ((MapType)ty0).Finite)) {
         Bpl.Expr b0, b1;
-        if (ty0 is SetType) {
+        if (ty0 is SetType && ((SetType)ty0).Finite) {
           b0 = e0;
           b1 = e1;
         } else if (ty0 is MapType && ((MapType)ty0).Finite) {
@@ -9132,7 +9141,8 @@ namespace Microsoft.Dafny {
       type = type.NormalizeExpand();
 
       if (type is SetType) {
-        return FunctionCall(Token.NoToken, "TSet", predef.Ty, TypeToTy(((CollectionType)type).Arg));
+        bool finite = ((SetType)type).Finite;
+        return FunctionCall(Token.NoToken, finite ? "TSet" : "TISet", predef.Ty, TypeToTy(((CollectionType)type).Arg));
       } else if (type is MultiSetType) {
         return FunctionCall(Token.NoToken, "TMultiSet", predef.Ty, TypeToTy(((CollectionType)type).Arg));
       } else if (type is SeqType) {
@@ -10474,10 +10484,10 @@ namespace Microsoft.Dafny {
 
         } else if (expr is SetDisplayExpr) {
           SetDisplayExpr e = (SetDisplayExpr)expr;
-          Bpl.Expr s = translator.FunctionCall(expr.tok, BuiltinFunction.SetEmpty, predef.BoxType);
+          Bpl.Expr s = translator.FunctionCall(expr.tok, e.Finite ? BuiltinFunction.SetEmpty : BuiltinFunction.ISetEmpty, predef.BoxType);
           foreach (Expression ee in e.Elements) {
             Bpl.Expr ss = BoxIfNecessary(expr.tok, TrExpr(ee), cce.NonNull(ee.Type));
-            s = translator.FunctionCall(expr.tok, BuiltinFunction.SetUnionOne, predef.BoxType, s, ss);
+            s = translator.FunctionCall(expr.tok, e.Finite ? BuiltinFunction.SetUnionOne : BuiltinFunction.ISetUnionOne, predef.BoxType, s, ss);
           }
           return s;
 
@@ -10765,7 +10775,7 @@ namespace Microsoft.Dafny {
               var eType = e.E.Type.NormalizeExpand();
               if (eType is SeqType) {
                 return translator.FunctionCall(expr.tok, BuiltinFunction.SeqLength, null, arg);
-              } else if (eType is SetType) {
+              } else if (eType is SetType && ((SetType)eType).Finite) {
                 return translator.FunctionCall(expr.tok, BuiltinFunction.SetCard, null, arg);
               } else if (eType is MultiSetType) {
                 return translator.FunctionCall(expr.tok, BuiltinFunction.MultiSetCard, null, arg);
@@ -11016,31 +11026,55 @@ namespace Microsoft.Dafny {
                 return Bpl.Expr.Binary(expr.tok, bOp, operand0, operand1);
               }
 
-            case BinaryExpr.ResolvedOpcode.SetEq:
-              return translator.FunctionCall(expr.tok, BuiltinFunction.SetEqual, null, e0, e1);
-            case BinaryExpr.ResolvedOpcode.SetNeq:
-              return Bpl.Expr.Unary(expr.tok, UnaryOperator.Opcode.Not, translator.FunctionCall(expr.tok, BuiltinFunction.SetEqual, null, e0, e1));
-            case BinaryExpr.ResolvedOpcode.ProperSubset:
+            case BinaryExpr.ResolvedOpcode.SetEq: {
+              bool finite = e.E1.Type.AsSetType.Finite;
+              var f = finite ? BuiltinFunction.SetEqual : BuiltinFunction.ISetEqual;
+              return translator.FunctionCall(expr.tok, f, null, e0, e1);
+            }
+            case BinaryExpr.ResolvedOpcode.SetNeq: {
+              bool finite = e.E1.Type.AsSetType.Finite;
+              var f = finite ? BuiltinFunction.SetEqual : BuiltinFunction.ISetEqual;
+              return Bpl.Expr.Unary(expr.tok, UnaryOperator.Opcode.Not, translator.FunctionCall(expr.tok, f, null, e0, e1));
+            }
+            case BinaryExpr.ResolvedOpcode.ProperSubset: {
               return translator.ProperSubset(expr.tok, e0, e1);
-            case BinaryExpr.ResolvedOpcode.Subset:
-              return translator.FunctionCall(expr.tok, BuiltinFunction.SetSubset, null, e0, e1);
-            case BinaryExpr.ResolvedOpcode.Superset:
-              return translator.FunctionCall(expr.tok, BuiltinFunction.SetSubset, null, e1, e0);
+            }
+            case BinaryExpr.ResolvedOpcode.Subset: {
+              bool finite = e.E1.Type.AsSetType.Finite;
+              var f = finite ? BuiltinFunction.SetSubset : BuiltinFunction.ISetSubset;
+              return translator.FunctionCall(expr.tok, f, null, e0, e1);
+            }
+            case BinaryExpr.ResolvedOpcode.Superset: {
+              bool finite = e.E1.Type.AsSetType.Finite;
+              var f = finite ? BuiltinFunction.SetSubset : BuiltinFunction.ISetSubset;
+              return translator.FunctionCall(expr.tok, f, null, e1, e0);
+            }
             case BinaryExpr.ResolvedOpcode.ProperSuperset:
               return translator.ProperSubset(expr.tok, e1, e0);
-            case BinaryExpr.ResolvedOpcode.Disjoint:
-              return translator.FunctionCall(expr.tok, BuiltinFunction.SetDisjoint, null, e0, e1);
+            case BinaryExpr.ResolvedOpcode.Disjoint: {
+              bool finite = e.E1.Type.AsSetType.Finite;
+              var f = finite ? BuiltinFunction.SetDisjoint : BuiltinFunction.ISetDisjoint;
+              return translator.FunctionCall(expr.tok, f, null, e0, e1);
+            }
             case BinaryExpr.ResolvedOpcode.InSet:
               Contract.Assert(false); throw new cce.UnreachableException();  // this case handled above
             case BinaryExpr.ResolvedOpcode.NotInSet:
               Contract.Assert(false); throw new cce.UnreachableException();  // this case handled above
-            case BinaryExpr.ResolvedOpcode.Union:
-              return translator.FunctionCall(expr.tok, BuiltinFunction.SetUnion, translator.TrType(expr.Type.AsSetType.Arg), e0, e1);
-            case BinaryExpr.ResolvedOpcode.Intersection:
-              return translator.FunctionCall(expr.tok, BuiltinFunction.SetIntersection, translator.TrType(expr.Type.AsSetType.Arg), e0, e1);
-            case BinaryExpr.ResolvedOpcode.SetDifference:
-              return translator.FunctionCall(expr.tok, BuiltinFunction.SetDifference, translator.TrType(expr.Type.AsSetType.Arg), e0, e1);
-
+            case BinaryExpr.ResolvedOpcode.Union: {
+              bool finite = e.E1.Type.AsSetType.Finite;
+              var f = finite ? BuiltinFunction.SetUnion : BuiltinFunction.ISetUnion;
+              return translator.FunctionCall(expr.tok, f, translator.TrType(expr.Type.AsSetType.Arg), e0, e1);
+            }
+            case BinaryExpr.ResolvedOpcode.Intersection: {
+              bool finite = e.E1.Type.AsSetType.Finite;
+              var f = finite ? BuiltinFunction.SetIntersection : BuiltinFunction.ISetIntersection;
+              return translator.FunctionCall(expr.tok, f, translator.TrType(expr.Type.AsSetType.Arg), e0, e1);
+            }
+            case BinaryExpr.ResolvedOpcode.SetDifference: {
+              bool finite = e.E1.Type.AsSetType.Finite;
+              var f = finite ? BuiltinFunction.SetDifference : BuiltinFunction.ISetDifference;
+              return translator.FunctionCall(expr.tok, f, translator.TrType(expr.Type.AsSetType.Arg), e0, e1);
+            }
             case BinaryExpr.ResolvedOpcode.MultiSetEq:
               return translator.FunctionCall(expr.tok, BuiltinFunction.MultiSetEqual, null, e0, e1);
             case BinaryExpr.ResolvedOpcode.MultiSetNeq:
@@ -11717,6 +11751,15 @@ namespace Microsoft.Dafny {
       SetSubset,
       SetDisjoint,
 
+      ISetEmpty,
+      ISetUnionOne,
+      ISetUnion,
+      ISetIntersection,
+      ISetDifference,
+      ISetEqual,
+      ISetSubset,
+      ISetDisjoint,
+
       MultiSetCard,
       MultiSetEmpty,
       MultiSetUnionOne,
@@ -11896,25 +11939,25 @@ namespace Microsoft.Dafny {
         case BuiltinFunction.SetEmpty: {
           Contract.Assert(args.Length == 0);
           Contract.Assert(typeInstantiation != null);
-          Bpl.Type resultType = predef.SetType(tok, typeInstantiation);
+          Bpl.Type resultType = predef.SetType(tok, true, typeInstantiation);
           return Bpl.Expr.CoerceType(tok, FunctionCall(tok, "Set#Empty", resultType, args), resultType);
         }
         case BuiltinFunction.SetUnionOne:
           Contract.Assert(args.Length == 2);
           Contract.Assert(typeInstantiation != null);
-          return FunctionCall(tok, "Set#UnionOne", predef.SetType(tok, typeInstantiation), args);
+          return FunctionCall(tok, "Set#UnionOne", predef.SetType(tok, true, typeInstantiation), args);
         case BuiltinFunction.SetUnion:
           Contract.Assert(args.Length == 2);
           Contract.Assert(typeInstantiation != null);
-          return FunctionCall(tok, "Set#Union", predef.SetType(tok, typeInstantiation), args);
+          return FunctionCall(tok, "Set#Union", predef.SetType(tok, true, typeInstantiation), args);
         case BuiltinFunction.SetIntersection:
           Contract.Assert(args.Length == 2);
           Contract.Assert(typeInstantiation != null);
-          return FunctionCall(tok, "Set#Intersection", predef.SetType(tok, typeInstantiation), args);
+          return FunctionCall(tok, "Set#Intersection", predef.SetType(tok, true, typeInstantiation), args);
         case BuiltinFunction.SetDifference:
           Contract.Assert(args.Length == 2);
           Contract.Assert(typeInstantiation != null);
-          return FunctionCall(tok, "Set#Difference", predef.SetType(tok, typeInstantiation), args);
+          return FunctionCall(tok, "Set#Difference", predef.SetType(tok, true, typeInstantiation), args);
         case BuiltinFunction.SetEqual:
           Contract.Assert(args.Length == 2);
           Contract.Assert(typeInstantiation == null);
@@ -11927,7 +11970,40 @@ namespace Microsoft.Dafny {
           Contract.Assert(args.Length == 2);
           Contract.Assert(typeInstantiation == null);
           return FunctionCall(tok, "Set#Disjoint", Bpl.Type.Bool, args);
-
+        case BuiltinFunction.ISetEmpty: {
+            Contract.Assert(args.Length == 0);
+            Contract.Assert(typeInstantiation != null);
+            Bpl.Type resultType = predef.SetType(tok, false, typeInstantiation);
+            return Bpl.Expr.CoerceType(tok, FunctionCall(tok, "ISet#Empty", resultType, args), resultType);
+          }
+        case BuiltinFunction.ISetUnionOne:
+          Contract.Assert(args.Length == 2);
+          Contract.Assert(typeInstantiation != null);
+          return FunctionCall(tok, "ISet#UnionOne", predef.SetType(tok, false, typeInstantiation), args);
+        case BuiltinFunction.ISetUnion:
+          Contract.Assert(args.Length == 2);
+          Contract.Assert(typeInstantiation != null);
+          return FunctionCall(tok, "ISet#Union", predef.SetType(tok, false, typeInstantiation), args);
+        case BuiltinFunction.ISetIntersection:
+          Contract.Assert(args.Length == 2);
+          Contract.Assert(typeInstantiation != null);
+          return FunctionCall(tok, "ISet#Intersection", predef.SetType(tok, false, typeInstantiation), args);
+        case BuiltinFunction.ISetDifference:
+          Contract.Assert(args.Length == 2);
+          Contract.Assert(typeInstantiation != null);
+          return FunctionCall(tok, "ISet#Difference", predef.SetType(tok, false, typeInstantiation), args);
+        case BuiltinFunction.ISetEqual:
+          Contract.Assert(args.Length == 2);
+          Contract.Assert(typeInstantiation == null);
+          return FunctionCall(tok, "ISet#Equal", Bpl.Type.Bool, args);
+        case BuiltinFunction.ISetSubset:
+          Contract.Assert(args.Length == 2);
+          Contract.Assert(typeInstantiation == null);
+          return FunctionCall(tok, "ISet#Subset", Bpl.Type.Bool, args);
+        case BuiltinFunction.ISetDisjoint:
+          Contract.Assert(args.Length == 2);
+          Contract.Assert(typeInstantiation == null);
+          return FunctionCall(tok, "ISet#Disjoint", Bpl.Type.Bool, args);
         case BuiltinFunction.MultiSetCard:
           Contract.Assert(args.Length == 1);
           Contract.Assert(typeInstantiation == null);
@@ -13261,7 +13337,7 @@ namespace Microsoft.Dafny {
           List<Expression> newElements = SubstituteExprList(e.Elements);
           if (newElements != e.Elements) {
             if (expr is SetDisplayExpr) {
-              newExpr = new SetDisplayExpr(expr.tok, newElements);
+              newExpr = new SetDisplayExpr(expr.tok, ((SetDisplayExpr)expr).Finite, newElements);
             } else if (expr is MultiSetDisplayExpr) {
               newExpr = new MultiSetDisplayExpr(expr.tok, newElements);
             } else {
@@ -13493,7 +13569,7 @@ namespace Microsoft.Dafny {
           Attributes newAttrs = SubstAttributes(e.Attributes);
           if (newBoundVars != e.BoundVars || newRange != e.Range || newTerm != e.Term || newAttrs != e.Attributes) {
             if (e is SetComprehension) {
-              newExpr = new SetComprehension(expr.tok, newBoundVars, newRange, newTerm, newAttrs);
+              newExpr = new SetComprehension(expr.tok, ((SetComprehension)e).Finite, newBoundVars, newRange, newTerm, newAttrs);
             } else if (e is MapComprehension) {
               newExpr = new MapComprehension(expr.tok, ((MapComprehension)e).Finite, newBoundVars, newRange, newTerm, newAttrs);
             } else if (expr is ForallExpr) {
diff --git a/Source/DafnyExtension/TokenTagger.cs b/Source/DafnyExtension/TokenTagger.cs
index af141ad7..8377b3a2 100644
--- a/Source/DafnyExtension/TokenTagger.cs
+++ b/Source/DafnyExtension/TokenTagger.cs
@@ -305,6 +305,7 @@ namespace DafnyLanguage
                 case "ghost":
                 case "if":
                 case "imap":
+                case "iset":
                 case "import":
                 case "in":
                 case "include":
diff --git a/Test/dafny0/ISets.dfy b/Test/dafny0/ISets.dfy
new file mode 100644
index 00000000..bb0230f4
--- /dev/null
+++ b/Test/dafny0/ISets.dfy
@@ -0,0 +1,40 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+ghost method M()
+{
+   ghost var s := iset{2};
+   // test "in
+   if(2 in s)
+   {
+   }
+   else
+   { assert false; }
+   // test "!in"
+   if(3 !in s)
+   {
+   }
+   else
+   { assert false; }
+   
+   if(s == iset{2})
+   {
+   }
+   else
+   { assert false; }
+}
+
+ghost method m1() {
+ var s1:iset<int> := iset{}; // the empty set   
+ var s2 := iset{1, 2, 3}; // set contains exactly 1, 2, and 3   
+ assert s2 == iset{1,1,2,3,3,3,3}; // same as before   
+ var s3, s4 := iset{1,2}, iset{1,4};
+
+ assert s2 + s4 == iset{1,2,3,4}; // set union   
+ assert s2 * s3 == iset{1,2} && s2 * s4 == iset{1}; // set intersection   
+ assert s2 - s3 == iset{3}; // set difference
+
+ assert (iset x | x in s2 :: x+1) == iset{2,3,4}; // set comprehension
+}
+
+
diff --git a/Test/dafny0/ISets.dfy.expect b/Test/dafny0/ISets.dfy.expect
new file mode 100644
index 00000000..73ba063c
--- /dev/null
+++ b/Test/dafny0/ISets.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 4 verified, 0 errors
diff --git a/Util/Emacs/dafny-mode.el b/Util/Emacs/dafny-mode.el
index 8355817a..fd1bf369 100644
--- a/Util/Emacs/dafny-mode.el
+++ b/Util/Emacs/dafny-mode.el
@@ -46,7 +46,7 @@
         "match" "case" "false" "true" "null")) . font-lock-keyword-face)
    `(,(dafny-regexp-opt '(
         "bool" "char" "int" "nat" "real"
-        "set" "multiset" "seq" "string" "map" "imap"
+        "set" "iset" "multiset" "seq" "string" "map" "imap"
 	"object" "array" "array2" "array3")) . font-lock-type-face)
    )
   "Minimal highlighting for Dafny mode")
diff --git a/Util/latex/dafny.sty b/Util/latex/dafny.sty
index 44a55f70..76d2278a 100644
--- a/Util/latex/dafny.sty
+++ b/Util/latex/dafny.sty
@@ -6,7 +6,7 @@
 
 \lstdefinelanguage{dafny}{
   morekeywords={class,datatype,codatatype,newtype,type,iterator,trait,extends,
-      bool,char,nat,int,real,object,set,multiset,seq,string,map,imap,array,array2,array3,
+      bool,char,nat,int,real,object,set,iset,multiset,seq,string,map,imap,array,array2,array3,
       function,predicate,copredicate,inductive,
       ghost,var,static,protected,refines,
       method,lemma,constructor,colemma,
diff --git a/Util/vim/dafny.vim b/Util/vim/dafny.vim
index 65d7165f..d81872aa 100644
--- a/Util/vim/dafny.vim
+++ b/Util/vim/dafny.vim
@@ -13,7 +13,7 @@ syntax keyword dafnyConditional if then else match case
 syntax keyword dafnyRepeat while
 syntax keyword dafnyStatement assume assert return yield new print break label where calc modify
 syntax keyword dafnyKeyword var ghost returns yields null static protected this refines include
-syntax keyword dafnyType bool char nat int real set multiset seq string map imap object array array2 array3
+syntax keyword dafnyType bool char nat int real set iset multiset seq string map imap object array array2 array3
 syntax keyword dafnyLogic requires ensures modifies reads decreases invariant
 syntax keyword dafnyOperator forall exists old fresh
 syntax keyword dafnyBoolean true false
-- 
cgit v1.2.3


From 0e63640cbdb2ba154ef1427782ba147717bee3cf Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Tue, 2 Jun 2015 13:15:01 -0700
Subject: Added {:auto_generated} trigger, which indicates that a declaration
 was not explicitly mentioned in the input.  This lets the Dafny IDE know not
 to add hovertext for these declarations.

---
 Source/Dafny/Rewriter.cs                  | 9 ++++-----
 Source/DafnyExtension/IdentifierTagger.cs | 4 +++-
 2 files changed, 7 insertions(+), 6 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 962b07b9..4e66915d 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -496,6 +496,7 @@ namespace Microsoft.Dafny
 
             // Annotate the new function so we remember that we introduced it
             fWithBody.Attributes = new Attributes("opaque_full", new List<Expression>(), fWithBody.Attributes);
+            fWithBody.Attributes = new Attributes("auto_generated", new List<Expression>(), fWithBody.Attributes);
 
             // Create a lemma to allow the user to selectively reveal the function's body          
             // That is, given:
@@ -505,7 +506,7 @@ namespace Microsoft.Dafny
             //     ensures foo(x, y) < 10;
             //   { x + y }
             // We produce:
-            //   lemma {:axiom} reveal_foo()
+            //   lemma {:axiom} {:auto_generated} reveal_foo()
             //     ensures forall x:int, y:int {:trigger foo(x,y)} :: 0 <= x < 5 && 0 <= y < 5 ==> foo(x,y) == foo_FULL(x,y);
             Expression reqExpr = new LiteralExpr(f.tok, true);
             foreach (Expression req in f.Req) {
@@ -518,10 +519,7 @@ namespace Microsoft.Dafny
               typeVars.Add(cloner.CloneTypeParam(tp));
             }
 
-            List<BoundVar> boundVars = new List<BoundVar>();
-            foreach (Formal formal in f.Formals) {
-              boundVars.Add(new BoundVar(f.tok, formal.Name, cloner.CloneType(formal.Type)));
-            }
+            var boundVars = f.Formals.ConvertAll(formal => new BoundVar(formal.tok, formal.Name, cloner.CloneType(formal.Type)));
 
             // Build the implication connecting the function's requires to the connection with the revealed-body version
             Func<Function, Expression> func_builder = func =>
@@ -552,6 +550,7 @@ namespace Microsoft.Dafny
 
             // Add an axiom attribute so that the compiler won't complain about the lemma's lack of a body
             Attributes lemma_attrs = new Attributes("axiom", new List<Expression>(), null);
+            lemma_attrs = new Attributes("auto_generated", new List<Expression>(), lemma_attrs);
 
             var reveal = new Lemma(f.tok, "reveal_" + f.Name, f.HasStaticKeyword, new List<TypeParameter>(), new List<Formal>(), new List<Formal>(), new List<MaybeFreeExpression>(),
                                     new Specification<FrameExpression>(new List<FrameExpression>(), null), newEnsuresList,
diff --git a/Source/DafnyExtension/IdentifierTagger.cs b/Source/DafnyExtension/IdentifierTagger.cs
index 3bb8f01c..086ac8e4 100644
--- a/Source/DafnyExtension/IdentifierTagger.cs
+++ b/Source/DafnyExtension/IdentifierTagger.cs
@@ -179,7 +179,9 @@ namespace DafnyLanguage
           } else if (d is ClassDecl) {
             var cl = (ClassDecl)d;
             foreach (var member in cl.Members) {
-              if (member is Function) {
+              if (Attributes.Contains(member.Attributes, "auto_generated")) {
+                // do nothing
+              } else  if (member is Function) {
                 var f = (Function)member;
                 foreach (var p in f.Formals) {
                   IdRegion.Add(newRegions, p.tok, p, true, module);
-- 
cgit v1.2.3


From 9a7cc1eaf7dc9006f249ceab7793ccd0b6da40ac Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Thu, 4 Jun 2015 00:31:16 -0700
Subject: Generate #requires function for OpaqueFunction.

---
 Source/Dafny/Translator.cs   |  2 +-
 Test/dafny4/Bug82.dfy        | 11 +++++++++++
 Test/dafny4/Bug82.dfy.expect |  2 ++
 3 files changed, 14 insertions(+), 1 deletion(-)
 create mode 100644 Test/dafny4/Bug82.dfy
 create mode 100644 Test/dafny4/Bug82.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 045ef8d0..e7a8bedf 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -1480,7 +1480,7 @@ namespace Microsoft.Dafny {
         AddFunctionAxiom(f, FunctionAxiomVisibility.ForeignModuleOnly, f.Body.Resolved);
       }
       // for body-less functions, at least generate its #requires function
-      if (f.Body == null) {
+      if (f.Body == null || IsOpaqueFunction(f)) {
         var b = FunctionAxiom(f, FunctionAxiomVisibility.ForeignModuleOnly, null, null);
         Contract.Assert(b == null);
       }
diff --git a/Test/dafny4/Bug82.dfy b/Test/dafny4/Bug82.dfy
new file mode 100644
index 00000000..bc7ff321
--- /dev/null
+++ b/Test/dafny4/Bug82.dfy
@@ -0,0 +1,11 @@
+// RUN: %dafny /compile:0  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+function {:opaque} Reverse(id:int) : int
+
+function RefineToMap(ReverseKey:int->int) : bool
+
+function RefineToMapOfSeqNums() : bool
+{
+    RefineToMap(Reverse)
+}
diff --git a/Test/dafny4/Bug82.dfy.expect b/Test/dafny4/Bug82.dfy.expect
new file mode 100644
index 00000000..73ba063c
--- /dev/null
+++ b/Test/dafny4/Bug82.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 4 verified, 0 errors
-- 
cgit v1.2.3


From 191ff327c49796e8a64fae893520d878b32d3268 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Sun, 7 Jun 2015 12:38:31 -0700
Subject: Fix the UseBaseNameForFileName flag; it shouldn't set the return code
 to zero.

The test suite relies on error codes all being zero (except for preprocessing
errors), so add a flag for that (as suggested in a source comment).
---
 Source/Dafny/DafnyOptions.cs      | 16 +++++++++++++++-
 Source/DafnyDriver/DafnyDriver.cs |  3 +--
 Test/lit.site.cfg                 |  2 +-
 3 files changed, 17 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index 4fc2de96..a6827d5f 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -54,6 +54,7 @@ namespace Microsoft.Dafny
     public string AutoReqPrintFile = null;
     public bool ignoreAutoReq = false;
     public bool AllowGlobals = false;
+    public bool CountVerificationErrors = true;
 
     protected override bool ParseOption(string name, Bpl.CommandLineOptionEngine.CommandLineParseState ps) {
       var args = ps.args;  // convenient synonym
@@ -171,6 +172,14 @@ namespace Microsoft.Dafny
           AllowGlobals = true;
           return true;
 
+        case "countVerificationErrors": {
+          int countErrors = 1; // defaults to reporting verification errors
+          if (ps.GetNumericArgument(ref countErrors, 2)) {
+            CountVerificationErrors = countErrors == 1;
+          }
+          return true;
+        }
+
         default:
           break;
       }
@@ -245,7 +254,7 @@ namespace Microsoft.Dafny
                     how discriminating they are:  0 < 1 < 2 < (3,4) < 5 < 6
                 6 (default) - most discriminating
   /noIncludes   Ignore include directives
-  /noNLarith    Reduce Z3's knowledge of non-linear arithmetic (*,/,%). 
+  /noNLarith    Reduce Z3's knowledge of non-linear arithmetic (*,/,%).
                 Results in more manual work, but also produces more predictable behavior.
   /autoReqPrint:<file>
                 Print out requirements that were automatically generated by autoReq.
@@ -256,6 +265,11 @@ namespace Microsoft.Dafny
                 a transition from the behavior in the language prior to version 1.9.3, from
                 which point onward all functions and methods declared at the module scope are
                 implicitly static and fields declarations are not allowed at the module scope.
+  /countVerificationErrors:<n>
+                0 - If preprocessing succeeds, set exit code to 0 regardless of the number
+                    of verification errors.
+                1 (default) - If preprocessing succeeds, set exit code to the number of
+                              verification errors.
 ");
       base.Usage();  // also print the Boogie options
     }
diff --git a/Source/DafnyDriver/DafnyDriver.cs b/Source/DafnyDriver/DafnyDriver.cs
index 854269c1..a769b829 100644
--- a/Source/DafnyDriver/DafnyDriver.cs
+++ b/Source/DafnyDriver/DafnyDriver.cs
@@ -104,9 +104,8 @@ namespace Microsoft.Dafny
           Console.WriteLine("Press Enter to exit.");
           Console.ReadLine();
         }
-        if (CommandLineOptions.Clo.UseBaseNameForFileName && exitValue != ExitValue.PREPROCESSING_ERROR)
+        if (!DafnyOptions.O.CountVerificationErrors && exitValue != ExitValue.PREPROCESSING_ERROR)
         {
-          // TODO(wuestholz): We should probably add a separate flag for this. This is currently only used by the new testing infrastructure.
           return 0;
         }
         //Console.ReadKey();
diff --git a/Test/lit.site.cfg b/Test/lit.site.cfg
index d0b3a85b..1fe593f4 100644
--- a/Test/lit.site.cfg
+++ b/Test/lit.site.cfg
@@ -91,7 +91,7 @@ if os.name == 'posix':
         lit_config.fatal('Cannot find mono. Make sure it is your PATH')
 
 # Expected output does not contain logo
-dafnyExecutable += ' -nologo'
+dafnyExecutable += ' -nologo -countVerificationErrors:0'
 
 # We do not want absolute or relative paths in error messages, just the basename of the file
 dafnyExecutable += ' -useBaseNameForFileName'
-- 
cgit v1.2.3


From 67c4a534c033a239d47c7bffd9b632ff59ce42a0 Mon Sep 17 00:00:00 2001
From: Bryan Parno <parno@microsoft.com>
Date: Mon, 8 Jun 2015 14:39:25 -0700
Subject: Fix some issues when compiling generic types and generic function
 method calls

---
 Source/Dafny/Compiler.cs | 12 +++++++++++-
 Source/Dafny/Resolver.cs |  3 ++-
 2 files changed, 13 insertions(+), 2 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index ef5ba69e..4d0182dc 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -1116,7 +1116,13 @@ namespace Microsoft.Dafny {
         return string.Format("new {0}()", s);
       } else if (type.IsTypeParameter) {
         var udt = (UserDefinedType)type;
-        return "default(@" + udt.FullCompileName + ")";
+        string s = "default(@" + udt.FullCompileName;
+        if (udt.TypeArgs.Count != 0)
+        {
+          s += "<" + TypeNames(udt.TypeArgs) + ">";
+        }
+        s += ")";
+        return s;
       } else if (type is SetType) {
         return DafnySetClass + "<" + TypeName(((SetType)type).Arg) + ">.Empty";
       } else if (type is MultiSetType) {
@@ -2959,6 +2965,10 @@ namespace Microsoft.Dafny {
         twr.Write(")");
       }
       twr.Write(".@{0}", f.CompileName);
+      if (f.TypeArgs.Count != 0) {
+          List<Type> typeArgs = f.TypeArgs.ConvertAll(ta => e.TypeArgumentSubstitutions[ta]);
+          twr.Write("<" + TypeNames(typeArgs) + ">");
+      }
       twr.Write("(");
       string sep = "";
       for (int i = 0; i < e.Args.Count; i++) {
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 52b01d58..5f01f913 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -4129,7 +4129,8 @@ namespace Microsoft.Dafny
           } else if (r.Type is Resolver_IdentifierExpr.ResolverType_Type) {
             var d = r.Decl;
             if (d is OpaqueTypeDecl) {
-              t.ResolvedParam = ((OpaqueTypeDecl)d).TheType;  // resolve like a type parameter, and it may have type parameters if it's an opaque type
+              t.ResolvedParam = ((OpaqueTypeDecl)d).TheType;  // resolve like a type parameter, and it may have type parameters if it's an opaque type              
+              t.ResolvedClass = d;  // Store the decl, so the compiler will generate the fully qualified name
             } else if (d is NewtypeDecl) {
               var dd = (NewtypeDecl)d;
               var caller = context as ICallable;
-- 
cgit v1.2.3


From 61d4f1a90833d66c5e959ae5c23b64f3fb23c510 Mon Sep 17 00:00:00 2001
From: Bryan Parno <parno@microsoft.com>
Date: Mon, 8 Jun 2015 17:52:01 -0700
Subject: Update the hash code for datatypes to use the djb2 hash algorithm,
 rather than xor.  The latter produces pessimal performance if the datatype
 contains duplicate data.

---
 Source/Dafny/Compiler.cs | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 4d0182dc..fd2392e6 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -441,19 +441,19 @@ namespace Microsoft.Dafny {
         wr.WriteLine(";");
         Indent(ind); wr.WriteLine("}");
 
-        // GetHashCode method
+        // GetHashCode method (Uses the djb2 algorithm)
         Indent(ind); wr.WriteLine("public override int GetHashCode() {");
-        Indent(ind + IndentAmount); wr.Write("return " + constructorIndex);
-
+        Indent(ind + IndentAmount); wr.WriteLine("ulong hash = 5381;");
+        Indent(ind + IndentAmount); wr.WriteLine("hash = ((hash << 5) + hash) + {0};", constructorIndex);
         i = 0;
         foreach (Formal arg in ctor.Formals) {
           if (!arg.IsGhost) {
             string nm = FormalName(arg, i);
-            wr.Write(" ^ this.@{0}.GetHashCode()", nm);
+            Indent(ind + IndentAmount); wr.WriteLine("hash = ((hash << 5) + hash) + ((ulong)this.@{0}.GetHashCode());", nm);
             i++;
           }
         }
-        wr.WriteLine(";");
+        Indent(ind + IndentAmount); wr.WriteLine("return (int) hash;");
         Indent(ind); wr.WriteLine("}");
 
         if (dt is IndDatatypeDecl) {
-- 
cgit v1.2.3


From 1e9a9af1700f67dde62e8ceb81aa16e13de0e3fb Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Sun, 7 Jun 2015 02:22:02 -0700
Subject: Add a compatibility layer over BigInteger.Parse

Mono currently does not implement support for BigInteger.Parse, so use Int64 if
possible, and throw the same error as was previously returned otherwise. This is
not too much of a problem in practice, because most of the integers that we
actually come across in real-life source files seem to fit in an Int64.
---
 Source/Dafny/BigIntegerParser.cs  | 27 +++++++++++++++++++++++++++
 Source/Dafny/Dafny.atg            |  4 ++--
 Source/Dafny/DafnyPipeline.csproj |  1 +
 Source/Dafny/Parser.cs            |  4 ++--
 4 files changed, 32 insertions(+), 4 deletions(-)
 create mode 100644 Source/Dafny/BigIntegerParser.cs

(limited to 'Source')

diff --git a/Source/Dafny/BigIntegerParser.cs b/Source/Dafny/BigIntegerParser.cs
new file mode 100644
index 00000000..94e842cc
--- /dev/null
+++ b/Source/Dafny/BigIntegerParser.cs
@@ -0,0 +1,27 @@
+using System;
+using System.Numerics;
+using System.Globalization;
+
+namespace Microsoft.Dafny {
+    internal static class BigIntegerParser {
+        /// <summary>
+        ///   Mono does not support the BigInteger.TryParse method. In practice,
+        ///   we seldom actually need to parse huge integers, so it makes sense
+        ///   to support most real-life cases by simply trying to parse using
+        ///   Int64, and only falling back if needed.
+        /// </summary>
+        internal static BigInteger Parse(string str, NumberStyles style) {
+            Int64 parsed;
+            if (Int64.TryParse(str, style, NumberFormatInfo.CurrentInfo, out parsed)) {
+                return new BigInteger(parsed);
+            } else {
+                // Throws on Mono 3.2.8
+                return BigInteger.Parse(str, style);
+            }
+        }
+
+        internal static BigInteger Parse(string str) {
+            return BigIntegerParser.Parse(str, NumberStyles.Integer);
+        }
+    }
+}
\ No newline at end of file
diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index b2b40629..6cc0af5a 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -2982,7 +2982,7 @@ Nat<out BigInteger n>
   ( digits
     (. S = Util.RemoveUnderscores(t.val);
        try {
-         n = BigInteger.Parse(S);
+         n = BigIntegerParser.Parse(S);
        } catch (System.FormatException) {
          SemErr("incorrectly formatted number");
          n = BigInteger.Zero;
@@ -2992,7 +2992,7 @@ Nat<out BigInteger n>
     (. S = Util.RemoveUnderscores(t.val.Substring(2));
        try {
          // note: leading 0 required when parsing positive hex numbers
-         n = BigInteger.Parse("0" + S, System.Globalization.NumberStyles.HexNumber);
+         n = BigIntegerParser.Parse("0" + S, System.Globalization.NumberStyles.HexNumber);
        } catch (System.FormatException) {
          SemErr("incorrectly formatted number");
          n = BigInteger.Zero;
diff --git a/Source/Dafny/DafnyPipeline.csproj b/Source/Dafny/DafnyPipeline.csproj
index 74f7dae6..f9540aa0 100644
--- a/Source/Dafny/DafnyPipeline.csproj
+++ b/Source/Dafny/DafnyPipeline.csproj
@@ -145,6 +145,7 @@
     <Compile Include="Cloner.cs" />
     <Compile Include="Util.cs" />
     <Compile Include="Compiler.cs" />
+    <Compile Include="BigIntegerParser.cs" />
     <Compile Include="DafnyAst.cs" />
     <Compile Include="DafnyMain.cs" />
     <Compile Include="DafnyOptions.cs" />
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index fa41877f..b183fff1 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -3988,7 +3988,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 			S = Util.RemoveUnderscores(t.val);
 			try {
-			 n = BigInteger.Parse(S);
+             n = BigIntegerParser.Parse(S);
 			} catch (System.FormatException) {
 			 SemErr("incorrectly formatted number");
 			 n = BigInteger.Zero;
@@ -3999,7 +3999,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			S = Util.RemoveUnderscores(t.val.Substring(2));
 			try {
 			 // note: leading 0 required when parsing positive hex numbers
-			 n = BigInteger.Parse("0" + S, System.Globalization.NumberStyles.HexNumber);
+             n = BigIntegerParser.Parse("0" + S, System.Globalization.NumberStyles.HexNumber);
 			} catch (System.FormatException) {
 			 SemErr("incorrectly formatted number");
 			 n = BigInteger.Zero;
-- 
cgit v1.2.3


From a297fb4b9e6c0b915b5bb5bd85050b26a9ed7e3b Mon Sep 17 00:00:00 2001
From: Michael Lowell Roberts <mirobert@microsoft.com>
Date: Fri, 12 Jun 2015 11:12:35 -0700
Subject: added -optimize option to compiler.

---
 Binaries/DafnyRuntime.cs             | 506 +++++++++++++++++++++++++++++++----
 Source/Dafny/DafnyOptions.cs         |  12 +
 Source/DafnyDriver/DafnyDriver.cs    |  13 +-
 Test/irondafny0/optimize0.dfy        |   6 +
 Test/irondafny0/optimize0.dfy.expect |   6 +
 5 files changed, 485 insertions(+), 58 deletions(-)
 create mode 100644 Test/irondafny0/optimize0.dfy
 create mode 100644 Test/irondafny0/optimize0.dfy.expect

(limited to 'Source')

diff --git a/Binaries/DafnyRuntime.cs b/Binaries/DafnyRuntime.cs
index fd680a0b..7d3799d8 100644
--- a/Binaries/DafnyRuntime.cs
+++ b/Binaries/DafnyRuntime.cs
@@ -4,39 +4,430 @@ using System.Numerics;
 namespace Dafny
 {
   using System.Collections.Generic;
+// set this option if you want to use System.Collections.Immutable and if you know what you're doing.
+#if DAFNY_USE_SYSTEM_COLLECTIONS_IMMUTABLE
+  using System.Collections.Immutable;
+  using System.Linq;
 
   public class Set<T>
   {
-    Dictionary<T, bool> dict;
-    Set(Dictionary<T, bool> d) {
+    readonly ImmutableHashSet<T> setImpl;
+    Set(ImmutableHashSet<T> d) {
+      this.setImpl = d;
+    }
+    public static readonly Set<T> Empty = new Set<T>(ImmutableHashSet<T>.Empty);
+    public static Set<T> FromElements(params T[] values) {
+      return FromElements((IEnumerable<T>)values);
+    }
+    public static Set<T> FromElements(IEnumerable<T> values) {
+      var d = ImmutableHashSet<T>.Empty.ToBuilder();
+      foreach (T t in values)
+        d.Add(t);
+      return new Set<T>(d.ToImmutable());
+    }
+    public static Set<T> FromCollection(ICollection<T> values) {
+      var d = ImmutableHashSet<T>.Empty.ToBuilder();
+      foreach (T t in values)
+        d.Add(t);
+      return new Set<T>(d.ToImmutable());
+    }
+    public int Length {
+      get { return this.setImpl.Count; }
+    }
+    public long LongLength {
+      get { return this.setImpl.Count; }
+    }
+    public IEnumerable<T> Elements {
+      get {
+        return this.setImpl;
+      }
+    }
+    /// <summary>
+    /// This is an inefficient iterator for producing all subsets of "this".  Each set returned is the same
+    /// Set<T> object (but this Set<T> object is fresh; in particular, it is not "this").
+    /// </summary>
+    public IEnumerable<Set<T>> AllSubsets {
+      get {
+        // Start by putting all set elements into a list
+        var elmts = new List<T>();
+        elmts.AddRange(this.setImpl);
+        var n = elmts.Count;
+        var which = new bool[n];
+        var s = ImmutableHashSet<T>.Empty.ToBuilder();
+        while (true) {
+          yield return new Set<T>(s.ToImmutable());
+          // "add 1" to "which", as if doing a carry chain.  For every digit changed, change the membership of the corresponding element in "s".
+          int i = 0;
+          for (; i < n && which[i]; i++) {
+            which[i] = false;
+            s.Remove(elmts[i]);
+          }
+          if (i == n) {
+            // we have cycled through all the subsets
+            break;
+          }
+          which[i] = true;
+          s.Add(elmts[i]);
+        }
+      }
+    }
+    public bool Equals(Set<T> other) {
+        return this.setImpl.Equals(other.setImpl);
+    }
+    public override bool Equals(object other) {
+        var otherSet = other as Set<T>;
+        return otherSet != null && Equals(otherSet);
+    }
+    public override int GetHashCode() {
+      var hashCode = 1;
+      foreach (var t in this.setImpl) {
+        hashCode = hashCode * (t.GetHashCode()+3);
+      }
+      return hashCode;
+    }
+    public override string ToString() {
+      var s = "{";
+      var sep = "";
+      foreach (var t in this.setImpl) {
+        s += sep + t.ToString();
+        sep = ", ";
+      }
+      return s + "}";
+    }
+    public bool IsProperSubsetOf(Set<T> other) {
+        return IsProperSubsetOf(other);
+    }
+    public bool IsSubsetOf(Set<T> other) {
+        return IsSubsetOf(other);
+    }
+    public bool IsSupersetOf(Set<T> other) {
+      return other.IsSupersetOf(this);
+    }
+    public bool IsProperSupersetOf(Set<T> other) {
+      return other.IsProperSupersetOf(this);
+    }
+    public bool IsDisjointFrom(Set<T> other) {
+      ImmutableHashSet<T> a, b;
+      if (this.setImpl.Count < other.setImpl.Count) {
+        a = this.setImpl; b = other.setImpl;
+      } else {
+        a = other.setImpl; b = this.setImpl;
+      }
+      foreach (T t in a) {
+        if (b.Contains(t))
+          return false;
+      }
+      return true;
+    }
+    public bool Contains(T t) {
+      return this.setImpl.Contains(t);
+    }
+    public Set<T> Union(Set<T> other) {
+        return new Set<T>(this.setImpl.Union(other.setImpl));
+    }
+    public Set<T> Intersect(Set<T> other) {
+      return new Set<T>(this.setImpl.Intersect(other.setImpl));
+    }
+    public Set<T> Difference(Set<T> other) {
+        return new Set<T>(this.setImpl.Except(other.setImpl));
+    }
+  }
+  public partial class MultiSet<T>
+  {
+
+    readonly ImmutableDictionary<T, int> dict;
+    MultiSet(ImmutableDictionary<T, int> d) {
       dict = d;
     }
+    public static readonly MultiSet<T> Empty = new MultiSet<T>(ImmutableDictionary<T, int>.Empty);
+    public static MultiSet<T> FromElements(params T[] values) {
+      var d = ImmutableDictionary<T, int>.Empty.ToBuilder();
+      foreach (T t in values) {
+        var i = 0;
+        if (!d.TryGetValue(t, out i)) {
+          i = 0;
+        }
+        d[t] = i + 1;
+      }
+      return new MultiSet<T>(d.ToImmutable());
+    }
+    public static MultiSet<T> FromCollection(ICollection<T> values) {
+      var d = ImmutableDictionary<T, int>.Empty.ToBuilder();
+      foreach (T t in values) {
+        var i = 0;
+        if (!d.TryGetValue(t, out i)) {
+          i = 0;
+        }
+        d[t] = i + 1;
+      }
+      return new MultiSet<T>(d.ToImmutable());
+    }
+    public static MultiSet<T> FromSeq(Sequence<T> values) {
+      var d = ImmutableDictionary<T, int>.Empty.ToBuilder();
+      foreach (T t in values.Elements) {
+        var i = 0;
+        if (!d.TryGetValue(t, out i)) {
+          i = 0;
+        }
+        d[t] = i + 1;
+      }
+      return new MultiSet<T>(d.ToImmutable());
+    }
+    public static MultiSet<T> FromSet(Set<T> values) {
+      var d = ImmutableDictionary<T, int>.Empty.ToBuilder();
+      foreach (T t in values.Elements) {
+        d[t] = 1;
+      }
+      return new MultiSet<T>(d.ToImmutable());
+    }
+
+    public bool Equals(MultiSet<T> other) {
+      return other.IsSubsetOf(this) && this.IsSubsetOf(other);
+    }
+    public override bool Equals(object other) {
+      return other is MultiSet<T> && Equals((MultiSet<T>)other);
+    }
+    public override int GetHashCode() {
+      var hashCode = 1;
+      foreach (var kv in dict) {
+        var key = kv.Key.GetHashCode();
+        key = (key << 3) | (key >> 29) ^ kv.Value.GetHashCode();
+        hashCode = hashCode * (key + 3);
+      }
+      return hashCode;
+    }
+    public override string ToString() {
+      var s = "multiset{";
+      var sep = "";
+      foreach (var kv in dict) {
+        var t = kv.Key.ToString();
+        for (int i = 0; i < kv.Value; i++) {
+          s += sep + t.ToString();
+          sep = ", ";
+        }
+      }
+      return s + "}";
+    }
+    public bool IsProperSubsetOf(MultiSet<T> other) {
+      return !Equals(other) && IsSubsetOf(other);
+    }
+    public bool IsSubsetOf(MultiSet<T> other) {
+      foreach (T t in dict.Keys) {
+        if (!other.dict.ContainsKey(t) || other.dict[t] < dict[t])
+          return false;
+      }
+      return true;
+    }
+    public bool IsSupersetOf(MultiSet<T> other) {
+      return other.IsSubsetOf(this);
+    }
+    public bool IsProperSupersetOf(MultiSet<T> other) {
+      return other.IsProperSubsetOf(this);
+    }
+    public bool IsDisjointFrom(MultiSet<T> other) {
+      foreach (T t in dict.Keys) {
+        if (other.dict.ContainsKey(t))
+          return false;
+      }
+      foreach (T t in other.dict.Keys) {
+        if (dict.ContainsKey(t))
+          return false;
+      }
+      return true;
+    }
+    public bool Contains(T t) {
+      return dict.ContainsKey(t);
+    }
+    public MultiSet<T> Union(MultiSet<T> other) {
+      if (dict.Count == 0)
+        return other;
+      else if (other.dict.Count == 0)
+        return this;
+        var r = ImmutableDictionary<T, int>.Empty.ToBuilder();
+      foreach (T t in dict.Keys) {
+        var i = 0;
+        if (!r.TryGetValue(t, out i)) {
+          i = 0;
+        }
+        r[t] = i + dict[t];
+      }
+      foreach (T t in other.dict.Keys) {
+        var i = 0;
+        if (!r.TryGetValue(t, out i)) {
+          i = 0;
+        }
+        r[t] = i + other.dict[t];
+      }
+      return new MultiSet<T>(r.ToImmutable());
+    }
+    public MultiSet<T> Intersect(MultiSet<T> other) {
+      if (dict.Count == 0)
+        return this;
+      else if (other.dict.Count == 0)
+        return other;
+      var r = ImmutableDictionary<T, int>.Empty.ToBuilder();
+      foreach (T t in dict.Keys) {
+        if (other.dict.ContainsKey(t)) {
+          r[t] = other.dict[t] < dict[t] ? other.dict[t] : dict[t];
+        }
+      }
+      return new MultiSet<T>(r.ToImmutable());
+    }
+    public MultiSet<T> Difference(MultiSet<T> other) { // \result == this - other
+      if (dict.Count == 0)
+        return this;
+      else if (other.dict.Count == 0)
+        return this;
+      var r = ImmutableDictionary<T, int>.Empty.ToBuilder();
+      foreach (T t in dict.Keys) {
+        if (!other.dict.ContainsKey(t)) {
+          r[t] = dict[t];
+        } else if (other.dict[t] < dict[t]) {
+          r[t] = dict[t] - other.dict[t];
+        }
+      }
+      return new MultiSet<T>(r.ToImmutable());
+    }
+    public IEnumerable<T> Elements {
+      get {
+        foreach (T t in dict.Keys) {
+          int n;
+          dict.TryGetValue(t, out n);
+          for (int i = 0; i < n; i ++) {
+            yield return t;
+          }
+        }
+      }
+    }
+  }
+
+  public partial class Map<U, V>
+  {
+    readonly ImmutableDictionary<U, V> dict;
+    Map(ImmutableDictionary<U, V> d) {
+      dict = d;
+    }
+    public static readonly Map<U, V> Empty = new Map<U, V>(ImmutableDictionary<U, V>.Empty);
+    public static Map<U, V> FromElements(params Pair<U, V>[] values) {
+      var d = ImmutableDictionary<U, V>.Empty.ToBuilder();
+      foreach (Pair<U, V> p in values) {
+        d[p.Car] = p.Cdr;
+      }
+      return new Map<U, V>(d.ToImmutable());
+    }
+    public static Map<U, V> FromCollection(List<Pair<U, V>> values) {
+      var d = ImmutableDictionary<U, V>.Empty.ToBuilder();
+      foreach (Pair<U, V> p in values) {
+        d[p.Car] = p.Cdr;
+      }
+      return new Map<U, V>(d.ToImmutable());
+    }
+    public int Length {
+      get { return dict.Count; }
+    }
+    public long LongLength {
+      get { return dict.Count; }
+    }
+    public bool Equals(Map<U, V> other) {
+      foreach (U u in dict.Keys) {
+        V v1, v2;
+        if (!dict.TryGetValue(u, out v1)) {
+          return false; // this shouldn't happen
+        }
+        if (!other.dict.TryGetValue(u, out v2)) {
+          return false; // other dictionary does not contain this element
+        }
+        if (!v1.Equals(v2)) {
+          return false;
+        }
+      }
+      foreach (U u in other.dict.Keys) {
+        if (!dict.ContainsKey(u)) {
+          return false; // this shouldn't happen
+        }
+      }
+      return true;
+    }
+    public override bool Equals(object other) {
+      return other is Map<U, V> && Equals((Map<U, V>)other);
+    }
+    public override int GetHashCode() {
+      var hashCode = 1;
+      foreach (var kv in dict) {
+        var key = kv.Key.GetHashCode();
+        key = (key << 3) | (key >> 29) ^ kv.Value.GetHashCode();
+        hashCode = hashCode * (key + 3);
+      }
+      return hashCode;
+    }
+    public override string ToString() {
+      var s = "map[";
+      var sep = "";
+      foreach (var kv in dict) {
+        s += sep + kv.Key.ToString() + " := " + kv.Value.ToString();
+        sep = ", ";
+      }
+      return s + "]";
+    }
+    public bool IsDisjointFrom(Map<U, V> other) {
+      foreach (U u in dict.Keys) {
+        if (other.dict.ContainsKey(u))
+          return false;
+      }
+      foreach (U u in other.dict.Keys) {
+        if (dict.ContainsKey(u))
+          return false;
+      }
+      return true;
+    }
+    public bool Contains(U u) {
+      return dict.ContainsKey(u);
+    }
+    public V Select(U index) {
+      return dict[index];
+    }
+    public Map<U, V> Update(U index, V val) {
+      return new Map<U, V>(dict.SetItem(index, val));
+    }
+    public IEnumerable<U> Domain {
+      get {
+        return dict.Keys;
+      }
+    }
+  }
+#else // !def DAFNY_USE_SYSTEM_COLLECTIONS_IMMUTABLE
+  public class Set<T>
+  {
+    HashSet<T> set;
+    Set(HashSet<T> s) {
+      this.set = s;
+    }
     public static Set<T> Empty {
       get {
-        return new Set<T>(new Dictionary<T, bool>(0));
+        return new Set<T>(new HashSet<T>());
       }
     }
     public static Set<T> FromElements(params T[] values) {
-      Dictionary<T, bool> d = new Dictionary<T, bool>(values.Length);
+      var s = new HashSet<T>();
       foreach (T t in values)
-        d[t] = true;
-      return new Set<T>(d);
+        s.Add(t);
+      return new Set<T>(s);
     }
     public static Set<T> FromCollection(ICollection<T> values) {
-      Dictionary<T, bool> d = new Dictionary<T, bool>();
+      HashSet<T> s = new HashSet<T>();
       foreach (T t in values)
-        d[t] = true;
-      return new Set<T>(d);
+        s.Add(t);
+      return new Set<T>(s);
     }
     public int Length {
-      get { return dict.Count; }
+      get { return this.set.Count; }
     }
     public long LongLength {
-      get { return dict.Count; }
+      get { return this.set.Count; }
     }
     public IEnumerable<T> Elements {
       get {
-        return dict.Keys;
+        return this.set;
       }
     }
     /// <summary>
@@ -47,36 +438,36 @@ namespace Dafny
       get {
         // Start by putting all set elements into a list
         var elmts = new List<T>();
-        elmts.AddRange(dict.Keys);
+        elmts.AddRange(this.set);
         var n = elmts.Count;
         var which = new bool[n];
-        var s = new Set<T>(new Dictionary<T, bool>(0));
+        var s = new Set<T>(new HashSet<T>());
         while (true) {
           yield return s;
           // "add 1" to "which", as if doing a carry chain.  For every digit changed, change the membership of the corresponding element in "s".
           int i = 0;
           for (; i < n && which[i]; i++) {
             which[i] = false;
-            s.dict.Remove(elmts[i]);
+            s.set.Remove(elmts[i]);
           }
           if (i == n) {
             // we have cycled through all the subsets
             break;
           }
           which[i] = true;
-          s.dict.Add(elmts[i], true);
+          s.set.Add(elmts[i]);
         }
       }
     }
     public bool Equals(Set<T> other) {
-      return dict.Count == other.dict.Count && IsSubsetOf(other);
+      return this.set.Count == other.set.Count && IsSubsetOf(other);
     }
     public override bool Equals(object other) {
       return other is Set<T> && Equals((Set<T>)other);
     }
     public override int GetHashCode() {
       var hashCode = 1;
-      foreach (var t in dict.Keys) {
+      foreach (var t in this.set) {
         hashCode = hashCode * (t.GetHashCode()+3);
       }
       return hashCode;
@@ -84,20 +475,20 @@ namespace Dafny
     public override string ToString() {
       var s = "{";
       var sep = "";
-      foreach (var t in dict.Keys) {
+      foreach (var t in this.set) {
         s += sep + t.ToString();
         sep = ", ";
       }
       return s + "}";
     }
     public bool IsProperSubsetOf(Set<T> other) {
-      return dict.Count < other.dict.Count && IsSubsetOf(other);
+      return this.set.Count < other.set.Count && IsSubsetOf(other);
     }
     public bool IsSubsetOf(Set<T> other) {
-      if (other.dict.Count < dict.Count)
+      if (other.set.Count < this.set.Count)
         return false;
-      foreach (T t in dict.Keys) {
-        if (!other.dict.ContainsKey(t))
+      foreach (T t in this.set) {
+        if (!other.set.Contains(t))
           return false;
       }
       return true;
@@ -109,66 +500,66 @@ namespace Dafny
       return other.IsProperSubsetOf(this);
     }
     public bool IsDisjointFrom(Set<T> other) {
-      Dictionary<T, bool> a, b;
-      if (dict.Count < other.dict.Count) {
-        a = dict; b = other.dict;
+      HashSet<T> a, b;
+      if (this.set.Count < other.set.Count) {
+        a = this.set; b = other.set;
       } else {
-        a = other.dict; b = dict;
+        a = other.set; b = this.set;
       }
-      foreach (T t in a.Keys) {
-        if (b.ContainsKey(t))
+      foreach (T t in a) {
+        if (b.Contains(t))
           return false;
       }
       return true;
     }
     public bool Contains(T t) {
-      return dict.ContainsKey(t);
+      return this.set.Contains(t);
     }
     public Set<T> Union(Set<T> other) {
-      if (dict.Count == 0)
+      if (this.set.Count == 0)
         return other;
-      else if (other.dict.Count == 0)
+      else if (other.set.Count == 0)
         return this;
-      Dictionary<T, bool> a, b;
-      if (dict.Count < other.dict.Count) {
-        a = dict; b = other.dict;
+      HashSet<T> a, b;
+      if (this.set.Count < other.set.Count) {
+        a = this.set; b = other.set;
       } else {
-        a = other.dict; b = dict;
+        a = other.set; b = this.set;
       }
-      Dictionary<T, bool> r = new Dictionary<T, bool>();
-      foreach (T t in b.Keys)
-        r[t] = true;
-      foreach (T t in a.Keys)
-        r[t] = true;
+      var r = new HashSet<T>();
+      foreach (T t in b)
+        r.Add(t);
+      foreach (T t in a)
+        r.Add(t);
       return new Set<T>(r);
     }
     public Set<T> Intersect(Set<T> other) {
-      if (dict.Count == 0)
+      if (this.set.Count == 0)
         return this;
-      else if (other.dict.Count == 0)
+      else if (other.set.Count == 0)
         return other;
-      Dictionary<T, bool> a, b;
-      if (dict.Count < other.dict.Count) {
-        a = dict; b = other.dict;
+      HashSet<T> a, b;
+      if (this.set.Count < other.set.Count) {
+        a = this.set; b = other.set;
       } else {
-        a = other.dict; b = dict;
+        a = other.set; b = this.set;
       }
-      var r = new Dictionary<T, bool>();
-      foreach (T t in a.Keys) {
-        if (b.ContainsKey(t))
-          r.Add(t, true);
+      var r = new HashSet<T>();
+      foreach (T t in a) {
+        if (b.Contains(t))
+          r.Add(t);
       }
       return new Set<T>(r);
     }
     public Set<T> Difference(Set<T> other) {
-      if (dict.Count == 0)
+      if (this.set.Count == 0)
         return this;
-      else if (other.dict.Count == 0)
+      else if (other.set.Count == 0)
         return this;
-      var r = new Dictionary<T, bool>();
-      foreach (T t in dict.Keys) {
-        if (!other.dict.ContainsKey(t))
-          r.Add(t, true);
+      var r = new HashSet<T>();
+      foreach (T t in this.set) {
+        if (!other.set.Contains(t))
+          r.Add(t);
       }
       return new Set<T>(r);
     }
@@ -447,6 +838,7 @@ namespace Dafny
       }
     }
   }
+#endif
   public class Sequence<T>
   {
     T[] elmts;
diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index a6827d5f..125ab11e 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -55,6 +55,7 @@ namespace Microsoft.Dafny
     public bool ignoreAutoReq = false;
     public bool AllowGlobals = false;
     public bool CountVerificationErrors = true;
+    public bool Optimize = false;
 
     protected override bool ParseOption(string name, Bpl.CommandLineOptionEngine.CommandLineParseState ps) {
       var args = ps.args;  // convenient synonym
@@ -180,6 +181,11 @@ namespace Microsoft.Dafny
           return true;
         }
 
+        case "optimize": {
+            Optimize = true;
+            return true;
+        }
+
         default:
           break;
       }
@@ -270,6 +276,12 @@ namespace Microsoft.Dafny
                     of verification errors.
                 1 (default) - If preprocessing succeeds, set exit code to the number of
                               verification errors.
+  /optimize     Produce optimized C# code, meaning:
+                  - selects optimized C# prelude by passing 
+                    /define:DAFNY_USE_SYSTEM_COLLECTIONS_IMMUTABLE to csc.exe (requires 
+                    System.Collections.Immutable.dll in the source directory to successfully 
+                    compile).
+                  - passes /optimize flag to csc.exe.
 ");
       base.Usage();  // also print the Boogie options
     }
diff --git a/Source/DafnyDriver/DafnyDriver.cs b/Source/DafnyDriver/DafnyDriver.cs
index a769b829..cf464754 100644
--- a/Source/DafnyDriver/DafnyDriver.cs
+++ b/Source/DafnyDriver/DafnyDriver.cs
@@ -15,6 +15,8 @@ namespace Microsoft.Dafny
   using System.Collections.Generic;
   using System.Diagnostics.Contracts;
   using System.IO;
+  using System.Reflection;
+
   using Microsoft.Boogie;
   using Bpl = Microsoft.Boogie;
 
@@ -330,7 +332,7 @@ namespace Microsoft.Dafny
       }
       else
       {
-        var provider = CodeDomProvider.CreateProvider("CSharp");
+        var provider = CodeDomProvider.CreateProvider("CSharp", new Dictionary<string, string> { { "CompilerVersion", "v4.0" } });
         var cp = new System.CodeDom.Compiler.CompilerParameters();
         cp.GenerateExecutable = hasMain;
         if (DafnyOptions.O.RunAfterCompile) {
@@ -344,6 +346,15 @@ namespace Microsoft.Dafny
         }
         cp.CompilerOptions = "/debug /nowarn:0164 /nowarn:0219";  // warning CS0164 complains about unreferenced labels, CS0219 is about unused variables
         cp.ReferencedAssemblies.Add("System.Numerics.dll");
+        cp.ReferencedAssemblies.Add("System.Core.dll");
+        cp.ReferencedAssemblies.Add("System.dll");
+
+        if (DafnyOptions.O.Optimize) {
+          var libPath = Path.GetDirectoryName(dafnyProgramName);
+          cp.CompilerOptions += string.Format(" /optimize /define:DAFNY_USE_SYSTEM_COLLECTIONS_IMMUTABLE /lib:{0}", libPath);
+          cp.ReferencedAssemblies.Add("System.Collections.Immutable.dll");
+          cp.ReferencedAssemblies.Add("System.Runtime.dll");
+        }
 
         var cr = provider.CompileAssemblyFromSource(cp, csharpProgram);
         var assemblyName = Path.GetFileName(cr.PathToAssembly);
diff --git a/Test/irondafny0/optimize0.dfy b/Test/irondafny0/optimize0.dfy
new file mode 100644
index 00000000..865d8707
--- /dev/null
+++ b/Test/irondafny0/optimize0.dfy
@@ -0,0 +1,6 @@
+// RUN: %dafny /compile:3 /optimize /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+method Main() {
+    print "o hai!";
+}
diff --git a/Test/irondafny0/optimize0.dfy.expect b/Test/irondafny0/optimize0.dfy.expect
new file mode 100644
index 00000000..6b3e13c5
--- /dev/null
+++ b/Test/irondafny0/optimize0.dfy.expect
@@ -0,0 +1,6 @@
+
+Dafny program verifier finished with 2 verified, 0 errors
+Program compiled successfully
+Running...
+
+o hai!
\ No newline at end of file
-- 
cgit v1.2.3


From 03a8bdfce9713570fdb3fcc05a31c6a83e26afd8 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Fri, 12 Jun 2015 13:01:36 -0700
Subject: Combined some common routines into CheckWellformedAndAssume, which
 also allows an improvement of the generated Boogie (which will be especially
 good soon, when reads-clause checking may change)

---
 Source/Dafny/Translator.cs                    | 123 ++++++++++++++++++++++----
 Test/dafny0/Definedness.dfy.expect            |  10 +--
 Test/dafny0/FunctionSpecifications.dfy.expect |  16 ++--
 Test/dafny0/Reads.dfy.expect                  |  10 +--
 Test/dafny0/SmallTests.dfy.expect             |   4 +-
 Test/dafny0/Superposition.dfy.expect          |  10 +--
 6 files changed, 126 insertions(+), 47 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index e7a8bedf..992939ec 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -1608,8 +1608,7 @@ namespace Microsoft.Dafny {
       Bpl.StmtList stmts;
       // check well-formedness of the preconditions, and then assume each one of them
       foreach (var p in iter.Requires) {
-        CheckWellformed(p.E, new WFOptions(), localVariables, builder, etran);
-        builder.Add(new Bpl.AssumeCmd(p.E.tok, etran.TrExpr(p.E)));
+        CheckWellformedAndAssume(p.E, new WFOptions(), localVariables, builder, etran);
       }
       // check well-formedness of the modifies and reads clauses
       CheckFrameWellFormed(new WFOptions(), iter.Modifies.Expressions, localVariables, builder, etran);
@@ -1651,8 +1650,7 @@ namespace Microsoft.Dafny {
 
       // check well-formedness of the user-defined part of the yield-requires
       foreach (var p in iter.YieldRequires) {
-        CheckWellformed(p.E, new WFOptions(), localVariables, builder, etran);
-        builder.Add(new Bpl.AssumeCmd(p.E.tok, etran.TrExpr(p.E)));
+        CheckWellformedAndAssume(p.E, new WFOptions(), localVariables, builder, etran);
       }
 
       // save the heap (representing the state where yield-requires holds):  $_OldIterHeap := Heap;
@@ -1704,12 +1702,10 @@ namespace Microsoft.Dafny {
       }
 
       foreach (var p in iter.YieldEnsures) {
-        CheckWellformed(p.E, new WFOptions(), localVariables, yeBuilder, yeEtran);
-        yeBuilder.Add(new Bpl.AssumeCmd(p.E.tok, yeEtran.TrExpr(p.E)));
+        CheckWellformedAndAssume(p.E, new WFOptions(), localVariables, yeBuilder, yeEtran);
       }
       foreach (var p in iter.Ensures) {
-        CheckWellformed(p.E, new WFOptions(), localVariables, endBuilder, yeEtran);
-        endBuilder.Add(new Bpl.AssumeCmd(p.E.tok, yeEtran.TrExpr(p.E)));
+        CheckWellformedAndAssume(p.E, new WFOptions(), localVariables, endBuilder, yeEtran);
       }
       builder.Add(new Bpl.IfCmd(iter.tok, null, yeBuilder.Collect(iter.tok), null, endBuilder.Collect(iter.tok)));
 
@@ -2863,8 +2859,7 @@ namespace Microsoft.Dafny {
       } else {
         // check well-formedness of the preconditions, and then assume each one of them
         foreach (MaybeFreeExpression p in m.Req) {
-          CheckWellformed(p.E, new WFOptions(), localVariables, builder, etran);
-          builder.Add(new Bpl.AssumeCmd(p.E.tok, etran.TrExpr(p.E)));
+          CheckWellformedAndAssume(p.E, new WFOptions(), localVariables, builder, etran);
         }
         // check well-formedness of the modifies clause
         CheckFrameWellFormed(new WFOptions(), m.Mod.Expressions, localVariables, builder, etran);
@@ -2902,8 +2897,7 @@ namespace Microsoft.Dafny {
 
         // check wellformedness of postconditions
         foreach (MaybeFreeExpression p in m.Ens) {
-          CheckWellformed(p.E, new WFOptions(), localVariables, builder, etran);
-          builder.Add(new Bpl.AssumeCmd(p.E.tok, etran.TrExpr(p.E)));
+          CheckWellformedAndAssume(p.E, new WFOptions(), localVariables, builder, etran);
         }
 
         stmts = builder.Collect(m.tok);
@@ -4045,8 +4039,7 @@ namespace Microsoft.Dafny {
       }
 
       foreach (Expression p in f.Req) {
-        CheckWellformed(p, new WFOptions(null, true /* do reads checks */), locals, builder, etran);
-        builder.Add(new Bpl.AssumeCmd(p.tok, etran.TrExpr(p)));
+        CheckWellformedAndAssume(p, new WFOptions(null, true /* do reads checks */), locals, builder, etran);
       }
 
       // check well-formedness of the decreases clauses (including termination, but no reads checks)
@@ -4090,9 +4083,8 @@ namespace Microsoft.Dafny {
       }
       // Now for the ensures clauses
       foreach (Expression p in f.Ens) {
-        CheckWellformed(p, new WFOptions(f, false), locals, postCheckBuilder, etran);
         // assume the postcondition for the benefit of checking the remaining postconditions
-        postCheckBuilder.Add(new Bpl.AssumeCmd(p.tok, etran.TrExpr(p)));
+        CheckWellformedAndAssume(p, new WFOptions(f, false), locals, postCheckBuilder, etran);
       }
       // Here goes the body (and include both termination checks and reads checks)
       StmtListBuilder bodyCheckBuilder = new StmtListBuilder();
@@ -4658,7 +4650,106 @@ namespace Microsoft.Dafny {
       builder.Add(new Bpl.AssumeCmd(expr.tok, CanCallAssumption(expr, etran)));
     }
 
+    void CheckWellformedAndAssume(Expression expr, WFOptions options, List<Variable> locals, Bpl.StmtListBuilder builder, ExpressionTranslator etran) {
+      Contract.Requires(expr != null);
+      Contract.Requires(expr.Type != null && expr.Type.IsBoolType);
+      Contract.Requires(options != null);
+      Contract.Requires(locals != null);
+      Contract.Requires(builder != null);
+      Contract.Requires(etran != null);
+      Contract.Requires(predef != null);
+      if (expr is BinaryExpr) {
+        var e = (BinaryExpr)expr;
+        switch (e.ResolvedOp) {
+          case BinaryExpr.ResolvedOpcode.And:
+            // WF[e0]; assume e0; WF[e1]; assume e1;
+            CheckWellformedAndAssume(e.E0, options, locals, builder, etran);
+            CheckWellformedAndAssume(e.E1, options, locals, builder, etran);
+            return;
+          case BinaryExpr.ResolvedOpcode.Imp: {
+              // if (*) {
+              //   WF[e0]; assume e0; WF[e1]; assume e1;
+              // } else {
+              //   assume e0 ==> e1;
+              // }
+              var bAnd = new Bpl.StmtListBuilder();
+              CheckWellformedAndAssume(e.E0, options, locals, bAnd, etran);
+              CheckWellformedAndAssume(e.E1, options, locals, bAnd, etran);
+              var bImp = new Bpl.StmtListBuilder();
+              bImp.Add(new Bpl.AssumeCmd(expr.tok, etran.TrExpr(expr)));
+              builder.Add(new Bpl.IfCmd(expr.tok, null, bAnd.Collect(expr.tok), null, bImp.Collect(expr.tok)));
+            }
+            return;
+          case BinaryExpr.ResolvedOpcode.Or: {
+              // if (*) {
+              //   WF[e0]; assume e0;
+              // } else {
+              //   assume !e0;
+              //   WF[e1]; assume e1;
+              // }
+              var b0 = new Bpl.StmtListBuilder();
+              CheckWellformedAndAssume(e.E0, options, locals, b0, etran);
+              var b1 = new Bpl.StmtListBuilder();
+              b1.Add(new Bpl.AssumeCmd(expr.tok, Bpl.Expr.Not(etran.TrExpr(e.E0))));
+              CheckWellformedAndAssume(e.E1, options, locals, b1, etran);
+              builder.Add(new Bpl.IfCmd(expr.tok, null, b0.Collect(expr.tok), null, b1.Collect(expr.tok)));
+            }
+            return;
+          default:
+            break;
+        }
+      } else if (expr is ITEExpr) {
+        var e = (ITEExpr)expr;
+        // if (*) {
+        //   WF[test]; assume test;
+        //   WF[thn]; assume thn;
+        // } else {
+        //   assume !test;
+        //   WF[els]; assume els;
+        // }
+        var bThn = new Bpl.StmtListBuilder();
+        CheckWellformedAndAssume(e.Test, options, locals, bThn, etran);
+        CheckWellformedAndAssume(e.Thn, options, locals, bThn, etran);
+        var bEls = new Bpl.StmtListBuilder();
+        bEls.Add(new Bpl.AssumeCmd(expr.tok, Bpl.Expr.Not(etran.TrExpr(e.Test))));
+        CheckWellformedAndAssume(e.Els, options, locals, bEls, etran);
+        builder.Add(new Bpl.IfCmd(expr.tok, null, bThn.Collect(expr.tok), null, bEls.Collect(expr.tok)));
+        return;
+      } else if (expr is QuantifierExpr) {
+        var e = (QuantifierExpr)expr;
+        // For (Q x :: body(x)), introduce fresh local variable x'.  Then:
+        //   havoc x'
+        //   WF[body(x')]; assume body(x');
+        // If the quantifier is universal, then continue as:
+        //   assume (\forall x :: body(x));
+        var typeMap = new Dictionary<TypeParameter, Type>();
+        var copies = new List<TypeParameter>();
+        copies = Map(e.TypeArgs, tp => e.Refresh(tp, CurrentIdGenerator));
+        typeMap = Util.Dict(e.TypeArgs, Map(copies, tp => (Type)new UserDefinedType(tp)));
+        var newLocals = Map(copies, tp => new Bpl.LocalVariable(tp.tok, new TypedIdent(tp.tok, nameTypeParam(tp), predef.Ty)));
+        locals.AddRange(newLocals);
+        var substMap = SetupBoundVarsAsLocals(e.BoundVars, builder, locals, etran, typeMap);  // ??
+        var s = new Substituter(null, substMap, typeMap, this);
+        var body = Substitute(e.LogicalBody(), null, substMap, typeMap);
+        builder.Add(new Bpl.HavocCmd(expr.tok, newLocals.ConvertAll(v => new Bpl.IdentifierExpr(v.tok, v))));
+        CheckWellformedAndAssume(body, options, locals, builder, etran);
+        if (e is ForallExpr) {
+          builder.Add(new Bpl.AssumeCmd(expr.tok, etran.TrExpr(expr)));
+        }
+        return;
+      }
+      // resort to the behavior of simply checking well-formedness followed by assuming the translated expression
+      CheckWellformedWithResult(expr, options, null, null, locals, builder, etran);
+      builder.Add(new Bpl.AssumeCmd(expr.tok, etran.TrExpr(expr)));
+    }
+
     void CheckWellformed(Expression expr, WFOptions options, List<Variable> locals, Bpl.StmtListBuilder builder, ExpressionTranslator etran) {
+      Contract.Requires(expr != null);
+      Contract.Requires(options != null);
+      Contract.Requires(locals != null);
+      Contract.Requires(builder != null);
+      Contract.Requires(etran != null);
+      Contract.Requires(predef != null);
       CheckWellformedWithResult(expr, options, null, null, locals, builder, etran);
     }
 
diff --git a/Test/dafny0/Definedness.dfy.expect b/Test/dafny0/Definedness.dfy.expect
index 41073c0e..5d823616 100644
--- a/Test/dafny0/Definedness.dfy.expect
+++ b/Test/dafny0/Definedness.dfy.expect
@@ -161,19 +161,15 @@ Definedness.dfy(215,10): Error BP5003: A postcondition might not hold on this re
 Definedness.dfy(217,46): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
+    (0,0): anon3_Else
 Definedness.dfy(224,22): Error: target object may be null
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Then
-    (0,0): anon2
-    (0,0): anon6_Then
+    (0,0): anon3_Then
 Definedness.dfy(237,10): Error BP5003: A postcondition might not hold on this return path.
 Definedness.dfy(240,24): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon7_Then
-    (0,0): anon2
-    (0,0): anon8_Else
+    (0,0): anon3_Else
 
 Dafny program verifier finished with 21 verified, 37 errors
diff --git a/Test/dafny0/FunctionSpecifications.dfy.expect b/Test/dafny0/FunctionSpecifications.dfy.expect
index 4b9aa202..f5112bfe 100644
--- a/Test/dafny0/FunctionSpecifications.dfy.expect
+++ b/Test/dafny0/FunctionSpecifications.dfy.expect
@@ -10,19 +10,19 @@ FunctionSpecifications.dfy(45,3): Error BP5003: A postcondition might not hold o
 FunctionSpecifications.dfy(40,24): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon11_Else
-    (0,0): anon14_Else
-    (0,0): anon15_Then
+    (0,0): anon13_Else
+    (0,0): anon16_Else
+    (0,0): anon17_Then
 FunctionSpecifications.dfy(53,11): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon8_Then
-    (0,0): anon3
+    (0,0): anon9_Then
+    (0,0): anon4
 FunctionSpecifications.dfy(59,10): Error BP5003: A postcondition might not hold on this return path.
 FunctionSpecifications.dfy(60,22): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
+    (0,0): anon6_Else
 FunctionSpecifications.dfy(108,23): Error: assertion violation
 Execution trace:
     (0,0): anon0
@@ -49,9 +49,7 @@ FunctionSpecifications.dfy(135,20): Error BP5003: A postcondition might not hold
 FunctionSpecifications.dfy(137,29): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Then
-    (0,0): anon2
-    (0,0): anon6_Else
+    (0,0): anon3_Else
 FunctionSpecifications.dfy(146,3): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/Reads.dfy.expect b/Test/dafny0/Reads.dfy.expect
index 090cf99d..1cd17d16 100644
--- a/Test/dafny0/Reads.dfy.expect
+++ b/Test/dafny0/Reads.dfy.expect
@@ -1,22 +1,18 @@
 Reads.dfy(9,30): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Then
 Reads.dfy(18,30): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
-    (0,0): anon11_Then
-    (0,0): anon12_Then
+    (0,0): anon9_Then
+    (0,0): anon3
 Reads.dfy(28,50): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
-    (0,0): anon7_Then
-    (0,0): anon8_Then
 Reads.dfy(37,43): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
-    (0,0): anon7_Then
-    (0,0): anon8_Then
+    (0,0): anon6_Then
 Reads.dfy(51,30): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/SmallTests.dfy.expect b/Test/dafny0/SmallTests.dfy.expect
index 0a274281..b475502a 100644
--- a/Test/dafny0/SmallTests.dfy.expect
+++ b/Test/dafny0/SmallTests.dfy.expect
@@ -9,15 +9,13 @@ SmallTests.dfy(66,51): Error: possible division by zero
 Execution trace:
     (0,0): anon0
     (0,0): anon12_Else
-    (0,0): anon3
     (0,0): anon13_Else
 SmallTests.dfy(67,22): Error: target object may be null
 Execution trace:
     (0,0): anon0
     (0,0): anon12_Then
-    (0,0): anon3
     (0,0): anon13_Then
-    (0,0): anon6
+    (0,0): anon14_Then
 SmallTests.dfy(86,24): Error: target object may be null
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/Superposition.dfy.expect b/Test/dafny0/Superposition.dfy.expect
index 4b8e354f..eccb16b0 100644
--- a/Test/dafny0/Superposition.dfy.expect
+++ b/Test/dafny0/Superposition.dfy.expect
@@ -14,7 +14,7 @@ Superposition.dfy(27,15): Error BP5003: A postcondition might not hold on this r
 Superposition.dfy(28,26): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
+    (0,0): anon6_Else
 
 Verifying CheckWellformed$$_0_M0.C.R ...
   [5 proof obligations]  error
@@ -22,7 +22,7 @@ Superposition.dfy(33,15): Error BP5003: A postcondition might not hold on this r
 Superposition.dfy(34,26): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
+    (0,0): anon6_Else
 
 Verifying CheckWellformed$$_1_M1.C.M ...
   [0 proof obligations]  verified
@@ -36,9 +36,9 @@ Superposition.dfy(50,25): Error BP5003: A postcondition might not hold on this r
 Superposition.dfy[M1](22,26): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon7_Else
-    (0,0): anon9_Then
-    (0,0): anon6
+    (0,0): anon8_Else
+    (0,0): anon10_Then
+    (0,0): anon7
 
 Verifying CheckWellformed$$_1_M1.C.Q ...
   [0 proof obligations]  verified
-- 
cgit v1.2.3


From e054e59a6deda9793b66cf78374b75f7d557bef8 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 12 Jun 2015 14:28:42 -0700
Subject: Fix a bug spotted by Chris in my BigInteger patch; thanks!

The problem was this:
  Console.WriteLine(Int64.Parse("08000000000000000", NumberStyles.HexNumber));
  // => -9223372036854775808
  Console.WriteLine(Int64.Parse("9223372036854775808"));
  // => Value was either too large or too small for an Int64.

In other words, large hex numbers are interpreted as a sequence of bits, not as
an actual number.
---
 Source/Dafny/BigIntegerParser.cs      |  4 ++--
 Test/dafny4/LargeConstants.dfy        | 14 ++++++++++++++
 Test/dafny4/LargeConstants.dfy.expect |  2 ++
 3 files changed, 18 insertions(+), 2 deletions(-)
 create mode 100644 Test/dafny4/LargeConstants.dfy
 create mode 100644 Test/dafny4/LargeConstants.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/BigIntegerParser.cs b/Source/Dafny/BigIntegerParser.cs
index 94e842cc..cd2cf314 100644
--- a/Source/Dafny/BigIntegerParser.cs
+++ b/Source/Dafny/BigIntegerParser.cs
@@ -11,8 +11,8 @@ namespace Microsoft.Dafny {
         ///   Int64, and only falling back if needed.
         /// </summary>
         internal static BigInteger Parse(string str, NumberStyles style) {
-            Int64 parsed;
-            if (Int64.TryParse(str, style, NumberFormatInfo.CurrentInfo, out parsed)) {
+            UInt64 parsed;
+            if (UInt64.TryParse(str, style, NumberFormatInfo.CurrentInfo, out parsed)) {
                 return new BigInteger(parsed);
             } else {
                 // Throws on Mono 3.2.8
diff --git a/Test/dafny4/LargeConstants.dfy b/Test/dafny4/LargeConstants.dfy
new file mode 100644
index 00000000..18435c30
--- /dev/null
+++ b/Test/dafny4/LargeConstants.dfy
@@ -0,0 +1,14 @@
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+lemma largeIsLarge()
+  ensures 0x8000000000000000 > 0 {
+}
+
+lemma SmallIsSmall()
+  ensures -0x8000000000000000 < 0 {
+}
+
+lemma ShouldCancelOut()
+  ensures -0x8000000000000000 + 0x8000000000000000 == 0 {
+}
diff --git a/Test/dafny4/LargeConstants.dfy.expect b/Test/dafny4/LargeConstants.dfy.expect
new file mode 100644
index 00000000..4ef2de53
--- /dev/null
+++ b/Test/dafny4/LargeConstants.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 6 verified, 0 errors
-- 
cgit v1.2.3


From 9a105ad12e6487725a90a6401478bd9ab8b905b0 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Fri, 12 Jun 2015 19:22:06 -0700
Subject: Little edits in new CheckWellformedAndAssume code

---
 Source/Dafny/Translator.cs | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 992939ec..e93e91df 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -4722,16 +4722,15 @@ namespace Microsoft.Dafny {
         //   WF[body(x')]; assume body(x');
         // If the quantifier is universal, then continue as:
         //   assume (\forall x :: body(x));
-        var typeMap = new Dictionary<TypeParameter, Type>();
-        var copies = new List<TypeParameter>();
-        copies = Map(e.TypeArgs, tp => e.Refresh(tp, CurrentIdGenerator));
-        typeMap = Util.Dict(e.TypeArgs, Map(copies, tp => (Type)new UserDefinedType(tp)));
-        var newLocals = Map(copies, tp => new Bpl.LocalVariable(tp.tok, new TypedIdent(tp.tok, nameTypeParam(tp), predef.Ty)));
+        // Create local variables corresponding to the type arguments:
+        var typeArgumentCopies = Map(e.TypeArgs, tp => e.Refresh(tp, CurrentIdGenerator));
+        var typeMap = Util.Dict(e.TypeArgs, Map(typeArgumentCopies, tp => (Type)new UserDefinedType(tp)));
+        var newLocals = Map(typeArgumentCopies, tp => new Bpl.LocalVariable(tp.tok, new TypedIdent(tp.tok, nameTypeParam(tp), predef.Ty)));
         locals.AddRange(newLocals);
-        var substMap = SetupBoundVarsAsLocals(e.BoundVars, builder, locals, etran, typeMap);  // ??
-        var s = new Substituter(null, substMap, typeMap, this);
+        // Create local variables corresponding to the in-parameters:
+        var substMap = SetupBoundVarsAsLocals(e.BoundVars, builder, locals, etran, typeMap);
+        // Get the body of the quantifier and suitably substitute for the type variables and bound variables
         var body = Substitute(e.LogicalBody(), null, substMap, typeMap);
-        builder.Add(new Bpl.HavocCmd(expr.tok, newLocals.ConvertAll(v => new Bpl.IdentifierExpr(v.tok, v))));
         CheckWellformedAndAssume(body, options, locals, builder, etran);
         if (e is ForallExpr) {
           builder.Add(new Bpl.AssumeCmd(expr.tok, etran.TrExpr(expr)));
-- 
cgit v1.2.3


From 2edb5e1ba0f8c9c79364d0f0415713f0ddfdeadd Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Mon, 15 Jun 2015 15:04:18 -0700
Subject: Postpone reads checks of function preconditions until after the
 entire precondition has otherwise been checked for well-formedness

---
 Source/Dafny/Translator.cs                    | 70 +++++++++++++++------------
 Test/dafny0/Array.dfy.expect                  | 30 ++++++------
 Test/dafny0/AutoReq.dfy.expect                |  6 +--
 Test/dafny0/Backticks.dfy.expect              |  2 +-
 Test/dafny0/BadFunction.dfy.expect            |  2 +-
 Test/dafny0/ComputationsLoop.dfy.expect       |  2 +-
 Test/dafny0/ComputationsLoop2.dfy.expect      |  4 +-
 Test/dafny0/ComputationsNeg.dfy.expect        |  2 +-
 Test/dafny0/ControlStructures.dfy.expect      |  4 +-
 Test/dafny0/Corecursion.dfy.expect            | 20 ++++----
 Test/dafny0/Datatypes.dfy.expect              | 20 ++++----
 Test/dafny0/Definedness.dfy.expect            |  8 +--
 Test/dafny0/DeterministicPick.dfy.expect      |  2 +-
 Test/dafny0/FunctionSpecifications.dfy.expect | 30 ++++++------
 Test/dafny0/Include.dfy.expect                |  2 +-
 Test/dafny0/LetExpr.dfy.expect                |  4 +-
 Test/dafny0/NatTypes.dfy.expect               |  6 +--
 Test/dafny0/PredExpr.dfy.expect               |  4 +-
 Test/dafny0/RankNeg.dfy.expect                | 16 +++---
 Test/dafny0/Reads.dfy                         |  4 +-
 Test/dafny0/Reads.dfy.expect                  | 19 +++-----
 Test/dafny0/Refinement.dfy.expect             |  2 +-
 Test/dafny0/SmallTests.dfy.expect             | 12 ++---
 Test/dafny0/StatementExpressions.dfy.expect   |  4 +-
 Test/dafny0/Superposition.dfy.expect          | 10 ++--
 Test/dafny0/Termination.dfy.expect            | 10 ++--
 Test/hofs/Classes.dfy.expect                  |  6 +--
 Test/hofs/Naked.dfy.expect                    | 14 +++---
 Test/hofs/ReadsReads.dfy.expect               |  8 +--
 Test/hofs/Simple.dfy.expect                   |  8 +--
 Test/hofs/Twice.dfy.expect                    |  4 +-
 31 files changed, 170 insertions(+), 165 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index e93e91df..c4bc6cdd 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -4021,6 +4021,7 @@ namespace Microsoft.Dafny {
       var implInParams = Bpl.Formal.StripWhereClauses(inParams);
       var locals = new List<Variable>();
       var builder = new Bpl.StmtListBuilder();
+      var builderInitializationArea = new Bpl.StmtListBuilder();
       builder.Add(new CommentCmd("AddWellformednessCheck for function " + f));
       builder.Add(CaptureState(f.tok, false, "initial state"));
 
@@ -4028,19 +4029,17 @@ namespace Microsoft.Dafny {
 
       // check well-formedness of the preconditions (including termination, and reads checks), and then
       // assume each one of them
-      var wfo = new WFOptions(null, true, true /* do delayed reads checks over requires */);
 
       // check well-formedness of the reads clause
+      var wfo = new WFOptions(null, true, true /* do delayed reads checks over requires */);
       CheckFrameWellFormed(wfo, f.Reads, locals, builder, etran);
+      wfo.ProcessSavedReadsChecks(locals, builderInitializationArea, builder);
 
-      // check the reads of the preconditions now
-      foreach (var a in wfo.Asserts) {
-        builder.Add(a);
-      }
-
+      wfo = new WFOptions(null, true, true /* do delayed reads checks */);
       foreach (Expression p in f.Req) {
-        CheckWellformedAndAssume(p, new WFOptions(null, true /* do reads checks */), locals, builder, etran);
+        CheckWellformedAndAssume(p, wfo, locals, builder, etran);
       }
+      wfo.ProcessSavedReadsChecks(locals, builderInitializationArea, builder);
 
       // check well-formedness of the decreases clauses (including termination, but no reads checks)
       foreach (Expression p in f.Decreases.Expressions)
@@ -4119,16 +4118,12 @@ namespace Microsoft.Dafny {
       postCheckBuilder.Add(new Bpl.AssumeCmd(f.tok, Bpl.Expr.False));
       builder.Add(new Bpl.IfCmd(f.tok, null, postCheckBuilder.Collect(f.tok), null, bodyCheckBuilder.Collect(f.tok)));
 
-      // var b$reads_guards_requires#0 : bool
-      locals.AddRange(wfo.Locals);
-      // This ugly way seems to be the way to add things at the start of a builder:
-      StmtList sl = builder.Collect(f.tok);
-      // b$reads_guards_requires#0 := true   ...
-      sl.BigBlocks[0].simpleCmds.InsertRange(0, wfo.AssignLocals);
-
+      var s0 = builderInitializationArea.Collect(f.tok);
+      var s1 = builder.Collect(f.tok);
+      var implBody = new StmtList(new List<BigBlock>(s0.BigBlocks.Concat(s1.BigBlocks)), f.tok);
       Bpl.Implementation impl = new Bpl.Implementation(f.tok, proc.Name,
         typeParams, Concat(typeInParams, implInParams), new List<Variable>(),
-        locals, sl, etran.TrAttributes(f.Attributes, null));
+        locals, implBody, etran.TrAttributes(f.Attributes, null));
       sink.AddTopLevelDeclaration(impl);
 
       if (InsertChecksums)
@@ -4582,7 +4577,11 @@ namespace Microsoft.Dafny {
     /// like it.  This is useful in function postconditions, where the result of the function is
     /// syntactically given as what looks like a recursive call with the same arguments.
     /// "DoReadsChecks" indicates whether or not to perform reads checks.  If so, the generated code
-    /// will make references to $_Frame.
+    /// will make references to $_Frame.  If "saveReadsChecks" is true, then the reads checks will
+    /// be recorded but postponsed.  In particular, CheckWellformed will append to .Locals a list of
+    /// fresh local variables and will append to .Assert assertions with appropriate error messages
+    /// that can be used later.  As a convenience, the ProcessSavedReadsChecks will make use of .Locals
+    /// and .Asserts (and AssignLocals) and update a given StmtListBuilder.
     /// </summary>
     private class WFOptions
     {
@@ -4596,6 +4595,7 @@ namespace Microsoft.Dafny {
       }
 
       public WFOptions(Function selfCallsAllowance, bool doReadsChecks, bool saveReadsChecks = false) {
+        Contract.Requires(!saveReadsChecks || doReadsChecks);  // i.e., saveReadsChecks ==> doReadsChecks
         SelfCallsAllowance = selfCallsAllowance;
         DoReadsChecks = doReadsChecks;
         if (saveReadsChecks) {
@@ -4629,6 +4629,24 @@ namespace Microsoft.Dafny {
             );
         }
       }
+
+      public void ProcessSavedReadsChecks(List<Variable> locals, StmtListBuilder builderInitializationArea, StmtListBuilder builder) {
+        Contract.Requires(locals != null);
+        Contract.Requires(builderInitializationArea != null);
+        Contract.Requires(builder != null);
+        Contract.Requires(Locals != null && Asserts != null);  // ProcessSavedReadsChecks should be called only if the constructor was called with saveReadsChecks
+
+        // var b$reads_guards#0 : bool  ...
+        locals.AddRange(Locals);
+        // b$reads_guards#0 := true   ...
+        foreach (var cmd in AssignLocals) {
+          builderInitializationArea.Add(cmd);
+        }
+        // assert b$reads_guards#0;  ...
+        foreach (var a in Asserts) {
+          builder.Add(a);
+        }
+      }
     }
 
     void TrStmt_CheckWellformed(Expression expr, Bpl.StmtListBuilder builder, List<Variable> locals, ExpressionTranslator etran, bool subsumption) {
@@ -4636,6 +4654,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(builder != null);
       Contract.Requires(locals != null);
       Contract.Requires(etran != null);
+      Contract.Requires(predef != null);
 
       Bpl.QKeyValue kv;
       if (subsumption) {
@@ -4738,10 +4757,13 @@ namespace Microsoft.Dafny {
         return;
       }
       // resort to the behavior of simply checking well-formedness followed by assuming the translated expression
-      CheckWellformedWithResult(expr, options, null, null, locals, builder, etran);
+      CheckWellformed(expr, options, locals, builder, etran);
       builder.Add(new Bpl.AssumeCmd(expr.tok, etran.TrExpr(expr)));
     }
 
+    /// <summary>
+    /// Check the well-formedness of "expr" (but don't leave hanging around any assumptions that affect control flow)
+    /// </summary>
     void CheckWellformed(Expression expr, WFOptions options, List<Variable> locals, Bpl.StmtListBuilder builder, ExpressionTranslator etran) {
       Contract.Requires(expr != null);
       Contract.Requires(options != null);
@@ -5292,21 +5314,9 @@ namespace Microsoft.Dafny {
 
             // Check frame WF and that it read covers itself
             newOptions = new WFOptions(options.SelfCallsAllowance, true /* check reads clauses */, true /* delay reads checks */);
-
             CheckFrameWellFormed(newOptions, reads, locals, newBuilder, newEtran);
-
             // new options now contains the delayed reads checks
-            locals.AddRange(newOptions.Locals);
-            // assign locals to true, but at a scope above
-            Contract.Assert(newBuilder != builder);
-            foreach (var a in newOptions.AssignLocals) {
-              builder.Add(a);
-            }
-
-            // add asserts to the current builder (right after frame WF)
-            foreach (var a in newOptions.Asserts) {
-              newBuilder.Add(a);
-            }
+            newOptions.ProcessSavedReadsChecks(locals, builder, newBuilder);
 
             // continue doing reads checks, but don't delay them
             newOptions = new WFOptions(options.SelfCallsAllowance, true, false);
diff --git a/Test/dafny0/Array.dfy.expect b/Test/dafny0/Array.dfy.expect
index bf4da25f..ff05137b 100644
--- a/Test/dafny0/Array.dfy.expect
+++ b/Test/dafny0/Array.dfy.expect
@@ -44,43 +44,43 @@ Execution trace:
 Array.dfy(120,8): Error: insufficient reads clause to read the indicated range of array elements
 Execution trace:
     (0,0): anon0
-    (0,0): anon9_Else
-    (0,0): anon10_Then
+    (0,0): anon10_Else
     (0,0): anon11_Then
     (0,0): anon12_Then
+    (0,0): anon13_Then
 Array.dfy(122,8): Error: insufficient reads clause to read the indicated range of array elements
 Execution trace:
     (0,0): anon0
-    (0,0): anon9_Else
-    (0,0): anon10_Then
+    (0,0): anon10_Else
     (0,0): anon11_Then
-    (0,0): anon12_Else
+    (0,0): anon12_Then
+    (0,0): anon13_Else
 Array.dfy(123,8): Error: insufficient reads clause to read the indicated range of array elements
 Execution trace:
     (0,0): anon0
-    (0,0): anon9_Else
-    (0,0): anon10_Then
+    (0,0): anon10_Else
     (0,0): anon11_Then
-    (0,0): anon12_Else
+    (0,0): anon12_Then
+    (0,0): anon13_Else
 Array.dfy(124,8): Error: insufficient reads clause to read the indicated range of array elements
 Execution trace:
     (0,0): anon0
-    (0,0): anon9_Else
-    (0,0): anon10_Then
+    (0,0): anon10_Else
     (0,0): anon11_Then
-    (0,0): anon12_Else
+    (0,0): anon12_Then
+    (0,0): anon13_Else
 Array.dfy(163,6): Error: insufficient reads clause to read array element
 Execution trace:
     (0,0): anon0
-    (0,0): anon7_Else
-    (0,0): anon8_Then
+    (0,0): anon8_Else
     (0,0): anon9_Then
+    (0,0): anon10_Then
 Array.dfy(171,6): Error: insufficient reads clause to read array element
 Execution trace:
     (0,0): anon0
-    (0,0): anon7_Else
-    (0,0): anon8_Then
+    (0,0): anon8_Else
     (0,0): anon9_Then
+    (0,0): anon10_Then
 Array.dfy(187,6): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/AutoReq.dfy.expect b/Test/dafny0/AutoReq.dfy.expect
index 547b676d..8486716d 100644
--- a/Test/dafny0/AutoReq.dfy.expect
+++ b/Test/dafny0/AutoReq.dfy.expect
@@ -2,17 +2,17 @@ AutoReq.dfy(247,5): Error: possible violation of function precondition
 AutoReq.dfy(239,14): Related location
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 AutoReq.dfy(13,3): Error: possible violation of function precondition
 AutoReq.dfy(5,14): Related location
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 AutoReq.dfy(25,3): Error: possible violation of function precondition
 AutoReq.dfy(5,14): Related location
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 AutoReq.dfy(38,12): Error: assertion violation
 AutoReq.dfy(31,13): Related location
 AutoReq.dfy(7,5): Related location
diff --git a/Test/dafny0/Backticks.dfy.expect b/Test/dafny0/Backticks.dfy.expect
index ab2bbc52..6657cd8c 100644
--- a/Test/dafny0/Backticks.dfy.expect
+++ b/Test/dafny0/Backticks.dfy.expect
@@ -1,8 +1,8 @@
 Backticks.dfy(38,5): Error: insufficient reads clause to invoke function
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
     (0,0): anon6_Else
+    (0,0): anon7_Else
 Backticks.dfy(77,8): Error: call may violate context's modifies clause
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/BadFunction.dfy.expect b/Test/dafny0/BadFunction.dfy.expect
index 7127b60b..9c4ae81d 100644
--- a/Test/dafny0/BadFunction.dfy.expect
+++ b/Test/dafny0/BadFunction.dfy.expect
@@ -1,6 +1,6 @@
 BadFunction.dfy(9,3): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 
 Dafny program verifier finished with 2 verified, 1 error
diff --git a/Test/dafny0/ComputationsLoop.dfy.expect b/Test/dafny0/ComputationsLoop.dfy.expect
index d9d48024..91dc2af9 100644
--- a/Test/dafny0/ComputationsLoop.dfy.expect
+++ b/Test/dafny0/ComputationsLoop.dfy.expect
@@ -1,7 +1,7 @@
 ComputationsLoop.dfy(7,3): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 ComputationsLoop.dfy(12,26): Error: assertion violation
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/ComputationsLoop2.dfy.expect b/Test/dafny0/ComputationsLoop2.dfy.expect
index 0a45e6d0..816cbd31 100644
--- a/Test/dafny0/ComputationsLoop2.dfy.expect
+++ b/Test/dafny0/ComputationsLoop2.dfy.expect
@@ -1,11 +1,11 @@
 ComputationsLoop2.dfy(6,3): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 ComputationsLoop2.dfy(11,3): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 ComputationsLoop2.dfy(16,26): Error: assertion violation
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/ComputationsNeg.dfy.expect b/Test/dafny0/ComputationsNeg.dfy.expect
index 16c8963f..a6318087 100644
--- a/Test/dafny0/ComputationsNeg.dfy.expect
+++ b/Test/dafny0/ComputationsNeg.dfy.expect
@@ -1,7 +1,7 @@
 ComputationsNeg.dfy(7,3): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 ComputationsNeg.dfy(11,1): Error BP5003: A postcondition might not hold on this return path.
 ComputationsNeg.dfy(10,17): Related location: This is the postcondition that might not hold.
 Execution trace:
diff --git a/Test/dafny0/ControlStructures.dfy.expect b/Test/dafny0/ControlStructures.dfy.expect
index 43124912..3f4dce92 100644
--- a/Test/dafny0/ControlStructures.dfy.expect
+++ b/Test/dafny0/ControlStructures.dfy.expect
@@ -26,11 +26,11 @@ Execution trace:
 ControlStructures.dfy(54,3): Error: missing case in case statement: Red
 Execution trace:
     (0,0): anon0
-    (0,0): anon8_Else
     (0,0): anon9_Else
     (0,0): anon10_Else
     (0,0): anon11_Else
-    (0,0): anon12_Then
+    (0,0): anon12_Else
+    (0,0): anon13_Then
 ControlStructures.dfy(75,3): Error: alternative cases fail to cover all possibilties
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/Corecursion.dfy.expect b/Test/dafny0/Corecursion.dfy.expect
index e30f6f1a..62b67cc3 100644
--- a/Test/dafny0/Corecursion.dfy.expect
+++ b/Test/dafny0/Corecursion.dfy.expect
@@ -1,36 +1,36 @@
 Corecursion.dfy(17,13): Error: cannot prove termination; try supplying a decreases clause (note that only functions without side effects can be called co-recursively)
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 Corecursion.dfy(23,13): Error: cannot prove termination; try supplying a decreases clause (note that only functions without any ensures clause can be called co-recursively)
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 Corecursion.dfy(58,5): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 Corecursion.dfy(71,16): Error: cannot prove termination; try supplying a decreases clause (note that calls cannot be co-recursive in this context)
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
+    (0,0): anon6_Else
 Corecursion.dfy(93,15): Error: cannot prove termination; try supplying a decreases clause (note that a call can be co-recursive only if all intra-cluster calls are in non-destructive contexts)
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
-    (0,0): anon6_Then
+    (0,0): anon6_Else
+    (0,0): anon7_Then
 Corecursion.dfy(103,15): Error: cannot prove termination; try supplying a decreases clause (note that a call can be co-recursive only if all intra-cluster calls are in non-destructive contexts)
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
-    (0,0): anon6_Then
+    (0,0): anon6_Else
+    (0,0): anon7_Then
 Corecursion.dfy(148,13): Error: failure to decrease termination measure (note that a call can be co-recursive only if all intra-cluster calls are in non-destructive contexts)
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 Corecursion.dfy(161,13): Error: failure to decrease termination measure (note that a call can be co-recursive only if all intra-cluster calls are in non-destructive contexts)
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 
 Dafny program verifier finished with 20 verified, 8 errors
diff --git a/Test/dafny0/Datatypes.dfy.expect b/Test/dafny0/Datatypes.dfy.expect
index 874df45e..4c0b1e96 100644
--- a/Test/dafny0/Datatypes.dfy.expect
+++ b/Test/dafny0/Datatypes.dfy.expect
@@ -16,27 +16,27 @@ Execution trace:
 Datatypes.dfy(349,5): Error: missing case in case statement: Cons
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
-    (0,0): anon7_Then
+    (0,0): anon7_Else
+    (0,0): anon8_Then
 Datatypes.dfy(349,5): Error: missing case in case statement: Nil
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
     (0,0): anon7_Else
-    (0,0): anon8_Then
+    (0,0): anon8_Else
+    (0,0): anon9_Then
 Datatypes.dfy(356,8): Error: missing case in case statement: Cons
 Execution trace:
     (0,0): anon0
-    (0,0): anon9_Else
-    (0,0): anon10_Then
+    (0,0): anon10_Else
     (0,0): anon11_Then
+    (0,0): anon12_Then
 Datatypes.dfy(356,8): Error: missing case in case statement: Nil
 Execution trace:
     (0,0): anon0
-    (0,0): anon9_Else
-    (0,0): anon10_Then
-    (0,0): anon11_Else
-    (0,0): anon12_Then
+    (0,0): anon10_Else
+    (0,0): anon11_Then
+    (0,0): anon12_Else
+    (0,0): anon13_Then
 Datatypes.dfy(82,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/Definedness.dfy.expect b/Test/dafny0/Definedness.dfy.expect
index 5d823616..af5b62b9 100644
--- a/Test/dafny0/Definedness.dfy.expect
+++ b/Test/dafny0/Definedness.dfy.expect
@@ -1,7 +1,7 @@
 Definedness.dfy(11,7): Error: possible division by zero
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 Definedness.dfy(18,16): Error: possible division by zero
 Execution trace:
     (0,0): anon0
@@ -161,15 +161,15 @@ Definedness.dfy(215,10): Error BP5003: A postcondition might not hold on this re
 Definedness.dfy(217,46): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 Definedness.dfy(224,22): Error: target object may be null
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Then
+    (0,0): anon4_Then
 Definedness.dfy(237,10): Error BP5003: A postcondition might not hold on this return path.
 Definedness.dfy(240,24): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 
 Dafny program verifier finished with 21 verified, 37 errors
diff --git a/Test/dafny0/DeterministicPick.dfy.expect b/Test/dafny0/DeterministicPick.dfy.expect
index f8b779ef..0999294e 100644
--- a/Test/dafny0/DeterministicPick.dfy.expect
+++ b/Test/dafny0/DeterministicPick.dfy.expect
@@ -1,6 +1,6 @@
 DeterministicPick.dfy(13,5): Error: to be compilable, the value of a let-such-that expression must be uniquely determined
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 
 Dafny program verifier finished with 6 verified, 1 error
diff --git a/Test/dafny0/FunctionSpecifications.dfy.expect b/Test/dafny0/FunctionSpecifications.dfy.expect
index f5112bfe..6d4bdfbb 100644
--- a/Test/dafny0/FunctionSpecifications.dfy.expect
+++ b/Test/dafny0/FunctionSpecifications.dfy.expect
@@ -2,27 +2,27 @@ FunctionSpecifications.dfy(35,25): Error BP5003: A postcondition might not hold
 FunctionSpecifications.dfy(31,13): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon8_Else
     (0,0): anon9_Else
-    (0,0): anon10_Then
-    (0,0): anon11_Else
+    (0,0): anon10_Else
+    (0,0): anon11_Then
+    (0,0): anon12_Else
 FunctionSpecifications.dfy(45,3): Error BP5003: A postcondition might not hold on this return path.
 FunctionSpecifications.dfy(40,24): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon13_Else
-    (0,0): anon16_Else
-    (0,0): anon17_Then
+    (0,0): anon14_Else
+    (0,0): anon17_Else
+    (0,0): anon18_Then
 FunctionSpecifications.dfy(53,11): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon9_Then
-    (0,0): anon4
+    (0,0): anon10_Then
+    (0,0): anon5
 FunctionSpecifications.dfy(59,10): Error BP5003: A postcondition might not hold on this return path.
 FunctionSpecifications.dfy(60,22): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
+    (0,0): anon7_Else
 FunctionSpecifications.dfy(108,23): Error: assertion violation
 Execution trace:
     (0,0): anon0
@@ -40,28 +40,28 @@ Execution trace:
 FunctionSpecifications.dfy(158,3): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 FunctionSpecifications.dfy(167,11): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 FunctionSpecifications.dfy(135,20): Error BP5003: A postcondition might not hold on this return path.
 FunctionSpecifications.dfy(137,29): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 FunctionSpecifications.dfy(146,3): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 FunctionSpecifications.dfy(153,3): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 FunctionSpecifications.dfy(174,3): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 FunctionSpecifications.dfy(171,20): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/Include.dfy.expect b/Test/dafny0/Include.dfy.expect
index cb329398..0921cec9 100644
--- a/Test/dafny0/Include.dfy.expect
+++ b/Test/dafny0/Include.dfy.expect
@@ -2,7 +2,7 @@ Include.dfy(19,19): Error BP5003: A postcondition might not hold on this return
 Includee.dfy(17,20): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 Includee.dfy[Concrete](22,16): Error: assertion violation
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/LetExpr.dfy.expect b/Test/dafny0/LetExpr.dfy.expect
index c6df95b8..66dc2764 100644
--- a/Test/dafny0/LetExpr.dfy.expect
+++ b/Test/dafny0/LetExpr.dfy.expect
@@ -24,11 +24,11 @@ Execution trace:
 LetExpr.dfy(305,42): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
+    (0,0): anon7_Else
 LetExpr.dfy(307,12): Error: assertion violation
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
+    (0,0): anon7_Else
 LetExpr.dfy(317,12): Error: to be compilable, the value of a let-such-that expression must be uniquely determined
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/NatTypes.dfy.expect b/Test/dafny0/NatTypes.dfy.expect
index 99fa16e5..abc253c1 100644
--- a/Test/dafny0/NatTypes.dfy.expect
+++ b/Test/dafny0/NatTypes.dfy.expect
@@ -32,12 +32,12 @@ Execution trace:
 NatTypes.dfy(109,45): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
     (0,0): anon7_Else
-    (0,0): anon8_Then
+    (0,0): anon8_Else
+    (0,0): anon9_Then
 NatTypes.dfy(132,35): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Then
+    (0,0): anon4_Then
 
 Dafny program verifier finished with 15 verified, 9 errors
diff --git a/Test/dafny0/PredExpr.dfy.expect b/Test/dafny0/PredExpr.dfy.expect
index 07bd5f20..744b091a 100644
--- a/Test/dafny0/PredExpr.dfy.expect
+++ b/Test/dafny0/PredExpr.dfy.expect
@@ -1,12 +1,12 @@
 PredExpr.dfy(7,12): Error: assertion violation
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 PredExpr.dfy(39,15): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
     (0,0): anon6_Else
+    (0,0): anon7_Else
 PredExpr.dfy(52,17): Error: assertion violation
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/RankNeg.dfy.expect b/Test/dafny0/RankNeg.dfy.expect
index d740f8a0..cf077cc4 100644
--- a/Test/dafny0/RankNeg.dfy.expect
+++ b/Test/dafny0/RankNeg.dfy.expect
@@ -1,22 +1,22 @@
 RankNeg.dfy(10,26): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
-    (0,0): anon6_Then
+    (0,0): anon6_Else
+    (0,0): anon7_Then
 RankNeg.dfy(15,28): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
-    (0,0): anon6_Then
+    (0,0): anon6_Else
+    (0,0): anon7_Then
 RankNeg.dfy(22,31): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
-    (0,0): anon6_Then
+    (0,0): anon6_Else
+    (0,0): anon7_Then
 RankNeg.dfy(32,25): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
-    (0,0): anon6_Then
+    (0,0): anon6_Else
+    (0,0): anon7_Then
 
 Dafny program verifier finished with 1 verified, 4 errors
diff --git a/Test/dafny0/Reads.dfy b/Test/dafny0/Reads.dfy
index 6ae07d53..545c9a18 100644
--- a/Test/dafny0/Reads.dfy
+++ b/Test/dafny0/Reads.dfy
@@ -72,7 +72,7 @@ class CircularChecking {
 
   function G1(): int
     reads this
-    requires F() == 100  // error: it is not known (yet) that the rest of what F() reads (namely, Repr) is empty
+    requires F() == 100  // fine, since the next line tells us that Repr is empty
     requires Repr == {}
 
   function H0(cell: Cell): int
@@ -86,7 +86,7 @@ class CircularChecking {
 
   function H2(cell: Cell): int
     reads this, Repr
-    requires cell != null && cell.data == 10  // error: it is not known (yet) that "cell in Repr"
+    requires cell != null && cell.data == 10  // this is okay, too, since reads checks are postponed
     requires cell in Repr
 }
 
diff --git a/Test/dafny0/Reads.dfy.expect b/Test/dafny0/Reads.dfy.expect
index 0b6a2d5a..9873f811 100644
--- a/Test/dafny0/Reads.dfy.expect
+++ b/Test/dafny0/Reads.dfy.expect
@@ -1,10 +1,4 @@
-Reads.dfy(75,14): Error: insufficient reads clause to invoke function
-Execution trace:
-    (0,0): anon0
 Reads.dfy(79,11): Error: insufficient reads clause to read field
-Execution trace:
-    (0,0): anon0
-Reads.dfy(89,35): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
 Reads.dfy(9,30): Error: insufficient reads clause to read field
@@ -13,19 +7,20 @@ Execution trace:
 Reads.dfy(18,30): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
-    (0,0): anon9_Then
-    (0,0): anon3
+    (0,0): anon10_Then
+    (0,0): anon4
 Reads.dfy(28,50): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
 Reads.dfy(37,43): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Then
+    (0,0): anon7_Then
+    (0,0): anon4
 Reads.dfy(51,30): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
-    (0,0): anon9_Then
-    (0,0): anon3
+    (0,0): anon10_Then
+    (0,0): anon4
 
-Dafny program verifier finished with 9 verified, 8 errors
+Dafny program verifier finished with 11 verified, 6 errors
diff --git a/Test/dafny0/Refinement.dfy.expect b/Test/dafny0/Refinement.dfy.expect
index 93d59873..d03b9412 100644
--- a/Test/dafny0/Refinement.dfy.expect
+++ b/Test/dafny0/Refinement.dfy.expect
@@ -16,7 +16,7 @@ Refinement.dfy(99,12): Error BP5003: A postcondition might not hold on this retu
 Refinement.dfy(78,15): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 Refinement.dfy(102,3): Error BP5003: A postcondition might not hold on this return path.
 Refinement.dfy(83,15): Related location: This is the postcondition that might not hold.
 Execution trace:
diff --git a/Test/dafny0/SmallTests.dfy.expect b/Test/dafny0/SmallTests.dfy.expect
index b475502a..3df8118a 100644
--- a/Test/dafny0/SmallTests.dfy.expect
+++ b/Test/dafny0/SmallTests.dfy.expect
@@ -4,18 +4,18 @@ Execution trace:
 SmallTests.dfy(65,36): Error: possible division by zero
 Execution trace:
     (0,0): anon0
-    (0,0): anon12_Then
+    (0,0): anon13_Then
 SmallTests.dfy(66,51): Error: possible division by zero
 Execution trace:
     (0,0): anon0
-    (0,0): anon12_Else
     (0,0): anon13_Else
+    (0,0): anon14_Else
 SmallTests.dfy(67,22): Error: target object may be null
 Execution trace:
     (0,0): anon0
-    (0,0): anon12_Then
     (0,0): anon13_Then
     (0,0): anon14_Then
+    (0,0): anon15_Then
 SmallTests.dfy(86,24): Error: target object may be null
 Execution trace:
     (0,0): anon0
@@ -91,7 +91,7 @@ Execution trace:
 SmallTests.dfy(386,6): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 SmallTests.dfy(691,14): Error: assertion violation
 Execution trace:
     (0,0): anon0
@@ -125,12 +125,12 @@ Execution trace:
 SmallTests.dfy(354,4): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 SmallTests.dfy(398,10): Error BP5003: A postcondition might not hold on this return path.
 SmallTests.dfy(401,41): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
+    (0,0): anon7_Else
 SmallTests.dfy(562,12): Error: assertion violation
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/StatementExpressions.dfy.expect b/Test/dafny0/StatementExpressions.dfy.expect
index 313c8884..9de6a5d1 100644
--- a/Test/dafny0/StatementExpressions.dfy.expect
+++ b/Test/dafny0/StatementExpressions.dfy.expect
@@ -11,11 +11,11 @@ Execution trace:
 StatementExpressions.dfy(77,6): Error: possible division by zero
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 StatementExpressions.dfy(88,5): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 StatementExpressions.dfy(98,18): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/Superposition.dfy.expect b/Test/dafny0/Superposition.dfy.expect
index eccb16b0..6497c712 100644
--- a/Test/dafny0/Superposition.dfy.expect
+++ b/Test/dafny0/Superposition.dfy.expect
@@ -14,7 +14,7 @@ Superposition.dfy(27,15): Error BP5003: A postcondition might not hold on this r
 Superposition.dfy(28,26): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
+    (0,0): anon7_Else
 
 Verifying CheckWellformed$$_0_M0.C.R ...
   [5 proof obligations]  error
@@ -22,7 +22,7 @@ Superposition.dfy(33,15): Error BP5003: A postcondition might not hold on this r
 Superposition.dfy(34,26): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
+    (0,0): anon7_Else
 
 Verifying CheckWellformed$$_1_M1.C.M ...
   [0 proof obligations]  verified
@@ -36,9 +36,9 @@ Superposition.dfy(50,25): Error BP5003: A postcondition might not hold on this r
 Superposition.dfy[M1](22,26): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon8_Else
-    (0,0): anon10_Then
-    (0,0): anon7
+    (0,0): anon9_Else
+    (0,0): anon11_Then
+    (0,0): anon8
 
 Verifying CheckWellformed$$_1_M1.C.Q ...
   [0 proof obligations]  verified
diff --git a/Test/dafny0/Termination.dfy.expect b/Test/dafny0/Termination.dfy.expect
index 98aa0cd8..bc59c722 100644
--- a/Test/dafny0/Termination.dfy.expect
+++ b/Test/dafny0/Termination.dfy.expect
@@ -4,9 +4,9 @@ Execution trace:
 Termination.dfy(361,47): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
-    (0,0): anon7_Else
-    (0,0): anon8_Then
-    (0,0): anon9_Else
+    (0,0): anon8_Else
+    (0,0): anon9_Then
+    (0,0): anon10_Else
 Termination.dfy(108,3): Error: cannot prove termination; try supplying a decreases clause for the loop
 Execution trace:
     (0,0): anon0
@@ -44,9 +44,9 @@ Execution trace:
 Termination.dfy(255,35): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
     (0,0): anon7_Else
-    (0,0): anon8_Then
+    (0,0): anon8_Else
+    (0,0): anon9_Then
 Termination.dfy(296,3): Error: decreases expression might not decrease
 Execution trace:
     Termination.dfy(296,3): anon9_LoopHead
diff --git a/Test/hofs/Classes.dfy.expect b/Test/hofs/Classes.dfy.expect
index 3c933bae..880dcc47 100644
--- a/Test/hofs/Classes.dfy.expect
+++ b/Test/hofs/Classes.dfy.expect
@@ -1,10 +1,10 @@
 Classes.dfy(41,6): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
-    (0,0): anon11_Then
-    (0,0): anon3
     (0,0): anon12_Then
-    (0,0): anon13_Else
+    (0,0): anon4
+    (0,0): anon13_Then
     (0,0): anon14_Else
+    (0,0): anon15_Else
 
 Dafny program verifier finished with 6 verified, 1 error
diff --git a/Test/hofs/Naked.dfy.expect b/Test/hofs/Naked.dfy.expect
index 62c035b2..a38dc560 100644
--- a/Test/hofs/Naked.dfy.expect
+++ b/Test/hofs/Naked.dfy.expect
@@ -1,20 +1,20 @@
 Naked.dfy(9,16): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
-    (0,0): anon7_Else
     (0,0): anon8_Else
-    (0,0): anon9_Then
+    (0,0): anon9_Else
+    (0,0): anon10_Then
 Naked.dfy(12,8): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
-    (0,0): anon7_Else
     (0,0): anon8_Else
     (0,0): anon9_Else
+    (0,0): anon10_Else
 Naked.dfy(17,53): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
     (0,0): anon6_Else
+    (0,0): anon7_Else
 Naked.dfy(22,13): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
@@ -24,12 +24,12 @@ Execution trace:
 Naked.dfy(29,30): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 Naked.dfy(29,30): Error: possible violation of function precondition
 Naked.dfy(32,14): Related location
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 Naked.dfy(32,15): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
@@ -42,7 +42,7 @@ Execution trace:
 Naked.dfy(45,30): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 Naked.dfy(48,11): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
diff --git a/Test/hofs/ReadsReads.dfy.expect b/Test/hofs/ReadsReads.dfy.expect
index 73002b73..cd013630 100644
--- a/Test/hofs/ReadsReads.dfy.expect
+++ b/Test/hofs/ReadsReads.dfy.expect
@@ -1,19 +1,19 @@
 ReadsReads.dfy(31,7): Error: insufficient reads clause to invoke function
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 ReadsReads.dfy(36,5): Error: insufficient reads clause to invoke function
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 ReadsReads.dfy(47,12): Error: insufficient reads clause to invoke function
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 ReadsReads.dfy(58,7): Error: insufficient reads clause to invoke function
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Else
+    (0,0): anon4_Else
 ReadsReads.dfy(87,50): Error: assertion violation
 Execution trace:
     (0,0): anon0
diff --git a/Test/hofs/Simple.dfy.expect b/Test/hofs/Simple.dfy.expect
index b3c126d5..1a1027ae 100644
--- a/Test/hofs/Simple.dfy.expect
+++ b/Test/hofs/Simple.dfy.expect
@@ -1,13 +1,13 @@
 Simple.dfy(14,10): Error: possible division by zero
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
-    (0,0): anon6_Then
+    (0,0): anon6_Else
+    (0,0): anon7_Then
 Simple.dfy(27,10): Error: possible division by zero
 Execution trace:
     (0,0): anon0
-    (0,0): anon5_Else
-    (0,0): anon6_Then
+    (0,0): anon6_Else
+    (0,0): anon7_Then
 Simple.dfy(37,9): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
diff --git a/Test/hofs/Twice.dfy.expect b/Test/hofs/Twice.dfy.expect
index 5ba4b47b..2476b945 100644
--- a/Test/hofs/Twice.dfy.expect
+++ b/Test/hofs/Twice.dfy.expect
@@ -5,7 +5,7 @@ Execution trace:
 Twice.dfy(35,32): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
-    (0,0): anon9_Else
-    (0,0): anon10_Then
+    (0,0): anon10_Else
+    (0,0): anon11_Then
 
 Dafny program verifier finished with 4 verified, 2 errors
-- 
cgit v1.2.3


From 58d639bff25a2d4dadf6febb81b1438e957c43cd Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Mon, 15 Jun 2015 16:19:11 -0700
Subject: Do postponsed reads checking also for the body of functions -- see
 Test/dafny0/Reads.dfy for benefits. (Unfortunately, this loses track of the
 "postcondition might not hold on this return path" locations, see
 Test/dafny0/FunctionSpecifications.dfy.)

---
 Source/Dafny/Translator.cs                    |  4 +++-
 Test/dafny0/Array.dfy.expect                  |  6 ++++++
 Test/dafny0/Backticks.dfy.expect              |  3 ++-
 Test/dafny0/Corecursion.dfy.expect            | 10 +++++-----
 Test/dafny0/FunctionSpecifications.dfy.expect | 20 +++++++++++---------
 Test/dafny0/NatTypes.dfy.expect               |  4 ++--
 Test/dafny0/PredExpr.dfy.expect               |  2 +-
 Test/dafny0/RankNeg.dfy.expect                | 16 ++++++++--------
 Test/dafny0/Reads.dfy                         |  2 +-
 Test/dafny0/Reads.dfy.expect                  |  6 +-----
 Test/dafny0/Termination.dfy.expect            | 10 +++++-----
 Test/hofs/Classes.dfy.expect                  |  6 +++---
 Test/hofs/Naked.dfy.expect                    |  8 ++++----
 13 files changed, 52 insertions(+), 45 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index c4bc6cdd..8bb628a8 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -4112,7 +4112,9 @@ namespace Microsoft.Dafny {
                                            * makes reads clauses also guard the requires */
                    , null);
 
-        CheckWellformedWithResult(f.Body, new WFOptions(null, true), funcAppl, f.ResultType, locals, bodyCheckBuilder, etran);
+        wfo = new WFOptions(null, true, true /* do delayed reads checks */);
+        CheckWellformedWithResult(f.Body, wfo, funcAppl, f.ResultType, locals, bodyCheckBuilder, etran);
+        wfo.ProcessSavedReadsChecks(locals, builderInitializationArea, bodyCheckBuilder);
       }
       // Combine the two, letting the postcondition be checked on after the "bodyCheckBuilder" branch
       postCheckBuilder.Add(new Bpl.AssumeCmd(f.tok, Bpl.Expr.False));
diff --git a/Test/dafny0/Array.dfy.expect b/Test/dafny0/Array.dfy.expect
index ff05137b..59dcb4bf 100644
--- a/Test/dafny0/Array.dfy.expect
+++ b/Test/dafny0/Array.dfy.expect
@@ -48,6 +48,7 @@ Execution trace:
     (0,0): anon11_Then
     (0,0): anon12_Then
     (0,0): anon13_Then
+    (0,0): anon9
 Array.dfy(122,8): Error: insufficient reads clause to read the indicated range of array elements
 Execution trace:
     (0,0): anon0
@@ -55,6 +56,7 @@ Execution trace:
     (0,0): anon11_Then
     (0,0): anon12_Then
     (0,0): anon13_Else
+    (0,0): anon9
 Array.dfy(123,8): Error: insufficient reads clause to read the indicated range of array elements
 Execution trace:
     (0,0): anon0
@@ -62,6 +64,7 @@ Execution trace:
     (0,0): anon11_Then
     (0,0): anon12_Then
     (0,0): anon13_Else
+    (0,0): anon9
 Array.dfy(124,8): Error: insufficient reads clause to read the indicated range of array elements
 Execution trace:
     (0,0): anon0
@@ -69,18 +72,21 @@ Execution trace:
     (0,0): anon11_Then
     (0,0): anon12_Then
     (0,0): anon13_Else
+    (0,0): anon9
 Array.dfy(163,6): Error: insufficient reads clause to read array element
 Execution trace:
     (0,0): anon0
     (0,0): anon8_Else
     (0,0): anon9_Then
     (0,0): anon10_Then
+    (0,0): anon7
 Array.dfy(171,6): Error: insufficient reads clause to read array element
 Execution trace:
     (0,0): anon0
     (0,0): anon8_Else
     (0,0): anon9_Then
     (0,0): anon10_Then
+    (0,0): anon7
 Array.dfy(187,6): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/Backticks.dfy.expect b/Test/dafny0/Backticks.dfy.expect
index 6657cd8c..57761ab4 100644
--- a/Test/dafny0/Backticks.dfy.expect
+++ b/Test/dafny0/Backticks.dfy.expect
@@ -1,8 +1,9 @@
 Backticks.dfy(38,5): Error: insufficient reads clause to invoke function
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
     (0,0): anon7_Else
+    (0,0): anon8_Else
+    (0,0): anon6
 Backticks.dfy(77,8): Error: call may violate context's modifies clause
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/Corecursion.dfy.expect b/Test/dafny0/Corecursion.dfy.expect
index 62b67cc3..619a9c84 100644
--- a/Test/dafny0/Corecursion.dfy.expect
+++ b/Test/dafny0/Corecursion.dfy.expect
@@ -13,17 +13,17 @@ Execution trace:
 Corecursion.dfy(71,16): Error: cannot prove termination; try supplying a decreases clause (note that calls cannot be co-recursive in this context)
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
+    (0,0): anon7_Else
 Corecursion.dfy(93,15): Error: cannot prove termination; try supplying a decreases clause (note that a call can be co-recursive only if all intra-cluster calls are in non-destructive contexts)
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
-    (0,0): anon7_Then
+    (0,0): anon7_Else
+    (0,0): anon8_Then
 Corecursion.dfy(103,15): Error: cannot prove termination; try supplying a decreases clause (note that a call can be co-recursive only if all intra-cluster calls are in non-destructive contexts)
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
-    (0,0): anon7_Then
+    (0,0): anon7_Else
+    (0,0): anon8_Then
 Corecursion.dfy(148,13): Error: failure to decrease termination measure (note that a call can be co-recursive only if all intra-cluster calls are in non-destructive contexts)
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/FunctionSpecifications.dfy.expect b/Test/dafny0/FunctionSpecifications.dfy.expect
index 6d4bdfbb..9f76313a 100644
--- a/Test/dafny0/FunctionSpecifications.dfy.expect
+++ b/Test/dafny0/FunctionSpecifications.dfy.expect
@@ -1,22 +1,24 @@
-FunctionSpecifications.dfy(35,25): Error BP5003: A postcondition might not hold on this return path.
+FunctionSpecifications.dfy(29,10): Error BP5003: A postcondition might not hold on this return path.
 FunctionSpecifications.dfy(31,13): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon9_Else
     (0,0): anon10_Else
-    (0,0): anon11_Then
-    (0,0): anon12_Else
-FunctionSpecifications.dfy(45,3): Error BP5003: A postcondition might not hold on this return path.
+    (0,0): anon11_Else
+    (0,0): anon12_Then
+    (0,0): anon13_Else
+    (0,0): anon9
+FunctionSpecifications.dfy(38,10): Error BP5003: A postcondition might not hold on this return path.
 FunctionSpecifications.dfy(40,24): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-    (0,0): anon14_Else
-    (0,0): anon17_Else
-    (0,0): anon18_Then
+    (0,0): anon15_Else
+    (0,0): anon18_Else
+    (0,0): anon19_Then
+    (0,0): anon14
 FunctionSpecifications.dfy(53,11): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon10_Then
+    (0,0): anon11_Then
     (0,0): anon5
 FunctionSpecifications.dfy(59,10): Error BP5003: A postcondition might not hold on this return path.
 FunctionSpecifications.dfy(60,22): Related location: This is the postcondition that might not hold.
diff --git a/Test/dafny0/NatTypes.dfy.expect b/Test/dafny0/NatTypes.dfy.expect
index abc253c1..5af90253 100644
--- a/Test/dafny0/NatTypes.dfy.expect
+++ b/Test/dafny0/NatTypes.dfy.expect
@@ -32,9 +32,9 @@ Execution trace:
 NatTypes.dfy(109,45): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
-    (0,0): anon7_Else
     (0,0): anon8_Else
-    (0,0): anon9_Then
+    (0,0): anon9_Else
+    (0,0): anon10_Then
 NatTypes.dfy(132,35): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/PredExpr.dfy.expect b/Test/dafny0/PredExpr.dfy.expect
index 744b091a..18d5d73f 100644
--- a/Test/dafny0/PredExpr.dfy.expect
+++ b/Test/dafny0/PredExpr.dfy.expect
@@ -5,8 +5,8 @@ Execution trace:
 PredExpr.dfy(39,15): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
     (0,0): anon7_Else
+    (0,0): anon8_Else
 PredExpr.dfy(52,17): Error: assertion violation
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny0/RankNeg.dfy.expect b/Test/dafny0/RankNeg.dfy.expect
index cf077cc4..b2686b43 100644
--- a/Test/dafny0/RankNeg.dfy.expect
+++ b/Test/dafny0/RankNeg.dfy.expect
@@ -1,22 +1,22 @@
 RankNeg.dfy(10,26): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
-    (0,0): anon7_Then
+    (0,0): anon7_Else
+    (0,0): anon8_Then
 RankNeg.dfy(15,28): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
-    (0,0): anon7_Then
+    (0,0): anon7_Else
+    (0,0): anon8_Then
 RankNeg.dfy(22,31): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
-    (0,0): anon7_Then
+    (0,0): anon7_Else
+    (0,0): anon8_Then
 RankNeg.dfy(32,25): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
-    (0,0): anon7_Then
+    (0,0): anon7_Else
+    (0,0): anon8_Then
 
 Dafny program verifier finished with 1 verified, 4 errors
diff --git a/Test/dafny0/Reads.dfy b/Test/dafny0/Reads.dfy
index f1c840c3..7e0ca1c4 100644
--- a/Test/dafny0/Reads.dfy
+++ b/Test/dafny0/Reads.dfy
@@ -123,6 +123,6 @@ function FunctionInQuantifier2(): int
   requires exists f: int -> int :: f.reads(10) == {} && f.requires(10) && f(10) == 100
   ensures FunctionInQuantifier2() == 100
 {
-  var f: int -> int :| f.reads(10) == {} && f.requires(10) && f(10) == 100;  // error: insufficient reads for f.reads(10)
+  var f: int -> int :| f.reads(10) == {} && f.requires(10) && f(10) == 100;  // fine :) :)
   f(10)
 }
diff --git a/Test/dafny0/Reads.dfy.expect b/Test/dafny0/Reads.dfy.expect
index 79d290da..0b599f3f 100644
--- a/Test/dafny0/Reads.dfy.expect
+++ b/Test/dafny0/Reads.dfy.expect
@@ -31,9 +31,5 @@ Execution trace:
 Reads.dfy(120,38): Error: insufficient reads clause to invoke function
 Execution trace:
     (0,0): anon0
-Reads.dfy(126,26): Error: insufficient reads clause to invoke function
-Execution trace:
-    (0,0): anon0
-    (0,0): anon8_Else
 
-Dafny program verifier finished with 15 verified, 10 errors
+Dafny program verifier finished with 16 verified, 9 errors
diff --git a/Test/dafny0/Termination.dfy.expect b/Test/dafny0/Termination.dfy.expect
index bc59c722..77a9e70e 100644
--- a/Test/dafny0/Termination.dfy.expect
+++ b/Test/dafny0/Termination.dfy.expect
@@ -4,9 +4,9 @@ Execution trace:
 Termination.dfy(361,47): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
-    (0,0): anon8_Else
-    (0,0): anon9_Then
-    (0,0): anon10_Else
+    (0,0): anon9_Else
+    (0,0): anon10_Then
+    (0,0): anon11_Else
 Termination.dfy(108,3): Error: cannot prove termination; try supplying a decreases clause for the loop
 Execution trace:
     (0,0): anon0
@@ -44,9 +44,9 @@ Execution trace:
 Termination.dfy(255,35): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-    (0,0): anon7_Else
     (0,0): anon8_Else
-    (0,0): anon9_Then
+    (0,0): anon9_Else
+    (0,0): anon10_Then
 Termination.dfy(296,3): Error: decreases expression might not decrease
 Execution trace:
     Termination.dfy(296,3): anon9_LoopHead
diff --git a/Test/hofs/Classes.dfy.expect b/Test/hofs/Classes.dfy.expect
index 880dcc47..21188d62 100644
--- a/Test/hofs/Classes.dfy.expect
+++ b/Test/hofs/Classes.dfy.expect
@@ -1,10 +1,10 @@
 Classes.dfy(41,6): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
-    (0,0): anon12_Then
-    (0,0): anon4
     (0,0): anon13_Then
-    (0,0): anon14_Else
+    (0,0): anon4
+    (0,0): anon14_Then
     (0,0): anon15_Else
+    (0,0): anon16_Else
 
 Dafny program verifier finished with 6 verified, 1 error
diff --git a/Test/hofs/Naked.dfy.expect b/Test/hofs/Naked.dfy.expect
index a38dc560..b4dfc561 100644
--- a/Test/hofs/Naked.dfy.expect
+++ b/Test/hofs/Naked.dfy.expect
@@ -1,20 +1,20 @@
 Naked.dfy(9,16): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
-    (0,0): anon8_Else
     (0,0): anon9_Else
-    (0,0): anon10_Then
+    (0,0): anon10_Else
+    (0,0): anon11_Then
 Naked.dfy(12,8): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
-    (0,0): anon8_Else
     (0,0): anon9_Else
     (0,0): anon10_Else
+    (0,0): anon11_Else
 Naked.dfy(17,53): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
-    (0,0): anon6_Else
     (0,0): anon7_Else
+    (0,0): anon8_Else
 Naked.dfy(22,13): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
-- 
cgit v1.2.3


From cc0a7cae53c068993e3b3004049629dd396cb649 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Mon, 15 Jun 2015 17:00:04 -0700
Subject: Changed logical order of requires and reads clauses on functions. 
 Reads clauses can now assume the precondition (as had also been the case back
 in the days when reads clauses had to be self framing).

---
 Source/Dafny/Translator.cs   | 21 ++++++++++++---------
 Test/dafny0/Reads.dfy        | 16 +++++++++++++---
 Test/dafny0/Reads.dfy.expect |  6 ++----
 Test/hofs/Classes.dfy        |  9 ++++-----
 Test/hofs/Classes.dfy.expect |  9 +++------
 5 files changed, 34 insertions(+), 27 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 8bb628a8..90d0b11c 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -4027,20 +4027,23 @@ namespace Microsoft.Dafny {
 
       DefineFrame(f.tok, f.Reads, builder, locals, null);
 
-      // check well-formedness of the preconditions (including termination, and reads checks), and then
-      // assume each one of them
-
-      // check well-formedness of the reads clause
-      var wfo = new WFOptions(null, true, true /* do delayed reads checks over requires */);
-      CheckFrameWellFormed(wfo, f.Reads, locals, builder, etran);
-      wfo.ProcessSavedReadsChecks(locals, builderInitializationArea, builder);
-
-      wfo = new WFOptions(null, true, true /* do delayed reads checks */);
+      // Check well-formedness of the preconditions (including termination), and then
+      // assume each one of them.  After all that (in particular, after assuming all
+      // of them), do the postponed reads checks.
+      var wfo = new WFOptions(null, true, true /* do delayed reads checks */);
       foreach (Expression p in f.Req) {
         CheckWellformedAndAssume(p, wfo, locals, builder, etran);
       }
       wfo.ProcessSavedReadsChecks(locals, builderInitializationArea, builder);
 
+      // Check well-formedness of the reads clause.  Note that this is done after assuming
+      // the preconditions.  In other words, the well-formedness of the reads clause is
+      // allowed to assume the precondition (yet, the requires clause is checked to
+      // read only those things indicated in the reads clause).
+      wfo = new WFOptions(null, true, true /* do delayed reads checks */);
+      CheckFrameWellFormed(wfo, f.Reads, locals, builder, etran);
+      wfo.ProcessSavedReadsChecks(locals, builderInitializationArea, builder);
+
       // check well-formedness of the decreases clauses (including termination, but no reads checks)
       foreach (Expression p in f.Decreases.Expressions)
       {
diff --git a/Test/dafny0/Reads.dfy b/Test/dafny0/Reads.dfy
index 7e0ca1c4..6dedbada 100644
--- a/Test/dafny0/Reads.dfy
+++ b/Test/dafny0/Reads.dfy
@@ -58,7 +58,7 @@ function ok5(r : R):()
 // Reads checking where there are circularities among the expressions
 
 class CircularChecking {
-  var Repr: set<object>
+  ghost var Repr: set<object>
     
   function F(): int
     reads this, Repr
@@ -76,8 +76,8 @@ class CircularChecking {
     requires Repr == {}
 
   function H0(cell: Cell): int
-    reads Repr  // error: reads is not self-framing (unless "this in Repr")
-    requires this in Repr  // lo and behold!  So, reads clause is fine, if we can assume the precondition
+    reads Repr  // by itself, this reads is not self-framing
+    requires this in Repr  // lo and behold!  So, reads clause is fine after all
 
   function H1(cell: Cell): int
     reads this, Repr
@@ -126,3 +126,13 @@ function FunctionInQuantifier2(): int
   var f: int -> int :| f.reads(10) == {} && f.requires(10) && f(10) == 100;  // fine :) :)
   f(10)
 }
+
+class DynamicFramesIdiom {
+  ghost var Repr: set<object>
+  predicate IllFormed_Valid()
+    reads Repr  // error: reads is not self framing (notice the absence of "this")
+  {
+    this in Repr  // this says that the predicate returns true if "this in Repr", but the
+                  // predicate can also be invoked in a state where its body will evaluate to false
+  }
+}
diff --git a/Test/dafny0/Reads.dfy.expect b/Test/dafny0/Reads.dfy.expect
index 0b599f3f..1199797f 100644
--- a/Test/dafny0/Reads.dfy.expect
+++ b/Test/dafny0/Reads.dfy.expect
@@ -1,4 +1,4 @@
-Reads.dfy(79,11): Error: insufficient reads clause to read field
+Reads.dfy(133,11): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
 Reads.dfy(9,30): Error: insufficient reads clause to read field
@@ -7,8 +7,6 @@ Execution trace:
 Reads.dfy(18,30): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
-    (0,0): anon10_Then
-    (0,0): anon4
 Reads.dfy(28,50): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
@@ -32,4 +30,4 @@ Reads.dfy(120,38): Error: insufficient reads clause to invoke function
 Execution trace:
     (0,0): anon0
 
-Dafny program verifier finished with 16 verified, 9 errors
+Dafny program verifier finished with 17 verified, 9 errors
diff --git a/Test/hofs/Classes.dfy b/Test/hofs/Classes.dfy
index 2b892b35..0ceb46f1 100644
--- a/Test/hofs/Classes.dfy
+++ b/Test/hofs/Classes.dfy
@@ -30,15 +30,14 @@ function B(t : T) : int -> int
 }
 
 function J(t : T) : int
-  requires t != null;
-  requires t.h.reads(0) == {};
-  reads t;
-  reads if t != null then t.h.reads(0) else {};
+  requires t != null
+  reads t
+  reads t.h.reads(0)
 {
   if t.h.requires(0) then
     B(t)(0)
   else
-    B(t)(0)  // fail
+    B(t)(0)  // error: precondition violation
 }
 
 method U(t : T)
diff --git a/Test/hofs/Classes.dfy.expect b/Test/hofs/Classes.dfy.expect
index 21188d62..e490dbe0 100644
--- a/Test/hofs/Classes.dfy.expect
+++ b/Test/hofs/Classes.dfy.expect
@@ -1,10 +1,7 @@
-Classes.dfy(41,6): Error: possible violation of function precondition
+Classes.dfy(40,6): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
-    (0,0): anon13_Then
-    (0,0): anon4
-    (0,0): anon14_Then
-    (0,0): anon15_Else
-    (0,0): anon16_Else
+    (0,0): anon7_Else
+    (0,0): anon8_Else
 
 Dafny program verifier finished with 6 verified, 1 error
-- 
cgit v1.2.3


From 379f88f77fbb86a4be9eac6825c7a9c1aabb2316 Mon Sep 17 00:00:00 2001
From: Michael Lowell Roberts <mirobert@microsoft.com>
Date: Tue, 16 Jun 2015 15:02:55 -0700
Subject: System.Collections.Immutable.dll is now stored in the Binaries
 directory and copied to the output directory when the /optimize flag is used.

---
 Binaries/System.Collections.Immutable.dll | Bin 0 -> 149752 bytes
 Source/DafnyDriver/DafnyDriver.cs         |  18 +++++++++++++++---
 2 files changed, 15 insertions(+), 3 deletions(-)
 create mode 100644 Binaries/System.Collections.Immutable.dll

(limited to 'Source')

diff --git a/Binaries/System.Collections.Immutable.dll b/Binaries/System.Collections.Immutable.dll
new file mode 100644
index 00000000..bcf23fe5
Binary files /dev/null and b/Binaries/System.Collections.Immutable.dll differ
diff --git a/Source/DafnyDriver/DafnyDriver.cs b/Source/DafnyDriver/DafnyDriver.cs
index cf464754..ce4d726f 100644
--- a/Source/DafnyDriver/DafnyDriver.cs
+++ b/Source/DafnyDriver/DafnyDriver.cs
@@ -349,10 +349,13 @@ namespace Microsoft.Dafny
         cp.ReferencedAssemblies.Add("System.Core.dll");
         cp.ReferencedAssemblies.Add("System.dll");
 
+        var libPath = Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location) + Path.DirectorySeparatorChar;
+        var immutableDllFileName = "System.Collections.Immutable.dll";
+        var immutableDllPath = libPath + immutableDllFileName;
+
         if (DafnyOptions.O.Optimize) {
-          var libPath = Path.GetDirectoryName(dafnyProgramName);
-          cp.CompilerOptions += string.Format(" /optimize /define:DAFNY_USE_SYSTEM_COLLECTIONS_IMMUTABLE /lib:{0}", libPath);
-          cp.ReferencedAssemblies.Add("System.Collections.Immutable.dll");
+          cp.CompilerOptions += " /optimize /define:DAFNY_USE_SYSTEM_COLLECTIONS_IMMUTABLE";
+          cp.ReferencedAssemblies.Add(immutableDllPath);
           cp.ReferencedAssemblies.Add("System.Runtime.dll");
         }
 
@@ -375,6 +378,15 @@ namespace Microsoft.Dafny
           }
         } else if (cr.Errors.Count == 0) {
           outputWriter.WriteLine("Compiled assembly into {0}", assemblyName);
+          if (DafnyOptions.O.Optimize) {
+            var outputDir = Path.GetDirectoryName(dafnyProgramName);
+            if (string.IsNullOrWhiteSpace(outputDir)) {
+              outputDir = ".";
+            }
+            var destPath = outputDir + Path.DirectorySeparatorChar + immutableDllFileName;
+            File.Copy(immutableDllPath, destPath, true);
+            outputWriter.WriteLine("Copied /optimize dependency {0} to {1}", immutableDllFileName, outputDir);
+          }
         } else {
           outputWriter.WriteLine("Errors compiling program into {0}", assemblyName);
           foreach (var ce in cr.Errors) {
-- 
cgit v1.2.3


From 0e2d86cd4fdfe917df8a6f755f4cccd66f2c16e2 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Fri, 19 Jun 2015 16:10:25 -0700
Subject: Fix various bugs in nested match patterns listed in issue #83

---
 Source/Dafny/Cloner.cs                |   8 +-
 Source/Dafny/Resolver.cs              | 405 ++++++++++++++++++++--------------
 Source/Dafny/Rewriter.cs              |  34 +++
 Test/dafny0/NestedPatterns.dfy        | 124 +++++++++++
 Test/dafny0/NestedPatterns.dfy.expect |   9 +
 5 files changed, 414 insertions(+), 166 deletions(-)
 create mode 100644 Test/dafny0/NestedPatterns.dfy
 create mode 100644 Test/dafny0/NestedPatterns.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index 9b7bb12e..f13aa2f4 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -294,8 +294,7 @@ namespace Microsoft.Dafny
         return new MapDisplayExpr(Tok(expr.tok), e.Finite, pp);
 
       } else if (expr is NameSegment) {
-        var e = (NameSegment)expr;
-        return new NameSegment(Tok(e.tok), e.Name, e.OptTypeArguments == null ? null : e.OptTypeArguments.ConvertAll(CloneType));
+        return CloneNameSegment(expr);
       } else if (expr is ExprDotName) {
         var e = (ExprDotName)expr;
         return new ExprDotName(Tok(e.tok), CloneExpr(e.Lhs), e.SuffixName, e.OptTypeArguments == null ? null : e.OptTypeArguments.ConvertAll(CloneType));
@@ -449,6 +448,11 @@ namespace Microsoft.Dafny
       }
     }
 
+    public virtual NameSegment CloneNameSegment(Expression expr) {
+      var e = (NameSegment)expr;
+      return new NameSegment(Tok(e.tok), e.Name, e.OptTypeArguments == null ? null : e.OptTypeArguments.ConvertAll(CloneType));
+    }
+
     public virtual AssignmentRhs CloneRHS(AssignmentRhs rhs) {
       AssignmentRhs c;
       if (rhs is ExprRhs) {
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 5f01f913..210e6f3d 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -5246,7 +5246,9 @@ namespace Microsoft.Dafny
       string name = FreshTempVarName("_mc#", codeContext);
       BoundVar bv = new BoundVar(s.Tok, name, type);
       List<CasePattern> patternSubst = new List<CasePattern>();
-      DesugarMatchCaseStmt(s, dtd, bv, patternSubst);
+      if (dtd != null) {
+        DesugarMatchCaseStmt(s, dtd, bv, patternSubst, codeContext);
+      }
 
       ISet<string> memberNamesUsed = new HashSet<string>();
       foreach (MatchCaseStmt mc in s.Cases) {
@@ -5270,20 +5272,20 @@ namespace Microsoft.Dafny
         }
         scope.PushMarker();
         int i = 0;
-        foreach (BoundVar v in mc.Arguments) {
-          if (!scope.Push(v.Name, v)) {
-            Error(v, "Duplicate parameter name: {0}", v.Name);
-          }
-          ResolveType(v.tok, v.Type, codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
-          if (ctor != null && i < ctor.Formals.Count) {
-            Formal formal = ctor.Formals[i];
-            Type st = SubstType(formal.Type, subst);
-            if (!UnifyTypes(v.Type, st)) {
-              Error(stmt, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
+        if (mc.Arguments != null) {
+          foreach (BoundVar v in mc.Arguments) {
+            scope.Push(v.Name, v);
+            ResolveType(v.tok, v.Type, codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
+            if (ctor != null && i < ctor.Formals.Count) {
+              Formal formal = ctor.Formals[i];
+              Type st = SubstType(formal.Type, subst);
+              if (!UnifyTypes(v.Type, st)) {
+                Error(stmt, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
+              }
+              v.IsGhost = formal.IsGhost;
             }
-            v.IsGhost = formal.IsGhost;
+            i++;
           }
-          i++;
         }
         foreach (Statement ss in mc.Body) {
           ResolveStatement(ss, bodyIsSpecOnly, codeContext);
@@ -5340,29 +5342,34 @@ namespace Microsoft.Dafny
       // (x, y) is treated as a 2-tuple constructor
       if (me.Source is DatatypeValue) {
         var e = (DatatypeValue)me.Source;
-        Contract.Assert(e.Arguments.Count >= 1);
-        Expression source = e.Arguments[0];
-        List<MatchCaseStmt> cases = new List<MatchCaseStmt>();
-        foreach (MatchCaseStmt mc in me.Cases) {
-          Contract.Assert(mc.CasePatterns != null);
-          Contract.Assert(mc.CasePatterns.Count == e.Arguments.Count);
-          CasePattern cp = mc.CasePatterns[0];
-          List<CasePattern> patterns;
-          if (cp.Arguments != null) {
-            patterns = cp.Arguments;
-          } else {
-            patterns = new List<CasePattern>();
-          }
+        if (e.Arguments.Count < 1) {
+          Error(me.Tok, "match source tuple needs at least 1 argument");
+        } else {
+          Expression source = e.Arguments[0];
+          List<MatchCaseStmt> cases = new List<MatchCaseStmt>();
+          foreach (MatchCaseStmt mc in me.Cases) {
+            if (mc.CasePatterns == null || mc.CasePatterns.Count != e.Arguments.Count) {
+              Error(mc.tok, "case arguments count does not match source arguments count");
+            } else {
+              CasePattern cp = mc.CasePatterns[0];
+              List<CasePattern> patterns;
+              if (cp.Arguments != null) {
+                patterns = cp.Arguments;
+              } else {
+                patterns = new List<CasePattern>();
+              }
 
-          List<Statement> body = mc.Body;
-          for (int i = e.Arguments.Count; 1 <= --i; ) {
-            // others go into the body
-            body = CreateMatchCaseStmtBody(mc.tok, e.Arguments[i], mc.CasePatterns[i], body);
+              List<Statement> body = mc.Body;
+              for (int i = e.Arguments.Count; 1 <= --i; ) {
+                // others go into the body
+                body = CreateMatchCaseStmtBody(me.Tok, e.Arguments[i], mc.CasePatterns[i], body);
+              }
+              cases.Add(new MatchCaseStmt(cp.tok, cp.Id, patterns, body));
+            }
           }
-          cases.Add(new MatchCaseStmt(cp.tok, cp.Id, patterns, body));
+          me.UpdateSource(source);
+          me.UpdateCases(cases);
         }
-        me.UpdateSource(source);
-        me.UpdateCases(cases);
       }
     }
 
@@ -5398,9 +5405,14 @@ namespace Microsoft.Dafny
      *       case Nil => y
      *       case Cons(z, zs) => last(ys)
      */
-    void DesugarMatchCaseStmt(MatchStmt s, DatatypeDecl dtd, BoundVar sourceVar, List<CasePattern> patterns) {
+    void DesugarMatchCaseStmt(MatchStmt s, DatatypeDecl dtd, BoundVar sourceVar, List<CasePattern> patterns, ICodeContext codeContext) {
       Contract.Assert(dtd != null);
       Dictionary<string, DatatypeCtor> ctors = datatypeCtors[dtd];
+      if (ctors == null) {
+        // there is no constructor, no need to desugar
+        return;
+      }
+
       foreach (MatchCaseStmt mc in s.Cases) {
         if (mc.Arguments != null) {
           // already desugared. This happens during the second pass resolver after cloning.
@@ -5410,46 +5422,31 @@ namespace Microsoft.Dafny
 
         Contract.Assert(mc.Arguments == null);
         Contract.Assert(mc.CasePatterns != null);
+        Contract.Assert(ctors != null);
         DatatypeCtor ctor = null;
-        if (ctors != null) {
-          if (!ctors.TryGetValue(mc.Id, out ctor)) {
-            Error(mc.tok, "member {0} does not exist in datatype {1}", mc.Id, dtd.Name);
-          } else {
-            Contract.Assert(ctor != null);  // follows from postcondition of TryGetValue
-            mc.Ctor = ctor;
-            if (ctor.Formals.Count != mc.CasePatterns.Count) {
-              Error(mc.tok, "member {0} has wrong number of formals (found {1}, expected {2})", mc.Id, mc.Arguments.Count, ctor.Formals.Count);
-            }
-          }
-        }
-        scope.PushMarker();
-        List<BoundVar> arguments = new List<BoundVar>();
-        foreach (CasePattern pat in mc.CasePatterns) {
-          // Find the constructor in the given datatype
-          // If what was parsed was just an identifier, we will interpret it as a datatype constructor, if possible
-          ctor = null;
-          if (pat.Var == null || (pat.Var != null && pat.Var.Type is TypeProxy && dtd != null)) {
-            if (datatypeCtors[dtd].TryGetValue(pat.Id, out ctor)) {
-              pat.Ctor = ctor;
-              pat.Var = null;
-            }
-          }
-          if (pat.Var != null) {
-            BoundVar v = pat.Var;
-            arguments.Add(v);
-            if (!scope.Push(v.Name, v)) {
-              Error(v, "Duplicate name: {0}", v.Name);
+
+        if (ctors.TryGetValue(mc.Id, out ctor)) {
+          scope.PushMarker();
+          foreach (CasePattern pat in mc.CasePatterns) {
+            FindDuplicateIdentifier(pat, ctors, true);
+          }
+          List<BoundVar> arguments = new List<BoundVar>();
+          foreach (CasePattern pat in mc.CasePatterns) {
+            if (pat.Var != null) {
+              BoundVar v = pat.Var;
+              arguments.Add(v);
+            } else {
+              DesugarMatchCasePattern(mc, pat, sourceVar);
+              patterns.Add(pat);
+              arguments.Add(sourceVar);
             }
-          } else {
-            DesugarMatchCasePattern(mc, pat, sourceVar);
-            patterns.Add(pat);
-            arguments.Add(sourceVar);
           }
+          mc.Arguments = arguments;
+          mc.CasePatterns = null;
+          scope.PopMarker();
         }
-        mc.Arguments = arguments;
-        mc.CasePatterns = null;
-        scope.PopMarker();
       }
+      
 
       List<MatchCaseStmt> newCases = new List<MatchCaseStmt>();
 
@@ -5473,13 +5470,13 @@ namespace Microsoft.Dafny
         if (CaseExprHasWildCard(mc)) {
           mcWithWildCard.Add(mc);
         } else {
-          thingsChanged |= CombineMatchCaseStmt(mc, newCases, caseMap);
+          thingsChanged |= CombineMatchCaseStmt(mc, newCases, caseMap, codeContext);
         }
       }
 
       foreach (MatchCaseStmt mc in mcWithWildCard) {
         // now process with cases with wildcard
-        thingsChanged |= CombineMatchCaseStmt(mc, newCases, caseMap);
+        thingsChanged |= CombineMatchCaseStmt(mc, newCases, caseMap, codeContext);
       }
 
       if (thingsChanged) {
@@ -5487,6 +5484,37 @@ namespace Microsoft.Dafny
       }
     }
 
+    void FindDuplicateIdentifier(CasePattern pat, Dictionary<string, DatatypeCtor> ctors, bool topLevel) {
+      Contract.Assert(ctors != null);
+      DatatypeCtor ctor = null;
+      // Find the constructor in the given datatype
+      // If what was parsed was just an identifier, we will interpret it as a datatype constructor, if possible
+      if (pat.Var == null || (pat.Var != null && pat.Var.Type is TypeProxy)) {
+        if (ctors.TryGetValue(pat.Id, out ctor)) {
+          pat.Ctor = ctor;
+          pat.Var = null;
+        }
+      }
+      if (pat.Var != null) {
+        BoundVar v = pat.Var;
+        if (topLevel) {
+          if (!scope.Push(v.Name, v)) {
+            Error(v, "Duplicate parameter name: {0}", v.Name);
+          }
+        } else {
+          if (scope.Find(v.Name) != null) {
+            Error(v, "Duplicate parameter name: {0}", v.Name);
+          }
+        }
+      } else {
+        if (pat.Arguments != null) {
+          foreach (CasePattern cp in pat.Arguments) {
+            FindDuplicateIdentifier(cp, ctors, false);
+          }
+        }
+      }
+    }
+
     void DesugarMatchCasePattern(MatchCaseStmt mc, CasePattern pat, BoundVar v) {
       // convert 
       //    case Cons(y, Cons(z, zs)) => body
@@ -5503,7 +5531,7 @@ namespace Microsoft.Dafny
       mc.UpdateBody(list);
     }
 
-    bool CombineMatchCaseStmt(MatchCaseStmt mc, List<MatchCaseStmt> newCases, Dictionary<string, MatchCaseStmt> caseMap) {
+    bool CombineMatchCaseStmt(MatchCaseStmt mc, List<MatchCaseStmt> newCases, Dictionary<string, MatchCaseStmt> caseMap, ICodeContext codeContext) {
       bool thingsChanged = false;
       MatchCaseStmt old_mc;
       if (caseMap.TryGetValue(mc.Id, out old_mc)) {
@@ -5513,9 +5541,9 @@ namespace Microsoft.Dafny
         if ((oldBody.Count == 1) && (oldBody[0] is MatchStmt)
             && (body.Count == 1) && (body[0] is MatchStmt)) {
           // both only have on statement and the statement is MatchStmt
-          MatchStmt old = (MatchStmt) oldBody[0];
-          MatchStmt current = (MatchStmt) body[0];
-          if (SameMatchCase(old_mc, mc)) {
+          if (SameMatchCaseStmt(old_mc, mc, codeContext)) {
+            MatchStmt old = (MatchStmt)old_mc.Body[0];
+            MatchStmt current = (MatchStmt)mc.Body[0];
             foreach (MatchCaseStmt c in current.Cases) {
               old.Cases.Add(c);
             }
@@ -5532,7 +5560,7 @@ namespace Microsoft.Dafny
       return thingsChanged;
     }
 
-    bool SameMatchCase(MatchCaseStmt one, MatchCaseStmt other) {
+    bool SameMatchCaseStmt(MatchCaseStmt one, MatchCaseStmt other, ICodeContext codeContext) {
       // this method is called after all the CasePattern in the match cases are converted
       // into BoundVars.
       Contract.Assert(one.CasePatterns == null && one.Arguments != null);
@@ -5562,14 +5590,43 @@ namespace Microsoft.Dafny
       for (int i = 0; i < one.Arguments.Count; i++) {
         BoundVar bv1 = one.Arguments[i];
         BoundVar bv2 = other.Arguments[i];
-        if (!LocalVariable.HasWildcardName(bv1) && !LocalVariable.HasWildcardName(bv2) &&
-            !bv1.Name.Equals(bv2.Name)) {
-          return false;
+        if (!LocalVariable.HasWildcardName(bv1) && !LocalVariable.HasWildcardName(bv2)) {
+          if (!bv1.Name.Equals(bv2.Name)) {
+            // need to substitute bv2 with bv1 in the matchstmt body
+            // what if match body already has the bv?? need to make a new bv
+            Type type = new InferredTypeProxy();
+            string name = FreshTempVarName("_mc#", codeContext);
+            BoundVar bv = new BoundVar(one.tok, name, type);
+            SubstituteMatchCaseBoundVar(one, bv1, bv);
+            SubstituteMatchCaseBoundVar(other, bv2, bv);
+          }
         }
       }
       return true;
     }
 
+    void SubstituteMatchCaseBoundVar(MatchCaseStmt mc, BoundVar oldBv, BoundVar newBv) {
+      List<BoundVar> arguments = new List<BoundVar>();
+      for (int i = 0; i < mc.Arguments.Count; i++) {
+        BoundVar bv = mc.Arguments[i];
+        if (bv == oldBv) {
+          arguments.Add(newBv);
+        } else {
+          arguments.Add(bv);
+        }
+      }
+      mc.Arguments = arguments;
+
+      // substitue the oldBv with newBv in the body
+      MatchCaseExprSubstituteCloner cloner = new MatchCaseExprSubstituteCloner(oldBv, newBv);
+      List<Statement> list = new List<Statement>();
+      foreach (Statement ss in mc.Body) {
+        Statement clone = cloner.CloneStmt(ss);
+        list.Add(clone);
+      }
+      mc.UpdateBody(list);
+    }
+
     void FillInDefaultLoopDecreases(LoopStmt loopStmt, Expression guard, List<Expression> theDecreases, ICallable enclosingMethod) {
       Contract.Requires(loopStmt != null);
       Contract.Requires(theDecreases != null);
@@ -7653,7 +7710,9 @@ namespace Microsoft.Dafny
       string name = FreshTempVarName("_mc#", opts.codeContext);
       BoundVar bv = new BoundVar(me.tok, name, type);
       List<CasePattern> patternSubst = new List<CasePattern>();
-      DesugarMatchCaseExpr(me, dtd, bv, patternSubst);
+      if (dtd != null) {
+        DesugarMatchCaseExpr(me, dtd, bv, patternSubst, opts.codeContext);
+      }
 
       ISet<string> memberNamesUsed = new HashSet<string>();
       expr.Type = new InferredTypeProxy();
@@ -7678,20 +7737,20 @@ namespace Microsoft.Dafny
         }
         scope.PushMarker();
         int i = 0;
-        foreach (BoundVar v in mc.Arguments) {
-          if (!scope.Push(v.Name, v)) {
-            Error(v, "Duplicate parameter name: {0}", v.Name);
-          }
-          ResolveType(v.tok, v.Type, opts.codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
-          if (ctor != null && i < ctor.Formals.Count) {
-            Formal formal = ctor.Formals[i];
-            Type st = SubstType(formal.Type, subst);
-            if (!UnifyTypes(v.Type, st)) {
-              Error(expr, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
+        if (mc.Arguments != null) {
+          foreach (BoundVar v in mc.Arguments) {
+            scope.Push(v.Name, v);
+            ResolveType(v.tok, v.Type, opts.codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
+            if (ctor != null && i < ctor.Formals.Count) {
+              Formal formal = ctor.Formals[i];
+              Type st = SubstType(formal.Type, subst);
+              if (!UnifyTypes(v.Type, st)) {
+                Error(expr, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
+              }
+              v.IsGhost = formal.IsGhost;
             }
-            v.IsGhost = formal.IsGhost;
+            i++;
           }
-          i++;
         }
         ResolveExpression(mc.Body, opts);
         // substitute body to replace the case pat with v. This needs to happen
@@ -7742,29 +7801,34 @@ namespace Microsoft.Dafny
       // (x, y) is treated as a 2-tuple constructor
       if (me.Source is DatatypeValue) {
         var e = (DatatypeValue)me.Source;
-        Contract.Assert(e.Arguments.Count >= 1);
-        Expression source = e.Arguments[0];
-        List<MatchCaseExpr> cases = new List<MatchCaseExpr>();
-        foreach (MatchCaseExpr mc in me.Cases) {
-          Contract.Assert(mc.CasePatterns != null);
-          Contract.Assert(mc.CasePatterns.Count == e.Arguments.Count);
-          CasePattern cp = mc.CasePatterns[0];
-          List<CasePattern> patterns;
-          if (cp.Arguments != null) {
-            patterns = cp.Arguments;
-          } else {
-            patterns = new List<CasePattern>();
-          }
+        if (e.Arguments.Count < 1) {
+          Error(me.tok, "match source tuple needs at least 1 argument");
+        } else {
+          Expression source = e.Arguments[0];
+          List<MatchCaseExpr> cases = new List<MatchCaseExpr>();
+          foreach (MatchCaseExpr mc in me.Cases) {
+            if (mc.CasePatterns == null || mc.CasePatterns.Count != e.Arguments.Count) {
+              Error(mc.tok, "case arguments count does not match source arguments count");
+            } else {
+              CasePattern cp = mc.CasePatterns[0];
+              List<CasePattern> patterns;
+              if (cp.Arguments != null) {
+                patterns = cp.Arguments;
+              } else {
+                patterns = new List<CasePattern>();
+              }
 
-          Expression body = mc.Body;
-          for (int i = e.Arguments.Count; 1 <= --i; ) {
-            // others go into the body
-            body = CreateMatchCaseExprBody(mc.tok, e.Arguments[i], mc.CasePatterns[i], body);
+              Expression body = mc.Body;
+              for (int i = e.Arguments.Count; 1 <= --i; ) {
+                // others go into the body
+                body = CreateMatchCaseExprBody(me.tok, e.Arguments[i], mc.CasePatterns[i], body);
+              }
+              cases.Add(new MatchCaseExpr(cp.tok, cp.Id, patterns, body));
+            }
           }
-          cases.Add(new MatchCaseExpr(cp.tok, cp.Id, patterns, body));
+          me.UpdateSource(source);
+          me.UpdateCases(cases);
         }
-        me.UpdateSource(source);
-        me.UpdateCases(cases);
       }
     }
 
@@ -7796,9 +7860,14 @@ namespace Microsoft.Dafny
      *       case Nil => y
      *       case Cons(z, zs) => last(ys)
      * */
-    void DesugarMatchCaseExpr(MatchExpr me, DatatypeDecl dtd, BoundVar sourceVar, List<CasePattern> patterns) {
+    void DesugarMatchCaseExpr(MatchExpr me, DatatypeDecl dtd, BoundVar sourceVar, List<CasePattern> patterns, ICodeContext codeContext) {
       Contract.Assert(dtd != null);
       Dictionary<string, DatatypeCtor> ctors = datatypeCtors[dtd];
+      if (ctors == null) {
+        // no constructors, there is no need to desugar
+        return;
+      }
+
       foreach (MatchCaseExpr mc in me.Cases) {
         if (mc.Arguments != null) {
           // already desugared. This happens during the second pass resolver after cloning.
@@ -7808,47 +7877,30 @@ namespace Microsoft.Dafny
 
         Contract.Assert(mc.Arguments == null);
         Contract.Assert(mc.CasePatterns != null);
+        Contract.Assert(ctors != null);
         DatatypeCtor ctor = null;
-        if (ctors != null) {
-          if (!ctors.TryGetValue(mc.Id, out ctor)) {
-            Error(mc.tok, "member {0} does not exist in datatype {1}", mc.Id, dtd.Name);
-          } else {
-            Contract.Assert(ctor != null);  // follows from postcondition of TryGetValue
-            mc.Ctor = ctor;
-            if (ctor.Formals.Count != mc.CasePatterns.Count) {
-              Error(mc.tok, "member {0} has wrong number of formals (found {1}, expected {2})", mc.Id, mc.CasePatterns.Count, ctor.Formals.Count);
-            }
-          }
-        }
-        scope.PushMarker();
-        List<BoundVar> arguments = new List<BoundVar>();
-        foreach (CasePattern pat in mc.CasePatterns) {
-          // Find the constructor in the given datatype
-          // If what was parsed was just an identifier, we will interpret it as a datatype constructor, if possible
-          ctor = null;
-          if (pat.Var == null || (pat.Var != null && pat.Var.Type is TypeProxy && dtd != null)) {
-            if (datatypeCtors[dtd].TryGetValue(pat.Id, out ctor)) {
-              pat.Ctor = ctor;
-              pat.Var = null;
-            }
-          }
-          if (pat.Var != null) {
-            BoundVar v = pat.Var;
-            arguments.Add(v);
-            if (!scope.Push(v.Name, v)) {
-              Error(v, "Duplicate name: {0}", v.Name);
+        if (ctors.TryGetValue(mc.Id, out ctor)) {
+          scope.PushMarker();
+          foreach (CasePattern pat in mc.CasePatterns) {
+            FindDuplicateIdentifier(pat, ctors, true);
+          }
+          List<BoundVar> arguments = new List<BoundVar>();
+          foreach (CasePattern pat in mc.CasePatterns) {
+            if (pat.Var != null) {
+              BoundVar v = pat.Var;
+              arguments.Add(v);
+            } else {
+              DesugarMatchCasePattern(mc, pat, sourceVar);
+              patterns.Add(pat);
+              arguments.Add(sourceVar);
             }
-          } else {
-            DesugarMatchCasePattern(mc, pat, sourceVar);
-            patterns.Add(pat);
-            arguments.Add(sourceVar);
           }
+          mc.Arguments = arguments;
+          mc.CasePatterns = null;
+          scope.PopMarker();
         }
-
-        mc.Arguments = arguments;
-        mc.CasePatterns = null;
-        scope.PopMarker();
       }
+      
 
       List<MatchCaseExpr> newCases = new List<MatchCaseExpr>();
       
@@ -7872,13 +7924,13 @@ namespace Microsoft.Dafny
         if (CaseExprHasWildCard(mc)) {
           mcWithWildCard.Add(mc);
         } else {
-          thingsChanged |= CombineMatchCaseExpr(mc, newCases, caseMap);
+          thingsChanged |= CombineMatchCaseExpr(mc, newCases, caseMap, codeContext);
         }
       }
 
       foreach (MatchCaseExpr mc in mcWithWildCard) {
         // now process with cases with wildcard
-        thingsChanged |= CombineMatchCaseExpr(mc, newCases, caseMap);
+        thingsChanged |= CombineMatchCaseExpr(mc, newCases, caseMap, codeContext);
       }      
 
       if (thingsChanged) {
@@ -7902,24 +7954,24 @@ namespace Microsoft.Dafny
 
 
     bool CaseExprHasWildCard(MatchCase mc) {
-      foreach (BoundVar bv in mc.Arguments) {
-        if (LocalVariable.HasWildcardName(bv)) {
-          return true;
+      if (mc.Arguments != null) {
+        foreach (BoundVar bv in mc.Arguments) {
+          if (LocalVariable.HasWildcardName(bv)) {
+            return true;
+          }
         }
       }
       return false;
     }
 
-    bool CombineMatchCaseExpr(MatchCaseExpr mc, List<MatchCaseExpr> newCases, Dictionary<string, MatchCaseExpr> caseMap) {
+    bool CombineMatchCaseExpr(MatchCaseExpr mc, List<MatchCaseExpr> newCases, Dictionary<string, MatchCaseExpr> caseMap, ICodeContext codeContext) {
       bool thingsChanged = false;
       MatchCaseExpr old_mc;
       if (caseMap.TryGetValue(mc.Id, out old_mc)) {
         // already has a case with the same ctor, try to consolidate the body.
-        Expression oldBody = old_mc.Body;
-        Expression body = mc.Body;
-        if (SameMatchCase(old_mc, mc)) {
-          MatchExpr old = (MatchExpr)oldBody;
-          MatchExpr current = (MatchExpr)body;
+        if (SameMatchCaseExpr(old_mc, mc, codeContext)) {
+          MatchExpr old = (MatchExpr)old_mc.Body;
+          MatchExpr current = (MatchExpr)mc.Body;
           foreach (MatchCaseExpr c in current.Cases) {
             old.Cases.Add(c);
           }
@@ -7935,7 +7987,7 @@ namespace Microsoft.Dafny
       return thingsChanged;
     }
 
-    bool SameMatchCase(MatchCaseExpr one, MatchCaseExpr other) {
+    bool SameMatchCaseExpr(MatchCaseExpr one, MatchCaseExpr other, ICodeContext codeContext) {
       // this method is called after all the CasePattern in the match cases are converted
       // into BoundVars.
       Contract.Assert(one.CasePatterns == null && one.Arguments != null);
@@ -7960,14 +8012,39 @@ namespace Microsoft.Dafny
       for (int i = 0; i < one.Arguments.Count; i++) {
         BoundVar bv1 = one.Arguments[i];
         BoundVar bv2 = other.Arguments[i];
-        if (!LocalVariable.HasWildcardName(bv1) && !LocalVariable.HasWildcardName(bv2) &&
-            !bv1.Name.Equals(bv2.Name)) {
-          return false;
+        if (!LocalVariable.HasWildcardName(bv1) && !LocalVariable.HasWildcardName(bv2)) {
+          if (!bv1.Name.Equals(bv2.Name)) {
+            // need to substitute bv2 with bv1 in the matchstmt body
+            // what if match body already has the bv?? need to make a new bv
+            Type type = new InferredTypeProxy();
+            string name = FreshTempVarName("_mc#", codeContext);
+            BoundVar bv = new BoundVar(one.tok, name, type);
+            SubstituteMatchCaseBoundVar(one, bv1, bv);
+            SubstituteMatchCaseBoundVar(other, bv2, bv);
+          }
         }
       }
       return true;
     }
 
+    void SubstituteMatchCaseBoundVar(MatchCaseExpr mc, BoundVar oldBv, BoundVar newBv) {
+      List<BoundVar> arguments = new List<BoundVar>();
+      for (int i = 0; i < mc.Arguments.Count; i++) {
+        BoundVar bv = mc.Arguments[i];
+        if (bv == oldBv) {
+          arguments.Add(newBv);
+        } else {
+          arguments.Add(bv);
+        }
+      }
+      mc.Arguments = arguments;
+
+      // substitue the oldBv with newBv in the body
+      MatchCaseExprSubstituteCloner cloner = new MatchCaseExprSubstituteCloner(oldBv, newBv);
+      Expression clone = cloner.CloneExpr(mc.Body);
+      mc.UpdateBody(clone);
+    }
+
     void ResolveCasePattern(CasePattern pat, Type sourceType, ICodeContext context) {
       Contract.Requires(pat != null);
       Contract.Requires(sourceType != null);
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 4e66915d..1dd985cb 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -1122,15 +1122,44 @@ namespace Microsoft.Dafny
   class MatchCaseExprSubstituteCloner : Cloner
   {
     private List<CasePattern> patternSubst;
+    private BoundVar oldvar;
     private BoundVar var;
 
     // the cloner is called after resolving the body of matchexpr, trying
     // to replace casepattern in the body that has been replaced by bv
     public MatchCaseExprSubstituteCloner(List<CasePattern> subst, BoundVar var) {
       this.patternSubst = subst;
+      this.oldvar = null;
       this.var = var;
     }
 
+    public MatchCaseExprSubstituteCloner(BoundVar oldvar, BoundVar var) {
+      this.patternSubst = null;
+      this.oldvar = oldvar;
+      this.var = var;
+    }
+
+    public override BoundVar CloneBoundVar(BoundVar bv) {
+      // replace bv with this.var is bv == oldvar
+      BoundVar bvNew;
+      if (oldvar != null && bv.Name.Equals(oldvar.Name)) {
+        bvNew = new BoundVar(Tok(bv.tok), oldvar.Name, CloneType(bv.Type));
+      } else {
+        bvNew = new BoundVar(Tok(bv.tok), bv.Name, CloneType(bv.Type));
+      }
+      bvNew.IsGhost = bv.IsGhost;
+      return bvNew;
+    }
+
+    public override NameSegment CloneNameSegment(Expression expr) {
+      var e = (NameSegment)expr;
+      if (oldvar != null && e.Name.Equals(oldvar.Name)) {
+        return new NameSegment(Tok(e.tok), var.Name, e.OptTypeArguments == null ? null : e.OptTypeArguments.ConvertAll(CloneType));
+      } else {
+        return new NameSegment(Tok(e.tok), e.Name, e.OptTypeArguments == null ? null : e.OptTypeArguments.ConvertAll(CloneType));
+      }
+    }
+
     public override Expression CloneApplySuffix(ApplySuffix e) {
       // if the ApplySuffix matches the CasePattern, then replace it with the BoundVar.
       if (FindMatchingPattern(e)) {
@@ -1141,6 +1170,9 @@ namespace Microsoft.Dafny
     }
 
     private bool FindMatchingPattern(ApplySuffix e) {
+      if (patternSubst == null) {
+        return false;
+      }
       Expression lhs = e.Lhs;
       if (!(lhs is NameSegment)) {
         return false;
@@ -1160,6 +1192,8 @@ namespace Microsoft.Dafny
             if (bv1 != arg2.Var) {
               found = false;
             }
+          } else {
+            found = false;
           }
         }
         if (found) {
diff --git a/Test/dafny0/NestedPatterns.dfy b/Test/dafny0/NestedPatterns.dfy
new file mode 100644
index 00000000..ef597936
--- /dev/null
+++ b/Test/dafny0/NestedPatterns.dfy
@@ -0,0 +1,124 @@
+// RUN: %dafny /compile:0  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+datatype List<T> = Nil | Cons(head: T, tail: List<T>)
+    
+method MethodA<T>(xs: List<T>) returns (ys: List<T>)
+{
+  match xs
+  case Nil =>
+    ys := Nil;
+  case Cons(h, Nil) =>
+    ys := Nil;
+  case Cons(h, Cons(h', tt)) => 
+    ys := tt;
+}
+    
+method MethodB<T>(xs: List<T>)
+{
+  match xs
+  case Nil =>
+  case Cons(h, Nil) =>
+    var x := 12;
+    var xxs := Cons(Nil, Nil);
+  case Cons(h, Cons(h', tt)) => 
+}
+    
+method MethodC<T>(xs: List<T>) returns (ys: List<T>)
+  requires xs.Cons? ==> !xs.tail.Cons?;
+{
+  match xs
+  case Nil =>
+    ys := Nil;
+  case Cons(h, Nil) =>
+    ys := Nil;
+}
+
+method MethodD<T>(xs: List<T>) returns (ys: List<T>)
+{
+  match xs
+  case Nil =>
+    ys := Nil;
+  case Cons(h, Nil) =>
+    var xxs: List<List<T>> := Cons(Nil, Nil);  // BUG: type inference is not doing the right thing on this lint
+  case Cons(h, Cons(h0, tt)) => 
+}
+
+method MethodE<T>(xs: List<T>) returns (ys: List<T>)
+{
+  var xxs: List<List<T>> := Cons(Nil, Nil);  // here it works! (but the same line in MethodD does not work)
+}
+
+method MethodF<T>(xs: List<T>) returns (ys: List<T>)
+  requires xs.Cons? ==> !xs.tail.Cons?;
+{
+  match xs
+  case Nil =>
+  case Cons(h, Nil) =>
+  case Cons(h0, Cons(h1, tt)) =>  // BUG: Dafny complains that Cons appears in more than one case; it seems to be due to the
+                                  // fact that the previous case uses identifier "h" as the first argument to Cons, whereas this
+                                  // line uses "h0"
+}
+
+method MethodG<T>(xs: List<T>) returns (xxs: List<List<T>>)
+{
+  match xs
+  case Nil =>
+    xxs := Cons(Nil, Nil);  // BUG: this causes there to be an "unresolved identifier: _mc#0" error; oddly enough, the error goes away if the third case is commented out
+  case Cons(h, t) =>
+  case Cons(h, Cons(ht, tt)) => 
+}
+
+method AssertionFailure(xs: List<T>)
+{
+  match xs
+  case (Nil) =>  // BUG: this line causes an assertion in the Dafny implementation (what should happen is that "(Nil)" should not be allowed here)
+  case (Cons(h, t)) =>  // BUG: ditto
+}
+
+method DuplicateIdentifierInPattern0<T>(xs: List<T>)
+{
+  match xs
+  case Nil =>
+  case Cons(h, Nil) =>
+  case Cons(h, Cons(_, h)) =>  // BUG:  this duplicate identifier name should give rise to an error (from the Resolver), but no error is reported
+}
+
+method DuplicateIdentifierInPattern1<T>(xs: List<T>)
+{
+  match xs
+  case Nil =>
+  case Cons(h, Nil) =>
+  case Cons(h, Cons(h, _)) =>  // BUG:  this duplicate identifier name should give rise to an error (from the Resolver), but no error is reported
+}
+
+method DuplicateIdentifierInPattern2<T>(xs: List<T>)
+{
+  match xs
+  case Nil =>
+  case Cons(h, Nil) =>
+  case Cons(h, Cons(e, e)) =>  // BUG:  here, the duplicate identifier is detected, but the error message is shown 3 times, which is less than ideal
+}
+
+method Tuples0(xs: List<T>, ys: List<T>)
+{
+  match (xs, ys)
+  case (Nil, Nil) =>
+  case (Cons(a, b), Nil) =>
+  case (Nil, Cons(x, y)) =>
+  case (Cons(a, b), Cons(x, y)) =>  // BUG: here and in some other places above, not all identifiers are highlighted in the Dafny IDE; it looks like
+                                    // only the identifiers in the last constructors are
+}
+
+method Tuples1(xs: List<T>, ys: List<T>)
+{
+  match (xs, ys, 4)
+  case (Nil, Nil) =>  // BUG: the mismatch of 3 versus 2 arguments in the previous line and this line causes Dafny to crash with an
+                      // assertion failure "mc.CasePatterns.Count == e.Arguments.Count"
+}
+
+method Tuples2(xs: List<T>, ys: List<T>)
+{
+  match (xs, ys, ())
+  case (Nil, Nil, ()) =>  // BUG: Dafny crashes with an assertion failure "e.Arguments.Count >= 1"
+}
diff --git a/Test/dafny0/NestedPatterns.dfy.expect b/Test/dafny0/NestedPatterns.dfy.expect
new file mode 100644
index 00000000..d83a7da1
--- /dev/null
+++ b/Test/dafny0/NestedPatterns.dfy.expect
@@ -0,0 +1,9 @@
+NestedPatterns.dfy(69,2): Error: member Cons appears in more than one case
+NestedPatterns.dfy(75,2): Error: member  does not exist in datatype List
+NestedPatterns.dfy(76,2): Error: member  does not exist in datatype List
+NestedPatterns.dfy(84,23): Error: Duplicate parameter name: h
+NestedPatterns.dfy(92,20): Error: Duplicate parameter name: h
+NestedPatterns.dfy(100,23): Error: Duplicate parameter name: e
+NestedPatterns.dfy(116,2): Error: case arguments count does not match source arguments count
+NestedPatterns.dfy(122,2): Error: match source tuple needs at least 1 argument
+8 resolution/type errors detected in NestedPatterns.dfy
-- 
cgit v1.2.3


From 819469c9ab3745ef6b99a08f9e4b08620b5c8ea5 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Mon, 22 Jun 2015 15:16:33 -0700
Subject: Fix issue #85. Only try to interpret an identifier as a datatype
 constructor when the datetype is not null.

---
 Source/Dafny/Resolver.cs | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 210e6f3d..ecb76ae8 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -8059,12 +8059,15 @@ namespace Microsoft.Dafny
       // Find the constructor in the given datatype
       // If what was parsed was just an identifier, we will interpret it as a datatype constructor, if possible
       DatatypeCtor ctor = null;
-      if (pat.Var == null || (pat.Var != null && pat.Var.Type is TypeProxy && dtd != null)) {
-        if (datatypeCtors[dtd].TryGetValue(pat.Id, out ctor)) {
-          pat.Ctor = ctor;
-          pat.Var = null;
+      if (dtd != null) {
+        if (pat.Var == null || (pat.Var != null && pat.Var.Type is TypeProxy)) {
+          if (datatypeCtors[dtd].TryGetValue(pat.Id, out ctor)) {
+            pat.Ctor = ctor;
+            pat.Var = null;
+          }
         }
       }
+        
 
       if (pat.Var != null) {
         // this is a simple resolution
-- 
cgit v1.2.3


From 91fa6b7d576a111f39cde20de5d8e612b4d712b5 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Thu, 25 Jun 2015 18:12:53 -0700
Subject: Tried to reduce frame-axiom instantiations by saying the earlier heap
 must be a "heap anchor". Currently, a heap is an anchor if it produced by a
 havoc (but not a direct update).

---
 Binaries/DafnyPrelude.bpl        |  3 ++-
 Source/Dafny/Translator.cs       | 29 +++++++++++++++++++----------
 Test/VSI-Benchmarks/b3.dfy       | 10 ++++++++--
 Test/VerifyThis2015/Problem3.dfy |  2 +-
 4 files changed, 30 insertions(+), 14 deletions(-)

(limited to 'Source')

diff --git a/Binaries/DafnyPrelude.bpl b/Binaries/DafnyPrelude.bpl
index ef6106e0..dbf9b76c 100644
--- a/Binaries/DafnyPrelude.bpl
+++ b/Binaries/DafnyPrelude.bpl
@@ -398,7 +398,8 @@ function {:inline true} read<alpha>(H:Heap, r:ref, f:Field alpha): alpha { H[r,
 function {:inline true} update<alpha>(H:Heap, r:ref, f:Field alpha, v:alpha): Heap { H[r,f := v] }
 
 function $IsGoodHeap(Heap): bool;
-var $Heap: Heap where $IsGoodHeap($Heap);
+function $IsHeapAnchor(Heap): bool;
+var $Heap: Heap where $IsGoodHeap($Heap) && $IsHeapAnchor($Heap);
 
 function $HeapSucc(Heap, Heap): bool;
 axiom (forall<alpha> h: Heap, r: ref, f: Field alpha, x: alpha :: { update(h, r, f, x) }
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 90d0b11c..4324b2b8 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -1761,7 +1761,7 @@ namespace Microsoft.Dafny {
       var oih = new Bpl.IdentifierExpr(iter.tok, "$_OldIterHeap", predef.HeapType);
       Bpl.Expr wh = BplAnd(
         FunctionCall(iter.tok, BuiltinFunction.IsGoodHeap, null, oih),
-        FunctionCall(iter.tok, BuiltinFunction.HeapSucc, null, oih, etran.HeapExpr));
+        HeapSucc(oih, etran.HeapExpr));
       localVariables.Add(new Bpl.LocalVariable(iter.tok, new Bpl.TypedIdent(iter.tok, "$_OldIterHeap", predef.HeapType, wh)));
 
       // do an initial YieldHavoc
@@ -3692,9 +3692,9 @@ namespace Microsoft.Dafny {
     /// <summary>
     /// Generates:
     ///   axiom (forall s, h0: HeapType, h1: HeapType, formals... ::
-    ///        { HeapSucc(h0,h1), F(s,h1,formals) }
+    ///        { IsHeapAnchor(h0), HeapSucc(h0,h1), F(s,h1,formals) }
     ///        heaps are well-formed and formals are allocated AND
-    ///        HeapSucc(h0,h1)
+    ///        IsHeapAnchor(h0) AND HeapSucc(h0,h1)
     ///        AND
     ///        (forall(alpha) o: ref, f: Field alpha ::
     ///            o != null AND h0[o,alloc] AND h1[o,alloc] AND
@@ -3813,7 +3813,8 @@ namespace Microsoft.Dafny {
         Bpl.Expr oNotNullAlloced = Bpl.Expr.And(oNotNull, Bpl.Expr.And(etran0.IsAlloced(f.tok, o), etran1.IsAlloced(f.tok, o)));
         Bpl.Expr unchanged = Bpl.Expr.Eq(ReadHeap(f.tok, h0, o, field), ReadHeap(f.tok, h1, o, field));
 
-        Bpl.Expr heapSucc = FunctionCall(f.tok, BuiltinFunction.HeapSucc, null, h0, h1);
+        Bpl.Expr h0IsHeapAnchor = FunctionCall(h0.tok, BuiltinFunction.IsHeapAnchor, null, h0);
+        Bpl.Expr heapSucc = HeapSucc(h0, h1);
         Bpl.Expr r0 = InRWClause(f.tok, o, field, f.Reads, etran0, null, null);
         Bpl.Expr q0 = new Bpl.ForallExpr(f.tok, new List<TypeVariable> { alpha }, new List<Variable> { oVar, fieldVar },
           Bpl.Expr.Imp(Bpl.Expr.And(oNotNullAlloced, r0), unchanged));
@@ -3873,11 +3874,11 @@ namespace Microsoft.Dafny {
         var F0 = new Bpl.NAryExpr(f.tok, fn, f0args);
         var F1 = new Bpl.NAryExpr(f.tok, fn, f1args);
         var eq = Bpl.Expr.Eq(F0, F1);
-        var tr = new Bpl.Trigger(f.tok, true, new List<Bpl.Expr> { heapSucc, F1 });
+        var tr = new Bpl.Trigger(f.tok, true, new List<Bpl.Expr> { h0IsHeapAnchor, heapSucc, F1 });
 
         var typeParams = TrTypeParamDecls(f.TypeArgs);
         var ax = new Bpl.ForallExpr(f.tok, typeParams, bvars, null, tr,
-          Bpl.Expr.Imp(Bpl.Expr.And(wellFormed, heapSucc),
+          Bpl.Expr.Imp(Bpl.Expr.And(wellFormed, Bpl.Expr.And(h0IsHeapAnchor, heapSucc)),
           Bpl.Expr.Imp(q0, eq)));
         sink.AddTopLevelDeclaration(new Bpl.Axiom(f.tok, ax, comment));
 #endif
@@ -5829,7 +5830,7 @@ namespace Microsoft.Dafny {
 
           var h0 = BplBoundVar("h0", predef.HeapType, bvars);
           var h1 = BplBoundVar("h1", predef.HeapType, bvars);
-          var heapSucc = FunctionCall(tok, BuiltinFunction.HeapSucc, null, h0, h1);
+          var heapSucc = HeapSucc(h0, h1);
           var goodHeaps = BplAnd(
             FunctionCall(tok, BuiltinFunction.IsGoodHeap, null, h0),
             FunctionCall(tok, BuiltinFunction.IsGoodHeap, null, h1));
@@ -6683,7 +6684,7 @@ namespace Microsoft.Dafny {
         // the frame condition, which is free since it is checked with every heap update and call
         boilerplate.Add(new BoilerplateTriple(tok, true, FrameCondition(tok, modifiesClause, isGhostContext, etranPre, etran, etranMod), null, "frame condition"));
         // HeapSucc(S1, S2) or HeapSuccGhost(S1, S2)
-        Bpl.Expr heapSucc = FunctionCall(tok, isGhostContext ? BuiltinFunction.HeapSuccGhost : BuiltinFunction.HeapSucc, null, etranPre.HeapExpr, etran.HeapExpr);
+        Bpl.Expr heapSucc = HeapSucc(etranPre.HeapExpr, etran.HeapExpr, isGhostContext);
         boilerplate.Add(new BoilerplateTriple(tok, true, heapSucc, null, "boilerplate"));
       }
       return boilerplate;
@@ -7316,7 +7317,7 @@ namespace Microsoft.Dafny {
           // havoc $Heap;
           builder.Add(new Bpl.HavocCmd(s.Tok, new List<Bpl.IdentifierExpr> { (Bpl.IdentifierExpr/*TODO: this cast is rather dubious*/)etran.HeapExpr }));
           // assume $HeapSucc(preModifyHeap, $Heap);   OR $HeapSuccGhost
-          builder.Add(new Bpl.AssumeCmd(s.Tok, FunctionCall(s.Tok, s.IsGhost ? BuiltinFunction.HeapSuccGhost : BuiltinFunction.HeapSucc, null, preModifyHeap, etran.HeapExpr)));
+          builder.Add(new Bpl.AssumeCmd(s.Tok, HeapSucc(preModifyHeap, etran.HeapExpr, s.IsGhost)));
           // assume nothing outside the frame was changed
           var etranPreLoop = new ExpressionTranslator(this, predef, preModifyHeap);
           var updatedFrameEtran = new ExpressionTranslator(etran, modifyFrameName);
@@ -7867,7 +7868,7 @@ namespace Microsoft.Dafny {
       var prevEtran = new ExpressionTranslator(this, predef, prevHeap);
       updater.Add(Bpl.Cmd.SimpleAssign(s.Tok, prevHeap, etran.HeapExpr));
       updater.Add(new Bpl.HavocCmd(s.Tok, new List<Bpl.IdentifierExpr> { (Bpl.IdentifierExpr/*TODO: this cast is rather dubious*/)etran.HeapExpr }));
-      updater.Add(new Bpl.AssumeCmd(s.Tok, FunctionCall(s.Tok, BuiltinFunction.HeapSucc, null, prevHeap, etran.HeapExpr)));
+      updater.Add(new Bpl.AssumeCmd(s.Tok, HeapSucc(prevHeap, etran.HeapExpr)));
 
       // Here comes:
       //   assume (forall<alpha> o: ref, f: Field alpha ::
@@ -11913,6 +11914,7 @@ namespace Microsoft.Dafny {
       IntToReal,
 
       IsGoodHeap,
+      IsHeapAnchor,
       HeapSucc,
       HeapSuccGhost,
 
@@ -12293,6 +12295,10 @@ namespace Microsoft.Dafny {
           Contract.Assert(args.Length == 1);
           Contract.Assert(typeInstantiation == null);
           return FunctionCall(tok, "$IsGoodHeap", Bpl.Type.Bool, args);
+        case BuiltinFunction.IsHeapAnchor:
+          Contract.Assert(args.Length == 1);
+          Contract.Assert(typeInstantiation == null);
+          return FunctionCall(tok, "$IsHeapAnchor", Bpl.Type.Bool, args);
         case BuiltinFunction.HeapSucc:
           Contract.Assert(args.Length == 2);
           Contract.Assert(typeInstantiation == null);
@@ -14131,6 +14137,9 @@ namespace Microsoft.Dafny {
         Bpl.Expr.Eq(oldHeap, newHeap),
         FunctionCall(newHeap.tok, BuiltinFunction.HeapSucc, null, oldHeap, newHeap));
     }
+    Bpl.Expr HeapSucc(Bpl.Expr oldHeap, Bpl.Expr newHeap, bool useGhostHeapSucc = false) {
+      return FunctionCall(newHeap.tok, useGhostHeapSucc ? BuiltinFunction.HeapSuccGhost : BuiltinFunction.HeapSucc, null, oldHeap, newHeap);
+    }
 
     // Bpl-making-utilities
 
diff --git a/Test/VSI-Benchmarks/b3.dfy b/Test/VSI-Benchmarks/b3.dfy
index f59b0c3e..d47c4d4d 100644
--- a/Test/VSI-Benchmarks/b3.dfy
+++ b/Test/VSI-Benchmarks/b3.dfy
@@ -96,7 +96,7 @@ class Benchmark3 {
       if x < m { k := j; m := x; }
       j := j+1;
     }
-    
+
     j := 0;
     while j < k
       invariant j <= k;
@@ -108,10 +108,16 @@ class Benchmark3 {
       RotationLemma(old(q.contents), j, qc0, q.contents);
       j := j+1;
     }
-  
+
     assert j == k;  
     assert q.contents == old(q.contents)[k..] + old(q.contents)[..k];
+    ghost var qq := q.contents;
     m := q.Dequeue();
+    assert q.contents == qq[1..] && m == qq[0];
+    assert [m] + q.contents == qq;
+    assert |old(q.contents)| == |q.contents| + 1;
+
+    assert q.contents == old(q.contents)[k+1..] + old(q.contents)[..k];  
   }
 
   lemma RotationLemma(O: seq, j: nat, A: seq, C: seq)
diff --git a/Test/VerifyThis2015/Problem3.dfy b/Test/VerifyThis2015/Problem3.dfy
index 4205035d..10ad2d3a 100644
--- a/Test/VerifyThis2015/Problem3.dfy
+++ b/Test/VerifyThis2015/Problem3.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" /vcsMaxKeepGoingSplits:5 "%s" > "%t"
+// RUN: %dafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // Rustan Leino
-- 
cgit v1.2.3


From 3ca52e0f1bdc1ee0edfe19f774661bf02bf0e6b3 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Mon, 29 Jun 2015 15:18:31 -0700
Subject: Fix identifiers in nested match patterns not showing in the IDE bug.
 Remember BoundVars that are combined in rewriting of the nested match
 patterns so they show up in the IDE correctly.

---
 Source/Dafny/Resolver.cs                  | 96 +++++++++++++++++++++++++++----
 Source/Dafny/Rewriter.cs                  | 46 +++++++++++++--
 Source/DafnyExtension/IdentifierTagger.cs | 24 +++++++-
 3 files changed, 147 insertions(+), 19 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index ecb76ae8..835871d9 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -5244,7 +5244,8 @@ namespace Microsoft.Dafny
       // convert CasePattern in MatchCaseExpr to BoundVar and flatten the MatchCaseExpr.
       Type type = new InferredTypeProxy();
       string name = FreshTempVarName("_mc#", codeContext);
-      BoundVar bv = new BoundVar(s.Tok, name, type);
+      MatchCaseToken mcToken = new MatchCaseToken(s.Tok);
+      BoundVar bv = new BoundVar(mcToken, name, type);
       List<CasePattern> patternSubst = new List<CasePattern>();
       if (dtd != null) {
         DesugarMatchCaseStmt(s, dtd, bv, patternSubst, codeContext);
@@ -5283,6 +5284,14 @@ namespace Microsoft.Dafny
                 Error(stmt, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
               }
               v.IsGhost = formal.IsGhost;
+
+              // update the type of the boundvars in the MatchCaseToken
+              if (v.tok is MatchCaseToken) {
+                MatchCaseToken mt = (MatchCaseToken)v.tok;
+                foreach (Tuple<IToken, BoundVar, bool> entry in mt.varList) {
+                  UnifyTypes(entry.Item2.Type, v.Type);
+                }
+              }
             }
             i++;
           }
@@ -5331,11 +5340,11 @@ namespace Microsoft.Dafny
      *    case (Suc(a), Suc(b)) => minus(a, b)
      * To:  
      *  match x
-     *    case Zero => match y
+     *    case Zero => match y (originalToken)
      *        case _ => zero
-     *    case Suc(_) => match y
+     *    case Suc(_) => match y (AutoGeneratedToken)
      *        case Zero => x
-     *    case Suc(a) => match y
+     *    case Suc(a) => match y (AutoGeneratedToken)
       *        case (b) => minus(a,b)
      */    
     void DesugarMatchStmtWithTupleExpression(MatchStmt me) {
@@ -5347,6 +5356,9 @@ namespace Microsoft.Dafny
         } else {
           Expression source = e.Arguments[0];
           List<MatchCaseStmt> cases = new List<MatchCaseStmt>();
+          // only keep the token for the first appearance, use autogenerated for the rest, otherwise more than one hovertext
+          // will show up in the IDE.
+          bool keepOrigToken = true; 
           foreach (MatchCaseStmt mc in me.Cases) {
             if (mc.CasePatterns == null || mc.CasePatterns.Count != e.Arguments.Count) {
               Error(mc.tok, "case arguments count does not match source arguments count");
@@ -5362,9 +5374,10 @@ namespace Microsoft.Dafny
               List<Statement> body = mc.Body;
               for (int i = e.Arguments.Count; 1 <= --i; ) {
                 // others go into the body
-                body = CreateMatchCaseStmtBody(me.Tok, e.Arguments[i], mc.CasePatterns[i], body);
+                body = CreateMatchCaseStmtBody(me.Tok, e.Arguments[i], mc.CasePatterns[i], body, keepOrigToken);
               }
               cases.Add(new MatchCaseStmt(cp.tok, cp.Id, patterns, body));
+              keepOrigToken = false;
             }
           }
           me.UpdateSource(source);
@@ -5373,7 +5386,7 @@ namespace Microsoft.Dafny
       }
     }
 
-    List<Statement> CreateMatchCaseStmtBody(Boogie.IToken tok, Expression source, CasePattern cp, List<Statement> body) {
+    List<Statement> CreateMatchCaseStmtBody(Boogie.IToken tok, Expression source, CasePattern cp, List<Statement> body, bool keepToken) {
       List<MatchCaseStmt> cases = new List<MatchCaseStmt>();
       List<CasePattern> patterns;
       if (cp.Var != null) {
@@ -5387,6 +5400,10 @@ namespace Microsoft.Dafny
         patterns = cp.Arguments;
       }
       cases.Add(new MatchCaseStmt(cp.tok, cp.Id, patterns, body));
+      if (!keepToken) {
+        AutoGeneratedTokenCloner cloner = new AutoGeneratedTokenCloner();
+        source = cloner.CloneExpr(source);
+      }
       List<Statement> list = new List<Statement>();
       // endTok??
       list.Add(new MatchStmt(tok, tok, source, cases, false));
@@ -5522,7 +5539,7 @@ namespace Microsoft.Dafny
       //    case Cons(y, #mc#) => match #mc#
       //            case Cons(z, zs) => body
 
-      Expression source = new NameSegment(pat.tok, v.Name, null);
+      Expression source = new NameSegment(new AutoGeneratedToken(pat.tok), v.Name, null);
       List<MatchCaseStmt> cases = new List<MatchCaseStmt>();
       cases.Add(new MatchCaseStmt(pat.tok, pat.Id, pat.Arguments == null ? new List<CasePattern>() : pat.Arguments, mc.Body));
       List<Statement> list = new List<Statement>();
@@ -5547,6 +5564,27 @@ namespace Microsoft.Dafny
             foreach (MatchCaseStmt c in current.Cases) {
               old.Cases.Add(c);
             }
+            // add the token from mc to old_mc so the identifiers will show correctly in the IDE
+            List<BoundVar> arguments = new List<BoundVar>();
+            Contract.Assert(old_mc.Arguments.Count == mc.Arguments.Count);
+            for (int i = 0; i < old_mc.Arguments.Count; i++) {
+              var bv = old_mc.Arguments[i];
+              MatchCaseToken mcToken;
+              if (!(bv.tok is MatchCaseToken)) {
+                // create a MatchCaseToken
+                mcToken = new MatchCaseToken(bv.tok);
+                // clone the bv but with the MatchCaseToken
+                var bvNew = new BoundVar(mcToken, bv.Name, bv.Type);
+                bvNew.IsGhost = bv.IsGhost;
+                arguments.Add(bvNew);
+              } else {
+                mcToken = (MatchCaseToken)bv.tok;
+                arguments.Add(bv);
+              }
+              mcToken.AddVar(bv.tok, bv, true);
+              mcToken.AddVar(mc.Arguments[i].tok, mc.Arguments[i], true);
+            }
+            old_mc.Arguments = arguments;
             thingsChanged = true;
           }
         } else {
@@ -5596,7 +5634,9 @@ namespace Microsoft.Dafny
             // what if match body already has the bv?? need to make a new bv
             Type type = new InferredTypeProxy();
             string name = FreshTempVarName("_mc#", codeContext);
-            BoundVar bv = new BoundVar(one.tok, name, type);
+            BoundVar bv = new BoundVar(new MatchCaseToken(one.tok), name, type);
+            ((MatchCaseToken)bv.tok).AddVar(bv1.tok, bv1, true);
+            ((MatchCaseToken)bv.tok).AddVar(bv2.tok, bv2, true);
             SubstituteMatchCaseBoundVar(one, bv1, bv);
             SubstituteMatchCaseBoundVar(other, bv2, bv);
           }
@@ -7708,7 +7748,7 @@ namespace Microsoft.Dafny
       // convert CasePattern in MatchCaseExpr to BoundVar and flatten the MatchCaseExpr.
       Type type = new InferredTypeProxy();
       string name = FreshTempVarName("_mc#", opts.codeContext);
-      BoundVar bv = new BoundVar(me.tok, name, type);
+      BoundVar bv = new BoundVar(new MatchCaseToken(me.tok), name, type);
       List<CasePattern> patternSubst = new List<CasePattern>();
       if (dtd != null) {
         DesugarMatchCaseExpr(me, dtd, bv, patternSubst, opts.codeContext);
@@ -7748,6 +7788,14 @@ namespace Microsoft.Dafny
                 Error(expr, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
               }
               v.IsGhost = formal.IsGhost;
+
+              // update the type of the boundvars in the MatchCaseToken
+              if (v.tok is MatchCaseToken) {
+                MatchCaseToken mt = (MatchCaseToken)v.tok;
+                foreach (Tuple<IToken, BoundVar, bool> entry in mt.varList) {
+                  UnifyTypes(entry.Item2.Type, v.Type);
+                }
+              }
             }
             i++;
           }
@@ -7945,7 +7993,7 @@ namespace Microsoft.Dafny
       //    case Cons(y, #mc#) => match #mc#
       //            case Cons(z, zs) => body
 
-      Expression source = new NameSegment(pat.tok, v.Name, null);
+      Expression source = new NameSegment(new AutoGeneratedToken(pat.tok), v.Name, null);
       List<MatchCaseExpr> cases = new List<MatchCaseExpr>(); 
       cases.Add(new MatchCaseExpr(pat.tok, pat.Id, pat.Arguments == null ? new List<CasePattern>() : pat.Arguments, mc.Body));
       MatchExpr e = new MatchExpr(pat.tok, source, cases, false);
@@ -7975,6 +8023,27 @@ namespace Microsoft.Dafny
           foreach (MatchCaseExpr c in current.Cases) {
             old.Cases.Add(c);
           }
+          // add the token from mc to old_mc so the identifiers will show correctly in the IDE
+          List<BoundVar> arguments = new List<BoundVar>();
+          Contract.Assert(old_mc.Arguments.Count == mc.Arguments.Count);
+          for (int i = 0; i < old_mc.Arguments.Count; i++) {
+            var bv = old_mc.Arguments[i];
+            MatchCaseToken mcToken;
+            if (!(bv.tok is MatchCaseToken)) {
+              // create a MatchCaseToken
+              mcToken = new MatchCaseToken(bv.tok);
+              // clone the bv but with the MatchCaseToken
+              var bvNew = new BoundVar(mcToken, bv.Name, bv.Type);
+              bvNew.IsGhost = bv.IsGhost;
+              arguments.Add(bvNew);
+            } else {
+              mcToken = (MatchCaseToken)bv.tok;
+              arguments.Add(bv);
+            }
+            mcToken.AddVar(bv.tok, bv, true);
+            mcToken.AddVar(mc.Arguments[i].tok, mc.Arguments[i], true);
+          }
+          old_mc.Arguments = arguments;
           thingsChanged = true;
         } else {
           // duplicate cases, do nothing for now. The error will be reported during resolving
@@ -7987,6 +8056,7 @@ namespace Microsoft.Dafny
       return thingsChanged;
     }
 
+
     bool SameMatchCaseExpr(MatchCaseExpr one, MatchCaseExpr other, ICodeContext codeContext) {
       // this method is called after all the CasePattern in the match cases are converted
       // into BoundVars.
@@ -8018,7 +8088,11 @@ namespace Microsoft.Dafny
             // what if match body already has the bv?? need to make a new bv
             Type type = new InferredTypeProxy();
             string name = FreshTempVarName("_mc#", codeContext);
-            BoundVar bv = new BoundVar(one.tok, name, type);
+            MatchCaseToken mcToken = new MatchCaseToken(one.tok);
+            BoundVar bv = new BoundVar(mcToken, name, type);
+            mcToken.AddVar(bv1.tok, bv1, true);
+            mcToken.AddVar(bv2.tok, bv2, true);
+            // substitute the appeareance of old bv with the new bv in the match case
             SubstituteMatchCaseBoundVar(one, bv1, bv);
             SubstituteMatchCaseBoundVar(other, bv2, bv);
           }
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 1dd985cb..9eb6bac2 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -2,6 +2,7 @@
 using System.Collections.Generic;
 using System.Diagnostics.Contracts;
 using Bpl = Microsoft.Boogie;
+using IToken = Microsoft.Boogie.IToken;
 
 namespace Microsoft.Dafny
 {
@@ -1140,10 +1141,10 @@ namespace Microsoft.Dafny
     }
 
     public override BoundVar CloneBoundVar(BoundVar bv) {
-      // replace bv with this.var is bv == oldvar
+      // replace bv with this.var if bv == oldvar
       BoundVar bvNew;
       if (oldvar != null && bv.Name.Equals(oldvar.Name)) {
-        bvNew = new BoundVar(Tok(bv.tok), oldvar.Name, CloneType(bv.Type));
+        bvNew = new BoundVar(new AutoGeneratedToken(bv.tok), var.Name, CloneType(bv.Type));
       } else {
         bvNew = new BoundVar(Tok(bv.tok), bv.Name, CloneType(bv.Type));
       }
@@ -1154,7 +1155,7 @@ namespace Microsoft.Dafny
     public override NameSegment CloneNameSegment(Expression expr) {
       var e = (NameSegment)expr;
       if (oldvar != null && e.Name.Equals(oldvar.Name)) {
-        return new NameSegment(Tok(e.tok), var.Name, e.OptTypeArguments == null ? null : e.OptTypeArguments.ConvertAll(CloneType));
+        return new NameSegment(new AutoGeneratedToken(e.tok), var.Name, e.OptTypeArguments == null ? null : e.OptTypeArguments.ConvertAll(CloneType));
       } else {
         return new NameSegment(Tok(e.tok), e.Name, e.OptTypeArguments == null ? null : e.OptTypeArguments.ConvertAll(CloneType));
       }
@@ -1162,14 +1163,22 @@ namespace Microsoft.Dafny
 
     public override Expression CloneApplySuffix(ApplySuffix e) {
       // if the ApplySuffix matches the CasePattern, then replace it with the BoundVar.
-      if (FindMatchingPattern(e)) {
-        return new NameSegment(e.tok, this.var.Name, null);
+      CasePattern cp = null;
+      if (FindMatchingPattern(e, out cp)) {
+        if (this.var.tok is MatchCaseToken) {
+          Contract.Assert(e.Args.Count == cp.Arguments.Count);
+          for (int i = 0; i < e.Args.Count; i++) {
+            ((MatchCaseToken)this.var.tok).AddVar(e.Args[i].tok, cp.Arguments[i].Var, false);
+          }
+        }
+        return new NameSegment(new AutoGeneratedToken(e.tok), this.var.Name, null);
       } else {
         return new ApplySuffix(Tok(e.tok), CloneExpr(e.Lhs), e.Args.ConvertAll(CloneExpr));
       }
     }
 
-    private bool FindMatchingPattern(ApplySuffix e) {
+    private bool FindMatchingPattern(ApplySuffix e, out CasePattern pattern) {
+      pattern = null;
       if (patternSubst == null) {
         return false;
       }
@@ -1197,12 +1206,37 @@ namespace Microsoft.Dafny
           }
         }
         if (found) {
+          pattern = cp;
           return true;
         }
       }
       return false;
     }
   }
+
+  // MatchCaseToken is used to record BoundVars that are consolidated due to rewrite of
+  // nested match patterns. We want to record the original BoundVars that are consolidated
+  // so that they will show up in the IDE correctly.
+  public class MatchCaseToken : AutoGeneratedToken
+  {
+    public readonly List<Tuple<IToken, BoundVar, bool>> varList;
+    public MatchCaseToken(IToken tok)
+      : base(tok) {
+      varList = new List<Tuple<IToken, BoundVar, bool>>();
+    }
+
+    public void AddVar(IToken tok, BoundVar var, bool isDefinition) {
+      varList.Add(new Tuple<IToken, BoundVar, bool>(tok, var, isDefinition));
+    }
+  }
+
+  // A cloner that replace the original token with AutoGeneratedToken.
+  class AutoGeneratedTokenCloner : Cloner
+  {
+    public override IToken Tok(IToken tok) {
+      return new AutoGeneratedToken(tok);
+    }
+  }
 }
 
 
diff --git a/Source/DafnyExtension/IdentifierTagger.cs b/Source/DafnyExtension/IdentifierTagger.cs
index 086ac8e4..262dddcd 100644
--- a/Source/DafnyExtension/IdentifierTagger.cs
+++ b/Source/DafnyExtension/IdentifierTagger.cs
@@ -270,7 +270,17 @@ namespace DafnyLanguage
       } else if (expr is MatchExpr) {
         var e = (MatchExpr)expr;
         foreach (var kase in e.Cases) {
-          kase.Arguments.ForEach(bv => IdRegion.Add(regions, bv.tok, bv, true, module));
+          kase.Arguments.ForEach(bv => {
+            IdRegion.Add(regions, bv.tok, bv, true, module);
+            // if the arguments is an encapsulation of different boundvars from nested match cases,
+            // add the boundvars so that they can show up in the IDE correctly
+            if (bv.tok is MatchCaseToken) {
+              MatchCaseToken mt = (MatchCaseToken)bv.tok;
+              foreach(Tuple<Bpl.IToken, BoundVar, bool> entry in mt.varList) {
+                IdRegion.Add(regions, entry.Item1, entry.Item2, entry.Item3, module);
+              }
+            }
+          });
         }
       } else if (expr is ChainingExpression) {
         var e = (ChainingExpression)expr;
@@ -313,7 +323,17 @@ namespace DafnyLanguage
       } else if (stmt is MatchStmt) {
         var s = (MatchStmt)stmt;
         foreach (var kase in s.Cases) {
-          kase.Arguments.ForEach(bv => IdRegion.Add(regions, bv.tok, bv, true, module));
+          kase.Arguments.ForEach(bv => {
+            IdRegion.Add(regions, bv.tok, bv, true, module);
+            // if the arguments is an encapsulation of different boundvars from nested match cases,
+            // add the boundvars so that they can show up in the IDE correctly
+            if (bv.tok is MatchCaseToken) {
+              MatchCaseToken mt = (MatchCaseToken)bv.tok;
+              foreach (Tuple<Bpl.IToken, BoundVar, bool> entry in mt.varList) {
+                IdRegion.Add(regions, entry.Item1, entry.Item2, entry.Item3, module);
+              }
+            }              
+          });
         }
       } else if (stmt is LoopStmt) {
         var s = (LoopStmt)stmt;
-- 
cgit v1.2.3


From 1697a133cababe66fef1fbf7a1ed9036255d8e68 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Tue, 30 Jun 2015 23:42:57 -0700
Subject: Fixed bugs in encoding of preconditions of function values, Issue
 #84.

---
 Source/Dafny/Translator.cs    | 43 ++++++++---------------
 Test/hofs/Naked.dfy           | 10 +++---
 Test/hofs/Naked.dfy.expect    |  8 ++---
 Test/hofs/Requires.dfy        | 82 +++++++++++++++++++++++++++++++++++++++++++
 Test/hofs/Requires.dfy.expect |  5 +++
 Test/hofs/Simple.dfy.expect   |  5 +--
 6 files changed, 109 insertions(+), 44 deletions(-)
 create mode 100644 Test/hofs/Requires.dfy
 create mode 100644 Test/hofs/Requires.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 4324b2b8..c98bd203 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -2176,13 +2176,6 @@ namespace Microsoft.Dafny {
       foreach (Expression req in f.Req) {
         pre = BplAnd(pre, etran.TrExpr(Substitute(req, null, substMap)));
       }
-      // useViaContext: (mh != ModuleContextHeight || fh != FunctionContextHeight)
-      ModuleDefinition mod = f.EnclosingClass.Module;
-      Bpl.Expr useViaContext = visibility == FunctionAxiomVisibility.ForeignModuleOnly ? (Bpl.Expr)Bpl.Expr.True :
-        Bpl.Expr.Neq(Bpl.Expr.Literal(mod.CallGraph.GetSCCRepresentativeId(f)), etran.FunctionContextHeight());
-
-      // ante := (useViaContext && typeAnte && pre)
-      ante = BplAnd(useViaContext, BplAnd(ante, pre));
 
       // Add the precondition function and its axiom (which is equivalent to the ante)
       if (body == null || (visibility == FunctionAxiomVisibility.IntraModuleOnly && lits == null)) {
@@ -2195,14 +2188,21 @@ namespace Microsoft.Dafny {
         }
         var appl = FunctionCall(f.tok, RequiresName(f), Bpl.Type.Bool,
           formals.ConvertAll(x => (Bpl.Expr)(new Bpl.IdentifierExpr(f.tok, x))));
-        sink.AddTopLevelDeclaration(new Axiom(f.tok, BplForall(formals, BplTrigger(appl), Bpl.Expr.Eq(appl, ante))));
-        // you could use it to check that it always works, but it makes VSI-Benchmarks/b3.dfy time out:
-        // ante = appl;
+        // axiom (forall params :: { f#requires(params) }  ante ==> f#requires(params) == pre);
+        sink.AddTopLevelDeclaration(new Axiom(f.tok, BplForall(formals, BplTrigger(appl),
+          BplImp(ante, Bpl.Expr.Eq(appl, pre)))));
         if (body == null) {
           return null;
         }
       }
 
+      // useViaContext: (mh != ModuleContextHeight || fh != FunctionContextHeight)
+      ModuleDefinition mod = f.EnclosingClass.Module;
+      Bpl.Expr useViaContext = visibility == FunctionAxiomVisibility.ForeignModuleOnly ? (Bpl.Expr)Bpl.Expr.True :
+        Bpl.Expr.Neq(Bpl.Expr.Literal(mod.CallGraph.GetSCCRepresentativeId(f)), etran.FunctionContextHeight());
+      // ante := (useViaContext && typeAnte && pre)
+      ante = BplAnd(useViaContext, BplAnd(ante, pre));
+
       // useViaCanCall: f#canCall(args)
       Bpl.IdentifierExpr canCallFuncID = new Bpl.IdentifierExpr(f.tok, f.FullSanitizedName + "#canCall", Bpl.Type.Bool);
       Bpl.Expr useViaCanCall = new Bpl.NAryExpr(f.tok, new Bpl.FunctionCall(canCallFuncID), Concat(tyargs,args));
@@ -5632,7 +5632,6 @@ namespace Microsoft.Dafny {
         {
           // Requires(Ty.., F#Handle( Ty1, ..., TyN, Layer, self), Heap, arg1, ..., argN)
           //   = F#Requires(Ty1, .., TyN, Layer, Heap, self, [Unbox] arg1, .., [Unbox] argN)
-          //   || Scramble(...)
 
           var fhandle = FunctionCall(f.tok, name, predef.HandleType, SnocSelf(args));
           var lhs = FunctionCall(f.tok, Requires(arity), Bpl.Type.Bool, Concat(tyargs, Cons(fhandle, Cons(h, lhs_args))));
@@ -5641,9 +5640,7 @@ namespace Microsoft.Dafny {
             // In case this is the /requires/ or /reads/ function, then there is no precondition
             rhs = Bpl.Expr.True;
           } else {
-            rhs = BplOr(
-              FunctionCall(f.tok, RequiresName(f), Bpl.Type.Bool, Concat(SnocSelf(Snoc(args, h)), rhs_args)),
-              MakeScrambler(f.tok, f.FullSanitizedName + "#lessReq", Concat(vars, bvars)));
+            rhs = FunctionCall(f.tok, RequiresName(f), Bpl.Type.Bool, Concat(SnocSelf(Snoc(args, h)), rhs_args));
           }
 
           sink.AddTopLevelDeclaration(new Axiom(f.tok,
@@ -5671,15 +5668,6 @@ namespace Microsoft.Dafny {
       return name;
     }
 
-    public Bpl.Expr MakeScrambler(IToken tk, string name, List<Variable> bvars) {
-      var f = new Bpl.Function(tk, name,
-        bvars.ConvertAll(bv => (Bpl.Variable)BplFormalVar(null, bv.TypedIdent.Type, true)),
-        BplFormalVar(null, Bpl.Type.Bool, false));
-
-      sink.AddTopLevelDeclaration(f);
-      return FunctionCall(tk, name, Bpl.Type.Bool, bvars.ConvertAll(bv => (Bpl.Expr)new Bpl.IdentifierExpr(tk, bv)));
-    }
-
     private void AddArrowTypeAxioms(ArrowTypeDecl ad) {
       Contract.Requires(ad != null);
       var arity = ad.Arity;
@@ -11476,11 +11464,8 @@ namespace Microsoft.Dafny {
         var rdvars = new List<Bpl.Variable>();
         var o = translator.UnboxIfBoxed(BplBoundVar(varNameGen.FreshId("#o#"), predef.BoxType, rdvars), new ObjectType());
 
-        Bpl.Expr ante = Bpl.Expr.And(Bpl.Expr.Neq(o, predef.Null), et.IsAlloced(e.tok, o));
-        Bpl.Expr consequent = translator.InRWClause(e.tok, o, null, e.Reads.ConvertAll(su.SubstFrameExpr), et, null, null);
-        Bpl.Expr rdbody =
-          new Bpl.LambdaExpr(e.tok, new List<TypeVariable>(), rdvars, null,
-            BplImp(ante, consequent));
+        Bpl.Expr rdbody = new Bpl.LambdaExpr(e.tok, new List<TypeVariable>(), rdvars, null,
+          translator.InRWClause(e.tok, o, null, e.Reads.ConvertAll(su.SubstFrameExpr), et, null, null));
 
         return translator.Lit(
           translator.FunctionCall(e.tok, BuiltinFunction.AtLayer, predef.HandleType,
@@ -14267,7 +14252,7 @@ namespace Microsoft.Dafny {
 
     /// Makes a simple trigger
     static Bpl.Trigger BplTrigger(Bpl.Expr e) {
-      return new Trigger(e.tok, true, new List<Bpl.Expr> { e });
+      return new Bpl.Trigger(e.tok, true, new List<Bpl.Expr> { e });
     }
 
     static Bpl.Axiom BplAxiom(Bpl.Expr e) {
diff --git a/Test/hofs/Naked.dfy b/Test/hofs/Naked.dfy
index fa99377f..d23eb507 100644
--- a/Test/hofs/Naked.dfy
+++ b/Test/hofs/Naked.dfy
@@ -19,17 +19,17 @@ module Functions {
 
 module Requires {
   function t(x: nat): nat
-  requires !t.requires(x);
+  requires !t.requires(x);  // error: use of naked function in its own SCC
   { x }
 
   function g(x: nat): nat
-  requires !(g).requires(x);
+  requires !(g).requires(x);  // error: use of naked function in its own SCC
   { x }
 
-  function g2(x: int): int { h(x) }
-
+  function D(x: int): int  // used so termination errors don't mask other errors
+  function g2(x: int): int decreases D(x) { h(x) }  // error: precondition violation
   function h(x: int): int
-    requires !g2.requires(x);
+    requires !g2.requires(x);  // error: use of naked function in its own SCC
   { x }
 }
 
diff --git a/Test/hofs/Naked.dfy.expect b/Test/hofs/Naked.dfy.expect
index b4dfc561..514952a1 100644
--- a/Test/hofs/Naked.dfy.expect
+++ b/Test/hofs/Naked.dfy.expect
@@ -21,11 +21,7 @@ Execution trace:
 Naked.dfy(26,14): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
-Naked.dfy(29,30): Error: cannot prove termination; try supplying a decreases clause
-Execution trace:
-    (0,0): anon0
-    (0,0): anon4_Else
-Naked.dfy(29,30): Error: possible violation of function precondition
+Naked.dfy(30,45): Error: possible violation of function precondition
 Naked.dfy(32,14): Related location
 Execution trace:
     (0,0): anon0
@@ -47,4 +43,4 @@ Naked.dfy(48,11): Error: cannot use naked function in recursive setting. Possibl
 Execution trace:
     (0,0): anon0
 
-Dafny program verifier finished with 1 verified, 12 errors
+Dafny program verifier finished with 2 verified, 11 errors
diff --git a/Test/hofs/Requires.dfy b/Test/hofs/Requires.dfy
new file mode 100644
index 00000000..68677b3e
--- /dev/null
+++ b/Test/hofs/Requires.dfy
@@ -0,0 +1,82 @@
+// RUN: %dafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+method Main()
+{
+  test0(10);
+	test5(11);
+	test6(12);
+	test1();
+	test2();
+}
+
+predicate valid(x:int) 
+{
+  x > 0
+}
+
+function ref1(y:int) : int
+  requires valid(y);
+{
+  y - 1
+}
+
+lemma assumption1()
+  ensures forall a, b :: valid(a) && valid(b) && ref1(a) == ref1(b) ==> a == b;
+{
+} 
+
+method test0(a: int)
+{
+  if ref1.requires(a) {
+    // the precondition should suffice to let us call the method
+    ghost var b := ref1(a);
+  }
+}
+method test5(a: int)
+{
+  if valid(a) {
+    // valid(a) is the precondition of ref1
+    assert ref1.requires(a);
+  }  
+} 
+method test6(a: int)
+{
+  if ref1.requires(a) {
+    // the precondition of ref1 is valid(a)
+    assert valid(a);
+  }  
+}
+
+method test1()
+{
+  if * {
+    assert forall a, b :: valid(a) && valid(b) && ref1(a) == ref1(b) ==> a == b;
+  } else {
+    assert forall a, b :: ref1.requires(a) && ref1.requires(b) && ref1(a) == ref1(b) 
+                          ==> a == b;
+  }
+}
+
+function {:opaque} ref2(y:int) : int        // Now with an opaque attribute
+  requires valid(y);
+{
+  y - 1
+}
+
+lemma assumption2()
+  ensures forall a, b :: valid(a) && valid(b) && ref2(a) == ref2(b) ==> a == b;
+{
+  reveal_ref2();
+}
+
+method test2()
+{
+  assumption2();
+  if * {
+    assert forall a, b :: valid(a) && valid(b) && ref2(a) == ref2(b) ==> a == b;
+  } else {
+    assert forall a, b :: ref2.requires(a) && ref2.requires(b) && ref2(a) == ref2(b) 
+                          ==> a == b;
+  }
+}
diff --git a/Test/hofs/Requires.dfy.expect b/Test/hofs/Requires.dfy.expect
new file mode 100644
index 00000000..b9a40d66
--- /dev/null
+++ b/Test/hofs/Requires.dfy.expect
@@ -0,0 +1,5 @@
+
+Dafny program verifier finished with 20 verified, 0 errors
+Program compiled successfully
+Running...
+
diff --git a/Test/hofs/Simple.dfy.expect b/Test/hofs/Simple.dfy.expect
index 1a1027ae..e2f16ef3 100644
--- a/Test/hofs/Simple.dfy.expect
+++ b/Test/hofs/Simple.dfy.expect
@@ -18,9 +18,6 @@ Execution trace:
     (0,0): anon3_Then
     (0,0): anon2
 Simple.dfy(61,10): Error: possible violation of function precondition
-Execution trace:
-    (0,0): anon0
-Simple.dfy(61,18): Error: assertion violation
 Execution trace:
     (0,0): anon0
 Simple.dfy(73,10): Error: assertion violation
@@ -29,4 +26,4 @@ Execution trace:
     Simple.dfy(72,38): anon5_Else
     Simple.dfy(73,38): anon6_Else
 
-Dafny program verifier finished with 14 verified, 7 errors
+Dafny program verifier finished with 14 verified, 6 errors
-- 
cgit v1.2.3


From f057d2ec10bdf93bb8ef73cbb3ea80d56159faeb Mon Sep 17 00:00:00 2001
From: Bryan Parno <parno@microsoft.com>
Date: Wed, 1 Jul 2015 11:53:59 -0700
Subject: Add code to calculate various interesting statistics about Dafny
 files.

---
 Source/Dafny/DafnyOptions.cs      |  14 +++-
 Source/Dafny/SccGraph.cs          |  10 ++-
 Source/Dafny/Util.cs              | 149 +++++++++++++++++++++++++++++++++++++-
 Source/DafnyDriver/DafnyDriver.cs |   7 ++
 4 files changed, 175 insertions(+), 5 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index 125ab11e..af940439 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -56,6 +56,8 @@ namespace Microsoft.Dafny
     public bool AllowGlobals = false;
     public bool CountVerificationErrors = true;
     public bool Optimize = false;
+    public bool PrintStats = false;
+    public bool PrintFunctionCallGraph = false;
 
     protected override bool ParseOption(string name, Bpl.CommandLineOptionEngine.CommandLineParseState ps) {
       var args = ps.args;  // convenient synonym
@@ -172,6 +174,14 @@ namespace Microsoft.Dafny
         case "allowGlobals":
           AllowGlobals = true;
           return true;
+        
+        case "stats":
+          PrintStats = true;
+          return true;
+
+        case "funcCallGraph":
+          PrintFunctionCallGraph = true;
+          return true;
 
         case "countVerificationErrors": {
           int countErrors = 1; // defaults to reporting verification errors
@@ -267,7 +277,7 @@ namespace Microsoft.Dafny
   /noAutoReq    Ignore autoReq attributes
   /allowGlobals Allow the implicit class '_default' to contain fields, instance functions,
                 and instance methods.  These class members are declared at the module scope,
-                outside of explicit classes.  This command-line option is provided to simply
+                outside of explicit classes.  This command-line option is provided to simplify
                 a transition from the behavior in the language prior to version 1.9.3, from
                 which point onward all functions and methods declared at the module scope are
                 implicitly static and fields declarations are not allowed at the module scope.
@@ -282,6 +292,8 @@ namespace Microsoft.Dafny
                     System.Collections.Immutable.dll in the source directory to successfully 
                     compile).
                   - passes /optimize flag to csc.exe.
+  /stats        Print interesting statistics about the Dafny files supplied.
+  /funcCallGraph Print out the function call graph.  Format is: func,mod=callee*
 ");
       base.Usage();  // also print the Boogie options
     }
diff --git a/Source/Dafny/SccGraph.cs b/Source/Dafny/SccGraph.cs
index 01a72fc5..20b4f65e 100644
--- a/Source/Dafny/SccGraph.cs
+++ b/Source/Dafny/SccGraph.cs
@@ -6,8 +6,8 @@ namespace Microsoft.Dafny {
 
   public class Graph<Node> where Node : class
   {
-    enum VisitedStatus { Unvisited, OnStack, Visited }
-    class Vertex {
+    public enum VisitedStatus { Unvisited, OnStack, Visited }
+    public class Vertex {
       public readonly Node N;
       public readonly List<Vertex/*!*/>/*!*/ Successors = new List<Vertex/*!*/>();
       public List<Vertex/*!*/> SccMembers;  // non-null only for the representative of the SCC
@@ -65,6 +65,10 @@ namespace Microsoft.Dafny {
     {
     }
 
+    public IEnumerable<Vertex> GetVertices() {
+      return vertices.Values;
+    }
+
     /// <summary>
     /// Idempotently adds a vertex 'n' to the graph.
     /// </summary>
@@ -97,7 +101,7 @@ namespace Microsoft.Dafny {
     /// <summary>
     /// Returns the vertex for 'n' if 'n' is in the graph.  Otherwise, returns null.
     /// </summary>
-    Vertex FindVertex(Node n) {
+    public Vertex FindVertex(Node n) {
       Vertex v;
       if (vertices.TryGetValue(n, out v)) {
         Contract.Assert(v != null);  // follows from postcondition of TryGetValue (since 'vertices' maps to the type Vertex!)
diff --git a/Source/Dafny/Util.cs b/Source/Dafny/Util.cs
index f9421659..63659696 100644
--- a/Source/Dafny/Util.cs
+++ b/Source/Dafny/Util.cs
@@ -8,7 +8,7 @@ using Microsoft.Boogie;
 
 
 namespace Microsoft.Dafny {
-  class Util
+  public class Util
   {
     public static string Comma<T>(IEnumerable<T> l, Func<T, string> f) {
       return Comma(",", l, f);
@@ -175,5 +175,152 @@ namespace Microsoft.Dafny {
       }
     }
 
+    /// <summary>
+    /// Class dedicated to traversing the function call graph
+    /// </summary>
+    class FunctionCallFinder : TopDownVisitor<List<Function>> {
+      protected override bool VisitOneExpr(Expression expr, ref List<Function> calls) {
+        if (expr is FunctionCallExpr) {
+          calls.Add(((FunctionCallExpr)expr).Function);
+        }
+        return true;
+      }
+    }
+
+    static Graph<Function> BuildFunctionCallGraph(Dafny.Program program) {
+      Graph<Function> functionCallGraph = new Graph<Function>();
+      FunctionCallFinder callFinder = new FunctionCallFinder();
+
+      foreach (var module in program.Modules) {
+        foreach (var decl in module.TopLevelDecls) {
+          if (decl is ClassDecl) {
+            var c = (ClassDecl)decl;
+            foreach (var member in c.Members) {
+              if (member is Function) {
+                var f = (Function)member;
+
+                List<Function> calls = new List<Function>();
+                foreach (var e in f.Reads) { if (e != null && e.E != null) { callFinder.Visit(e.E, calls); } }
+                foreach (var e in f.Req) { if (e != null) { callFinder.Visit(e, calls); } }
+                foreach (var e in f.Ens) { if (e != null) { callFinder.Visit(e, calls); } }
+                if (f.Body != null) {
+                  callFinder.Visit(f.Body, calls);
+                }
+
+                foreach (var callee in calls) {
+                  functionCallGraph.AddEdge(f, callee);
+                }
+              }
+            }
+          }
+        }
+      }
+
+      return functionCallGraph;
+    }
+
+    /// <summary>
+    /// Prints the program's function call graph in a format suitable for consumption in other tools
+    /// </summary>
+    public static void PrintFunctionCallGraph(Dafny.Program program) {
+      var functionCallGraph = BuildFunctionCallGraph(program);
+
+      foreach (var vertex in functionCallGraph.GetVertices()) {
+        var func = vertex.N;
+        Console.Write("{0},{1}=", func.CompileName, func.EnclosingClass.Module.CompileName);
+        foreach (var callee in vertex.Successors) {
+          Console.Write("{0} ", callee.N.CompileName);
+        }
+        Console.Write("\n");
+      }
+    }
+
+    /// <summary>
+    /// Generic statistic counter
+    /// </summary>
+    static void IncrementStat(IDictionary<string, ulong> stats, string stat) {
+      ulong currentValue;
+      if (stats.TryGetValue(stat, out currentValue)) {
+        stats[stat] += 1;
+      } else {
+        stats.Add(stat, 1);
+      }
+    }
+
+    /// <summary>
+    /// Track the maximum value of some statistic
+    /// </summary>
+    static void UpdateMax(IDictionary<string, ulong> stats, string stat, ulong val) {
+      ulong currentValue;
+      if (stats.TryGetValue(stat, out currentValue)) {
+        if (val > currentValue) {
+          stats[stat] = val;
+        }
+      } else {
+        stats.Add(stat, val);
+      }
+    }
+
+    /// <summary>
+    /// Compute various interesting statistics about the Dafny program
+    /// </summary>
+    public static void PrintStats(Dafny.Program program) {
+      SortedDictionary<string, ulong> stats = new SortedDictionary<string, ulong>();
+
+      foreach (var module in program.Modules) {
+        IncrementStat(stats, "Modules");
+        UpdateMax(stats, "Module height (max)", (ulong)module.Height);
+
+        ulong num_scc = (ulong)module.CallGraph.TopologicallySortedComponents().Count;
+        UpdateMax(stats, "Call graph width (max)", num_scc);
+
+        foreach (var decl in module.TopLevelDecls) {
+          if (decl is DatatypeDecl) {
+            IncrementStat(stats, "Datatypes");
+          } else if (decl is ClassDecl) {
+            var c = (ClassDecl)decl;
+            if (c.Name != "_default") {
+              IncrementStat(stats, "Classes");
+            }
+
+            foreach (var member in c.Members) {
+              if (member is Function) {
+                IncrementStat(stats, "Functions (total)");
+                var f = (Function)member;
+                if (f.IsRecursive) {
+                  IncrementStat(stats, "Functions recursive");
+                }
+              } else if (member is Method) {
+                IncrementStat(stats, "Methods (total)");
+                var method = (Method)member;
+                if (method.IsRecursive) {
+                  IncrementStat(stats, "Methods recursive");
+                }
+                if (method.IsGhost) {
+                  IncrementStat(stats, "Methods ghost");
+                }
+              }
+            }
+          }
+        }
+      }
+
+      // Print out the results, with some nice formatting
+      Console.WriteLine("");
+      Console.WriteLine("Statistics");
+      Console.WriteLine("----------");
+
+      int max_key_length = 0;
+      foreach (var key in stats.Keys) {
+        if (key.Length > max_key_length) {
+          max_key_length = key.Length;
+        }
+      }
+
+      foreach (var keypair in stats) {
+        string keyString = keypair.Key.PadRight(max_key_length + 2);
+        Console.WriteLine("{0} {1,4}", keyString, keypair.Value);
+      }
+    }
   }
 }
diff --git a/Source/DafnyDriver/DafnyDriver.cs b/Source/DafnyDriver/DafnyDriver.cs
index ce4d726f..9fdc9320 100644
--- a/Source/DafnyDriver/DafnyDriver.cs
+++ b/Source/DafnyDriver/DafnyDriver.cs
@@ -199,6 +199,13 @@ namespace Microsoft.Dafny
           }
           exitValue = allOk ? ExitValue.VERIFIED : ExitValue.NOT_VERIFIED;
         }
+
+        if (err == null && dafnyProgram != null && DafnyOptions.O.PrintStats) {
+          Util.PrintStats(dafnyProgram);
+        }
+        if (err == null && dafnyProgram != null && DafnyOptions.O.PrintFunctionCallGraph) {
+          Util.PrintFunctionCallGraph(dafnyProgram);
+        }
       }
       return exitValue;
     }
-- 
cgit v1.2.3


From 5b3dcd0c09a7ea8a34e7f5e4b8800015b3b07e96 Mon Sep 17 00:00:00 2001
From: Bryan Parno <parno@microsoft.com>
Date: Wed, 1 Jul 2015 12:37:54 -0700
Subject: Add the ability to specify how much "fuel" a function should have,
 i.e., how many times Z3 is permitted to unfold it's definition.  The new
 {:fuel} annotation can be added to the function itself, it which case it will
 apply to all uses of that function, or it can overridden within the scope of
 a module, function, method, iterator, calc, forall, while, assert, or assume.
  The general format is:

{:fuel functionName,lowFuel,highFuel}

When applied as an annotation to the function itself, omit functionName.
If highFuel is omitted, it defaults to lowFuel + 1.

The default fuel setting for recursive functions is 1,2.  Setting the fuel higher,
say, to 3,4, will give more unfoldings, which may make some proofs go through
with less programmer assistance (e.g., with fewer assert statements), but it may
also increase verification time, so use it with care.  Setting the fuel to 0,0 is
similar to making the definition opaque, except when used with all literal arguments.
---
 Source/Dafny/Cloner.cs      |   2 +-
 Source/Dafny/Dafny.atg      |   4 +-
 Source/Dafny/DafnyAst.cs    |  25 ++-
 Source/Dafny/Parser.cs      |  78 ++++----
 Source/Dafny/Resolver.cs    |  74 +++++++-
 Source/Dafny/Scanner.cs     |  31 +---
 Source/Dafny/Translator.cs  | 388 ++++++++++++++++++++++++++++++----------
 Test/dafny0/Fuel.dfy        | 423 ++++++++++++++++++++++++++++++++++++++++++++
 Test/dafny0/Fuel.dfy.expect |  95 ++++++++++
 Test/dafny4/Circ.dfy        |   2 +
 10 files changed, 967 insertions(+), 155 deletions(-)
 create mode 100644 Test/dafny0/Fuel.dfy
 create mode 100644 Test/dafny0/Fuel.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index f13aa2f4..e313ffac 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -545,7 +545,7 @@ namespace Microsoft.Dafny
 
       } else if (stmt is CalcStmt) {
           var s = (CalcStmt)stmt;
-          r = new CalcStmt(Tok(s.Tok), Tok(s.EndTok), CloneCalcOp(s.Op), s.Lines.ConvertAll(CloneExpr), s.Hints.ConvertAll(CloneBlockStmt), s.StepOps.ConvertAll(CloneCalcOp), CloneCalcOp(s.ResultOp));
+          r = new CalcStmt(Tok(s.Tok), Tok(s.EndTok), CloneCalcOp(s.Op), s.Lines.ConvertAll(CloneExpr), s.Hints.ConvertAll(CloneBlockStmt), s.StepOps.ConvertAll(CloneCalcOp), CloneCalcOp(s.ResultOp), CloneAttributes(s.Attributes));
 
       } else if (stmt is MatchStmt) {
         var s = (MatchStmt)stmt;
diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index 6cc0af5a..5d4a4321 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -1965,6 +1965,7 @@ ModifyStmt<out Statement s>
 CalcStmt<out Statement s>
 = (. Contract.Ensures(Contract.ValueAtReturn(out s) != null);
      Token x;
+     Attributes attrs = null;
      CalcStmt.CalcOp op, calcOp = Microsoft.Dafny.CalcStmt.DefaultOp, resOp = Microsoft.Dafny.CalcStmt.DefaultOp;
      var lines = new List<Expression>();
      var hints = new List<BlockStmt>();
@@ -1976,6 +1977,7 @@ CalcStmt<out Statement s>
      IToken danglingOperator = null;
   .)
   "calc"                                                  (. x = t; .)
+  { IF(IsAttribute()) Attribute<ref attrs> }
   [ CalcOp<out opTok, out calcOp>                         (. maybeOp = calcOp.ResultOp(calcOp); // guard against non-transitive calcOp (like !=)
                                                              if (maybeOp == null) {
                                                                SemErr(opTok, "the main operator of a calculation must be transitive");
@@ -2024,7 +2026,7 @@ CalcStmt<out Statement s>
       // Repeat the last line to create a dummy line for the dangling hint
       lines.Add(lines[lines.Count - 1]);
     }
-    s = new CalcStmt(x, t, calcOp, lines, hints, stepOps, resOp);
+    s = new CalcStmt(x, t, calcOp, lines, hints, stepOps, resOp, attrs);
   .)
   .
 CalcOp<out IToken x, out CalcStmt.CalcOp/*!*/ op>
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index b8660f98..c9c9ccc8 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -314,6 +314,22 @@ namespace Microsoft.Dafny {
       return null;
     }
 
+
+    /// <summary>
+    /// Same as FindExpressions, but returns all matches
+    /// </summary>
+    public static List<List<Expression>> FindAllExpressions(Attributes attrs, string nm) {
+      Contract.Requires(nm != null);
+      List<List<Expression>> ret = null;
+      for (; attrs != null; attrs = attrs.Prev) {
+        if (attrs.Name == nm) {
+          ret = ret ?? new List<List<Expression>>();   // Avoid allocating the list in the common case where we don't find nm
+          ret.Add(attrs.Args);
+        }
+      }
+      return ret;
+    }
+
     /// <summary>
     /// Returns true if "nm" is a specified attribute whose arguments match the "allowed" parameter.
     /// - if "nm" is not found in attrs, return false and leave value unmodified.  Otherwise,
@@ -2874,6 +2890,7 @@ namespace Microsoft.Dafny {
     public override string WhatKind { get { return "function"; } }
     public readonly bool IsProtected;
     public bool IsRecursive;  // filled in during resolution
+    public bool IsFueled;  // filled in during resolution if anyone tries to adjust this function's fuel
     public readonly List<TypeParameter> TypeArgs;
     public readonly List<Formal> Formals;
     public readonly Type ResultType;
@@ -2899,7 +2916,7 @@ namespace Microsoft.Dafny {
         return Contract.Exists(Decreases.Expressions, e => e is WildcardExpr);
       }
     }
-
+    
     /// <summary>
     /// The "AllCalls" field is used for non-FixpointPredicate, non-PrefixPredicate functions only (so its value should not be relied upon for FixpointPredicate and PrefixPredicate functions).
     /// It records all function calls made by the Function, including calls made in the body as well as in the specification.
@@ -2944,6 +2961,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(cce.NonNullElements(ens));
       Contract.Requires(decreases != null);
       this.IsProtected = isProtected;
+      this.IsFueled = false;  // Defaults to false.  Only set to true if someone mentions this function in a fuel annotation
       this.TypeArgs = typeArgs;
       this.Formals = formals;
       this.ResultType = resultType;
@@ -2968,6 +2986,8 @@ namespace Microsoft.Dafny {
     }
     ModuleDefinition ICodeContext.EnclosingModule { get { return this.EnclosingClass.Module; } }
     bool ICodeContext.MustReverify { get { return false; } }
+
+    public bool IsFuelAware() { return IsRecursive || IsFueled; }
   }
 
   public class Predicate : Function
@@ -4640,7 +4660,7 @@ namespace Microsoft.Dafny {
       Contract.Invariant(StepOps.Count == Hints.Count);
     }
 
-    public CalcStmt(IToken tok, IToken endTok, CalcOp op, List<Expression> lines, List<BlockStmt> hints, List<CalcOp> stepOps, CalcOp resultOp)
+    public CalcStmt(IToken tok, IToken endTok, CalcOp op, List<Expression> lines, List<BlockStmt> hints, List<CalcOp> stepOps, CalcOp resultOp, Attributes attrs)
       : base(tok, endTok)
     {
       Contract.Requires(tok != null);
@@ -4665,6 +4685,7 @@ namespace Microsoft.Dafny {
       }
       this.Steps = new List<Expression>();
       this.Result = null;
+      this.Attributes = attrs;
     }
 
     public override IEnumerable<Statement> SubStatements
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index b183fff1..c4047819 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -74,8 +74,8 @@ public class Parser {
 	public const int _ellipsis = 58;
 	public const int maxT = 137;
 
-	const bool _T = true;
-	const bool _x = false;
+	const bool T = true;
+	const bool x = false;
 	const int minErrDist = 2;
 
 	public Scanner/*!*/ scanner;
@@ -2565,6 +2565,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 	void CalcStmt(out Statement s) {
 		Contract.Ensures(Contract.ValueAtReturn(out s) != null);
 		Token x;
+		Attributes attrs = null;
 		CalcStmt.CalcOp op, calcOp = Microsoft.Dafny.CalcStmt.DefaultOp, resOp = Microsoft.Dafny.CalcStmt.DefaultOp;
 		var lines = new List<Expression>();
 		var hints = new List<BlockStmt>();
@@ -2577,6 +2578,9 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		
 		Expect(31);
 		x = t; 
+		while (IsAttribute()) {
+			Attribute(ref attrs);
+		}
 		if (StartOf(25)) {
 			CalcOp(out opTok, out calcOp);
 			maybeOp = calcOp.ResultOp(calcOp); // guard against non-transitive calcOp (like !=)
@@ -2631,7 +2635,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		 // Repeat the last line to create a dummy line for the dangling hint
 		 lines.Add(lines[lines.Count - 1]);
 		}
-		s = new CalcStmt(x, t, calcOp, lines, hints, stepOps, resOp);
+		s = new CalcStmt(x, t, calcOp, lines, hints, stepOps, resOp, attrs);
 		
 	}
 
@@ -3988,7 +3992,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 			S = Util.RemoveUnderscores(t.val);
 			try {
-             n = BigIntegerParser.Parse(S);
+			 n = BigIntegerParser.Parse(S);
 			} catch (System.FormatException) {
 			 SemErr("incorrectly formatted number");
 			 n = BigInteger.Zero;
@@ -3999,7 +4003,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			S = Util.RemoveUnderscores(t.val.Substring(2));
 			try {
 			 // note: leading 0 required when parsing positive hex numbers
-             n = BigIntegerParser.Parse("0" + S, System.Globalization.NumberStyles.HexNumber);
+			 n = BigIntegerParser.Parse("0" + S, System.Globalization.NumberStyles.HexNumber);
 			} catch (System.FormatException) {
 			 SemErr("incorrectly formatted number");
 			 n = BigInteger.Zero;
@@ -4364,38 +4368,38 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 	}
 
 	static readonly bool[,]/*!*/ set = {
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_T, _x,_x,_T,_T, _T,_x,_x,_T, _T,_x,_x,_T, _T,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _x,_x,_T,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_T, _x,_x,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _T,_x,_x,_x, _x,_x,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_x,_T,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_T, _x,_T,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_x, _x,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_T, _x,_x,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_T,_T, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _T,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
-		{_x,_x,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x}
+		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,T, x,x,T,T, T,x,x,T, T,x,x,T, T,x,T,T, T,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, T,x,T,T, x,x,T,T, T,x,x,T, x,x,T,T, T,T,T,T, T,x,T,T, x,x,T,x, x,T,T,T, T,T,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,x,T, x,x,x,x, T,x,T,T, T,T,T,T, T,T,T,T, x,x,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,x,x, T,x,x,x, x,x,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{x,T,x,x, x,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, x,x,T,x, x,x,x,T, x,x,x,x, x,x,x,x, T,T,x,T, x,T,x,x, T,x,T,T, T,T,T,T, T,T,T,T, x,x,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,T,x,T, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,T,T, T,x,x,T, x,x,T,T, T,T,T,T, x,x,x},
+		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,T,T,T, T,T,x,T, T,T,T,x, x,T,x,T, x,x,x,x, x,x,x,x, T,T,x,T, x,x,x,x, T,x,T,T, T,T,T,T, T,T,T,T, x,x,T,T, T,T,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{x,T,T,x, x,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, T,x,T,T, x,x,T,x, x,T,T,T, T,T,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, x,x,x},
+		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,x,x,x, x,T,x,T, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,T,T, T,x,x,T, x,x,T,T, T,T,T,T, x,x,x},
+		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, T,x,T,T, x,x,T,x, x,T,T,T, T,T,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,T,x,T, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,T,T, T,x,x,T, x,x,T,T, T,T,T,T, x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,T,x,T, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,T,T, T,x,x,T, x,x,T,T, T,T,T,T, x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, T,x,T,T, x,x,T,x, x,T,T,T, T,T,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,T,T, T,x,T,T, x,x,T,x, x,T,T,T, T,T,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, T,T,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,T,x, x,x,x,x, T,T,x,T, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,T,T, T,x,x,T, x,x,T,T, T,T,T,T, x,x,x},
+		{x,x,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, x,x,x},
+		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, T,x,T,T, x,x,T,x, x,T,T,T, T,T,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,T,x, x,x,x,x, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,T,x,T, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
+		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, T,T,x,T, x,x,x,x, T,x,T,T, T,T,T,T, T,T,T,T, x,x,T,T, T,T,T,T, T,T,T,T, x,T,T,T, x,T,T,T, T,T,T,T, T,x,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,x,x,x, x,T,T,T, T,T,T,T, T,T,T,T, T,x,x},
+		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,T,T,T, T,T,x,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, T,T,T,T, T,T,T,T, T,T,T,x, T,T,x,T, x,x,x,x, T,x,T,T, T,T,T,T, T,T,T,T, x,x,T,T, T,T,T,T, T,T,T,T, x,T,T,x, x,T,T,T, T,T,T,T, T,x,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,x,x,x, x,T,T,T, T,T,T,T, T,T,T,T, T,x,x}
 
 	};
 } // end Parser
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 835871d9..e48a7932 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -455,6 +455,25 @@ namespace Microsoft.Dafny
           }
         }
       }
+
+      // Determine, for each function, whether someone tries to adjust its fuel parameter
+      foreach (var module in prog.Modules) {
+        CheckForFuelAdjustments(module.tok, module.Attributes, module, this);
+        foreach (var clbl in ModuleDefinition.AllItersAndCallables(module.TopLevelDecls)) {
+          Statement body = null;
+          if (clbl is Method) {
+            body = ((Method)clbl).Body;
+            CheckForFuelAdjustments(clbl.Tok,((Method)clbl).Attributes, module, this);
+          } else if (clbl is IteratorDecl) {
+            body = ((IteratorDecl)clbl).Body;
+            CheckForFuelAdjustments(clbl.Tok, ((IteratorDecl)clbl).Attributes, module, this);
+          }
+          if (body != null) {
+            var c = new FuelAdjustment_Visitor(this);
+            c.Visit(body, new FuelAdjustment_Context(module, this));
+          }
+        }
+      }
     }
 
     void FillInDefaultDecreasesClauses(Program prog)
@@ -683,8 +702,8 @@ namespace Microsoft.Dafny
       var datatypeDependencies = new Graph<IndDatatypeDecl>();
       var codatatypeDependencies = new Graph<CoDatatypeDecl>();
       int prevErrorCount = ErrorCount;
-      ResolveAttributes(m.Attributes, new ResolveOpts(new NoContext(m.Module), false));
       ResolveTopLevelDecls_Signatures(m, m.TopLevelDecls, datatypeDependencies, codatatypeDependencies);
+      ResolveAttributes(m.Attributes, new ResolveOpts(new NoContext(m.Module), false)); // Must follow ResolveTopLevelDecls_Signatures, in case attributes refer to members
       if (ErrorCount == prevErrorCount) {
         ResolveTopLevelDecls_Meat(m.TopLevelDecls, datatypeDependencies, codatatypeDependencies);
       }
@@ -2335,6 +2354,59 @@ namespace Microsoft.Dafny
     }
     #endregion CheckTailRecursive
 
+    // ------------------------------------------------------------------------------------------------------
+    // ----- FuelAdjustmentChecks ---------------------------------------------------------------------------
+    // ------------------------------------------------------------------------------------------------------
+    #region FuelAdjustmentChecks
+
+    protected static void CheckForFuelAdjustments(IToken tok, Attributes attrs, ModuleDefinition currentModule, ResolutionErrorReporter reporter) {
+      List<List<Expression>> results = Attributes.FindAllExpressions(attrs, "fuel");
+
+      if (results != null) {
+        foreach (List<Expression> args in results) {
+          if (args != null && args.Count >= 2) {
+            // Try to extract the function from the first argument
+            MemberSelectExpr selectExpr = args[0].Resolved as MemberSelectExpr;
+            if (selectExpr != null) {
+              Function f = selectExpr.Member as Function;
+              if (f != null) {
+                f.IsFueled = true;
+                if (f.IsProtected && currentModule != f.EnclosingClass.Module) {
+                  reporter.Error(tok, "cannot adjust fuel for protected function {0} from another module", f.Name);
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+
+    public class FuelAdjustment_Context
+    {
+      public ModuleDefinition currentModule;
+      public ResolutionErrorReporter reporter;
+      public FuelAdjustment_Context(ModuleDefinition currentModule, ResolutionErrorReporter reporter) {
+        this.currentModule = currentModule;
+        this.reporter = reporter;
+      }
+    }
+
+    class FuelAdjustment_Visitor : ResolverTopDownVisitor<FuelAdjustment_Context>
+    {
+      public FuelAdjustment_Visitor(Resolver resolver)
+        : base(resolver) {
+        Contract.Requires(resolver != null);
+      }
+
+      protected override bool VisitOneStmt(Statement stmt, ref FuelAdjustment_Context st) {
+        Contract.Requires(stmt != null);
+        Resolver.CheckForFuelAdjustments(stmt.Tok, stmt.Attributes, st.currentModule, st.reporter);
+        return true;
+      }
+    }
+
+    #endregion FuelAdjustmentChecks
+
     // ------------------------------------------------------------------------------------------------------
     // ----- FixpointPredicateChecks ------------------------------------------------------------------------
     // ------------------------------------------------------------------------------------------------------
diff --git a/Source/Dafny/Scanner.cs b/Source/Dafny/Scanner.cs
index 4c5eedb4..d0d2e4dd 100644
--- a/Source/Dafny/Scanner.cs
+++ b/Source/Dafny/Scanner.cs
@@ -217,7 +217,7 @@ public class Scanner {
 
 	[ContractInvariantMethod]
 	void objectInvariant(){
-		Contract.Invariant(this._buffer != null);
+		Contract.Invariant(buffer!=null);
 		Contract.Invariant(t != null);
 		Contract.Invariant(start != null);
 		Contract.Invariant(tokens != null);
@@ -227,18 +227,7 @@ public class Scanner {
 		Contract.Invariant(errorHandler != null);
 	}
 
-	private Buffer/*!*/ _buffer; // scanner buffer
-
-	public Buffer/*!*/ buffer {
-		get {
-			Contract.Ensures(Contract.Result<Buffer>() != null);
-			return this._buffer;
-		}
-		set {
-			Contract.Requires(value != null);
-			this._buffer = value;
-		}
-	}
+	public Buffer/*!*/ buffer; // scanner buffer
 
 	Token/*!*/ t;          // current token
 	int ch;           // current input character
@@ -310,7 +299,7 @@ public class Scanner {
 	}
 
 //	[NotDelayed]
-	public Scanner (string/*!*/ fileName, Errors/*!*/ errorHandler, bool useBaseName = false) : base() {
+	public Scanner (string/*!*/ fileName, Errors/*!*/ errorHandler) : base() {
 	  Contract.Requires(fileName != null);
 	  Contract.Requires(errorHandler != null);
 		this.errorHandler = errorHandler;
@@ -318,8 +307,8 @@ public class Scanner {
 		t = new Token(); // dummy because t is a non-null field
 		try {
 			Stream stream = new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read);
-			this._buffer = new Buffer(stream, false);
-			Filename = useBaseName? GetBaseName(fileName): fileName;
+			buffer = new Buffer(stream, false);
+			Filename = fileName;
 			Init();
 		} catch (IOException) {
 			throw new FatalError("Cannot open file " + fileName);
@@ -327,22 +316,18 @@ public class Scanner {
 	}
 
 //	[NotDelayed]
-	public Scanner (Stream/*!*/ s, Errors/*!*/ errorHandler, string/*!*/ fileName, bool useBaseName = false) : base() {
+	public Scanner (Stream/*!*/ s, Errors/*!*/ errorHandler, string/*!*/ fileName) : base() {
 	  Contract.Requires(s != null);
 	  Contract.Requires(errorHandler != null);
 	  Contract.Requires(fileName != null);
 		pt = tokens = new Token();  // first token is a dummy
 		t = new Token(); // dummy because t is a non-null field
-		this._buffer = new Buffer(s, true);
+		buffer = new Buffer(s, true);
 		this.errorHandler = errorHandler;
-		this.Filename = useBaseName? GetBaseName(fileName) : fileName;
+		this.Filename = fileName;
 		Init();
 	}
 
-    string GetBaseName(string fileName) {
-        return System.IO.Path.GetFileName(fileName); // Return basename
-    }
-
 	void Init() {
 		pos = -1; line = 1; col = 0;
 		oldEols = 0;
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 4324b2b8..9ba11e2f 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -114,6 +114,7 @@ namespace Microsoft.Dafny {
     readonly Dictionary<string, Bpl.Constant> fieldConstants = new Dictionary<string,Constant>();
     readonly ISet<string> abstractTypes = new HashSet<string>();
     readonly ISet<string> opaqueTypes = new HashSet<string>();
+    FuelContext fuelContext = null;
     Program program;
 
     [ContractInvariantMethod]
@@ -625,6 +626,11 @@ namespace Microsoft.Dafny {
     }
     void AddTypeDecl(NewtypeDecl dd) {
       Contract.Requires(dd != null);
+      Contract.Ensures(fuelContext == Contract.OldValue(fuelContext));      
+
+      FuelContext oldFuelContext = this.fuelContext;
+      this.fuelContext = FuelSetting.NewFuelContext(dd);
+
       AddTypeDecl_Aux(dd.tok, dd.FullName, new List<TypeParameter>());
       AddWellformednessCheck(dd);
       // Add $Is and $IsAlloc axioms for the newtype
@@ -667,6 +673,7 @@ namespace Microsoft.Dafny {
 
         sink.AddTopLevelDeclaration(new Bpl.Axiom(dd.tok, BplForall(vars, BplTrigger(is_o), body), name));
       });
+      this.fuelContext = oldFuelContext;
     }
     void AddTypeDecl_Aux(IToken tok, string nm, List<TypeParameter> typeArgs) {
       Contract.Requires(tok != null);
@@ -1181,7 +1188,7 @@ namespace Microsoft.Dafny {
       }
     }
 
-    Bpl.Expr LayerSucc(Bpl.Expr e, int amt = 1) {
+    public Bpl.Expr LayerSucc(Bpl.Expr e, int amt = 1) {
       if (amt == 0) {
         return e;
       } else if (amt > 0) {
@@ -1301,6 +1308,7 @@ namespace Microsoft.Dafny {
     {
       Contract.Requires(sink != null && predef != null);
       Contract.Requires(c != null);
+      Contract.Ensures(fuelContext == Contract.OldValue(fuelContext));
 
       sink.AddTopLevelDeclaration(GetClass(c));
       if (c is ArrayClassDecl) {
@@ -1387,6 +1395,9 @@ namespace Microsoft.Dafny {
 
         } else if (member is Function) {
           var f = (Function)member;
+          FuelContext oldFuelContext = this.fuelContext;
+          this.fuelContext = FuelSetting.NewFuelContext(f);
+
           AddClassMember_Function(f);
           if (!IsOpaqueFunction(f) && !f.IsBuiltin && !(f.tok is IncludeToken)) { // Opaque function's well-formedness is checked on the full version
             AddWellformednessCheck(f);
@@ -1399,9 +1410,11 @@ namespace Microsoft.Dafny {
             AddClassMember_Function(cop.PrefixPredicate);
             // skip the well-formedness check, because it has already been done for the fixpoint-predicate
           }
-
+          this.fuelContext = oldFuelContext;
         } else if (member is Method) {
           Method m = (Method)member;
+          FuelContext oldFuelContext = this.fuelContext;
+          this.fuelContext = FuelSetting.NewFuelContext(m);
 
           // wellformedness check for method specification
           if (m.EnclosingClass is IteratorDecl && m == ((IteratorDecl)m.EnclosingClass).Member_MoveNext) {
@@ -1434,7 +1447,7 @@ namespace Microsoft.Dafny {
             sink.AddTopLevelDeclaration(proc);
             AddMethodImpl(m, proc, false);
           }
-
+          this.fuelContext = oldFuelContext;
         } else {
           Contract.Assert(false); throw new cce.UnreachableException();  // unexpected member
         }
@@ -1467,7 +1480,7 @@ namespace Microsoft.Dafny {
       // declare function
       AddFunction(f);
       // add synonym axiom
-      if (f.IsRecursive) {
+      if (f.IsFuelAware()) {
         AddSynonymAxiom(f);
       }
       // add frame axiom
@@ -1494,6 +1507,10 @@ namespace Microsoft.Dafny {
 
     void AddIteratorSpecAndBody(IteratorDecl iter) {
       Contract.Requires(iter != null);
+      Contract.Ensures(fuelContext == Contract.OldValue(fuelContext));
+
+      FuelContext oldFuelContext = this.fuelContext;      
+      this.fuelContext = FuelSetting.NewFuelContext(iter);
 
       // wellformedness check for method specification
       Bpl.Procedure proc = AddIteratorProc(iter, MethodTranslationKind.SpecWellformedness);
@@ -1506,6 +1523,7 @@ namespace Microsoft.Dafny {
         // ...and its implementation
         AddIteratorImpl(iter, proc);
       }
+      this.fuelContext = oldFuelContext;
     }
 
     Bpl.Procedure AddIteratorProc(IteratorDecl iter, MethodTranslationKind kind) {
@@ -1950,7 +1968,7 @@ namespace Microsoft.Dafny {
       var formals = MkTyParamBinders(GetTypeParams(f), out tyargs);
       var args = new List<Bpl.Expr>();
       Bpl.BoundVariable layer;
-      if (f.IsRecursive) {
+      if (f.IsFuelAware()) {
         layer = new Bpl.BoundVariable(f.tok, new Bpl.TypedIdent(f.tok, "$ly", predef.LayerType));
         formals.Add(layer);
         // Note, "layer" is not added to "args" here; rather, that's done below, as needed
@@ -2121,7 +2139,7 @@ namespace Microsoft.Dafny {
       var formals = MkTyParamBinders(GetTypeParams(f), out tyargs);
 
       Bpl.BoundVariable layer;
-      if (f.IsRecursive) {
+      if (f.IsFuelAware()) {
         layer = new Bpl.BoundVariable(f.tok, new Bpl.TypedIdent(f.tok, "$ly", predef.LayerType));
         formals.Add(layer);
         // Note, "layer" is not added to "args" here; rather, that's done below, as needed
@@ -2317,7 +2335,7 @@ namespace Microsoft.Dafny {
 
     void AddSynonymAxiom(Function f) {
       Contract.Requires(f != null);
-      Contract.Requires(f.IsRecursive);
+      Contract.Requires(f.IsFuelAware());
       Contract.Requires(sink != null && predef != null);
       // axiom  // layer synonym axiom
       //   (forall s, $Heap, formals ::
@@ -2400,7 +2418,7 @@ namespace Microsoft.Dafny {
       var coArgs = new List<Bpl.Expr>(tyexprs);
       var prefixArgs = new List<Bpl.Expr>(tyexprs);
       var prefixArgsLimited = new List<Bpl.Expr>(tyexprs);
-      if (pp.IsRecursive) {
+      if (pp.IsFuelAware()) {
         var sV = new Bpl.BoundVariable(tok, new Bpl.TypedIdent(tok, "$ly", predef.LayerType));
         var s = new Bpl.IdentifierExpr(tok, sV);
         var succS = FunctionCall(tok, BuiltinFunction.LayerSucc, null, s);
@@ -3073,13 +3091,13 @@ namespace Microsoft.Dafny {
         Bpl.FunctionCall funcIdT = new Bpl.FunctionCall(new Bpl.IdentifierExpr(f.OverriddenFunction.tok, f.OverriddenFunction.FullSanitizedName, TrType(f.OverriddenFunction.ResultType)));
         List<Bpl.Expr> argsC = new List<Bpl.Expr>();
         List<Bpl.Expr> argsT = new List<Bpl.Expr>();
-        if (f.IsRecursive)
+        if (f.IsFuelAware())
         {
-            argsC.Add(etran.LayerN(1));
+            argsC.Add(etran.layerInterCluster.GetFunctionFuel(f));
         }
-        if (f.OverriddenFunction.IsRecursive)
+        if (f.OverriddenFunction.IsFuelAware())
         {
-            argsT.Add(etran.LayerN(1));
+          argsT.Add(etran.layerInterCluster.GetFunctionFuel(f));
         }
         argsC.Add(etran.HeapExpr);
         argsT.Add(etran.HeapExpr);
@@ -3726,7 +3744,7 @@ namespace Microsoft.Dafny {
         var typeParams = TrTypeParamDecls(f.TypeArgs);
         {
           var formals = new List<Variable>();
-          if (f.IsRecursive) {
+          if (f.IsFuelAware()) {
             formals.Add(new Bpl.Formal(f.tok, new Bpl.TypedIdent(f.tok, "$ly", predef.LayerType), true));
           }
           if (!f.IsStatic) {
@@ -3750,7 +3768,7 @@ namespace Microsoft.Dafny {
         List<Bpl.Expr> argsF = new List<Bpl.Expr>();
         List<Bpl.Expr> argsFFrame = new List<Bpl.Expr>();
         List<Bpl.Expr> argsCanCall = new List<Bpl.Expr>();
-        if (f.IsRecursive) {
+        if (f.IsFuelAware()) {
           var sV = new Bpl.BoundVariable(f.tok, new Bpl.TypedIdent(f.tok, "$ly", predef.LayerType));
           var s = new Bpl.IdentifierExpr(f.tok, sV);
           bvars.Add(sV);
@@ -3795,7 +3813,7 @@ namespace Microsoft.Dafny {
         sink.AddTopLevelDeclaration(new Bpl.Axiom(f.tok, ax));
       } else {
 #else
-        // This is the general case
+      // This is the general case
         Bpl.Expr h0; var h0Var = BplBoundVar("$h0", predef.HeapType, out h0);
         Bpl.Expr h1; var h1Var = BplBoundVar("$h1", predef.HeapType, out h1);
 
@@ -3825,7 +3843,7 @@ namespace Microsoft.Dafny {
         var f1args = new List<Bpl.Expr>(tyexprs);
         var f0argsCanCall = new List<Bpl.Expr>(tyexprs);
         var f1argsCanCall = new List<Bpl.Expr>(tyexprs);
-        if (f.IsRecursive) {
+        if (f.IsFuelAware()) {
           Bpl.Expr s; var sV = BplBoundVar("$ly", predef.LayerType, out s);
           bvars.Add(sV);
           f0args.Add(s); f1args.Add(s);  // but don't add to f0argsCanCall or f1argsCanCall
@@ -4066,8 +4084,8 @@ namespace Microsoft.Dafny {
         foreach (var p in GetTypeParams(f)) {
           args.Add(trTypeParam(p, null));
         }
-        if (f.IsRecursive) {
-          args.Add(etran.LayerN(1));
+        if (f.IsFuelAware()) {
+          args.Add(etran.layerInterCluster.GetFunctionFuel(f));
         }
         args.Add(etran.HeapExpr);
         if (!f.IsStatic) {
@@ -4100,8 +4118,8 @@ namespace Microsoft.Dafny {
         foreach (var p in GetTypeParams(f)) {
           args.Add(trTypeParam(p, null));
         }
-        if (f.IsRecursive) {
-          args.Add(etran.LayerN(1));
+        if (f.IsFuelAware()) {
+          args.Add(etran.layerInterCluster.GetFunctionFuel(f));
         }
         args.Add(etran.HeapExpr);
         foreach (Variable p in implInParams) {
@@ -5572,7 +5590,7 @@ namespace Microsoft.Dafny {
           tyargs.Add(TypeToTy(fm.Type));
         }
         tyargs.Add(TypeToTy(f.ResultType));
-        if (f.IsRecursive) {
+        if (f.IsFuelAware()) {
           Bpl.Expr ly; vars.Add(BplBoundVar("$ly", predef.LayerType, out ly)); args.Add(ly);
           formals.Add(BplFormalVar(null, predef.LayerType, true));
         }
@@ -6135,7 +6153,7 @@ namespace Microsoft.Dafny {
         var typeParams = TrTypeParamDecls(f.TypeArgs);
         var formals = new List<Variable>();
         formals.AddRange(MkTyParamFormals(GetTypeParams(f)));
-        if (f.IsRecursive) {
+        if (f.IsFuelAware()) {
           formals.Add(new Bpl.Formal(f.tok, new Bpl.TypedIdent(f.tok, "$ly", predef.LayerType), true));
         }
         formals.Add(new Bpl.Formal(f.tok, new Bpl.TypedIdent(f.tok, "$heap", predef.HeapType), true));
@@ -6212,7 +6230,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(predef != null);
       Contract.Requires(currentModule == null && codeContext == null);
       Contract.Ensures(currentModule == null && codeContext == null);
-      Contract.Ensures(Contract.Result<Bpl.Procedure>() != null);
+      Contract.Ensures(Contract.Result<Bpl.Procedure>() != null);      
 
       currentModule = m.EnclosingClass.Module;
       codeContext = m;
@@ -6495,7 +6513,7 @@ namespace Microsoft.Dafny {
       // parameters of the procedure
       List<Variable> inParams = new List<Variable>();
       Bpl.Formal layer;
-      if (f.IsRecursive) {
+      if (f.IsFuelAware()) {
         layer = new Bpl.Formal(f.tok, new Bpl.TypedIdent(f.tok, "$ly", predef.LayerType), true);
         inParams.Add(layer);
       } else {
@@ -7018,9 +7036,11 @@ namespace Microsoft.Dafny {
       Contract.Requires(locals != null);
       Contract.Requires(etran != null);
       Contract.Requires(codeContext != null && predef != null);
+      Contract.Ensures(fuelContext == Contract.OldValue(fuelContext));
       if (stmt is PredicateStmt) {
+        this.fuelContext = FuelSetting.ExpandFuelContext(stmt.Attributes, this.fuelContext);
         if (stmt is AssertStmt || DafnyOptions.O.DisallowSoundnessCheating) {
-          AddComment(builder, stmt, "assert statement");
+          AddComment(builder, stmt, "assert statement");          
           PredicateStmt s = (PredicateStmt)stmt;
           TrStmt_CheckWellformed(s.Expr, builder, locals, etran, false);
           IToken enclosingToken = null;
@@ -7040,13 +7060,14 @@ namespace Microsoft.Dafny {
               }
             }
             builder.Add(new Bpl.AssumeCmd(stmt.Tok, etran.TrExpr(s.Expr)));
-          }
+          }          
         } else if (stmt is AssumeStmt) {
           AddComment(builder, stmt, "assume statement");
           AssumeStmt s = (AssumeStmt)stmt;
           TrStmt_CheckWellformed(s.Expr, builder, locals, etran, false);
           builder.Add(new Bpl.AssumeCmd(stmt.Tok, etran.TrExpr(s.Expr), etran.TrAttributes(stmt.Attributes, null)));
         }
+        this.fuelContext = FuelSetting.PopFuelContext();
       } else if (stmt is PrintStmt) {
         AddComment(builder, stmt, "print statement");
         PrintStmt s = (PrintStmt)stmt;
@@ -7279,6 +7300,7 @@ namespace Microsoft.Dafny {
 
       } else if (stmt is WhileStmt) {
         AddComment(builder, stmt, "while statement");
+        this.fuelContext = FuelSetting.ExpandFuelContext(stmt.Attributes, this.fuelContext);
         var s = (WhileStmt)stmt;
         BodyTranslator bodyTr = null;
         if (s.Body != null) {
@@ -7289,7 +7311,7 @@ namespace Microsoft.Dafny {
           };
         }
         TrLoop(s, s.Guard, bodyTr, builder, locals, etran);
-
+        this.fuelContext = FuelSetting.PopFuelContext();
       } else if (stmt is AlternativeLoopStmt) {
         AddComment(builder, stmt, "alternative loop statement");
         var s = (AlternativeLoopStmt)stmt;
@@ -7331,6 +7353,7 @@ namespace Microsoft.Dafny {
 
       } else if (stmt is ForallStmt) {
         var s = (ForallStmt)stmt;
+        this.fuelContext = FuelSetting.ExpandFuelContext(stmt.Attributes, this.fuelContext);
         if (s.Kind == ForallStmt.ParBodyKind.Assign) {
           AddComment(builder, stmt, "forall statement (assign)");
           Contract.Assert(s.Ens.Count == 0);
@@ -7374,7 +7397,7 @@ namespace Microsoft.Dafny {
         } else {
           Contract.Assert(false);  // unexpected kind
         }
-
+        this.fuelContext = FuelSetting.PopFuelContext();
       } else if (stmt is CalcStmt) {
         /* Translate into:
         if (*) {
@@ -7397,9 +7420,10 @@ namespace Microsoft.Dafny {
         }
         assume line<0> op line<n>;
         */
-        var s = (CalcStmt)stmt;
+        var s = (CalcStmt)stmt;        
         Contract.Assert(s.Steps.Count == s.Hints.Count); // established by the resolver
         AddComment(builder, stmt, "calc statement");
+        this.fuelContext = FuelSetting.ExpandFuelContext(stmt.Attributes, this.fuelContext);
         CurrentIdGenerator.Push();  // put the entire calc statement within its own sub-branch
         if (s.Lines.Count > 0) {
           Bpl.IfCmd ifCmd = null;
@@ -7464,7 +7488,7 @@ namespace Microsoft.Dafny {
           }
         }
         CurrentIdGenerator.Pop();
-
+        this.fuelContext = FuelSetting.PopFuelContext();
       } else if (stmt is MatchStmt) {
         var s = (MatchStmt)stmt;
         TrStmt_CheckWellformed(s.Source, builder, locals, etran, true);
@@ -10262,6 +10286,227 @@ namespace Microsoft.Dafny {
       }
     }
 
+    internal class FuelSettingPair 
+    {
+      public int low;
+      public int high;
+
+      public FuelSettingPair(int low = (int)FuelSetting.FuelAmount.LOW, int high = (int)FuelSetting.FuelAmount.HIGH) {
+        this.low = low;
+        this.high = high;
+      }
+    }
+
+    // C#'s version of a type alias
+    internal class FuelContext : Dictionary<Function, FuelSettingPair> { }
+
+    internal class FuelSetting
+    {
+      public enum FuelAmount { NONE, LOW, HIGH };
+      public static Stack<FuelContext> SavedContexts = new Stack<FuelContext>();
+
+      private static FuelSettingPair FuelAttrib(Function f) {
+        Contract.Requires(f != null);
+        Contract.Ensures(Contract.Result<FuelSettingPair>() != null);
+        FuelSettingPair setting = new FuelSettingPair();
+
+        if (f.Attributes != null) {
+          List<Expression> args = Attributes.FindExpressions(f.Attributes, "fuel");
+          if (args != null && args.Count >= 2) {
+            LiteralExpr literalLow = args[0] as LiteralExpr;
+            LiteralExpr literalHigh = args[1] as LiteralExpr;
+
+            if (literalLow != null && literalLow.Value is BigInteger && literalHigh != null && literalHigh.Value is BigInteger) {
+              setting.low = (int)((BigInteger)literalLow.Value);
+              setting.high = (int)((BigInteger)literalHigh.Value);
+            }
+          } else if (args != null && args.Count >= 1) {
+            LiteralExpr literal = args[0] as LiteralExpr;
+            if (literal != null && literal.Value is BigInteger) {
+              setting.low = (int)((BigInteger)literal.Value);
+              setting.high = setting.low + 1;
+            }
+          }
+        }
+
+        return setting;
+      }
+
+      public int amount;        // Amount of fuel above that represented by start
+      private Bpl.Expr start;   // Starting fuel argument (null indicates LZ)      
+      private Translator translator;
+
+      public FuelSetting(Translator translator, int amount, Bpl.Expr start = null) {
+        this.translator = translator;
+        this.amount = amount;
+        this.start = start;
+      }
+
+      public FuelSetting Offset(int offset) {
+        return new FuelSetting(translator, this.amount + offset, start);
+      }
+
+      public Bpl.Expr LayerZero() {
+        Contract.Ensures(Contract.Result<Bpl.Expr>() != null);
+        return new Bpl.IdentifierExpr(Token.NoToken, "$LZ", translator.predef.LayerType);
+      }
+
+      public Bpl.Expr LayerN(int n) {
+        Contract.Requires(0 <= n);
+        Contract.Ensures(Contract.Result<Bpl.Expr>() != null);
+        return translator.LayerSucc(LayerZero(), n);
+      }
+
+      private Bpl.Expr ToExpr(int amount) {
+        if (start == null) {
+          return LayerN(amount);
+        } else {
+          return translator.LayerSucc(start, amount);
+        }
+      }
+
+      public Bpl.Expr ToExpr() {
+        return this.ToExpr(this.amount);
+      }
+
+      /// <summary>
+      /// Get the fuel value for this function, given the ambient environment (represented by the fuel setting)
+      /// the function itself, and the function call's context (if any)
+      /// </summary>      
+      public Bpl.Expr GetFunctionFuel(Function f) {
+        Contract.Requires(f != null);
+        if (this.amount == (int)FuelAmount.NONE) {
+          return this.ToExpr();
+        } else {
+          FuelSettingPair setting = null;
+          var found = translator.fuelContext.TryGetValue(f, out setting);
+
+          if (!found) {  // If the context doesn't define fuel for this function, check for a fuel attribute (which supplies a default value if none is found)
+            setting = FuelAttrib(f);
+          }
+
+          if (this.amount == (int)FuelAmount.LOW) {
+            return ToExpr(setting.low);
+          } else if (this.amount == (int)FuelAmount.HIGH) {
+            return ToExpr(setting.high);
+          } else {
+            Contract.Assert(false); // Should not reach here
+            return null;
+          }
+        }
+      }
+
+
+      /// <summary>
+      /// Finds all fuel related attributes of the form {:fuel function low [high]}
+      /// Adds the setting to the context _if_ the context does not already have a setting for that function.
+      /// In other words, it should be called in order from most to least specific contenxt scope.
+      /// </summary>    
+      private static void FindFuelAttributes(Attributes attribs, FuelContext fuelContext) {
+        Function f = null;
+        FuelSettingPair setting = null;
+
+        if (attribs != null) {
+          List<List<Expression>> results = Attributes.FindAllExpressions(attribs, "fuel");
+
+          if (results != null) {
+            foreach (List<Expression> args in results) {
+              if (args != null && args.Count >= 2) {
+                // Try to extract the function from the first argument
+                MemberSelectExpr selectExpr = args[0].Resolved as MemberSelectExpr;
+                if (selectExpr != null) {
+                  f = selectExpr.Member as Function;
+                }
+
+                // Try to extract the lower fuel setting
+                LiteralExpr literalLow = args[1] as LiteralExpr;
+                if (literalLow != null && literalLow.Value is BigInteger) {
+                  setting = new FuelSettingPair();
+                  setting.low = (int)((BigInteger)literalLow.Value);
+                }
+
+                // The user may supply an additional high argument; if not, it defaults to low + 1
+                if (f != null && args.Count >= 3) {
+                  LiteralExpr literalHigh = args[2] as LiteralExpr;
+                  if (setting != null && literalHigh != null && literalHigh.Value is BigInteger) {
+                    setting.high = (int)((BigInteger)literalHigh.Value);
+                    if (!fuelContext.ContainsKey(f)) {
+                      fuelContext.Add(f, setting);
+                    }
+                  }
+                } else if (f != null && setting != null) {
+                  setting.high = setting.low + 1;
+                  if (!fuelContext.ContainsKey(f)) {
+                    fuelContext.Add(f, setting);
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+
+      /// <summary>
+      /// Extend the given context with fuel information from the declaration itself, and enclosing modules
+      /// </summary>
+      private static void AddFuelContext(FuelContext context, TopLevelDecl decl) {
+        FindFuelAttributes(decl.Attributes, context);
+
+        var module = decl.Module;
+        while (module != null) {
+          FindFuelAttributes(module.Attributes, context);
+          module = module.Module;
+        }
+      }
+
+      /// <summary>
+      /// Creates a summary of all fuel settings in scope, starting from the given class declaration
+      /// </summary>      
+      public static FuelContext NewFuelContext(TopLevelDecl decl) {
+        FuelContext context = new FuelContext();
+        AddFuelContext(context, decl);
+        return context;
+      }
+
+      /// <summary>
+      /// Creates a summary of all fuel settings in scope, starting from the given member declaration      
+      /// </summary>      
+      public static FuelContext NewFuelContext(MemberDecl decl) {
+        FuelContext context = new FuelContext();
+
+        FindFuelAttributes(decl.Attributes, context);
+        AddFuelContext(context, decl.EnclosingClass);
+        
+        return context;
+      }
+
+      /// <summary>
+      /// Extends the given fuel context with any new fuel settings found in attribs
+      /// </summary>    
+      public static FuelContext ExpandFuelContext(Attributes attribs, FuelContext oldFuelContext) {
+        Contract.Ensures(SavedContexts.Count == Contract.OldValue(SavedContexts.Count) + 1);
+        FuelContext newContext = new FuelContext();
+        FindFuelAttributes(attribs, newContext);
+        if (newContext.Count > 0) {
+          foreach (var pair in oldFuelContext) {
+            if (!newContext.ContainsKey(pair.Key)) {    // Local setting takes precedence over old context
+              newContext.Add(pair.Key, pair.Value);              
+            }
+          }          
+        } else {
+          newContext = oldFuelContext;
+        }
+        SavedContexts.Push(oldFuelContext);
+        return newContext;
+      }
+
+      public static FuelContext PopFuelContext() {
+        Contract.Requires(SavedContexts.Count > 0);
+        return SavedContexts.Pop();
+      }
+
+    }
+
     internal class ExpressionTranslator
     {
       public readonly Bpl.Expr HeapExpr;
@@ -10270,8 +10515,8 @@ namespace Microsoft.Dafny {
       public readonly string This;
       public readonly string modifiesFrame; // the name of the context's frame variable.
       readonly Function applyLimited_CurrentFunction;
-      public readonly Bpl.Expr layerInterCluster;
-      public readonly Bpl.Expr layerIntraCluster = null;  // a value of null says to do the same as for inter-cluster calls
+      public readonly FuelSetting layerInterCluster;
+      public readonly FuelSetting layerIntraCluster = null;  // a value of null says to do the same as for inter-cluster calls
       public int Statistics_CustomLayerFunctionCount = 0;
       public readonly bool ProducingCoCertificates = false;
       [ContractInvariantMethod]
@@ -10287,41 +10532,17 @@ namespace Microsoft.Dafny {
         Contract.Invariant(0 <= Statistics_CustomLayerFunctionCount);
       }
 
-      /// <summary>
-      /// This is a general constructor, but takes the layerInterCluster as an int.
-      /// </summary>
-      ExpressionTranslator(Translator translator, PredefinedDecls predef, Bpl.Expr heap, string thisVar,
-        Function applyLimited_CurrentFunction, int layerInterCluster, Bpl.Expr layerIntraCluster, string modifiesFrame) {
-
-        Contract.Requires(translator != null);
-        Contract.Requires(predef != null);
-        Contract.Requires(heap != null);
-        Contract.Requires(thisVar != null);
-        Contract.Requires(0 <= layerInterCluster);
-        Contract.Requires(modifiesFrame != null);
-
-        this.translator = translator;
-        this.predef = predef;
-        this.HeapExpr = heap;
-        this.This = thisVar;
-        this.applyLimited_CurrentFunction = applyLimited_CurrentFunction;
-        this.layerInterCluster = LayerN(layerInterCluster);
-        this.layerIntraCluster = layerIntraCluster;
-        this.modifiesFrame = modifiesFrame;
-      }
-
       /// <summary>
       /// This is the most general constructor.  It is private and takes all the parameters.  Whenever
       /// one ExpressionTranslator is constructed from another, unchanged parameters are just copied in.
       /// </summary>
       ExpressionTranslator(Translator translator, PredefinedDecls predef, Bpl.Expr heap, string thisVar,
-        Function applyLimited_CurrentFunction, Bpl.Expr layerInterCluster, Bpl.Expr layerIntraCluster, string modifiesFrame) {
+        Function applyLimited_CurrentFunction, FuelSetting layerInterCluster, FuelSetting layerIntraCluster, string modifiesFrame) {
 
         Contract.Requires(translator != null);
         Contract.Requires(predef != null);
         Contract.Requires(heap != null);
-        Contract.Requires(thisVar != null);
-        Contract.Requires(layerInterCluster != null);
+        Contract.Requires(thisVar != null);       
         Contract.Requires(modifiesFrame != null);
 
         this.translator = translator;
@@ -10329,7 +10550,7 @@ namespace Microsoft.Dafny {
         this.HeapExpr = heap;
         this.This = thisVar;
         this.applyLimited_CurrentFunction = applyLimited_CurrentFunction;
-        this.layerInterCluster = layerInterCluster;
+        this.layerInterCluster = layerInterCluster;        
         if (layerIntraCluster == null) {
           this.layerIntraCluster = layerInterCluster;
         } else {
@@ -10365,7 +10586,7 @@ namespace Microsoft.Dafny {
       }
 
       public ExpressionTranslator(Translator translator, PredefinedDecls predef, Bpl.Expr heap, string thisVar)
-        : this(translator, predef, heap, thisVar, null, 1, null, "$_Frame") {
+        : this(translator, predef, heap, thisVar, null, new FuelSetting(translator, 1), null, "$_Frame") {
         Contract.Requires(translator != null);
         Contract.Requires(predef != null);
         Contract.Requires(heap != null);
@@ -10409,7 +10630,7 @@ namespace Microsoft.Dafny {
         Contract.Requires(layerArgument != null);
         Contract.Ensures(Contract.Result<ExpressionTranslator>() != null);
 
-        return new ExpressionTranslator(translator, predef, HeapExpr, This, null, layerArgument, layerArgument, modifiesFrame);
+        return new ExpressionTranslator(translator, predef, HeapExpr, This, null, new FuelSetting(translator, 0, layerArgument), new FuelSetting(translator, 0, layerArgument), modifiesFrame);
       }
 
       public ExpressionTranslator LimitedFunctions(Function applyLimited_CurrentFunction, Bpl.Expr layerArgument) {
@@ -10417,16 +10638,16 @@ namespace Microsoft.Dafny {
         Contract.Requires(layerArgument != null);
         Contract.Ensures(Contract.Result<ExpressionTranslator>() != null);
 
-        return new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, /* layerArgument */ layerInterCluster, layerArgument, modifiesFrame);
+        return new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, /* layerArgument */ layerInterCluster, new FuelSetting(translator, 0, layerArgument), modifiesFrame);
       }
 
       public ExpressionTranslator LayerOffset(int offset) {
         Contract.Requires(0 <= offset);
         Contract.Ensures(Contract.Result<ExpressionTranslator>() != null);
 
-        var et = new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, translator.LayerSucc(layerInterCluster, offset), layerIntraCluster, modifiesFrame);
+        var et = new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, layerInterCluster.Offset(offset), layerIntraCluster, modifiesFrame);
         if (this.oldEtran != null) {
-          var etOld = new ExpressionTranslator(translator, predef, Old.HeapExpr, This, applyLimited_CurrentFunction, translator.LayerSucc(layerInterCluster, offset), layerIntraCluster, modifiesFrame);
+          var etOld = new ExpressionTranslator(translator, predef, Old.HeapExpr, This, applyLimited_CurrentFunction, layerInterCluster.Offset(offset), layerIntraCluster, modifiesFrame);
           etOld.oldEtran = etOld;
           et.oldEtran = etOld;
         }
@@ -10465,17 +10686,6 @@ namespace Microsoft.Dafny {
         }
       }
 
-      public Bpl.Expr LayerZero() {
-        Contract.Ensures(Contract.Result<Bpl.Expr>() != null);
-        return new Bpl.IdentifierExpr(Token.NoToken, "$LZ", predef.LayerType);
-      }
-
-      public Bpl.Expr LayerN(int n) {
-        Contract.Requires(0 <= n);
-        Contract.Ensures(Contract.Result<Bpl.Expr>() != null);
-        return translator.LayerSucc(LayerZero(), n);
-      }
-
       public Bpl.IdentifierExpr ModuleContextHeight() {
         Contract.Ensures(Contract.Result<Bpl.IdentifierExpr>().Type != null);
         return new Bpl.IdentifierExpr(Token.NoToken, "$ModuleContextHeight", Bpl.Type.Int);
@@ -10649,8 +10859,8 @@ namespace Microsoft.Dafny {
             },
             fn => {
               var args = e.TypeApplication.ConvertAll(translator.TypeToTy);
-              if (fn.IsRecursive) {
-                args.Add(layerInterCluster);
+              if (fn.IsFuelAware()) {
+                args.Add(this.layerInterCluster.GetFunctionFuel(fn));
               }
               if (!fn.IsStatic) {
                 args.Add(/* translator.BoxIfUnboxed */(TrExpr(e.Obj)/*, e.Type */));
@@ -10806,15 +11016,15 @@ namespace Microsoft.Dafny {
         } else if (expr is FunctionCallExpr) {
           FunctionCallExpr e = (FunctionCallExpr)expr;
           Bpl.Expr layerArgument;
-          if (e.Function.IsRecursive) {
+          if (e.Function.IsFuelAware()) {
             Statistics_CustomLayerFunctionCount++;
             ModuleDefinition module = e.Function.EnclosingClass.Module;
             if (this.applyLimited_CurrentFunction != null &&
               this.layerIntraCluster != null &&
               ModuleDefinition.InSameSCC(e.Function, applyLimited_CurrentFunction)) {
-              layerArgument = this.layerIntraCluster;
+              layerArgument = this.layerIntraCluster.GetFunctionFuel(e.Function);
             } else {
-              layerArgument = this.layerInterCluster;
+              layerArgument = this.layerInterCluster.GetFunctionFuel(e.Function);
             }
           } else {
             layerArgument = null;
@@ -10992,7 +11202,7 @@ namespace Microsoft.Dafny {
               if (cot != null) {
                 var e0args = e.E0.Type.NormalizeExpand().TypeArgs;
                 var e1args = e.E1.Type.NormalizeExpand().TypeArgs;
-                return translator.CoEqualCall(cot, e0args, e1args, null, LayerN(2), e0, e1, expr.tok);
+                return translator.CoEqualCall(cot, e0args, e1args, null, this.layerInterCluster.LayerN((int)FuelSetting.FuelAmount.HIGH), e0, e1, expr.tok);
               }
               typ = Bpl.Type.Bool;
               bOpcode = BinaryOperator.Opcode.Eq; break;
@@ -11001,7 +11211,7 @@ namespace Microsoft.Dafny {
               if (cotx != null) {
                 var e0args = e.E0.Type.NormalizeExpand().TypeArgs;
                 var e1args = e.E1.Type.NormalizeExpand().TypeArgs;
-                var x = translator.CoEqualCall(cotx, e0args, e1args, null, LayerN(2), e0, e1, expr.tok);
+                var x = translator.CoEqualCall(cotx, e0args, e1args, null, this.layerInterCluster.LayerN((int)FuelSetting.FuelAmount.HIGH), e0, e1, expr.tok);
                 return Bpl.Expr.Unary(expr.tok, UnaryOperator.Opcode.Not, x);
               }
               typ = Bpl.Type.Bool;
@@ -11282,7 +11492,7 @@ namespace Microsoft.Dafny {
               var e2type = e.E2.Type.NormalizeExpand();
               var cot = e1type.AsCoDatatype;
               Contract.Assert(cot != null);  // the argument types of prefix equality (and prefix disequality) are codatatypes
-              var r = translator.CoEqualCall(cot, e1type.TypeArgs, e2type.TypeArgs, e0, LayerN(2), e1, e2);
+              var r = translator.CoEqualCall(cot, e1type.TypeArgs, e2type.TypeArgs, e0, this.layerInterCluster.LayerN((int)FuelSetting.FuelAmount.HIGH), e1, e2);
               if (e.Op == TernaryExpr.Opcode.PrefixEqOp) {
                 return r;
               } else {
@@ -11315,8 +11525,7 @@ namespace Microsoft.Dafny {
           if (Attributes.ContainsBool(e.Attributes, "layerQuantifier", ref _scratch)) {
             // If this is a layer quantifier, quantify over layers here, and use $LS(ly) layers in the translation of the body
             var ly = BplBoundVar(e.Refresh("q$ly#", translator.CurrentIdGenerator), predef.LayerType, bvars);
-            Expr layer = translator.LayerSucc(ly);
-            bodyEtran = new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, layer, layer, modifiesFrame);
+            bodyEtran = new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, new FuelSetting(translator, 1, ly), new FuelSetting(translator, 1, ly), modifiesFrame);
           }
           if (Attributes.ContainsBool(e.Attributes, "heapQuantifier", ref _scratch)) {
             var h = BplBoundVar(e.Refresh("q$heap#", translator.CurrentIdGenerator), predef.HeapType, bvars);
@@ -11489,7 +11698,7 @@ namespace Microsoft.Dafny {
                 new Bpl.LambdaExpr(e.tok, new List<TypeVariable>(), bvars, null, ebody),
                 new Bpl.LambdaExpr(e.tok, new List<TypeVariable>(), bvars, null, reqbody),
                 new Bpl.LambdaExpr(e.tok, new List<TypeVariable>(), bvars, null, rdbody))),
-            layerIntraCluster ?? layerInterCluster),
+                layerIntraCluster != null ? layerIntraCluster.ToExpr() : layerInterCluster.ToExpr()),
           predef.HandleType);
       }
 
@@ -12582,15 +12791,14 @@ namespace Microsoft.Dafny {
           //   checked $PrefixEqual#Dt(k, A, B) || (0 < k ==> A.Cons? ==> B.Cons? && A.head == B.head && $PrefixEqual#2#Dt(k - 1, A.tail, B.tail))  // note the #2 in the recursive call, just like for user-defined predicates that are inlined by TrSplitExpr
           //   free $PrefixEqual#Dt(k, A, B);
           var kPos = Bpl.Expr.Lt(Bpl.Expr.Literal(0), k);
-          var prefixEqK = CoEqualCall(codecl, e1type.TypeArgs, e2type.TypeArgs, k, etran.LayerN(2), A, B); // FunctionCall(expr.tok, CoPrefixName(codecl, 1), Bpl.Type.Bool, k, A, B);
+          var prefixEqK = CoEqualCall(codecl, e1type.TypeArgs, e2type.TypeArgs, k, etran.layerInterCluster.LayerN((int)FuelSetting.FuelAmount.HIGH), A, B); // FunctionCall(expr.tok, CoPrefixName(codecl, 1), Bpl.Type.Bool, k, A, B);
           var kMinusOne = Bpl.Expr.Sub(k, Bpl.Expr.Literal(1));
           // for the inlining of the definition of prefix equality, translate the two main equality operands arguments with a higher offset (to obtain #2 functions)
           var etran2 = etran.LayerOffset(1);
           var A2 = etran2.TrExpr(e.E1);
           var B2 = etran2.TrExpr(e.E2);
           var needsTokenAdjust = TrSplitNeedsTokenAdjustment(expr);
-          // Dan: dafny4/Circ.dfy needs this one to be 2+, rather than 1+
-          Bpl.Expr layer = LayerSucc(etran.layerInterCluster, 2);
+          Bpl.Expr layer = etran.layerInterCluster.LayerN((int)FuelSetting.FuelAmount.HIGH);
           foreach (var c in CoPrefixEquality(needsTokenAdjust ? new ForceCheckToken(expr.tok) : expr.tok, codecl, e1type.TypeArgs, e2type.TypeArgs, kMinusOne, layer, A2, B2, true)) {
             var p = Bpl.Expr.Binary(c.tok, BinaryOperator.Opcode.Or, prefixEqK, Bpl.Expr.Imp(kPos, c));
             splits.Add(new SplitExprInfo(SplitExprInfo.K.Checked, p));
@@ -13944,7 +14152,7 @@ namespace Microsoft.Dafny {
           r = rr;
         } else if (stmt is CalcStmt) {
           var s = (CalcStmt)stmt;
-          var rr = new CalcStmt(s.Tok, s.EndTok, SubstCalcOp(s.Op), s.Lines.ConvertAll(Substitute), s.Hints.ConvertAll(SubstBlockStmt), s.StepOps.ConvertAll(SubstCalcOp), SubstCalcOp(s.ResultOp));
+          var rr = new CalcStmt(s.Tok, s.EndTok, SubstCalcOp(s.Op), s.Lines.ConvertAll(Substitute), s.Hints.ConvertAll(SubstBlockStmt), s.StepOps.ConvertAll(SubstCalcOp), SubstCalcOp(s.ResultOp), SubstAttributes(s.Attributes));
           rr.Steps.AddRange(s.Steps.ConvertAll(Substitute));
           rr.Result = Substitute(s.Result);
           r = rr;
diff --git a/Test/dafny0/Fuel.dfy b/Test/dafny0/Fuel.dfy
new file mode 100644
index 00000000..c8a1fc2f
--- /dev/null
+++ b/Test/dafny0/Fuel.dfy
@@ -0,0 +1,423 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+module TestModule1 {
+    function pos(x:int) : int 
+    {
+        if x < 0 then 0
+        else 1 + pos(x - 1)
+    }
+
+    method test(y:int, z:int) 
+        requires y > 5;
+        requires z < 0;
+    {
+        assert pos(z) == 0;
+        assert pos(-1) == 0;
+        assert pos(y) == 3 + pos(y - 3);    // error: Should fail, due to lack of fuel
+        assert pos(y) == 4 + pos(y - 4);    // Succeeds, thanks to the assume from the preceding assert
+    }
+}
+
+// Test with function-level fuel boost
+module TestModule2 {
+    function {:fuel 3} pos1(x:int) : int 
+    {
+        if x < 0 then 0
+        else 1 + pos1(x - 1)
+    }
+
+    function {:fuel 3,5} pos2(x:int) : int 
+    {
+        if x < 0 then 0
+        else 1 + pos2(x - 1)
+    }
+
+    function {:fuel 3,5} pos3(x:int) : int 
+    {
+        if x < 0 then 0
+        else 1 + pos3(x - 1)
+    }
+
+    function {:opaque} {:fuel 3,5} pos4(x:int) : int 
+    {
+        if x < 0 then 0
+        else 1 + pos3(x - 1)
+    }
+
+    method test(y:int, z:int) 
+        requires y > 5;
+        requires z < 0;
+    {
+        assert pos1(z) == 0;
+        assert pos1(-1) == 0;
+        assert pos1(y) == 3 + pos1(y - 3);
+        assert pos1(y) == 4 + pos1(y - 4);
+
+        assert pos2(z) == 0;
+        assert pos2(-1) == 0;
+        assert pos2(y) == 3 + pos2(y - 3);
+        assert pos2(y) == 4 + pos2(y - 4);
+
+        if (*) {
+            assert pos3(y) == 5 + pos3(y - 5);  // Just enough fuel to get here
+        } else {
+            assert pos3(y) == 6 + pos3(y - 6);  // error: Should fail even with a boost, since boost is too small
+        }
+
+        if (*) {
+            assert pos4(z) == 0;    // error: Fuel shouldn't overcome opaque
+        } else {
+            reveal_pos4();
+            assert pos4(y) == 5 + pos4(y - 5);  // With reveal, everything should work as above
+        }
+
+
+    }
+}
+
+
+module TestModule3 {
+    // This fuel setting is equivalent to opaque, except for literals
+    function {:fuel 0,0} pos(x:int) : int 
+    {
+        if x < 0 then 0
+        else 1 + pos(x - 1)
+    }
+
+    method test(y:int, z:int) 
+        requires y > 5;
+        requires z < 0;
+    {
+        assert pos(z) == 0;             // error: Opaque setting hides body
+        assert pos(-1) == 0;            // Passes, since Dafny's computation mode for lits ignore fuel
+        assert pos(y) == 3 + pos(y - 3);// error: Opaque setting hides body
+    }
+}
+
+// Test fuel settings via different contexts
+module TestModule4 {
+    function pos(x:int) : int 
+    {
+        if x < 0 then 0
+        else 1 + pos(x - 1)
+    }
+
+    // Should pass
+    method {:fuel pos,3,5} test1(y:int, z:int) 
+        requires y > 5;
+        requires z < 0;
+    {
+        assert pos(z) == 0;
+        assert pos(-1) == 0;
+        assert pos(y) == 3 + pos(y - 3);
+    }
+
+    method {:fuel pos,0,0} test2(y:int, z:int) 
+        requires y > 5;
+        requires z < 0;
+    {
+        assert pos(z) == 0;               // error: Should fail due to "opaque" fuel setting
+        assert pos(-1) == 0;
+        assert pos(y) == 3 + pos(y - 3);  // error: Should fail due to "opaque" fuel setting
+    }
+
+    method test3(y:int, z:int) 
+        requires y > 5;
+        requires z < 0;
+    {
+        assert {:fuel pos,0,0} pos(z) == 0;               // error: Should fail due to "opaque" fuel setting
+        assert pos(-1) == 0;
+        if (*) {
+            assert pos(y) == 3 + pos(y - 3);  // error: Should fail without extra fuel setting
+            assert pos(y) == 6 + pos(y - 6);  // error: Should fail even with previous assert turned into assume
+        } else {
+            assert {:fuel pos,3,5} pos(y) == 3 + pos(y - 3);  // Should succeed with extra fuel setting
+            assert pos(y) == 6 + pos(y - 6);  // Should succeed thanks to previous assert turned into assume
+        } 
+    }
+
+    method test4(y:int, z:int) 
+        requires y > 5;
+        requires z < 0;
+    {
+        forall t:int {:fuel pos,3} | t > 0 
+            ensures true;
+        {
+            assert pos(y) == 3 + pos(y - 3);    // Expected to pass, due to local fuel boost
+        }
+
+        if (*) {
+            calc {:fuel pos,3} {
+                pos(y);
+                3 + pos(y - 3);
+            }
+        }
+
+        assert pos(y) == 3 + pos(y - 3);    // error: Should fail, due to lack of fuel outside the forall
+    }
+}
+
+// Test fuel settings via different module contexts
+module TestModule5 {
+    // Test module level fuel settings, with nested modules
+
+    module TestModule5a {
+        module {:fuel TestModule5aiA.pos,3} TestModule5ai {
+            module TestModule5aiA {
+                function pos(x:int) : int 
+                {
+                    if x < 0 then 0
+                    else 1 + pos(x - 1)
+                }
+
+                method test(y:int, z:int) 
+                    requires y > 5;
+                    requires z < 0;
+                {
+                    assert pos(z) == 0;
+                    assert pos(-1) == 0;
+                    assert pos(y) == 3 + pos(y - 3);    // Should pass due to intermediate module's fuel setting
+                }
+            }
+
+            method test(y:int, z:int) 
+                requires y > 5;
+                requires z < 0;
+            {
+                assert TestModule5aiA.pos(z) == 0;
+                assert TestModule5aiA.pos(-1) == 0;
+                assert TestModule5aiA.pos(y) == 3 + TestModule5aiA.pos(y - 3);    // Should pass due to module level fuel
+            }
+        }
+  
+        method test(y:int, z:int) 
+            requires y > 5;
+            requires z < 0;
+        {
+            assert TestModule5ai.TestModule5aiA.pos(z) == 0;
+            assert TestModule5ai.TestModule5aiA.pos(-1) == 0;
+            assert TestModule5ai.TestModule5aiA.pos(y) == 3 + TestModule5ai.TestModule5aiA.pos(y - 3);    // error: Should fail, due to lack of fuel
+        }
+    }
+
+    module {:fuel TestModule5bi.TestModule5biA.pos,3} TestModule5b {
+        module  TestModule5bi {
+            module TestModule5biA {
+                function pos(x:int) : int 
+                {
+                    if x < 0 then 0
+                    else 1 + pos(x - 1)
+                }
+
+                method test(y:int, z:int) 
+                    requires y > 5;
+                    requires z < 0;
+                {
+                    assert pos(z) == 0;
+                    assert pos(-1) == 0;
+                    assert pos(y) == 3 + pos(y - 3);    // Should succceed due to outer module fuel setting
+                }
+            }
+        }
+    }
+}
+
+// Test fuel setting for multiple functions
+module TestModule6 {
+    function pos(x:int) : int 
+    {
+        if x < 0 then 0
+        else 1 + pos(x - 1)
+    }
+
+    function neg(x:int) : int
+        decreases 1 - x;
+    {
+        if x > 0 then 0
+        else 1 + neg(x + 1)
+    }
+
+    method test1(y:int, z:int) 
+        requires y > 5;
+        requires z < 5;
+    {
+        assert pos(y) == 3 + pos(y - 3);    // error: Should fail, due to lack of fuel
+
+        assert neg(z) == 3 + neg(z + 3);    // error: Should fail, due to lack of fuel
+    }
+
+    method {:fuel pos,3} {:fuel neg,4} test2(y:int, z:int) 
+        requires y > 5;
+        requires z < -5;
+    {
+        assert pos(y) == 3 + pos(y - 3);    
+
+        assert neg(z) == 3 + neg(z + 3);    
+    }
+}
+
+// Test fuel settings with multiple overlapping contexts
+module TestModule7 {
+    function {:fuel 3} pos(x:int) : int 
+    {
+        if x < 0 then 0
+        else 1 + pos(x - 1)
+    }
+
+    function {:fuel 0,0} neg(x:int) : int
+        decreases 1 - x;
+    {
+        if x > 0 then 0
+        else 1 + neg(x + 1)
+    }
+
+    method {:fuel neg,4} {:fuel pos,0,0} test1(y:int, z:int) 
+        requires y > 5;
+        requires z < -5;
+    {
+        if (*) {
+            assert pos(y) == 3 + pos(y - 3);    // error: Method fuel should override function fuel, so this should fail
+            assert neg(z) == 3 + neg(z + 3);    // Method fuel should override function fuel, so this succeeds
+        }
+
+        forall t:int {:fuel pos,3} | t > 0 
+            ensures true;
+        {
+            assert pos(y) == 3 + pos(y - 3);    // Statement fuel should override method fuel, so this should succeed
+        }
+    }
+}
+
+// Test fuel in a slightly more complicated setting
+module TestModule8 {
+
+    newtype byte = i:int | 0 <= i < 0x100
+    newtype uint64 = i:int | 0 <= i < 0x10000000000000000
+
+    datatype G = GUint64
+               | GArray(elt:G)
+               | GTuple(t:seq<G>)
+               | GByteArray
+               | GTaggedUnion(cases:seq<G>)
+
+        datatype V = VUint64(u:uint64)
+                   | VTuple(t:seq<V>)
+                   | VCase(c:uint64, val:V)
+
+        predicate {:fuel 2} ValInGrammar(val:V, grammar:G)
+        {
+            match val
+                case VUint64(_) => grammar.GUint64?
+                case VTuple(t)  => grammar.GTuple? && |t| == |grammar.t|
+                                      && forall i :: 0 <= i < |t| ==> ValInGrammar(t[i], grammar.t[i])
+                case VCase(c, val) => grammar.GTaggedUnion? && int(c) < |grammar.cases| && ValInGrammar(val, grammar.cases[c])
+        }
+
+        datatype CRequest = CRequest(client:EndPoint, seqno:uint64, request:CAppMessage) | CRequestNoOp()
+
+        type EndPoint
+        function method EndPoint_grammar() : G { GUint64 }
+        function method CRequest_grammar() : G { GTaggedUnion([ GTuple([EndPoint_grammar(), GUint64, CAppMessage_grammar()]), GUint64]) }
+
+        function method parse_EndPoint(val:V) : EndPoint
+            requires ValInGrammar(val, EndPoint_grammar());
+
+        type CAppMessage
+        function method CAppMessage_grammar() : G { GTaggedUnion([GUint64, GUint64, GUint64]) }
+        function method parse_AppMessage(val:V) : CAppMessage
+            requires ValInGrammar(val, CAppMessage_grammar());
+
+        function method {:fuel ValInGrammar,1,2} parse_Request1(val:V) : CRequest
+            requires ValInGrammar(val, CRequest_grammar());
+        {
+            if val.c == 0 then
+                var ep := parse_EndPoint(val.val.t[0]); // With default fuel, error: function precondition, destructor, index
+                CRequest(ep, val.val.t[1].u, parse_AppMessage(val.val.t[2]))    // error: index out of range, destructor
+            else 
+                CRequestNoOp()
+        }
+
+        function method parse_Request2(val:V) : CRequest
+            requires ValInGrammar(val, CRequest_grammar());
+        {
+            if val.c == 0 then
+                var ep := parse_EndPoint(val.val.t[0]);                      // With fuel boosted to 2 this succeeds
+                CRequest(ep, val.val.t[1].u, parse_AppMessage(val.val.t[2])) // error: destructor
+            else 
+                CRequestNoOp()
+        }
+
+        function method {:fuel ValInGrammar,3} parse_Request3(val:V) : CRequest
+            requires ValInGrammar(val, CRequest_grammar());
+        {
+            if val.c == 0 then
+                var ep := parse_EndPoint(val.val.t[0]); 
+                CRequest(ep, val.val.t[1].u, parse_AppMessage(val.val.t[2]))    // With one more boost, everything succeeds
+            else 
+                CRequestNoOp()
+        }
+
+        // With the method, everything succeeds with one less fuel boost (i.e., 2, rather than 3, as in parse_Request3)
+        method parse_Request4(val:V) returns (req:CRequest)     
+            requires ValInGrammar(val, CRequest_grammar());
+        {
+            if val.c == 0 {
+                var ep := parse_EndPoint(val.val.t[0]);
+                req := CRequest(ep, val.val.t[1].u, parse_AppMessage(val.val.t[2]));
+            } else {
+                req := CRequestNoOp();
+            }
+        }
+}
+
+
+// Test fuel when it's applied to a non-recursive function
+module TestModule9 {
+    function abs(x:int) : int
+    {
+        if x < 0 then -1 * x else x
+    }
+
+    // All should pass.
+    method test1(y:int, z:int)
+        requires y > 5;
+        requires z < 0;
+    {
+        assert abs(z) == -1*z;
+        assert abs(y) == y;
+        assert abs(-1) == 1;
+    }
+
+    // Method-level fuel override
+    method {:fuel abs,0,0} test2(y:int, z:int)
+        requires y > 5;
+        requires z < 0;
+    {
+        assert abs(z) == -1*z;  // error: Cannot see the body of abs
+        assert abs(y) == y;     // error: Cannot see the body of abs
+        assert abs(-1) == 1;    // lit bypasses fuel, so this should succeed
+    }
+
+    // Statement-level fuel override
+    method test3(y:int, z:int)
+        requires y > 5;
+        requires z < 0;
+    {
+        assert {:fuel abs,0,0} abs(z) == -1*z;  // error: Cannot see the body of abs
+        assert abs(y) == y;     // Normal success
+        assert abs(-1) == 1;    // lit bypasses fuel, so this should succeed
+    }
+
+    // Giving more fuel to a non-recursive function won't help,
+    // but it shouldn't hurt either.
+    method {:fuel abs,5,7} test4(y:int, z:int)
+        requires y > 5;
+        requires z < 0;
+    {
+        assert abs(z) == -1*z;
+        assert abs(y) == y;
+        assert abs(-1) == 1;
+    }
+}
+
diff --git a/Test/dafny0/Fuel.dfy.expect b/Test/dafny0/Fuel.dfy.expect
new file mode 100644
index 00000000..4c180a9c
--- /dev/null
+++ b/Test/dafny0/Fuel.dfy.expect
@@ -0,0 +1,95 @@
+Fuel.dfy(17,23): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Fuel.dfy(65,28): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+    (0,0): anon6_Else
+Fuel.dfy(69,28): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+    (0,0): anon6_Then
+    (0,0): anon7_Then
+Fuel.dfy(92,23): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Fuel.dfy(94,23): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Fuel.dfy(120,23): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Fuel.dfy(122,23): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Fuel.dfy(129,39): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Fuel.dfy(132,27): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+    (0,0): anon3_Then
+Fuel.dfy(133,27): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+    (0,0): anon3_Then
+Fuel.dfy(157,23): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+    (0,0): anon10_Else
+    (0,0): anon9
+Fuel.dfy(200,56): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Fuel.dfy(245,23): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Fuel.dfy(247,23): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Fuel.dfy(280,27): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+    (0,0): anon7_Then
+Fuel.dfy(335,27): Error: possible violation of function precondition
+Fuel.dfy(324,22): Related location
+Execution trace:
+    (0,0): anon0
+    (0,0): anon7_Else
+    (0,0): anon8_Then
+Fuel.dfy(335,50): Error: destructor 't' can only be applied to datatype values constructed by 'VTuple'
+Execution trace:
+    (0,0): anon0
+    (0,0): anon7_Else
+    (0,0): anon8_Then
+Fuel.dfy(335,51): Error: index out of range
+Execution trace:
+    (0,0): anon0
+    (0,0): anon7_Else
+    (0,0): anon8_Then
+Fuel.dfy(336,39): Error: index out of range
+Execution trace:
+    (0,0): anon0
+    (0,0): anon7_Else
+    (0,0): anon8_Then
+Fuel.dfy(336,43): Error: destructor 'u' can only be applied to datatype values constructed by 'VUint64'
+Execution trace:
+    (0,0): anon0
+    (0,0): anon7_Else
+    (0,0): anon8_Then
+Fuel.dfy(346,43): Error: destructor 'u' can only be applied to datatype values constructed by 'VUint64'
+Execution trace:
+    (0,0): anon0
+    (0,0): anon7_Else
+    (0,0): anon8_Then
+Fuel.dfy(397,23): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Fuel.dfy(398,23): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Fuel.dfy(407,39): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+
+Dafny program verifier finished with 51 verified, 24 errors
diff --git a/Test/dafny4/Circ.dfy b/Test/dafny4/Circ.dfy
index e7609195..d110c05c 100644
--- a/Test/dafny4/Circ.dfy
+++ b/Test/dafny4/Circ.dfy
@@ -16,6 +16,7 @@ function zip(a: Stream, b: Stream): Stream { Cons(a.head, zip(b, a.tail)) }
 colemma BlinkZipProperty()
   ensures zip(zeros(), ones()) == blink();
 {
+    BlinkZipProperty();
 }
 
 // ----- Thue-Morse sequence -----
@@ -75,6 +76,7 @@ colemma FProperty(s: Stream<Bit>)
     // def. zip
     Cons(s.head, Cons(not(s).head, zip(s.tail, not(s).tail)));
   }
+  FProperty(s.tail);
 }
 
 // The fix-point theorem now follows easily.
-- 
cgit v1.2.3


From 50218b46904369dba030ed97067dacc87937003c Mon Sep 17 00:00:00 2001
From: Bryan Parno <parno@microsoft.com>
Date: Wed, 1 Jul 2015 12:42:55 -0700
Subject: Compile function methods into C# in a more efficient manner, at least
 for some common expressions.

---
 Source/Dafny/Compiler.cs | 137 +++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 133 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index fd2392e6..9f5b3e93 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -940,15 +940,144 @@ namespace Microsoft.Dafny {
       }
     }
 
-    void CompileReturnBody(Expression body, int indent) {
-      Contract.Requires(0 <= indent);
-      body = body.Resolved;
+    void TrCasePatternOpt(CasePattern pat, Expression rhs, string rhs_string, int indent) {
+      Contract.Requires(pat != null);
+      Contract.Requires(rhs != null);
+      if (pat.Var != null) {
+        // The trivial Dafny "pattern" expression
+        //    var x := G
+        // is translated into C# as:
+        // var x := G;
+        var bv = pat.Var;
+        if (!bv.IsGhost) {
+          Indent(indent);
+          wr.Write("{0} {1} = ", TypeName(bv.Type), "@" + bv.CompileName);
+          if (rhs != null) {
+            TrExpr(rhs);
+          } else {
+            wr.Write(rhs_string);
+          }
+          wr.Write(";\n");
+        }
+      } else if (pat.Arguments != null) {
+        // The Dafny "pattern" expression
+        //    var Pattern(x,y) := G
+        // is translated into C# as:
+        // var tmp := G;
+        // var x := dtorX(tmp);
+        // var y := dtorY(tmp);
+        var ctor = pat.Ctor;
+        Contract.Assert(ctor != null);  // follows from successful resolution
+        Contract.Assert(pat.Arguments.Count == ctor.Formals.Count);  // follows from successful resolution
+
+        // Create the temporary variable to hold G
+        var tmp_name = idGenerator.FreshId("_let_tmp_rhs");
+        Indent(indent);
+        wr.Write("{0} {1} = ", TypeName(rhs.Type), tmp_name);
+        TrExpr(rhs);
+        wr.WriteLine(";");
+
+        var k = 0;  // number of non-ghost formals processed
+        for (int i = 0; i < pat.Arguments.Count; i++) {
+          var arg = pat.Arguments[i];
+          var formal = ctor.Formals[i];
+          if (formal.IsGhost) {
+            // nothing to compile, but do a sanity check
+            Contract.Assert(!Contract.Exists(arg.Vars, bv => !bv.IsGhost));
+          } else {            
+            TrCasePatternOpt(arg, null, string.Format("(({0})({1})._D).@{2}", DtCtorName(ctor, ((DatatypeValue)pat.Expr).InferredTypeArgs), tmp_name, FormalName(formal, k)), indent);
+            k++;
+          }
+        }
+      }
+    }
+
+    void ReturnExpr(Expression expr, int indent) {
       Indent(indent);
       wr.Write("return ");
-      TrExpr(body);
+      TrExpr(expr);
       wr.WriteLine(";");
     }
 
+    void TrExprOpt(Expression expr, int indent) {
+      Contract.Requires(expr != null);
+      if (expr is LetExpr) {
+        var e = (LetExpr)expr;
+        if (e.Exact) {
+          for (int i = 0; i < e.LHSs.Count; i++) {
+            var lhs = e.LHSs[i];
+            if (Contract.Exists(lhs.Vars, bv => !bv.IsGhost)) {
+              TrCasePatternOpt(lhs, e.RHSs[i], null, indent);
+            }            
+          }
+          TrExprOpt(e.Body, indent);
+        } else {
+          // We haven't optimized the other cases, so fallback to normal compilation
+          ReturnExpr(e, indent);
+        }
+      } else if (expr is ITEExpr) {
+        ITEExpr e = (ITEExpr)expr;
+        Indent(indent);
+        wr.Write("if (");
+        TrExpr(e.Test);
+        wr.Write(") {\n");
+        TrExprOpt(e.Thn, indent + IndentAmount);
+        Indent(indent);
+        wr.WriteLine("} else {");
+        TrExprOpt(e.Els, indent + IndentAmount);
+        Indent(indent);
+        wr.WriteLine("}");
+      } else if (expr is MatchExpr) {
+        var e = (MatchExpr)expr;   
+        //   var _source = E;
+        //   if (source.is_Ctor0) {
+        //     FormalType f0 = ((Dt_Ctor0)source._D).a0;
+        //     ...
+        //     return Body0;
+        //   } else if (...) {
+        //     ...
+        //   } else if (true) {
+        //     ...
+        //   }
+        string source = idGenerator.FreshId("_source");
+        Indent(indent);
+        wr.Write("{0} {1} = ", TypeName(e.Source.Type), source);
+        TrExpr(e.Source);
+        wr.WriteLine(";");        
+
+        if (e.Cases.Count == 0) {
+          // the verifier would have proved we never get here; still, we need some code that will compile
+          wr.Write("throw new System.Exception();");
+        } else {
+          int i = 0;
+          var sourceType = (UserDefinedType)e.Source.Type.NormalizeExpand();
+          foreach (MatchCaseExpr mc in e.Cases) {
+            //Indent(indent);
+            MatchCasePrelude(source, sourceType, cce.NonNull(mc.Ctor), mc.Arguments, i, e.Cases.Count, indent);
+            TrExprOpt(mc.Body, indent + IndentAmount);
+            i++;
+          }
+          Indent(indent);
+          wr.WriteLine("}");
+        }        
+      }  else if (expr is StmtExpr) {
+        var e = (StmtExpr)expr;
+        TrExprOpt(e.E, indent);
+      } else {
+        // We haven't optimized any other cases, so fallback to normal compilation
+        ReturnExpr(expr, indent);
+      }
+    }
+
+    void CompileReturnBody(Expression body, int indent) {
+      Contract.Requires(0 <= indent);
+      body = body.Resolved;
+      //Indent(indent);
+      //wr.Write("return ");
+      TrExprOpt(body, indent);
+      //wr.WriteLine(";");
+    }
+
     // ----- Type ---------------------------------------------------------------------------------
 
     readonly string DafnySetClass = "Dafny.Set";
-- 
cgit v1.2.3


From 550caf7bc7e6427f26bfb3d24f224e12c6c1c318 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Wed, 1 Jul 2015 13:29:11 -0700
Subject: Fixed bug in BplImp! Improvements in encoding of reads of function
 values.

---
 Binaries/DafnyPrelude.bpl             |  8 ++++++++
 Source/Dafny/Translator.cs            | 16 +++++++---------
 Test/VerifyThis2015/Problem3.dfy      |  2 +-
 Test/dafny4/NumberRepresentations.dfy |  2 +-
 4 files changed, 17 insertions(+), 11 deletions(-)

(limited to 'Source')

diff --git a/Binaries/DafnyPrelude.bpl b/Binaries/DafnyPrelude.bpl
index dbf9b76c..2ca10f73 100644
--- a/Binaries/DafnyPrelude.bpl
+++ b/Binaries/DafnyPrelude.bpl
@@ -273,6 +273,8 @@ const unique class._System.set: ClassName;
 const unique class._System.seq: ClassName;
 const unique class._System.multiset: ClassName;
 
+function Tclass._System.object(): Ty;
+
 function /*{:never_pattern true}*/ dtype(ref): Ty; // changed from ClassName to Ty
 
 function TypeTuple(a: ClassName, b: ClassName): ClassName;
@@ -287,6 +289,12 @@ axiom (forall a: ClassName, b: ClassName :: { TypeTuple(a,b) }
 
 type HandleType;
 
+function SetRef_to_SetBox(s: [ref]bool): Set Box;
+axiom (forall s: [ref]bool, bx: Box :: { SetRef_to_SetBox(s)[bx] }
+  SetRef_to_SetBox(s)[bx] == s[$Unbox(bx): ref]);
+axiom (forall s: [ref]bool :: { SetRef_to_SetBox(s) }
+  $Is(SetRef_to_SetBox(s), TSet(Tclass._System.object())));
+
 // ---------------------------------------------------------------
 // -- Datatypes --------------------------------------------------
 // ---------------------------------------------------------------
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index c98bd203..78f5c89d 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -5713,11 +5713,9 @@ namespace Microsoft.Dafny {
 
       {
         // forall t1, .., tN+1 : Ty, p: [Heap, Box, ..., Box] Box, heap : Heap, b1, ..., bN : Box
-        //      :: RequriesN(...) ==> ApplyN(t1, .. tN+1, HandleN(h, r, rd), heap, b1, ..., bN) = h[heap, b1, ..., bN]
-        //
-        // no precondition for these, but:
-        // for requires, we add: RequiresN(...) <== r[heap, b1, ..., bN]
-        // for reads, we could:  ReadsN(...)[bx] ==> rd[heap, b1, ..., bN][bx] , but we don't
+        //      :: ApplyN(t1, .. tN+1, HandleN(h, r, rd), heap, b1, ..., bN) == h[heap, b1, ..., bN]
+        //      :: RequiresN(t1, .. tN+1, HandleN(h, r, rd), heap, b1, ..., bN) <== r[heap, b1, ..., bN]
+        //      :: ReadsN(t1, .. tN+1, HandleN(h, r, rd), heap, b1, ..., bN) == rd[heap, b1, ..., bN]
         Action<string, Bpl.Type, string, Bpl.Type, string, Bpl.Type> SelectorSemantics = (selector, selectorTy, selectorVar, selectorVarTy, precond, precondTy) => {
           Contract.Assert((precond == null) == (precondTy == null));
           var bvars = new List<Bpl.Variable>();
@@ -5919,7 +5917,7 @@ namespace Microsoft.Dafny {
       var inner_name = GetClass(td).TypedIdent.Name;
       string name = "T" + inner_name;
       // Create the type constructor
-      {
+      if (td.Name != "object") {  // the type constructor for "object" is in DafnyPrelude.bpl
         Bpl.Variable tyVarOut = BplFormalVar(null, predef.Ty, false);
         List<Bpl.Variable> args = new List<Bpl.Variable>(
           Enumerable.Range(0, arity).Select(i =>
@@ -11462,10 +11460,10 @@ namespace Microsoft.Dafny {
         }
 
         var rdvars = new List<Bpl.Variable>();
-        var o = translator.UnboxIfBoxed(BplBoundVar(varNameGen.FreshId("#o#"), predef.BoxType, rdvars), new ObjectType());
-
+        var o = BplBoundVar(varNameGen.FreshId("#o#"), predef.RefType, rdvars);
         Bpl.Expr rdbody = new Bpl.LambdaExpr(e.tok, new List<TypeVariable>(), rdvars, null,
           translator.InRWClause(e.tok, o, null, e.Reads.ConvertAll(su.SubstFrameExpr), et, null, null));
+        rdbody = translator.FunctionCall(e.tok, "SetRef_to_SetBox", predef.SetType(e.tok, true, predef.BoxType), rdbody);
 
         return translator.Lit(
           translator.FunctionCall(e.tok, BuiltinFunction.AtLayer, predef.HandleType,
@@ -14220,7 +14218,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(b != null);
       Contract.Ensures(Contract.Result<Bpl.Expr>() != null);
 
-      if (a == Bpl.Expr.True || b == Bpl.Expr.True || b == Bpl.Expr.False) {
+      if (a == Bpl.Expr.True || b == Bpl.Expr.True) {
         return b;
       } else if (a == Bpl.Expr.False) {
         return Bpl.Expr.True;
diff --git a/Test/VerifyThis2015/Problem3.dfy b/Test/VerifyThis2015/Problem3.dfy
index 10ad2d3a..4205035d 100644
--- a/Test/VerifyThis2015/Problem3.dfy
+++ b/Test/VerifyThis2015/Problem3.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" /vcsMaxKeepGoingSplits:5 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // Rustan Leino
diff --git a/Test/dafny4/NumberRepresentations.dfy b/Test/dafny4/NumberRepresentations.dfy
index 8a94505c..1ebdf64c 100644
--- a/Test/dafny4/NumberRepresentations.dfy
+++ b/Test/dafny4/NumberRepresentations.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /vcsMaxKeepGoingSplits:5 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // We consider a number representation that consists of a sequence of digits.  The least
-- 
cgit v1.2.3


From 7dcc8c64e6fbcbf2fa40702619795144f9681f24 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Wed, 1 Jul 2015 13:33:38 -0700
Subject: Made code contracts compliant

---
 Source/Dafny/DafnyAst.cs | 1 +
 Source/Dafny/Resolver.cs | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index c9c9ccc8..712cb00a 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -2987,6 +2987,7 @@ namespace Microsoft.Dafny {
     ModuleDefinition ICodeContext.EnclosingModule { get { return this.EnclosingClass.Module; } }
     bool ICodeContext.MustReverify { get { return false; } }
 
+    [Pure]
     public bool IsFuelAware() { return IsRecursive || IsFueled; }
   }
 
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index e48a7932..29e36ccd 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -2399,7 +2399,6 @@ namespace Microsoft.Dafny
       }
 
       protected override bool VisitOneStmt(Statement stmt, ref FuelAdjustment_Context st) {
-        Contract.Requires(stmt != null);
         Resolver.CheckForFuelAdjustments(stmt.Tok, stmt.Attributes, st.currentModule, st.reporter);
         return true;
       }
-- 
cgit v1.2.3


From 0dd2dcd63d8daaa10ac532d4927acbf4f01ea186 Mon Sep 17 00:00:00 2001
From: Bryan Parno <parno@microsoft.com>
Date: Thu, 2 Jul 2015 10:10:59 -0700
Subject: Fixed a contract error provoked by one of the tests.

---
 Source/Dafny/Compiler.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 9f5b3e93..4fdd34f6 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -942,7 +942,7 @@ namespace Microsoft.Dafny {
 
     void TrCasePatternOpt(CasePattern pat, Expression rhs, string rhs_string, int indent) {
       Contract.Requires(pat != null);
-      Contract.Requires(rhs != null);
+      Contract.Requires(pat.Var != null || rhs != null);
       if (pat.Var != null) {
         // The trivial Dafny "pattern" expression
         //    var x := G
-- 
cgit v1.2.3


From 85d4456ccf1e1d8c456dffa012d3f3d724f50a4a Mon Sep 17 00:00:00 2001
From: Michael Lowell Roberts <mirobert@microsoft.com>
Date: Thu, 2 Jul 2015 15:00:52 -0700
Subject: multiple changes... - fix for requirement inheritance in refinement.
 - minimimally viable implementation of exclusive refinement feature.

---
 Source/Dafny/Cloner.cs                |  11 +-
 Source/Dafny/Dafny.atg                |   5 +-
 Source/Dafny/DafnyAst.cs              | 119 ++++-
 Source/Dafny/Makefile                 |   4 +-
 Source/Dafny/Parser.cs                | 962 +++++++++++++++++-----------------
 Source/Dafny/RefinementTransformer.cs |   9 +
 Source/Dafny/Resolver.cs              |  71 ++-
 Source/Dafny/Scanner.cs               | 198 +++----
 Source/Dafny/Translator.cs            |   4 +-
 9 files changed, 768 insertions(+), 615 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index e313ffac..6e64c7ec 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -17,12 +17,15 @@ namespace Microsoft.Dafny
       if (m is DefaultModuleDecl) {
         nw = new DefaultModuleDecl();
       } else {
-        nw = new ModuleDefinition(Tok(m.tok), name, m.IsAbstract, m.IsFacade, m.RefinementBaseName, m.Module, CloneAttributes(m.Attributes), true);
+        nw = new ModuleDefinition(Tok(m.tok), name, m.IsAbstract, m.IsFacade, m.IsExclusiveRefinement, m.RefinementBaseName, m.Module, CloneAttributes(m.Attributes), true);
       }
       foreach (var d in m.TopLevelDecls) {
         nw.TopLevelDecls.Add(CloneDeclaration(d, nw));
       }
-      nw.RefinementBase = m.RefinementBase;
+      if (null != m.RefinementBase) {
+          nw.RefinementBase = m.RefinementBase;
+      }
+      nw.ClonedFrom = m;
       nw.Height = m.Height;
       return nw;
     }
@@ -33,7 +36,7 @@ namespace Microsoft.Dafny
 
       if (d is OpaqueTypeDecl) {
         var dd = (OpaqueTypeDecl)d;
-        return new OpaqueTypeDecl(Tok(dd.tok), dd.Name, m, dd.EqualitySupport, dd.TypeArgs.ConvertAll(CloneTypeParam), CloneAttributes(dd.Attributes));
+        return new OpaqueTypeDecl(Tok(dd.tok), dd.Name, m, dd.EqualitySupport, dd.TypeArgs.ConvertAll(CloneTypeParam), CloneAttributes(dd.Attributes), d);
       } else if (d is TypeSynonymDecl) {
         var dd = (TypeSynonymDecl)d;
         var tps = dd.TypeArgs.ConvertAll(CloneTypeParam);
@@ -138,7 +141,7 @@ namespace Microsoft.Dafny
     }
 
     public TypeParameter CloneTypeParam(TypeParameter tp) {
-      return new TypeParameter(Tok(tp.tok), tp.Name, tp.EqualitySupport);
+      return new TypeParameter(Tok(tp.tok), tp.Name, tp.EqualitySupport, tp);
     }
 
     public MemberDecl CloneMember(MemberDecl member) {
diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index 5d4a4321..7b51fb5e 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -542,6 +542,7 @@ SubModuleDecl<ModuleDefinition parent, out ModuleDecl submodule>
      ModuleDecl sm;
      submodule = null; // appease compiler
      bool isAbstract = false;
+     bool isExclusively = false;
      bool opened = false;
   .)
   ( [ "abstract"  (. isAbstract = true; .) ]
@@ -549,7 +550,9 @@ SubModuleDecl<ModuleDefinition parent, out ModuleDecl submodule>
     { Attribute<ref attrs> }
     NoUSIdent<out id>
 
-      [ "refines" QualifiedModuleName<out idRefined> ] (. module = new ModuleDefinition(id, id.val, isAbstract, false, idRefined == null ? null : idRefined, parent, attrs, false); .)
+      [ "exclusively" "refines" QualifiedModuleName<out idRefined> (. isExclusively = true; .)  
+      | "refines" QualifiedModuleName<out idRefined> (. isExclusively = false; .) ] 
+            (. module = new ModuleDefinition(id, id.val, isAbstract, false, isExclusively, idRefined == null ? null : idRefined, parent, attrs, false, this); .)  
        "{"                                             (. module.BodyStartTok = t; .)
         { SubModuleDecl<module, out sm>                (. module.TopLevelDecls.Add(sm); .)
         | ClassDecl<module, out c>                     (. module.TopLevelDecls.Add(c); .)
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 712cb00a..134fb4c1 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -86,7 +86,7 @@ namespace Microsoft.Dafny {
 
   public class BuiltIns
   {
-    public readonly ModuleDefinition SystemModule = new ModuleDefinition(Token.NoToken, "_System", false, false, null, null, null, true);
+    public readonly ModuleDefinition SystemModule = new ModuleDefinition(Token.NoToken, "_System", false, false, /*isExclusiveRefinement:*/ false, null, null, null, true);
     readonly Dictionary<int, ClassDecl> arrayTypeDecls = new Dictionary<int, ClassDecl>();
     readonly Dictionary<int, ArrowTypeDecl> arrowTypeDecls = new Dictionary<int, ArrowTypeDecl>();
     readonly Dictionary<int, TupleTypeDecl> tupleTypeDecls = new Dictionary<int, TupleTypeDecl>();
@@ -1486,6 +1486,8 @@ namespace Microsoft.Dafny {
     IToken INamedRegion.BodyEndTok { get { return BodyEndTok; } }
     string INamedRegion.Name { get { return Name; } }
     string compileName;
+    private readonly Declaration clonedFrom;
+
     public virtual string CompileName {
       get {
         if (compileName == null) {
@@ -1496,12 +1498,19 @@ namespace Microsoft.Dafny {
     }
     public Attributes Attributes;  // readonly, except during class merging in the refinement transformations
 
-    public Declaration(IToken tok, string name, Attributes attributes) {
+    public Declaration(IToken tok, string name, Attributes attributes, Declaration clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       this.tok = tok;
       this.Name = name;
       this.Attributes = attributes;
+      this.clonedFrom = clonedFrom;
+    }
+
+    public Declaration ClonedFrom { 
+      get {
+        return this.clonedFrom;
+      } 
     }
 
     [Pure]
@@ -1513,12 +1522,10 @@ namespace Microsoft.Dafny {
     internal FreshIdGenerator IdGenerator = new FreshIdGenerator();
   }
 
-  public class OpaqueType_AsParameter : TypeParameter
-  {
+  public class OpaqueType_AsParameter : TypeParameter {
     public readonly List<TypeParameter> TypeArgs;
     public OpaqueType_AsParameter(IToken tok, string name, EqualitySupportValue equalitySupport, List<TypeParameter> typeArgs)
-      : base(tok, name, equalitySupport)
-    {
+      : base(tok, name, equalitySupport) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(typeArgs != null);
@@ -1566,8 +1573,8 @@ namespace Microsoft.Dafny {
     }
     public int PositionalIndex; // which type parameter this is (ie. in C<S, T, U>, S is 0, T is 1 and U is 2).
 
-    public TypeParameter(IToken tok, string name, EqualitySupportValue equalitySupport = EqualitySupportValue.Unspecified)
-      : base(tok, name, null) {
+    public TypeParameter(IToken tok, string name, EqualitySupportValue equalitySupport = EqualitySupportValue.Unspecified, Declaration clonedFrom = null)
+      : base(tok, name, null, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       EqualitySupport = equalitySupport;
@@ -1642,7 +1649,7 @@ namespace Microsoft.Dafny {
   }
 
   public class ModuleSignature {
-
+    private ModuleDefinition exclusiveRefinement = null;
     public readonly Dictionary<string, TopLevelDecl> TopLevels = new Dictionary<string, TopLevelDecl>();
     public readonly Dictionary<string, Tuple<DatatypeCtor, bool>> Ctors = new Dictionary<string, Tuple<DatatypeCtor, bool>>();
     public readonly Dictionary<string, MemberDecl> StaticMembers = new Dictionary<string, MemberDecl>();
@@ -1663,6 +1670,25 @@ namespace Microsoft.Dafny {
         return false;
       }
     }
+
+    public ModuleDefinition ExclusiveRefinement {
+      get {
+        if (null == exclusiveRefinement) {
+          return ModuleDef == null ? null : ModuleDef.ExclusiveRefinement;          
+        } else {
+          return exclusiveRefinement;
+        }
+      }
+
+      set {
+        if (null == ExclusiveRefinement) {
+          exclusiveRefinement = null;
+        } else {
+          throw new InvalidOperationException("An exclusive refinement relationship cannot be amended.");
+        }
+      }
+    }
+
   }
 
   public class ModuleDefinition : INamedRegion
@@ -1678,22 +1704,64 @@ namespace Microsoft.Dafny {
     public readonly Attributes Attributes;
     public readonly List<IToken> RefinementBaseName;  // null if no refinement base
     public ModuleDecl RefinementBaseRoot; // filled in early during resolution, corresponds to RefinementBaseName[0]
-    public ModuleDefinition RefinementBase;  // filled in during resolution (null if no refinement base)
+
     public List<Include> Includes;
 
     public readonly List<TopLevelDecl> TopLevelDecls = new List<TopLevelDecl>();  // filled in by the parser; readonly after that
     public readonly Graph<ICallable> CallGraph = new Graph<ICallable>();  // filled in during resolution
     public int Height;  // height in the topological sorting of modules; filled in during resolution
     public readonly bool IsAbstract;
+    public readonly bool IsExclusiveRefinement;
     public readonly bool IsFacade; // True iff this module represents a module facade (that is, an abstract interface)
     private readonly bool IsBuiltinName; // true if this is something like _System that shouldn't have it's name mangled.
+
+    private ModuleDefinition exclusiveRefinement;
+
+    public ModuleDefinition ExclusiveRefinement {
+      get { return exclusiveRefinement; }
+      set {
+        if (null == exclusiveRefinement) {
+          if (!value.IsExclusiveRefinement) {
+            throw new ArgumentException(
+              string.Format("Exclusive refinement of {0} with 'new' module {0} is disallowed.",
+              Name,
+              value.Name));
+          }
+          // todo: validate state of `value`.
+          exclusiveRefinement = value;
+        } else {
+          throw new InvalidOperationException(string.Format("Exclusive refinement of {0} has already been established {1}; cannot reestabilish as {2}.", Name, exclusiveRefinement.Name, value.Name));
+        }
+      }
+    }
+
+    public int ExclusiveRefinementCount { get; set; }
+
+    private ModuleDefinition refinementBase; // filled in during resolution via RefinementBase property (null if no refinement base yet or at all).
+
+    public ModuleDefinition RefinementBase {
+        get {
+           return refinementBase;
+        }
+
+        set {
+          // the refinementBase member may only be changed once.
+          if (null != refinementBase) {
+              throw new InvalidOperationException(string.Format("This module ({0}) already has a refinement base ({1}).", Name, refinementBase.Name));
+          }
+          refinementBase = value;
+        }
+    }
+
+    public ModuleDefinition ClonedFrom { get; set; }
+
     [ContractInvariantMethod]
     void ObjectInvariant() {
       Contract.Invariant(cce.NonNullElements(TopLevelDecls));
       Contract.Invariant(CallGraph != null);
     }
 
-    public ModuleDefinition(IToken tok, string name, bool isAbstract, bool isFacade, List<IToken> refinementBase, ModuleDefinition parent, Attributes attributes, bool isBuiltinName)
+    public ModuleDefinition(IToken tok, string name, bool isAbstract, bool isFacade, bool isExclusiveRefinement, List<IToken> refinementBase, ModuleDefinition parent, Attributes attributes, bool isBuiltinName, Parser parser = null)
     {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
@@ -1704,8 +1772,9 @@ namespace Microsoft.Dafny {
       RefinementBaseName = refinementBase;
       IsAbstract = isAbstract;
       IsFacade = isFacade;
+      IsExclusiveRefinement = isExclusiveRefinement;
       RefinementBaseRoot = null;
-      RefinementBase = null;
+      this.refinementBase = null;
       Includes = new List<Include>();
       IsBuiltinName = isBuiltinName;
     }
@@ -1844,7 +1913,9 @@ namespace Microsoft.Dafny {
   }
 
   public class DefaultModuleDecl : ModuleDefinition {
-    public DefaultModuleDecl() : base(Token.NoToken, "_module", false, false, null, null, null, true) {
+      public DefaultModuleDecl()
+          : base(Token.NoToken, "_module", false, false, /*isExclusiveRefinement:*/ false, null, null, null, true)
+      {
     }
     public override bool IsDefaultModule {
       get {
@@ -1862,8 +1933,8 @@ namespace Microsoft.Dafny {
       Contract.Invariant(cce.NonNullElements(TypeArgs));
     }
 
-    public TopLevelDecl(IToken tok, string name, ModuleDefinition module, List<TypeParameter> typeArgs, Attributes attributes)
-      : base(tok, name, attributes) {
+    public TopLevelDecl(IToken tok, string name, ModuleDefinition module, List<TypeParameter> typeArgs, Attributes attributes, Declaration clonedFrom = null)
+      : base(tok, name, attributes, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(cce.NonNullElements(typeArgs));
@@ -2116,7 +2187,7 @@ namespace Microsoft.Dafny {
     public List<DatatypeDestructor> Destructors = new List<DatatypeDestructor>();  // contents filled in during resolution; includes both implicit (not mentionable in source) and explicit destructors
 
     public DatatypeCtor(IToken tok, string name, [Captured] List<Formal> formals, Attributes attributes)
-      : base(tok, name, attributes) {
+      : base(tok, name, attributes, null) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(cce.NonNullElements(formals));
@@ -2326,7 +2397,7 @@ namespace Microsoft.Dafny {
     public TopLevelDecl EnclosingClass;  // filled in during resolution
     public MemberDecl RefinementBase;  // filled in during the pre-resolution refinement transformation; null if the member is new here
     public MemberDecl(IToken tok, string name, bool hasStaticKeyword, bool isGhost, Attributes attributes)
-      : base(tok, name, attributes) {
+      : base(tok, name, attributes, null) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       HasStaticKeyword = hasStaticKeyword;
@@ -2463,8 +2534,8 @@ namespace Microsoft.Dafny {
       Contract.Invariant(TheType != null && Name == TheType.Name);
     }
 
-    public OpaqueTypeDecl(IToken tok, string name, ModuleDefinition module, TypeParameter.EqualitySupportValue equalitySupport, List<TypeParameter> typeArgs, Attributes attributes)
-      : base(tok, name, module, typeArgs, attributes) {
+    public OpaqueTypeDecl(IToken tok, string name, ModuleDefinition module, TypeParameter.EqualitySupportValue equalitySupport, List<TypeParameter> typeArgs, Attributes attributes, Declaration clonedFrom = null)
+      : base(tok, name, module, typeArgs, attributes, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(module != null);
@@ -3063,7 +3134,7 @@ namespace Microsoft.Dafny {
       prefixPredCall.TypeArgumentSubstitutions = new Dictionary<TypeParameter, Type>();
       var old_to_new = new Dictionary<TypeParameter, TypeParameter>();
       for (int i = 0; i < this.TypeArgs.Count; i++) {
-	 old_to_new[this.TypeArgs[i]] = this.PrefixPredicate.TypeArgs[i];
+   old_to_new[this.TypeArgs[i]] = this.PrefixPredicate.TypeArgs[i];
       }
       foreach (var p in fexp.TypeArgumentSubstitutions) {
         prefixPredCall.TypeArgumentSubstitutions[old_to_new[p.Key]] = p.Value;
@@ -5578,8 +5649,8 @@ namespace Microsoft.Dafny {
       Contract.Invariant(cce.NonNullElements(Arguments));
       Contract.Invariant(cce.NonNullElements(InferredTypeArgs));
       Contract.Invariant(
-	Ctor == null ||
-	InferredTypeArgs.Count == Ctor.EnclosingDatatype.TypeArgs.Count);
+  Ctor == null ||
+  InferredTypeArgs.Count == Ctor.EnclosingDatatype.TypeArgs.Count);
     }
 
     public DatatypeValue(IToken tok, string datatypeName, string memberName, [Captured] List<Expression> arguments)
@@ -6009,10 +6080,10 @@ namespace Microsoft.Dafny {
         Function == null || TypeArgumentSubstitutions == null ||
         Contract.ForAll(
           Function.TypeArgs,
-        	  a => TypeArgumentSubstitutions.ContainsKey(a)) &&
+            a => TypeArgumentSubstitutions.ContainsKey(a)) &&
         Contract.ForAll(
           TypeArgumentSubstitutions.Keys,
-        	  a => Function.TypeArgs.Contains(a) || Function.EnclosingClass.TypeArgs.Contains(a)));
+            a => Function.TypeArgs.Contains(a) || Function.EnclosingClass.TypeArgs.Contains(a)));
     }
 
     public Function Function;  // filled in by resolution
diff --git a/Source/Dafny/Makefile b/Source/Dafny/Makefile
index 4c01c780..e8c0f5e0 100644
--- a/Source/Dafny/Makefile
+++ b/Source/Dafny/Makefile
@@ -4,8 +4,8 @@
 # from http://boogiepartners.codeplex.com/. Update the FRAME_DIR variable to
 # point to whatever directory you install that into.
 # ###############################################################################
-COCO_EXE_DIR = ..\..\..\boogiepartners\CocoRdownload
-FRAME_DIR = ..\..\..\boogiepartners\CocoR\Modified
+COCO_EXE_DIR = ..\..\..\boogie-partners\CocoRdownload
+FRAME_DIR = ..\..\..\boogie-partners\CocoR\Modified
 COCO = $(COCO_EXE_DIR)\Coco.exe
 
 # "all" depends on 2 files, really (Parser.cs and Scanner.cs), but they
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index c4047819..a90e650a 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -72,10 +72,10 @@ public class Parser {
 	public const int _star = 56;
 	public const int _notIn = 57;
 	public const int _ellipsis = 58;
-	public const int maxT = 137;
+	public const int maxT = 138;
 
-	const bool T = true;
-	const bool x = false;
+	const bool _T = true;
+	const bool _x = false;
 	const int minErrDist = 2;
 
 	public Scanner/*!*/ scanner;
@@ -540,42 +540,42 @@ bool IsType(ref IToken pt) {
 		}
 		while (StartOf(1)) {
 			switch (la.kind) {
-			case 60: case 61: case 63: {
+			case 60: case 61: case 64: {
 				SubModuleDecl(defaultModule, out submodule);
 				defaultModule.TopLevelDecls.Add(submodule); 
 				break;
 			}
-			case 68: {
+			case 69: {
 				ClassDecl(defaultModule, out c);
 				defaultModule.TopLevelDecls.Add(c); 
 				break;
 			}
-			case 74: case 75: {
+			case 75: case 76: {
 				DatatypeDecl(defaultModule, out dt);
 				defaultModule.TopLevelDecls.Add(dt); 
 				break;
 			}
-			case 77: {
+			case 78: {
 				NewtypeDecl(defaultModule, out td);
 				defaultModule.TopLevelDecls.Add(td); 
 				break;
 			}
-			case 78: {
+			case 79: {
 				OtherTypeDecl(defaultModule, out td);
 				defaultModule.TopLevelDecls.Add(td); 
 				break;
 			}
-			case 79: {
+			case 80: {
 				IteratorDecl(defaultModule, out iter);
 				defaultModule.TopLevelDecls.Add(iter); 
 				break;
 			}
-			case 70: {
+			case 71: {
 				TraitDecl(defaultModule, out trait);
 				defaultModule.TopLevelDecls.Add(trait); 
 				break;
 			}
-			case 37: case 38: case 39: case 40: case 41: case 71: case 72: case 73: case 76: case 82: case 83: case 84: case 85: {
+			case 37: case 38: case 39: case 40: case 41: case 72: case 73: case 74: case 77: case 83: case 84: case 85: case 86: {
 				ClassMemberDecl(membersDefaultClass, false, !DafnyOptions.O.AllowGlobals);
 				break;
 			}
@@ -606,6 +606,7 @@ bool IsType(ref IToken pt) {
 		ModuleDecl sm;
 		submodule = null; // appease compiler
 		bool isAbstract = false;
+		bool isExclusively = false;
 		bool opened = false;
 		
 		if (la.kind == 60 || la.kind == 61) {
@@ -618,51 +619,59 @@ bool IsType(ref IToken pt) {
 				Attribute(ref attrs);
 			}
 			NoUSIdent(out id);
-			if (la.kind == 62) {
-				Get();
-				QualifiedModuleName(out idRefined);
+			if (la.kind == 62 || la.kind == 63) {
+				if (la.kind == 62) {
+					Get();
+					Expect(63);
+					QualifiedModuleName(out idRefined);
+					isExclusively = true; 
+				} else {
+					Get();
+					QualifiedModuleName(out idRefined);
+					isExclusively = false; 
+				}
 			}
-			module = new ModuleDefinition(id, id.val, isAbstract, false, idRefined == null ? null : idRefined, parent, attrs, false); 
+			module = new ModuleDefinition(id, id.val, isAbstract, false, isExclusively, idRefined == null ? null : idRefined, parent, attrs, false, this); 
 			Expect(45);
 			module.BodyStartTok = t; 
 			while (StartOf(1)) {
 				switch (la.kind) {
-				case 60: case 61: case 63: {
+				case 60: case 61: case 64: {
 					SubModuleDecl(module, out sm);
 					module.TopLevelDecls.Add(sm); 
 					break;
 				}
-				case 68: {
+				case 69: {
 					ClassDecl(module, out c);
 					module.TopLevelDecls.Add(c); 
 					break;
 				}
-				case 70: {
+				case 71: {
 					TraitDecl(module, out trait);
 					module.TopLevelDecls.Add(trait); 
 					break;
 				}
-				case 74: case 75: {
+				case 75: case 76: {
 					DatatypeDecl(module, out dt);
 					module.TopLevelDecls.Add(dt); 
 					break;
 				}
-				case 77: {
+				case 78: {
 					NewtypeDecl(module, out td);
 					module.TopLevelDecls.Add(td); 
 					break;
 				}
-				case 78: {
+				case 79: {
 					OtherTypeDecl(module, out td);
 					module.TopLevelDecls.Add(td); 
 					break;
 				}
-				case 79: {
+				case 80: {
 					IteratorDecl(module, out iter);
 					module.TopLevelDecls.Add(iter); 
 					break;
 				}
-				case 37: case 38: case 39: case 40: case 41: case 71: case 72: case 73: case 76: case 82: case 83: case 84: case 85: {
+				case 37: case 38: case 39: case 40: case 41: case 72: case 73: case 74: case 77: case 83: case 84: case 85: case 86: {
 					ClassMemberDecl(namedModuleDefaultClassMembers, false, !DafnyOptions.O.AllowGlobals);
 					break;
 				}
@@ -672,22 +681,22 @@ bool IsType(ref IToken pt) {
 			module.BodyEndTok = t;
 			module.TopLevelDecls.Add(new DefaultClassDecl(module, namedModuleDefaultClassMembers));
 			submodule = new LiteralModuleDecl(module, parent); 
-		} else if (la.kind == 63) {
+		} else if (la.kind == 64) {
 			Get();
-			if (la.kind == 64) {
+			if (la.kind == 65) {
 				Get();
 				opened = true;
 			}
 			NoUSIdent(out id);
-			if (la.kind == 65 || la.kind == 66) {
-				if (la.kind == 65) {
+			if (la.kind == 66 || la.kind == 67) {
+				if (la.kind == 66) {
 					Get();
 					QualifiedModuleName(out idPath);
 					submodule = new AliasModuleDecl(idPath, id, parent, opened); 
 				} else {
 					Get();
 					QualifiedModuleName(out idPath);
-					if (la.kind == 67) {
+					if (la.kind == 68) {
 						Get();
 						QualifiedModuleName(out idAssignment);
 					}
@@ -695,7 +704,7 @@ bool IsType(ref IToken pt) {
 				}
 			}
 			if (la.kind == 27) {
-				while (!(la.kind == 0 || la.kind == 27)) {SynErr(138); Get();}
+				while (!(la.kind == 0 || la.kind == 27)) {SynErr(139); Get();}
 				Get();
 				errors.Warning(t, "the semi-colon that used to terminate a sub-module declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 			}
@@ -705,7 +714,7 @@ bool IsType(ref IToken pt) {
 			 submodule = new AliasModuleDecl(idPath, id, parent, opened);
 			}
 			
-		} else SynErr(139);
+		} else SynErr(140);
 	}
 
 	void ClassDecl(ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c) {
@@ -719,8 +728,8 @@ bool IsType(ref IToken pt) {
 		List<MemberDecl/*!*/> members = new List<MemberDecl/*!*/>();
 		IToken bodyStart;
 		
-		while (!(la.kind == 0 || la.kind == 68)) {SynErr(140); Get();}
-		Expect(68);
+		while (!(la.kind == 0 || la.kind == 69)) {SynErr(141); Get();}
+		Expect(69);
 		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
@@ -728,7 +737,7 @@ bool IsType(ref IToken pt) {
 		if (la.kind == 51) {
 			GenericParameters(typeArgs);
 		}
-		if (la.kind == 69) {
+		if (la.kind == 70) {
 			Get();
 			Type(out trait);
 			traits.Add(trait); 
@@ -760,13 +769,13 @@ bool IsType(ref IToken pt) {
 		IToken bodyStart = Token.NoToken;  // dummy assignment
 		bool co = false;
 		
-		while (!(la.kind == 0 || la.kind == 74 || la.kind == 75)) {SynErr(141); Get();}
-		if (la.kind == 74) {
+		while (!(la.kind == 0 || la.kind == 75 || la.kind == 76)) {SynErr(142); Get();}
+		if (la.kind == 75) {
 			Get();
-		} else if (la.kind == 75) {
+		} else if (la.kind == 76) {
 			Get();
 			co = true; 
-		} else SynErr(142);
+		} else SynErr(143);
 		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
@@ -774,7 +783,7 @@ bool IsType(ref IToken pt) {
 		if (la.kind == 51) {
 			GenericParameters(typeArgs);
 		}
-		Expect(65);
+		Expect(66);
 		bodyStart = t; 
 		DatatypeMemberDecl(ctors);
 		while (la.kind == 23) {
@@ -782,7 +791,7 @@ bool IsType(ref IToken pt) {
 			DatatypeMemberDecl(ctors);
 		}
 		if (la.kind == 27) {
-			while (!(la.kind == 0 || la.kind == 27)) {SynErr(143); Get();}
+			while (!(la.kind == 0 || la.kind == 27)) {SynErr(144); Get();}
 			Get();
 			errors.Warning(t, "the semi-colon that used to terminate a (co)datatype declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 		}
@@ -803,12 +812,12 @@ bool IsType(ref IToken pt) {
 		Type baseType = null;
 		Expression wh;
 		
-		Expect(77);
+		Expect(78);
 		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		Expect(65);
+		Expect(66);
 		if (IsIdentColonOrBar()) {
 			NoUSIdent(out bvId);
 			if (la.kind == 21) {
@@ -822,7 +831,7 @@ bool IsType(ref IToken pt) {
 		} else if (StartOf(3)) {
 			Type(out baseType);
 			td = new NewtypeDecl(theVerifyThisFile ? id : new IncludeToken(id), id.val, module, baseType, attrs); 
-		} else SynErr(144);
+		} else SynErr(145);
 	}
 
 	void OtherTypeDecl(ModuleDefinition module, out TopLevelDecl td) {
@@ -833,7 +842,7 @@ bool IsType(ref IToken pt) {
 		td = null;
 		Type ty;
 		
-		Expect(78);
+		Expect(79);
 		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
@@ -850,18 +859,18 @@ bool IsType(ref IToken pt) {
 			if (la.kind == 51) {
 				GenericParameters(typeArgs);
 			}
-			if (la.kind == 65) {
+			if (la.kind == 66) {
 				Get();
 				Type(out ty);
 				td = new TypeSynonymDecl(id, id.val, typeArgs, module, ty, attrs); 
 			}
-		} else SynErr(145);
+		} else SynErr(146);
 		if (td == null) {
 		 td = new OpaqueTypeDecl(id, id.val, module, eqSupport, typeArgs, attrs);
 		}
 		
 		if (la.kind == 27) {
-			while (!(la.kind == 0 || la.kind == 27)) {SynErr(146); Get();}
+			while (!(la.kind == 0 || la.kind == 27)) {SynErr(147); Get();}
 			Get();
 			errors.Warning(t, "the semi-colon that used to terminate an opaque-type declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 		}
@@ -890,8 +899,8 @@ bool IsType(ref IToken pt) {
 		IToken bodyStart = Token.NoToken;
 		IToken bodyEnd = Token.NoToken;
 		
-		while (!(la.kind == 0 || la.kind == 79)) {SynErr(147); Get();}
-		Expect(79);
+		while (!(la.kind == 0 || la.kind == 80)) {SynErr(148); Get();}
+		Expect(80);
 		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
@@ -901,8 +910,8 @@ bool IsType(ref IToken pt) {
 				GenericParameters(typeArgs);
 			}
 			Formals(true, true, ins);
-			if (la.kind == 80 || la.kind == 81) {
-				if (la.kind == 80) {
+			if (la.kind == 81 || la.kind == 82) {
+				if (la.kind == 81) {
 					Get();
 				} else {
 					Get();
@@ -913,7 +922,7 @@ bool IsType(ref IToken pt) {
 		} else if (la.kind == 58) {
 			Get();
 			signatureEllipsis = t; 
-		} else SynErr(148);
+		} else SynErr(149);
 		while (StartOf(5)) {
 			IteratorSpec(reads, mod, decreases, req, ens, yieldReq, yieldEns, ref readsAttrs, ref modAttrs, ref decrAttrs);
 		}
@@ -940,8 +949,8 @@ bool IsType(ref IToken pt) {
 		List<MemberDecl/*!*/> members = new List<MemberDecl/*!*/>();
 		IToken bodyStart;
 		
-		while (!(la.kind == 0 || la.kind == 70)) {SynErr(149); Get();}
-		Expect(70);
+		while (!(la.kind == 0 || la.kind == 71)) {SynErr(150); Get();}
+		Expect(71);
 		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
@@ -968,11 +977,11 @@ bool IsType(ref IToken pt) {
 		MemberModifiers mmod = new MemberModifiers();
 		IToken staticToken = null, protectedToken = null;
 		
-		while (la.kind == 71 || la.kind == 72 || la.kind == 73) {
-			if (la.kind == 71) {
+		while (la.kind == 72 || la.kind == 73 || la.kind == 74) {
+			if (la.kind == 72) {
 				Get();
 				mmod.IsGhost = true; 
-			} else if (la.kind == 72) {
+			} else if (la.kind == 73) {
 				Get();
 				mmod.IsStatic = true; staticToken = t; 
 			} else {
@@ -980,7 +989,7 @@ bool IsType(ref IToken pt) {
 				mmod.IsProtected = true; protectedToken = t; 
 			}
 		}
-		if (la.kind == 76) {
+		if (la.kind == 77) {
 			if (moduleLevelDecl) {
 			 SemErr(la, "fields are not allowed to be declared at the module level; instead, wrap the field in a 'class' declaration");
 			 mmod.IsStatic = false;
@@ -1008,7 +1017,7 @@ bool IsType(ref IToken pt) {
 			
 			MethodDecl(mmod, allowConstructors, out m);
 			mm.Add(m); 
-		} else SynErr(150);
+		} else SynErr(151);
 	}
 
 	void Attribute(ref Attributes attrs) {
@@ -1093,8 +1102,8 @@ bool IsType(ref IToken pt) {
 		Attributes attrs = null;
 		IToken/*!*/ id;  Type/*!*/ ty;
 		
-		while (!(la.kind == 0 || la.kind == 76)) {SynErr(151); Get();}
-		Expect(76);
+		while (!(la.kind == 0 || la.kind == 77)) {SynErr(152); Get();}
+		Expect(77);
 		if (mmod.IsStatic) { SemErr(t, "fields cannot be declared 'static'"); }
 		
 		while (la.kind == 45) {
@@ -1131,7 +1140,7 @@ bool IsType(ref IToken pt) {
 		
 		if (la.kind == 37) {
 			Get();
-			if (la.kind == 82) {
+			if (la.kind == 83) {
 				Get();
 				isFunctionMethod = true; 
 			}
@@ -1151,11 +1160,11 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 58) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(152);
+			} else SynErr(153);
 		} else if (la.kind == 38) {
 			Get();
 			isPredicate = true; 
-			if (la.kind == 82) {
+			if (la.kind == 83) {
 				Get();
 				isFunctionMethod = true; 
 			}
@@ -1182,7 +1191,7 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 58) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(153);
+			} else SynErr(154);
 		} else if (la.kind == 39) {
 			Get();
 			Expect(38);
@@ -1205,7 +1214,7 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 58) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(154);
+			} else SynErr(155);
 		} else if (la.kind == 41) {
 			Get();
 			isCoPredicate = true; 
@@ -1227,8 +1236,8 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 58) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(155);
-		} else SynErr(156);
+			} else SynErr(156);
+		} else SynErr(157);
 		decreases = isIndPredicate || isCoPredicate ? null : new List<Expression/*!*/>(); 
 		while (StartOf(9)) {
 			FunctionSpec(reqs, reads, ens, decreases);
@@ -1287,9 +1296,9 @@ bool IsType(ref IToken pt) {
 		IToken bodyStart = Token.NoToken;
 		IToken bodyEnd = Token.NoToken;
 		
-		while (!(StartOf(10))) {SynErr(157); Get();}
+		while (!(StartOf(10))) {SynErr(158); Get();}
 		switch (la.kind) {
-		case 82: {
+		case 83: {
 			Get();
 			break;
 		}
@@ -1298,12 +1307,12 @@ bool IsType(ref IToken pt) {
 			isLemma = true; 
 			break;
 		}
-		case 83: {
+		case 84: {
 			Get();
 			isCoLemma = true; 
 			break;
 		}
-		case 84: {
+		case 85: {
 			Get();
 			isCoLemma = true;
 			errors.Warning(t, "the 'comethod' keyword has been deprecated; it has been renamed to 'colemma'");
@@ -1316,7 +1325,7 @@ bool IsType(ref IToken pt) {
 			isIndLemma = true; 
 			break;
 		}
-		case 85: {
+		case 86: {
 			Get();
 			if (allowConstructor) {
 			 isConstructor = true;
@@ -1326,7 +1335,7 @@ bool IsType(ref IToken pt) {
 			
 			break;
 		}
-		default: SynErr(158); break;
+		default: SynErr(159); break;
 		}
 		keywordToken = t; 
 		if (isLemma) {
@@ -1369,7 +1378,7 @@ bool IsType(ref IToken pt) {
 				GenericParameters(typeArgs);
 			}
 			Formals(true, !mmod.IsGhost, ins);
-			if (la.kind == 81) {
+			if (la.kind == 82) {
 				Get();
 				if (isConstructor) { SemErr(t, "constructors cannot have out-parameters"); } 
 				Formals(false, !mmod.IsGhost, outs);
@@ -1377,7 +1386,7 @@ bool IsType(ref IToken pt) {
 		} else if (la.kind == 58) {
 			Get();
 			signatureEllipsis = t; 
-		} else SynErr(159);
+		} else SynErr(160);
 		while (StartOf(11)) {
 			MethodSpec(req, mod, ens, dec, ref decAttrs, ref modAttrs);
 		}
@@ -1450,14 +1459,14 @@ bool IsType(ref IToken pt) {
 		} else if (la.kind == 2) {
 			Get();
 			id = t; 
-		} else SynErr(160);
+		} else SynErr(161);
 		Expect(21);
 		Type(out ty);
 	}
 
 	void OldSemi() {
 		if (la.kind == 27) {
-			while (!(la.kind == 0 || la.kind == 27)) {SynErr(161); Get();}
+			while (!(la.kind == 0 || la.kind == 27)) {SynErr(162); Get();}
 			Get();
 		}
 	}
@@ -1480,7 +1489,7 @@ bool IsType(ref IToken pt) {
 		Contract.Ensures(Contract.ValueAtReturn(out id)!=null);
 		Contract.Ensures(Contract.ValueAtReturn(out ty)!=null);
 		isGhost = false; 
-		if (la.kind == 71) {
+		if (la.kind == 72) {
 			Get();
 			if (allowGhostKeyword) { isGhost = true; } else { SemErr(t, "formal cannot be declared 'ghost' in this context"); } 
 		}
@@ -1532,7 +1541,7 @@ bool IsType(ref IToken pt) {
 		Contract.Ensures(Contract.ValueAtReturn(out ty)!=null);
 		Contract.Ensures(Contract.ValueAtReturn(out identName)!=null);
 		string name = null; id = Token.NoToken; ty = new BoolType()/*dummy*/; isGhost = false; 
-		if (la.kind == 71) {
+		if (la.kind == 72) {
 			Get();
 			isGhost = true; 
 		}
@@ -1554,7 +1563,7 @@ bool IsType(ref IToken pt) {
 			id = t; name = id.val;
 			Expect(21);
 			Type(out ty);
-		} else SynErr(162);
+		} else SynErr(163);
 		if (name != null) {
 		 identName = name;
 		} else {
@@ -1742,7 +1751,7 @@ bool IsType(ref IToken pt) {
 			ty = new UserDefinedType(e.tok, e); 
 			break;
 		}
-		default: SynErr(163); break;
+		default: SynErr(164); break;
 		}
 		if (la.kind == 29) {
 			Type t2; 
@@ -1763,7 +1772,7 @@ bool IsType(ref IToken pt) {
 	void Formals(bool incoming, bool allowGhostKeyword, List<Formal> formals) {
 		Contract.Requires(cce.NonNullElements(formals)); IToken id;  Type ty;  bool isGhost; 
 		Expect(49);
-		if (la.kind == 1 || la.kind == 71) {
+		if (la.kind == 1 || la.kind == 72) {
 			GIdentType(allowGhostKeyword, out id, out ty, out isGhost);
 			formals.Add(new Formal(id, id.val, ty, incoming, isGhost)); 
 			while (la.kind == 22) {
@@ -1781,7 +1790,7 @@ List<MaybeFreeExpression/*!*/>/*!*/ yieldReq, List<MaybeFreeExpression/*!*/>/*!*
 ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 		Expression/*!*/ e; FrameExpression/*!*/ fe; bool isFree = false; bool isYield = false; Attributes ensAttrs = null;
 		
-		while (!(StartOf(13))) {SynErr(164); Get();}
+		while (!(StartOf(13))) {SynErr(165); Get();}
 		if (la.kind == 43) {
 			Get();
 			while (IsAttribute()) {
@@ -1809,13 +1818,13 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 			}
 			OldSemi();
 		} else if (StartOf(14)) {
-			if (la.kind == 86) {
+			if (la.kind == 87) {
 				Get();
 				isFree = true;
 				errors.Warning(t, "the 'free' keyword is soon to be deprecated");
 				
 			}
-			if (la.kind == 88) {
+			if (la.kind == 89) {
 				Get();
 				isYield = true; 
 			}
@@ -1829,7 +1838,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 				 req.Add(new MaybeFreeExpression(e, isFree));
 				}
 				
-			} else if (la.kind == 87) {
+			} else if (la.kind == 88) {
 				Get();
 				while (IsAttribute()) {
 					Attribute(ref ensAttrs);
@@ -1842,7 +1851,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 				 ens.Add(new MaybeFreeExpression(e, isFree, ensAttrs));
 				}
 				
-			} else SynErr(165);
+			} else SynErr(166);
 		} else if (la.kind == 35) {
 			Get();
 			while (IsAttribute()) {
@@ -1850,7 +1859,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 			}
 			DecreasesList(decreases, false, false);
 			OldSemi();
-		} else SynErr(166);
+		} else SynErr(167);
 	}
 
 	void BlockStmt(out BlockStmt/*!*/ block, out IToken bodyStart, out IToken bodyEnd) {
@@ -1872,7 +1881,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Requires(cce.NonNullElements(req)); Contract.Requires(cce.NonNullElements(mod)); Contract.Requires(cce.NonNullElements(ens)); Contract.Requires(cce.NonNullElements(decreases));
 		Expression/*!*/ e;  FrameExpression/*!*/ fe;  bool isFree = false; Attributes ensAttrs = null;
 		
-		while (!(StartOf(16))) {SynErr(167); Get();}
+		while (!(StartOf(16))) {SynErr(168); Get();}
 		if (la.kind == 42) {
 			Get();
 			while (IsAttribute()) {
@@ -1886,8 +1895,8 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				mod.Add(fe); 
 			}
 			OldSemi();
-		} else if (la.kind == 44 || la.kind == 86 || la.kind == 87) {
-			if (la.kind == 86) {
+		} else if (la.kind == 44 || la.kind == 87 || la.kind == 88) {
+			if (la.kind == 87) {
 				Get();
 				isFree = true;
 				errors.Warning(t, "the 'free' keyword is soon to be deprecated");
@@ -1898,7 +1907,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Expression(out e, false, false);
 				OldSemi();
 				req.Add(new MaybeFreeExpression(e, isFree)); 
-			} else if (la.kind == 87) {
+			} else if (la.kind == 88) {
 				Get();
 				while (IsAttribute()) {
 					Attribute(ref ensAttrs);
@@ -1906,7 +1915,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Expression(out e, false, false);
 				OldSemi();
 				ens.Add(new MaybeFreeExpression(e, isFree, ensAttrs)); 
-			} else SynErr(168);
+			} else SynErr(169);
 		} else if (la.kind == 35) {
 			Get();
 			while (IsAttribute()) {
@@ -1914,7 +1923,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			DecreasesList(decreases, true, false);
 			OldSemi();
-		} else SynErr(169);
+		} else SynErr(170);
 	}
 
 	void FrameExpression(out FrameExpression fe, bool allowSemi, bool allowLambda) {
@@ -1927,18 +1936,18 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (StartOf(7)) {
 			Expression(out e, allowSemi, allowLambda);
 			feTok = e.tok; 
-			if (la.kind == 89) {
+			if (la.kind == 90) {
 				Get();
 				Ident(out id);
 				fieldName = id.val;  feTok = id; 
 			}
 			fe = new FrameExpression(feTok, e, fieldName); 
-		} else if (la.kind == 89) {
+		} else if (la.kind == 90) {
 			Get();
 			Ident(out id);
 			fieldName = id.val; 
 			fe = new FrameExpression(id, new ImplicitThisExpr(id), fieldName); 
-		} else SynErr(170);
+		} else SynErr(171);
 	}
 
 	void DecreasesList(List<Expression> decreases, bool allowWildcard, bool allowLambda) {
@@ -1993,7 +2002,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Requires(cce.NonNullElements(reads));
 		Contract.Requires(decreases == null || cce.NonNullElements(decreases));
 		Expression/*!*/ e;  FrameExpression/*!*/ fe; 
-		while (!(StartOf(17))) {SynErr(171); Get();}
+		while (!(StartOf(17))) {SynErr(172); Get();}
 		if (la.kind == 44) {
 			Get();
 			Expression(out e, false, false);
@@ -2009,7 +2018,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				reads.Add(fe); 
 			}
 			OldSemi();
-		} else if (la.kind == 87) {
+		} else if (la.kind == 88) {
 			Get();
 			Expression(out e, false, false);
 			OldSemi();
@@ -2023,7 +2032,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			
 			DecreasesList(decreases, false, false);
 			OldSemi();
-		} else SynErr(172);
+		} else SynErr(173);
 	}
 
 	void FunctionBody(out Expression/*!*/ e, out IToken bodyStart, out IToken bodyEnd) {
@@ -2042,7 +2051,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			fe = new FrameExpression(t, new WildcardExpr(t), null); 
 		} else if (StartOf(18)) {
 			FrameExpression(out fe, allowSemi, false);
-		} else SynErr(173);
+		} else SynErr(174);
 	}
 
 	void PossiblyWildExpression(out Expression e, bool allowLambda) {
@@ -2053,7 +2062,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			e = new WildcardExpr(t); 
 		} else if (StartOf(7)) {
 			Expression(out e, false, allowLambda);
-		} else SynErr(174);
+		} else SynErr(175);
 	}
 
 	void Stmt(List<Statement/*!*/>/*!*/ ss) {
@@ -2070,14 +2079,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken bodyStart, bodyEnd;
 		int breakCount;
 		
-		while (!(StartOf(19))) {SynErr(175); Get();}
+		while (!(StartOf(19))) {SynErr(176); Get();}
 		switch (la.kind) {
 		case 45: {
 			BlockStmt(out bs, out bodyStart, out bodyEnd);
 			s = bs; 
 			break;
 		}
-		case 100: {
+		case 101: {
 			AssertStmt(out s);
 			break;
 		}
@@ -2085,31 +2094,31 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			AssumeStmt(out s);
 			break;
 		}
-		case 101: {
+		case 102: {
 			PrintStmt(out s);
 			break;
 		}
-		case 1: case 2: case 3: case 4: case 8: case 10: case 19: case 20: case 23: case 49: case 130: case 131: case 132: case 133: case 134: case 135: {
+		case 1: case 2: case 3: case 4: case 8: case 10: case 19: case 20: case 23: case 49: case 131: case 132: case 133: case 134: case 135: case 136: {
 			UpdateStmt(out s);
 			break;
 		}
-		case 71: case 76: {
+		case 72: case 77: {
 			VarDeclStatement(out s);
 			break;
 		}
-		case 97: {
+		case 98: {
 			IfStmt(out s);
 			break;
 		}
-		case 98: {
+		case 99: {
 			WhileStmt(out s);
 			break;
 		}
-		case 99: {
+		case 100: {
 			MatchStmt(out s);
 			break;
 		}
-		case 102: case 103: {
+		case 103: case 104: {
 			ForallStmt(out s);
 			break;
 		}
@@ -2117,11 +2126,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			CalcStmt(out s);
 			break;
 		}
-		case 104: {
+		case 105: {
 			ModifyStmt(out s);
 			break;
 		}
-		case 90: {
+		case 91: {
 			Get();
 			x = t; 
 			NoUSIdent(out id);
@@ -2130,24 +2139,24 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			s.Labels = new LList<Label>(new Label(x, id.val), s.Labels); 
 			break;
 		}
-		case 91: {
+		case 92: {
 			Get();
 			x = t; breakCount = 1; label = null; 
 			if (la.kind == 1) {
 				NoUSIdent(out id);
 				label = id.val; 
-			} else if (la.kind == 27 || la.kind == 91) {
-				while (la.kind == 91) {
+			} else if (la.kind == 27 || la.kind == 92) {
+				while (la.kind == 92) {
 					Get();
 					breakCount++; 
 				}
-			} else SynErr(176);
-			while (!(la.kind == 0 || la.kind == 27)) {SynErr(177); Get();}
+			} else SynErr(177);
+			while (!(la.kind == 0 || la.kind == 27)) {SynErr(178); Get();}
 			Expect(27);
 			s = label != null ? new BreakStmt(x, t, label) : new BreakStmt(x, t, breakCount); 
 			break;
 		}
-		case 88: case 94: {
+		case 89: case 95: {
 			ReturnStmt(out s);
 			break;
 		}
@@ -2155,7 +2164,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			SkeletonStmt(out s);
 			break;
 		}
-		default: SynErr(178); break;
+		default: SynErr(179); break;
 		}
 	}
 
@@ -2164,7 +2173,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression e = dummyExpr; Attributes attrs = null;
 		IToken dotdotdot = null;
 		
-		Expect(100);
+		Expect(101);
 		x = t; 
 		while (IsAttribute()) {
 			Attribute(ref attrs);
@@ -2174,7 +2183,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 58) {
 			Get();
 			dotdotdot = t; 
-		} else SynErr(179);
+		} else SynErr(180);
 		Expect(27);
 		if (dotdotdot != null) {
 		 s = new SkeletonStatement(new AssertStmt(x, t, new LiteralExpr(x, true), attrs), dotdotdot, null);
@@ -2199,7 +2208,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 58) {
 			Get();
 			dotdotdot = t; 
-		} else SynErr(180);
+		} else SynErr(181);
 		Expect(27);
 		if (dotdotdot != null) {
 		 s = new SkeletonStatement(new AssumeStmt(x, t, new LiteralExpr(x, true), attrs), dotdotdot, null);
@@ -2214,7 +2223,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken x;  Expression e;
 		var args = new List<Expression>();
 		
-		Expect(101);
+		Expect(102);
 		x = t; 
 		Expression(out e, false, true);
 		args.Add(e); 
@@ -2244,14 +2253,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			Expect(27);
 			endTok = t; rhss.Add(new ExprRhs(e, attrs)); 
-		} else if (la.kind == 22 || la.kind == 93 || la.kind == 95) {
+		} else if (la.kind == 22 || la.kind == 94 || la.kind == 96) {
 			lhss.Add(e); 
 			while (la.kind == 22) {
 				Get();
 				Lhs(out e);
 				lhss.Add(e); 
 			}
-			if (la.kind == 93) {
+			if (la.kind == 94) {
 				Get();
 				x = t; 
 				Rhs(out r);
@@ -2261,7 +2270,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					Rhs(out r);
 					rhss.Add(r); 
 				}
-			} else if (la.kind == 95) {
+			} else if (la.kind == 96) {
 				Get();
 				x = t; 
 				if (la.kind == _assume) {
@@ -2269,13 +2278,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					suchThatAssume = t; 
 				}
 				Expression(out suchThat, false, true);
-			} else SynErr(181);
+			} else SynErr(182);
 			Expect(27);
 			endTok = t; 
 		} else if (la.kind == 21) {
 			Get();
 			SemErr(t, "invalid statement (did you forget the 'label' keyword?)"); 
-		} else SynErr(182);
+		} else SynErr(183);
 		if (suchThat != null) {
 		 s = new AssignSuchThatStmt(x, endTok, lhss, suchThat, suchThatAssume, null);
 		} else {
@@ -2299,11 +2308,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Attributes attrs = null;
 		IToken endTok;
 		
-		if (la.kind == 71) {
+		if (la.kind == 72) {
 			Get();
 			isGhost = true;  x = t; 
 		}
-		Expect(76);
+		Expect(77);
 		if (!isGhost) { x = t; } 
 		while (la.kind == 45) {
 			Attribute(ref attrs);
@@ -2318,8 +2327,8 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			LocalIdentTypeOptional(out d, isGhost);
 			lhss.Add(d); d.Attributes = attrs; attrs = null; 
 		}
-		if (la.kind == 45 || la.kind == 93 || la.kind == 95) {
-			if (la.kind == 93) {
+		if (la.kind == 45 || la.kind == 94 || la.kind == 96) {
+			if (la.kind == 94) {
 				Get();
 				assignTok = t; 
 				Rhs(out r);
@@ -2333,7 +2342,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				while (la.kind == 45) {
 					Attribute(ref attrs);
 				}
-				Expect(95);
+				Expect(96);
 				assignTok = t; 
 				if (la.kind == _assume) {
 					Expect(30);
@@ -2342,7 +2351,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Expression(out suchThat, false, true);
 			}
 		}
-		while (!(la.kind == 0 || la.kind == 27)) {SynErr(183); Get();}
+		while (!(la.kind == 0 || la.kind == 27)) {SynErr(184); Get();}
 		Expect(27);
 		endTok = t; 
 		ConcreteUpdateStatement update;
@@ -2376,7 +2385,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<GuardedAlternative> alternatives;
 		ifStmt = dummyStmt;  // to please the compiler
 		
-		Expect(97);
+		Expect(98);
 		x = t; 
 		if (IsAlternative()) {
 			AlternativeBlock(out alternatives, out endTok);
@@ -2392,13 +2401,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			endTok = thn.EndTok; 
 			if (la.kind == 34) {
 				Get();
-				if (la.kind == 97) {
+				if (la.kind == 98) {
 					IfStmt(out s);
 					els = s; endTok = s.EndTok; 
 				} else if (la.kind == 45) {
 					BlockStmt(out bs, out bodyStart, out bodyEnd);
 					els = bs; endTok = bs.EndTok; 
-				} else SynErr(184);
+				} else SynErr(185);
 			}
 			if (guardEllipsis != null) {
 			 ifStmt = new SkeletonStatement(new IfStmt(x, endTok, guard, thn, els), guardEllipsis, null);
@@ -2406,7 +2415,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 ifStmt = new IfStmt(x, endTok, guard, thn, els);
 			}
 			
-		} else SynErr(185);
+		} else SynErr(186);
 	}
 
 	void WhileStmt(out Statement stmt) {
@@ -2425,7 +2434,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		stmt = dummyStmt;  // to please the compiler
 		bool isDirtyLoop = true;
 		
-		Expect(98);
+		Expect(99);
 		x = t; 
 		if (IsLoopSpec() || IsAlternative()) {
 			while (StartOf(22)) {
@@ -2451,7 +2460,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Expect(58);
 				bodyEllipsis = t; endTok = t; isDirtyLoop = false; 
 			} else if (StartOf(23)) {
-			} else SynErr(186);
+			} else SynErr(187);
 			if (guardEllipsis != null || bodyEllipsis != null) {
 			 if (mod != null) {
 			   SemErr(mod[0].E.tok, "'modifies' clauses are not allowed on refining loops");
@@ -2469,7 +2478,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 stmt = new WhileStmt(x, endTok, guard, invariants, new Specification<Expression>(decreases, decAttrs), new Specification<FrameExpression>(mod, modAttrs), body);
 			}
 			
-		} else SynErr(187);
+		} else SynErr(188);
 	}
 
 	void MatchStmt(out Statement/*!*/ s) {
@@ -2478,7 +2487,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<MatchCaseStmt/*!*/> cases = new List<MatchCaseStmt/*!*/>();
 		bool usesOptionalBrace = false;
 		
-		Expect(99);
+		Expect(100);
 		x = t; 
 		Expression(out e, true, true);
 		if (la.kind == _lbrace) {
@@ -2494,7 +2503,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				CaseStatement(out c);
 				cases.Add(c); 
 			}
-		} else SynErr(188);
+		} else SynErr(189);
 		s = new MatchStmt(x, t, e, cases, usesOptionalBrace); 
 	}
 
@@ -2511,15 +2520,15 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken bodyStart, bodyEnd;
 		IToken tok = Token.NoToken;
 		
-		if (la.kind == 102) {
+		if (la.kind == 103) {
 			Get();
 			x = t; tok = x; 
-		} else if (la.kind == 103) {
+		} else if (la.kind == 104) {
 			Get();
 			x = t;
 			errors.Warning(t, "the 'parallel' keyword has been deprecated; the comprehension statement now uses the keyword 'forall' (and the parentheses around the bound variables are now optional)");
 			
-		} else SynErr(189);
+		} else SynErr(190);
 		if (la.kind == _openparen) {
 			Expect(49);
 			if (la.kind == 1) {
@@ -2530,19 +2539,19 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			if (la.kind == _ident) {
 				QuantifierDomain(out bvars, out attrs, out range);
 			}
-		} else SynErr(190);
+		} else SynErr(191);
 		if (bvars == null) { bvars = new List<BoundVar>(); }
 		if (range == null) { range = new LiteralExpr(x, true); }
 		
-		while (la.kind == 86 || la.kind == 87) {
+		while (la.kind == 87 || la.kind == 88) {
 			isFree = false; 
-			if (la.kind == 86) {
+			if (la.kind == 87) {
 				Get();
 				isFree = true;
 				errors.Warning(t, "the 'free' keyword is soon to be deprecated");
 				
 			}
-			Expect(87);
+			Expect(88);
 			Expression(out e, false, true);
 			ens.Add(new MaybeFreeExpression(e, isFree)); 
 			OldSemi();
@@ -2620,7 +2629,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				} else if (la.kind == 31) {
 					CalcStmt(out subCalc);
 					hintEnd = subCalc.EndTok; subhints.Add(subCalc); 
-				} else SynErr(191);
+				} else SynErr(192);
 			}
 			var h = new BlockStmt(hintStart, hintEnd, subhints); // if the hint is empty, hintStart is the first token of the next line, but it doesn't matter because the block statement is just used as a container
 			hints.Add(h);
@@ -2646,7 +2655,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		BlockStmt body = null;  IToken bodyStart;
 		IToken ellipsisToken = null;
 		
-		Expect(104);
+		Expect(105);
 		tok = t; 
 		while (IsAttribute()) {
 			Attribute(ref attrs);
@@ -2662,14 +2671,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 58) {
 			Get();
 			ellipsisToken = t; 
-		} else SynErr(192);
+		} else SynErr(193);
 		if (la.kind == 45) {
 			BlockStmt(out body, out bodyStart, out endTok);
 		} else if (la.kind == 27) {
-			while (!(la.kind == 0 || la.kind == 27)) {SynErr(193); Get();}
+			while (!(la.kind == 0 || la.kind == 27)) {SynErr(194); Get();}
 			Get();
 			endTok = t; 
-		} else SynErr(194);
+		} else SynErr(195);
 		s = new ModifyStmt(tok, endTok, mod, attrs, body);
 		if (ellipsisToken != null) {
 		 s = new SkeletonStatement(s, ellipsisToken, null);
@@ -2683,13 +2692,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		AssignmentRhs r;
 		bool isYield = false;
 		
-		if (la.kind == 94) {
+		if (la.kind == 95) {
 			Get();
 			returnTok = t; 
-		} else if (la.kind == 88) {
+		} else if (la.kind == 89) {
 			Get();
 			returnTok = t; isYield = true; 
-		} else SynErr(195);
+		} else SynErr(196);
 		if (StartOf(26)) {
 			Rhs(out r);
 			rhss = new List<AssignmentRhs>(); rhss.Add(r); 
@@ -2715,7 +2724,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression e; 
 		Expect(58);
 		dotdotdot = t; 
-		if (la.kind == 92) {
+		if (la.kind == 93) {
 			Get();
 			names = new List<IToken>(); exprs = new List<Expression>(); whereTok = t;
 			Ident(out tok);
@@ -2725,7 +2734,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Ident(out tok);
 				names.Add(tok); 
 			}
-			Expect(93);
+			Expect(94);
 			Expression(out e, false, true);
 			exprs.Add(e); 
 			while (la.kind == 22) {
@@ -2752,7 +2761,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		r = dummyRhs;  // to please compiler
 		Attributes attrs = null;
 		
-		if (la.kind == 96) {
+		if (la.kind == 97) {
 			Get();
 			newToken = t; 
 			TypeAndToken(out x, out ty);
@@ -2787,7 +2796,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (StartOf(7)) {
 			Expression(out e, false, true);
 			r = new ExprRhs(e); 
-		} else SynErr(196);
+		} else SynErr(197);
 		while (la.kind == 45) {
 			Attribute(ref attrs);
 		}
@@ -2808,7 +2817,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (la.kind == 26 || la.kind == 47 || la.kind == 49) {
 				Suffix(ref e);
 			}
-		} else SynErr(197);
+		} else SynErr(198);
 	}
 
 	void Expressions(List<Expression> args) {
@@ -2857,16 +2866,16 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (StartOf(7)) {
 			Expression(out ee, true, true);
 			e = ee; 
-		} else SynErr(198);
+		} else SynErr(199);
 	}
 
 	void LoopSpec(List<MaybeFreeExpression> invariants, List<Expression> decreases, ref List<FrameExpression> mod, ref Attributes decAttrs, ref Attributes modAttrs) {
 		Expression e; FrameExpression fe;
 		bool isFree = false; Attributes attrs = null;
 		
-		if (la.kind == 36 || la.kind == 86) {
-			while (!(la.kind == 0 || la.kind == 36 || la.kind == 86)) {SynErr(199); Get();}
-			if (la.kind == 86) {
+		if (la.kind == 36 || la.kind == 87) {
+			while (!(la.kind == 0 || la.kind == 36 || la.kind == 87)) {SynErr(200); Get();}
+			if (la.kind == 87) {
 				Get();
 				isFree = true; errors.Warning(t, "the 'free' keyword is soon to be deprecated"); 
 			}
@@ -2878,7 +2887,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			invariants.Add(new MaybeFreeExpression(e, isFree, attrs)); 
 			OldSemi();
 		} else if (la.kind == 35) {
-			while (!(la.kind == 0 || la.kind == 35)) {SynErr(200); Get();}
+			while (!(la.kind == 0 || la.kind == 35)) {SynErr(201); Get();}
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref decAttrs);
@@ -2886,7 +2895,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			DecreasesList(decreases, true, true);
 			OldSemi();
 		} else if (la.kind == 42) {
-			while (!(la.kind == 0 || la.kind == 42)) {SynErr(201); Get();}
+			while (!(la.kind == 0 || la.kind == 42)) {SynErr(202); Get();}
 			Get();
 			mod = mod ?? new List<FrameExpression>(); 
 			while (IsAttribute()) {
@@ -2900,7 +2909,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				mod.Add(fe); 
 			}
 			OldSemi();
-		} else SynErr(202);
+		} else SynErr(203);
 	}
 
 	void CaseStatement(out MatchCaseStmt/*!*/ c) {
@@ -2937,12 +2946,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				arguments.Add(pat); 
 			}
 			Expect(50);
-		} else SynErr(203);
+		} else SynErr(204);
 		Expect(28);
-		while (!(StartOf(28))) {SynErr(204); Get();}
+		while (!(StartOf(28))) {SynErr(205); Get();}
 		while (IsNotEndOfCase()) {
 			Stmt(body);
-			while (!(StartOf(28))) {SynErr(205); Get();}
+			while (!(StartOf(28))) {SynErr(206); Get();}
 		}
 		c = new MatchCaseStmt(x, name, arguments, body); 
 	}
@@ -2990,7 +2999,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			IdentTypeOptional(out bv);
 			pat = new CasePattern(bv.tok, bv);
 			
-		} else SynErr(206);
+		} else SynErr(207);
 		if (pat == null) {
 		 pat = new CasePattern(t, "_ParseError", new List<CasePattern>());
 		}
@@ -3028,7 +3037,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		case 53: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Eq; 
-			if (la.kind == 105) {
+			if (la.kind == 106) {
 				Get();
 				Expect(47);
 				Expression(out k, true, true);
@@ -3046,12 +3055,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  binOp = BinaryExpr.Opcode.Gt; 
 			break;
 		}
-		case 106: {
+		case 107: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 107: {
+		case 108: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Ge; 
 			break;
@@ -3066,32 +3075,32 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  binOp = BinaryExpr.Opcode.Neq; 
 			break;
 		}
-		case 108: {
+		case 109: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 109: {
+		case 110: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		case 110: case 111: {
+		case 111: case 112: {
 			EquivOp();
 			x = t;  binOp = BinaryExpr.Opcode.Iff; 
 			break;
 		}
-		case 112: case 113: {
+		case 113: case 114: {
 			ImpliesOp();
 			x = t;  binOp = BinaryExpr.Opcode.Imp; 
 			break;
 		}
-		case 114: case 115: {
+		case 115: case 116: {
 			ExpliesOp();
 			x = t;  binOp = BinaryExpr.Opcode.Exp; 
 			break;
 		}
-		default: SynErr(207); break;
+		default: SynErr(208); break;
 		}
 		if (k == null) {
 		 op = new Microsoft.Dafny.CalcStmt.BinaryCalcOp(binOp);
@@ -3102,67 +3111,67 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 	}
 
 	void EquivOp() {
-		if (la.kind == 110) {
+		if (la.kind == 111) {
 			Get();
-		} else if (la.kind == 111) {
+		} else if (la.kind == 112) {
 			Get();
-		} else SynErr(208);
+		} else SynErr(209);
 	}
 
 	void ImpliesOp() {
-		if (la.kind == 112) {
+		if (la.kind == 113) {
 			Get();
-		} else if (la.kind == 113) {
+		} else if (la.kind == 114) {
 			Get();
-		} else SynErr(209);
+		} else SynErr(210);
 	}
 
 	void ExpliesOp() {
-		if (la.kind == 114) {
+		if (la.kind == 115) {
 			Get();
-		} else if (la.kind == 115) {
+		} else if (la.kind == 116) {
 			Get();
-		} else SynErr(210);
+		} else SynErr(211);
 	}
 
 	void AndOp() {
-		if (la.kind == 116) {
+		if (la.kind == 117) {
 			Get();
-		} else if (la.kind == 117) {
+		} else if (la.kind == 118) {
 			Get();
-		} else SynErr(211);
+		} else SynErr(212);
 	}
 
 	void OrOp() {
-		if (la.kind == 118) {
+		if (la.kind == 119) {
 			Get();
-		} else if (la.kind == 119) {
+		} else if (la.kind == 120) {
 			Get();
-		} else SynErr(212);
+		} else SynErr(213);
 	}
 
 	void NegOp() {
-		if (la.kind == 120) {
+		if (la.kind == 121) {
 			Get();
-		} else if (la.kind == 121) {
+		} else if (la.kind == 122) {
 			Get();
-		} else SynErr(213);
+		} else SynErr(214);
 	}
 
 	void Forall() {
-		if (la.kind == 102) {
+		if (la.kind == 103) {
 			Get();
-		} else if (la.kind == 122) {
+		} else if (la.kind == 123) {
 			Get();
-		} else SynErr(214);
+		} else SynErr(215);
 	}
 
 	void Exists() {
-		if (la.kind == 123) {
+		if (la.kind == 124) {
 			Get();
-		} else if (la.kind == 124) {
+		} else if (la.kind == 125) {
 			Get();
-		} else SynErr(215);
+		} else SynErr(216);
 	}
 
 	void QSep() {
@@ -3170,7 +3179,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 25) {
 			Get();
-		} else SynErr(216);
+		} else SynErr(217);
 	}
 
 	void EquivExpression(out Expression e0, bool allowSemi, bool allowLambda) {
@@ -3188,12 +3197,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Ensures(Contract.ValueAtReturn(out e0) != null); IToken/*!*/ x;  Expression/*!*/ e1; 
 		LogicalExpression(out e0, allowSemi, allowLambda);
 		if (IsImpliesOp() || IsExpliesOp()) {
-			if (la.kind == 112 || la.kind == 113) {
+			if (la.kind == 113 || la.kind == 114) {
 				ImpliesOp();
 				x = t; 
 				ImpliesExpression(out e1, allowSemi, allowLambda);
 				e0 = new BinaryExpr(x, BinaryExpr.Opcode.Imp, e0, e1); 
-			} else if (la.kind == 114 || la.kind == 115) {
+			} else if (la.kind == 115 || la.kind == 116) {
 				ExpliesOp();
 				x = t; 
 				LogicalExpression(out e1, allowSemi, allowLambda);
@@ -3204,7 +3213,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					LogicalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e0, e1); 
 				}
-			} else SynErr(217);
+			} else SynErr(218);
 		}
 	}
 
@@ -3212,7 +3221,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Ensures(Contract.ValueAtReturn(out e0) != null); IToken/*!*/ x;  Expression/*!*/ e1; 
 		RelationalExpression(out e0, allowSemi, allowLambda);
 		if (IsAndOp() || IsOrOp()) {
-			if (la.kind == 116 || la.kind == 117) {
+			if (la.kind == 117 || la.kind == 118) {
 				AndOp();
 				x = t; 
 				RelationalExpression(out e1, allowSemi, allowLambda);
@@ -3223,7 +3232,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					RelationalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.And, e0, e1); 
 				}
-			} else if (la.kind == 118 || la.kind == 119) {
+			} else if (la.kind == 119 || la.kind == 120) {
 				OrOp();
 				x = t; 
 				RelationalExpression(out e1, allowSemi, allowLambda);
@@ -3234,7 +3243,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					RelationalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Or, e0, e1); 
 				}
-			} else SynErr(218);
+			} else SynErr(219);
 		}
 	}
 
@@ -3370,7 +3379,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		case 53: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Eq; 
-			if (la.kind == 105) {
+			if (la.kind == 106) {
 				Get();
 				Expect(47);
 				Expression(out k, true, true);
@@ -3388,12 +3397,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  op = BinaryExpr.Opcode.Gt; 
 			break;
 		}
-		case 106: {
+		case 107: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 107: {
+		case 108: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Ge; 
 			break;
@@ -3401,7 +3410,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		case 54: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Neq; 
-			if (la.kind == 105) {
+			if (la.kind == 106) {
 				Get();
 				Expect(47);
 				Expression(out k, true, true);
@@ -3409,7 +3418,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			break;
 		}
-		case 125: {
+		case 126: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.In; 
 			break;
@@ -3419,11 +3428,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  op = BinaryExpr.Opcode.NotIn; 
 			break;
 		}
-		case 120: {
+		case 121: {
 			Get();
 			x = t;  y = Token.NoToken; 
 			if (la.val == "!") {
-				Expect(120);
+				Expect(121);
 				y = t; 
 			}
 			if (y == Token.NoToken) {
@@ -3442,17 +3451,17 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  op = BinaryExpr.Opcode.Neq; 
 			break;
 		}
-		case 108: {
+		case 109: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 109: {
+		case 110: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		default: SynErr(219); break;
+		default: SynErr(220); break;
 		}
 	}
 
@@ -3468,23 +3477,23 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void AddOp(out IToken x, out BinaryExpr.Opcode op) {
 		Contract.Ensures(Contract.ValueAtReturn(out x) != null); x = Token.NoToken;  op=BinaryExpr.Opcode.Add/*(dummy)*/; 
-		if (la.kind == 126) {
+		if (la.kind == 127) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Add; 
-		} else if (la.kind == 127) {
+		} else if (la.kind == 128) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Sub; 
-		} else SynErr(220);
+		} else SynErr(221);
 	}
 
 	void UnaryExpression(out Expression e, bool allowSemi, bool allowLambda) {
 		Contract.Ensures(Contract.ValueAtReturn(out e) != null); IToken/*!*/ x;  e = dummyExpr; 
-		if (la.kind == 127) {
+		if (la.kind == 128) {
 			Get();
 			x = t; 
 			UnaryExpression(out e, allowSemi, allowLambda);
 			e = new NegationExpression(x, e); 
-		} else if (la.kind == 120 || la.kind == 121) {
+		} else if (la.kind == 121 || la.kind == 122) {
 			NegOp();
 			x = t; 
 			UnaryExpression(out e, allowSemi, allowLambda);
@@ -3534,7 +3543,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (IsSuffix()) {
 				Suffix(ref e);
 			}
-		} else SynErr(221);
+		} else SynErr(222);
 	}
 
 	void MulOp(out IToken x, out BinaryExpr.Opcode op) {
@@ -3542,13 +3551,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (la.kind == 56) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Mul; 
-		} else if (la.kind == 128) {
+		} else if (la.kind == 129) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Div; 
-		} else if (la.kind == 129) {
+		} else if (la.kind == 130) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Mod; 
-		} else SynErr(222);
+		} else SynErr(223);
 	}
 
 	void MapDisplayExpr(IToken/*!*/ mapToken, bool finite, out Expression e) {
@@ -3583,10 +3592,10 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			if (IsGenericInstantiation()) {
 				typeArgs = new List<Type>(); 
 				GenericInstantiation(typeArgs);
-			} else if (la.kind == 105) {
+			} else if (la.kind == 106) {
 				HashCall(id, out openParen, out typeArgs, out args);
 			} else if (StartOf(30)) {
-			} else SynErr(223);
+			} else SynErr(224);
 			e = new ExprDotName(id, e, id.val, typeArgs);
 			if (openParen != null) {
 			 e = new ApplySuffix(openParen, e, args);
@@ -3598,14 +3607,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			if (StartOf(7)) {
 				Expression(out ee, true, true);
 				e0 = ee; 
-				if (la.kind == 136) {
+				if (la.kind == 137) {
 					Get();
 					anyDots = true; 
 					if (StartOf(7)) {
 						Expression(out ee, true, true);
 						e1 = ee; 
 					}
-				} else if (la.kind == 93) {
+				} else if (la.kind == 94) {
 					Get();
 					Expression(out ee, true, true);
 					e1 = ee; 
@@ -3639,15 +3648,15 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 						multipleIndices.Add(ee);
 						
 					}
-				} else SynErr(224);
-			} else if (la.kind == 136) {
+				} else SynErr(225);
+			} else if (la.kind == 137) {
 				Get();
 				anyDots = true; 
 				if (StartOf(7)) {
 					Expression(out ee, true, true);
 					e1 = ee; 
 				}
-			} else SynErr(225);
+			} else SynErr(226);
 			if (multipleIndices != null) {
 			 e = new MultiSelectExpr(x, e, multipleIndices);
 			 // make sure an array class with this dimensionality exists
@@ -3691,7 +3700,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			Expect(50);
 			e = new ApplySuffix(openParen, e, args); 
-		} else SynErr(226);
+		} else SynErr(227);
 	}
 
 	void ISetDisplayExpr(IToken/*!*/ setToken, bool finite, out Expression e) {
@@ -3733,7 +3742,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				}
 			}
 			Expect(50);
-		} else SynErr(227);
+		} else SynErr(228);
 		while (la.kind == 43 || la.kind == 44) {
 			if (la.kind == 43) {
 				Get();
@@ -3759,7 +3768,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;
 		
 		switch (la.kind) {
-		case 97: {
+		case 98: {
 			Get();
 			x = t; 
 			Expression(out e, true, true);
@@ -3770,11 +3779,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			e = new ITEExpr(x, e, e0, e1); 
 			break;
 		}
-		case 99: {
+		case 100: {
 			MatchExpression(out e, allowSemi, allowLambda);
 			break;
 		}
-		case 102: case 122: case 123: case 124: {
+		case 103: case 123: case 124: case 125: {
 			QuantifierGuts(out e, allowSemi, allowLambda);
 			break;
 		}
@@ -3790,13 +3799,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			SetComprehensionExpr(x, false, out e, allowSemi, allowLambda);
 			break;
 		}
-		case 30: case 31: case 100: {
+		case 30: case 31: case 101: {
 			StmtInExpr(out s);
 			Expression(out e, allowSemi, allowLambda);
 			e = new StmtExpr(s.Tok, s, e); 
 			break;
 		}
-		case 71: case 76: {
+		case 72: case 77: {
 			LetExpr(out e, allowSemi, allowLambda);
 			break;
 		}
@@ -3812,11 +3821,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			MapComprehensionExpr(x, false, out e, allowSemi, allowLambda);
 			break;
 		}
-		case 90: {
+		case 91: {
 			NamedExpr(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(228); break;
+		default: SynErr(229); break;
 		}
 	}
 
@@ -3828,10 +3837,10 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (IsGenericInstantiation()) {
 			typeArgs = new List<Type>(); 
 			GenericInstantiation(typeArgs);
-		} else if (la.kind == 105) {
+		} else if (la.kind == 106) {
 			HashCall(id, out openParen, out typeArgs, out args);
 		} else if (StartOf(30)) {
-		} else SynErr(229);
+		} else SynErr(230);
 		e = new NameSegment(id, id.val, typeArgs);
 		if (openParen != null) {
 		 e = new ApplySuffix(openParen, e, args);
@@ -3860,7 +3869,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			e = new SeqDisplayExpr(x, elements); 
 			Expect(48);
-		} else SynErr(230);
+		} else SynErr(231);
 	}
 
 	void MultiSetExpr(out Expression e) {
@@ -3884,7 +3893,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Expression(out e, true, true);
 			e = new MultiSetFormingExpr(x, e); 
 			Expect(50);
-		} else SynErr(231);
+		} else SynErr(232);
 	}
 
 	void ConstAtomExpression(out Expression e, bool allowSemi, bool allowLambda) {
@@ -3893,17 +3902,17 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;  Type toType = null;
 		
 		switch (la.kind) {
-		case 130: {
+		case 131: {
 			Get();
 			e = new LiteralExpr(t, false); 
 			break;
 		}
-		case 131: {
+		case 132: {
 			Get();
 			e = new LiteralExpr(t, true); 
 			break;
 		}
-		case 132: {
+		case 133: {
 			Get();
 			e = new LiteralExpr(t); 
 			break;
@@ -3931,12 +3940,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			
 			break;
 		}
-		case 133: {
+		case 134: {
 			Get();
 			e = new ThisExpr(t); 
 			break;
 		}
-		case 134: {
+		case 135: {
 			Get();
 			x = t; 
 			Expect(49);
@@ -3945,7 +3954,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			e = new UnaryOpExpr(x, UnaryOpExpr.Opcode.Fresh, e); 
 			break;
 		}
-		case 135: {
+		case 136: {
 			Get();
 			x = t; 
 			Expect(49);
@@ -3980,7 +3989,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			ParensExpression(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(232); break;
+		default: SynErr(233); break;
 		}
 	}
 
@@ -4009,7 +4018,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 n = BigInteger.Zero;
 			}
 			
-		} else SynErr(233);
+		} else SynErr(234);
 	}
 
 	void Dec(out Basetypes.BigDec d) {
@@ -4053,20 +4062,20 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 29) {
 			Get();
 			oneShot = true; 
-		} else SynErr(234);
+		} else SynErr(235);
 	}
 
 	void MapLiteralExpressions(out List<ExpressionPair> elements) {
 		Expression/*!*/ d, r;
 		elements = new List<ExpressionPair/*!*/>(); 
 		Expression(out d, true, true);
-		Expect(93);
+		Expect(94);
 		Expression(out r, true, true);
 		elements.Add(new ExpressionPair(d,r)); 
 		while (la.kind == 22) {
 			Get();
 			Expression(out d, true, true);
-			Expect(93);
+			Expect(94);
 			Expression(out r, true, true);
 			elements.Add(new ExpressionPair(d,r)); 
 		}
@@ -4100,7 +4109,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<MatchCaseExpr/*!*/> cases = new List<MatchCaseExpr/*!*/>();
 		bool usesOptionalBrace = false;
 		
-		Expect(99);
+		Expect(100);
 		x = t; 
 		Expression(out e, allowSemi, allowLambda);
 		if (la.kind == _lbrace) {
@@ -4116,7 +4125,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				CaseExpression(out c, allowSemi, allowLambda);
 				cases.Add(c); 
 			}
-		} else SynErr(235);
+		} else SynErr(236);
 		e = new MatchExpr(x, e, cases, usesOptionalBrace); 
 	}
 
@@ -4128,13 +4137,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression range;
 		Expression/*!*/ body;
 		
-		if (la.kind == 102 || la.kind == 122) {
+		if (la.kind == 103 || la.kind == 123) {
 			Forall();
 			x = t;  univ = true; 
-		} else if (la.kind == 123 || la.kind == 124) {
+		} else if (la.kind == 124 || la.kind == 125) {
 			Exists();
 			x = t; 
-		} else SynErr(236);
+		} else SynErr(237);
 		QuantifierDomain(out bvars, out attrs, out range);
 		QSep();
 		Expression(out body, allowSemi, allowLambda);
@@ -4177,13 +4186,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void StmtInExpr(out Statement s) {
 		s = dummyStmt; 
-		if (la.kind == 100) {
+		if (la.kind == 101) {
 			AssertStmt(out s);
 		} else if (la.kind == 30) {
 			AssumeStmt(out s);
 		} else if (la.kind == 31) {
 			CalcStmt(out s);
-		} else SynErr(237);
+		} else SynErr(238);
 	}
 
 	void LetExpr(out Expression e, bool allowSemi, bool allowLambda) {
@@ -4196,11 +4205,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Attributes attrs = null;
 		e = dummyExpr;
 		
-		if (la.kind == 71) {
+		if (la.kind == 72) {
 			Get();
 			isGhost = true;  x = t; 
 		}
-		Expect(76);
+		Expect(77);
 		if (!isGhost) { x = t; } 
 		CasePattern(out pat);
 		if (isGhost) { pat.Vars.Iter(bv => bv.IsGhost = true); }
@@ -4213,13 +4222,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			letLHSs.Add(pat);
 			
 		}
-		if (la.kind == 93) {
+		if (la.kind == 94) {
 			Get();
-		} else if (la.kind == 45 || la.kind == 95) {
+		} else if (la.kind == 45 || la.kind == 96) {
 			while (la.kind == 45) {
 				Attribute(ref attrs);
 			}
-			Expect(95);
+			Expect(96);
 			exact = false;
 			foreach (var lhs in letLHSs) {
 			 if (lhs.Arguments != null) {
@@ -4227,7 +4236,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 }
 			}
 			
-		} else SynErr(238);
+		} else SynErr(239);
 		Expression(out e, false, true);
 		letRHSs.Add(e); 
 		while (la.kind == 22) {
@@ -4245,7 +4254,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;
 		Expression expr;
 		
-		Expect(90);
+		Expect(91);
 		x = t; 
 		NoUSIdent(out d);
 		Expect(21);
@@ -4287,7 +4296,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				arguments.Add(pat); 
 			}
 			Expect(50);
-		} else SynErr(239);
+		} else SynErr(240);
 		Expect(28);
 		Expression(out body, allowSemi, allowLambda);
 		c = new MatchCaseExpr(x, name, arguments, body); 
@@ -4295,7 +4304,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void HashCall(IToken id, out IToken openParen, out List<Type> typeArgs, out List<Expression> args) {
 		Expression k; args = new List<Expression>(); typeArgs = null; 
-		Expect(105);
+		Expect(106);
 		id.val = id.val + "#"; 
 		if (la.kind == 51) {
 			typeArgs = new List<Type>(); 
@@ -4352,7 +4361,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 43) {
 			Get();
 			x = t; 
-		} else SynErr(240);
+		} else SynErr(241);
 	}
 
 
@@ -4368,38 +4377,38 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 	}
 
 	static readonly bool[,]/*!*/ set = {
-		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,T, x,x,T,T, T,x,x,T, T,x,x,T, T,x,T,T, T,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, T,x,T,T, x,x,T,T, T,x,x,T, x,x,T,T, T,T,T,T, T,x,T,T, x,x,T,x, x,T,T,T, T,T,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,x,T, x,x,x,x, T,x,T,T, T,T,T,T, T,T,T,T, x,x,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,x,x, T,x,x,x, x,x,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{x,T,x,x, x,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, x,x,T,x, x,x,x,T, x,x,x,x, x,x,x,x, T,T,x,T, x,T,x,x, T,x,T,T, T,T,T,T, T,T,T,T, x,x,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,T,x,T, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,T,T, T,x,x,T, x,x,T,T, T,T,T,T, x,x,x},
-		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,T,T,T, T,T,x,T, T,T,T,x, x,T,x,T, x,x,x,x, x,x,x,x, T,T,x,T, x,x,x,x, T,x,T,T, T,T,T,T, T,T,T,T, x,x,T,T, T,T,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{x,T,T,x, x,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, T,x,T,T, x,x,T,x, x,T,T,T, T,T,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, x,x,x},
-		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,x,x,x, x,T,x,T, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,T,T, T,x,x,T, x,x,T,T, T,T,T,T, x,x,x},
-		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, T,x,T,T, x,x,T,x, x,T,T,T, T,T,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,T,x,T, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,T,T, T,x,x,T, x,x,T,T, T,T,T,T, x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,T,x,T, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,T,T, T,x,x,T, x,x,T,T, T,T,T,T, x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, T,x,T,T, x,x,T,x, x,T,T,T, T,T,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,T,T, T,x,T,T, x,x,T,x, x,T,T,T, T,T,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, T,T,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,T,x, x,x,x,x, T,T,x,T, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,T,T, T,x,x,T, x,x,T,T, T,T,T,T, x,x,x},
-		{x,x,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, x,x,x},
-		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, T,x,T,T, x,x,T,x, x,T,T,T, T,T,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,T,T,T, x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,T,x, x,x,x,x, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,T,x,T, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x},
-		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, T,T,x,T, x,x,x,x, T,x,T,T, T,T,T,T, T,T,T,T, x,x,T,T, T,T,T,T, T,T,T,T, x,T,T,T, x,T,T,T, T,T,T,T, T,x,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,x,x,x, x,T,T,T, T,T,T,T, T,T,T,T, T,x,x},
-		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,T,T,T, T,T,x,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, T,T,T,T, T,T,T,T, T,T,T,x, T,T,x,T, x,x,x,x, T,x,T,T, T,T,T,T, T,T,T,T, x,x,T,T, T,T,T,T, T,T,T,T, x,T,T,x, x,T,T,T, T,T,T,T, T,x,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,x,x,x, x,T,T,T, T,T,T,T, T,T,T,T, T,x,x}
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_T, _x,_x,_T,_T, _T,_x,_x,_T, _T,_x,_x,_T, _T,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_x, _x,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_T,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_x,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x}
 
 	};
 } // end Parser
@@ -4486,185 +4495,186 @@ public class Errors {
 			case 59: s = "\"include\" expected"; break;
 			case 60: s = "\"abstract\" expected"; break;
 			case 61: s = "\"module\" expected"; break;
-			case 62: s = "\"refines\" expected"; break;
-			case 63: s = "\"import\" expected"; break;
-			case 64: s = "\"opened\" expected"; break;
-			case 65: s = "\"=\" expected"; break;
-			case 66: s = "\"as\" expected"; break;
-			case 67: s = "\"default\" expected"; break;
-			case 68: s = "\"class\" expected"; break;
-			case 69: s = "\"extends\" expected"; break;
-			case 70: s = "\"trait\" expected"; break;
-			case 71: s = "\"ghost\" expected"; break;
-			case 72: s = "\"static\" expected"; break;
-			case 73: s = "\"protected\" expected"; break;
-			case 74: s = "\"datatype\" expected"; break;
-			case 75: s = "\"codatatype\" expected"; break;
-			case 76: s = "\"var\" expected"; break;
-			case 77: s = "\"newtype\" expected"; break;
-			case 78: s = "\"type\" expected"; break;
-			case 79: s = "\"iterator\" expected"; break;
-			case 80: s = "\"yields\" expected"; break;
-			case 81: s = "\"returns\" expected"; break;
-			case 82: s = "\"method\" expected"; break;
-			case 83: s = "\"colemma\" expected"; break;
-			case 84: s = "\"comethod\" expected"; break;
-			case 85: s = "\"constructor\" expected"; break;
-			case 86: s = "\"free\" expected"; break;
-			case 87: s = "\"ensures\" expected"; break;
-			case 88: s = "\"yield\" expected"; break;
-			case 89: s = "\"`\" expected"; break;
-			case 90: s = "\"label\" expected"; break;
-			case 91: s = "\"break\" expected"; break;
-			case 92: s = "\"where\" expected"; break;
-			case 93: s = "\":=\" expected"; break;
-			case 94: s = "\"return\" expected"; break;
-			case 95: s = "\":|\" expected"; break;
-			case 96: s = "\"new\" expected"; break;
-			case 97: s = "\"if\" expected"; break;
-			case 98: s = "\"while\" expected"; break;
-			case 99: s = "\"match\" expected"; break;
-			case 100: s = "\"assert\" expected"; break;
-			case 101: s = "\"print\" expected"; break;
-			case 102: s = "\"forall\" expected"; break;
-			case 103: s = "\"parallel\" expected"; break;
-			case 104: s = "\"modify\" expected"; break;
-			case 105: s = "\"#\" expected"; break;
-			case 106: s = "\"<=\" expected"; break;
-			case 107: s = "\">=\" expected"; break;
-			case 108: s = "\"\\u2264\" expected"; break;
-			case 109: s = "\"\\u2265\" expected"; break;
-			case 110: s = "\"<==>\" expected"; break;
-			case 111: s = "\"\\u21d4\" expected"; break;
-			case 112: s = "\"==>\" expected"; break;
-			case 113: s = "\"\\u21d2\" expected"; break;
-			case 114: s = "\"<==\" expected"; break;
-			case 115: s = "\"\\u21d0\" expected"; break;
-			case 116: s = "\"&&\" expected"; break;
-			case 117: s = "\"\\u2227\" expected"; break;
-			case 118: s = "\"||\" expected"; break;
-			case 119: s = "\"\\u2228\" expected"; break;
-			case 120: s = "\"!\" expected"; break;
-			case 121: s = "\"\\u00ac\" expected"; break;
-			case 122: s = "\"\\u2200\" expected"; break;
-			case 123: s = "\"exists\" expected"; break;
-			case 124: s = "\"\\u2203\" expected"; break;
-			case 125: s = "\"in\" expected"; break;
-			case 126: s = "\"+\" expected"; break;
-			case 127: s = "\"-\" expected"; break;
-			case 128: s = "\"/\" expected"; break;
-			case 129: s = "\"%\" expected"; break;
-			case 130: s = "\"false\" expected"; break;
-			case 131: s = "\"true\" expected"; break;
-			case 132: s = "\"null\" expected"; break;
-			case 133: s = "\"this\" expected"; break;
-			case 134: s = "\"fresh\" expected"; break;
-			case 135: s = "\"old\" expected"; break;
-			case 136: s = "\"..\" expected"; break;
-			case 137: s = "??? expected"; break;
-			case 138: s = "this symbol not expected in SubModuleDecl"; break;
-			case 139: s = "invalid SubModuleDecl"; break;
-			case 140: s = "this symbol not expected in ClassDecl"; break;
-			case 141: s = "this symbol not expected in DatatypeDecl"; break;
-			case 142: s = "invalid DatatypeDecl"; break;
-			case 143: s = "this symbol not expected in DatatypeDecl"; break;
-			case 144: s = "invalid NewtypeDecl"; break;
-			case 145: s = "invalid OtherTypeDecl"; break;
-			case 146: s = "this symbol not expected in OtherTypeDecl"; break;
-			case 147: s = "this symbol not expected in IteratorDecl"; break;
-			case 148: s = "invalid IteratorDecl"; break;
-			case 149: s = "this symbol not expected in TraitDecl"; break;
-			case 150: s = "invalid ClassMemberDecl"; break;
-			case 151: s = "this symbol not expected in FieldDecl"; break;
-			case 152: s = "invalid FunctionDecl"; break;
+			case 62: s = "\"exclusively\" expected"; break;
+			case 63: s = "\"refines\" expected"; break;
+			case 64: s = "\"import\" expected"; break;
+			case 65: s = "\"opened\" expected"; break;
+			case 66: s = "\"=\" expected"; break;
+			case 67: s = "\"as\" expected"; break;
+			case 68: s = "\"default\" expected"; break;
+			case 69: s = "\"class\" expected"; break;
+			case 70: s = "\"extends\" expected"; break;
+			case 71: s = "\"trait\" expected"; break;
+			case 72: s = "\"ghost\" expected"; break;
+			case 73: s = "\"static\" expected"; break;
+			case 74: s = "\"protected\" expected"; break;
+			case 75: s = "\"datatype\" expected"; break;
+			case 76: s = "\"codatatype\" expected"; break;
+			case 77: s = "\"var\" expected"; break;
+			case 78: s = "\"newtype\" expected"; break;
+			case 79: s = "\"type\" expected"; break;
+			case 80: s = "\"iterator\" expected"; break;
+			case 81: s = "\"yields\" expected"; break;
+			case 82: s = "\"returns\" expected"; break;
+			case 83: s = "\"method\" expected"; break;
+			case 84: s = "\"colemma\" expected"; break;
+			case 85: s = "\"comethod\" expected"; break;
+			case 86: s = "\"constructor\" expected"; break;
+			case 87: s = "\"free\" expected"; break;
+			case 88: s = "\"ensures\" expected"; break;
+			case 89: s = "\"yield\" expected"; break;
+			case 90: s = "\"`\" expected"; break;
+			case 91: s = "\"label\" expected"; break;
+			case 92: s = "\"break\" expected"; break;
+			case 93: s = "\"where\" expected"; break;
+			case 94: s = "\":=\" expected"; break;
+			case 95: s = "\"return\" expected"; break;
+			case 96: s = "\":|\" expected"; break;
+			case 97: s = "\"new\" expected"; break;
+			case 98: s = "\"if\" expected"; break;
+			case 99: s = "\"while\" expected"; break;
+			case 100: s = "\"match\" expected"; break;
+			case 101: s = "\"assert\" expected"; break;
+			case 102: s = "\"print\" expected"; break;
+			case 103: s = "\"forall\" expected"; break;
+			case 104: s = "\"parallel\" expected"; break;
+			case 105: s = "\"modify\" expected"; break;
+			case 106: s = "\"#\" expected"; break;
+			case 107: s = "\"<=\" expected"; break;
+			case 108: s = "\">=\" expected"; break;
+			case 109: s = "\"\\u2264\" expected"; break;
+			case 110: s = "\"\\u2265\" expected"; break;
+			case 111: s = "\"<==>\" expected"; break;
+			case 112: s = "\"\\u21d4\" expected"; break;
+			case 113: s = "\"==>\" expected"; break;
+			case 114: s = "\"\\u21d2\" expected"; break;
+			case 115: s = "\"<==\" expected"; break;
+			case 116: s = "\"\\u21d0\" expected"; break;
+			case 117: s = "\"&&\" expected"; break;
+			case 118: s = "\"\\u2227\" expected"; break;
+			case 119: s = "\"||\" expected"; break;
+			case 120: s = "\"\\u2228\" expected"; break;
+			case 121: s = "\"!\" expected"; break;
+			case 122: s = "\"\\u00ac\" expected"; break;
+			case 123: s = "\"\\u2200\" expected"; break;
+			case 124: s = "\"exists\" expected"; break;
+			case 125: s = "\"\\u2203\" expected"; break;
+			case 126: s = "\"in\" expected"; break;
+			case 127: s = "\"+\" expected"; break;
+			case 128: s = "\"-\" expected"; break;
+			case 129: s = "\"/\" expected"; break;
+			case 130: s = "\"%\" expected"; break;
+			case 131: s = "\"false\" expected"; break;
+			case 132: s = "\"true\" expected"; break;
+			case 133: s = "\"null\" expected"; break;
+			case 134: s = "\"this\" expected"; break;
+			case 135: s = "\"fresh\" expected"; break;
+			case 136: s = "\"old\" expected"; break;
+			case 137: s = "\"..\" expected"; break;
+			case 138: s = "??? expected"; break;
+			case 139: s = "this symbol not expected in SubModuleDecl"; break;
+			case 140: s = "invalid SubModuleDecl"; break;
+			case 141: s = "this symbol not expected in ClassDecl"; break;
+			case 142: s = "this symbol not expected in DatatypeDecl"; break;
+			case 143: s = "invalid DatatypeDecl"; break;
+			case 144: s = "this symbol not expected in DatatypeDecl"; break;
+			case 145: s = "invalid NewtypeDecl"; break;
+			case 146: s = "invalid OtherTypeDecl"; break;
+			case 147: s = "this symbol not expected in OtherTypeDecl"; break;
+			case 148: s = "this symbol not expected in IteratorDecl"; break;
+			case 149: s = "invalid IteratorDecl"; break;
+			case 150: s = "this symbol not expected in TraitDecl"; break;
+			case 151: s = "invalid ClassMemberDecl"; break;
+			case 152: s = "this symbol not expected in FieldDecl"; break;
 			case 153: s = "invalid FunctionDecl"; break;
 			case 154: s = "invalid FunctionDecl"; break;
 			case 155: s = "invalid FunctionDecl"; break;
 			case 156: s = "invalid FunctionDecl"; break;
-			case 157: s = "this symbol not expected in MethodDecl"; break;
-			case 158: s = "invalid MethodDecl"; break;
+			case 157: s = "invalid FunctionDecl"; break;
+			case 158: s = "this symbol not expected in MethodDecl"; break;
 			case 159: s = "invalid MethodDecl"; break;
-			case 160: s = "invalid FIdentType"; break;
-			case 161: s = "this symbol not expected in OldSemi"; break;
-			case 162: s = "invalid TypeIdentOptional"; break;
-			case 163: s = "invalid TypeAndToken"; break;
-			case 164: s = "this symbol not expected in IteratorSpec"; break;
-			case 165: s = "invalid IteratorSpec"; break;
+			case 160: s = "invalid MethodDecl"; break;
+			case 161: s = "invalid FIdentType"; break;
+			case 162: s = "this symbol not expected in OldSemi"; break;
+			case 163: s = "invalid TypeIdentOptional"; break;
+			case 164: s = "invalid TypeAndToken"; break;
+			case 165: s = "this symbol not expected in IteratorSpec"; break;
 			case 166: s = "invalid IteratorSpec"; break;
-			case 167: s = "this symbol not expected in MethodSpec"; break;
-			case 168: s = "invalid MethodSpec"; break;
+			case 167: s = "invalid IteratorSpec"; break;
+			case 168: s = "this symbol not expected in MethodSpec"; break;
 			case 169: s = "invalid MethodSpec"; break;
-			case 170: s = "invalid FrameExpression"; break;
-			case 171: s = "this symbol not expected in FunctionSpec"; break;
-			case 172: s = "invalid FunctionSpec"; break;
-			case 173: s = "invalid PossiblyWildFrameExpression"; break;
-			case 174: s = "invalid PossiblyWildExpression"; break;
-			case 175: s = "this symbol not expected in OneStmt"; break;
-			case 176: s = "invalid OneStmt"; break;
-			case 177: s = "this symbol not expected in OneStmt"; break;
-			case 178: s = "invalid OneStmt"; break;
-			case 179: s = "invalid AssertStmt"; break;
-			case 180: s = "invalid AssumeStmt"; break;
-			case 181: s = "invalid UpdateStmt"; break;
+			case 170: s = "invalid MethodSpec"; break;
+			case 171: s = "invalid FrameExpression"; break;
+			case 172: s = "this symbol not expected in FunctionSpec"; break;
+			case 173: s = "invalid FunctionSpec"; break;
+			case 174: s = "invalid PossiblyWildFrameExpression"; break;
+			case 175: s = "invalid PossiblyWildExpression"; break;
+			case 176: s = "this symbol not expected in OneStmt"; break;
+			case 177: s = "invalid OneStmt"; break;
+			case 178: s = "this symbol not expected in OneStmt"; break;
+			case 179: s = "invalid OneStmt"; break;
+			case 180: s = "invalid AssertStmt"; break;
+			case 181: s = "invalid AssumeStmt"; break;
 			case 182: s = "invalid UpdateStmt"; break;
-			case 183: s = "this symbol not expected in VarDeclStatement"; break;
-			case 184: s = "invalid IfStmt"; break;
+			case 183: s = "invalid UpdateStmt"; break;
+			case 184: s = "this symbol not expected in VarDeclStatement"; break;
 			case 185: s = "invalid IfStmt"; break;
-			case 186: s = "invalid WhileStmt"; break;
+			case 186: s = "invalid IfStmt"; break;
 			case 187: s = "invalid WhileStmt"; break;
-			case 188: s = "invalid MatchStmt"; break;
-			case 189: s = "invalid ForallStmt"; break;
+			case 188: s = "invalid WhileStmt"; break;
+			case 189: s = "invalid MatchStmt"; break;
 			case 190: s = "invalid ForallStmt"; break;
-			case 191: s = "invalid CalcStmt"; break;
-			case 192: s = "invalid ModifyStmt"; break;
-			case 193: s = "this symbol not expected in ModifyStmt"; break;
-			case 194: s = "invalid ModifyStmt"; break;
-			case 195: s = "invalid ReturnStmt"; break;
-			case 196: s = "invalid Rhs"; break;
-			case 197: s = "invalid Lhs"; break;
-			case 198: s = "invalid Guard"; break;
-			case 199: s = "this symbol not expected in LoopSpec"; break;
+			case 191: s = "invalid ForallStmt"; break;
+			case 192: s = "invalid CalcStmt"; break;
+			case 193: s = "invalid ModifyStmt"; break;
+			case 194: s = "this symbol not expected in ModifyStmt"; break;
+			case 195: s = "invalid ModifyStmt"; break;
+			case 196: s = "invalid ReturnStmt"; break;
+			case 197: s = "invalid Rhs"; break;
+			case 198: s = "invalid Lhs"; break;
+			case 199: s = "invalid Guard"; break;
 			case 200: s = "this symbol not expected in LoopSpec"; break;
 			case 201: s = "this symbol not expected in LoopSpec"; break;
-			case 202: s = "invalid LoopSpec"; break;
-			case 203: s = "invalid CaseStatement"; break;
-			case 204: s = "this symbol not expected in CaseStatement"; break;
+			case 202: s = "this symbol not expected in LoopSpec"; break;
+			case 203: s = "invalid LoopSpec"; break;
+			case 204: s = "invalid CaseStatement"; break;
 			case 205: s = "this symbol not expected in CaseStatement"; break;
-			case 206: s = "invalid CasePattern"; break;
-			case 207: s = "invalid CalcOp"; break;
-			case 208: s = "invalid EquivOp"; break;
-			case 209: s = "invalid ImpliesOp"; break;
-			case 210: s = "invalid ExpliesOp"; break;
-			case 211: s = "invalid AndOp"; break;
-			case 212: s = "invalid OrOp"; break;
-			case 213: s = "invalid NegOp"; break;
-			case 214: s = "invalid Forall"; break;
-			case 215: s = "invalid Exists"; break;
-			case 216: s = "invalid QSep"; break;
-			case 217: s = "invalid ImpliesExpliesExpression"; break;
-			case 218: s = "invalid LogicalExpression"; break;
-			case 219: s = "invalid RelOp"; break;
-			case 220: s = "invalid AddOp"; break;
-			case 221: s = "invalid UnaryExpression"; break;
-			case 222: s = "invalid MulOp"; break;
-			case 223: s = "invalid Suffix"; break;
+			case 206: s = "this symbol not expected in CaseStatement"; break;
+			case 207: s = "invalid CasePattern"; break;
+			case 208: s = "invalid CalcOp"; break;
+			case 209: s = "invalid EquivOp"; break;
+			case 210: s = "invalid ImpliesOp"; break;
+			case 211: s = "invalid ExpliesOp"; break;
+			case 212: s = "invalid AndOp"; break;
+			case 213: s = "invalid OrOp"; break;
+			case 214: s = "invalid NegOp"; break;
+			case 215: s = "invalid Forall"; break;
+			case 216: s = "invalid Exists"; break;
+			case 217: s = "invalid QSep"; break;
+			case 218: s = "invalid ImpliesExpliesExpression"; break;
+			case 219: s = "invalid LogicalExpression"; break;
+			case 220: s = "invalid RelOp"; break;
+			case 221: s = "invalid AddOp"; break;
+			case 222: s = "invalid UnaryExpression"; break;
+			case 223: s = "invalid MulOp"; break;
 			case 224: s = "invalid Suffix"; break;
 			case 225: s = "invalid Suffix"; break;
 			case 226: s = "invalid Suffix"; break;
-			case 227: s = "invalid LambdaExpression"; break;
-			case 228: s = "invalid EndlessExpression"; break;
-			case 229: s = "invalid NameSegment"; break;
-			case 230: s = "invalid DisplayExpr"; break;
-			case 231: s = "invalid MultiSetExpr"; break;
-			case 232: s = "invalid ConstAtomExpression"; break;
-			case 233: s = "invalid Nat"; break;
-			case 234: s = "invalid LambdaArrow"; break;
-			case 235: s = "invalid MatchExpression"; break;
-			case 236: s = "invalid QuantifierGuts"; break;
-			case 237: s = "invalid StmtInExpr"; break;
-			case 238: s = "invalid LetExpr"; break;
-			case 239: s = "invalid CaseExpression"; break;
-			case 240: s = "invalid DotSuffix"; break;
+			case 227: s = "invalid Suffix"; break;
+			case 228: s = "invalid LambdaExpression"; break;
+			case 229: s = "invalid EndlessExpression"; break;
+			case 230: s = "invalid NameSegment"; break;
+			case 231: s = "invalid DisplayExpr"; break;
+			case 232: s = "invalid MultiSetExpr"; break;
+			case 233: s = "invalid ConstAtomExpression"; break;
+			case 234: s = "invalid Nat"; break;
+			case 235: s = "invalid LambdaArrow"; break;
+			case 236: s = "invalid MatchExpression"; break;
+			case 237: s = "invalid QuantifierGuts"; break;
+			case 238: s = "invalid StmtInExpr"; break;
+			case 239: s = "invalid LetExpr"; break;
+			case 240: s = "invalid CaseExpression"; break;
+			case 241: s = "invalid DotSuffix"; break;
 
 			default: s = "error " + n; break;
 		}
diff --git a/Source/Dafny/RefinementTransformer.cs b/Source/Dafny/RefinementTransformer.cs
index 05146b7d..2d32f78a 100644
--- a/Source/Dafny/RefinementTransformer.cs
+++ b/Source/Dafny/RefinementTransformer.cs
@@ -86,6 +86,15 @@ namespace Microsoft.Dafny
         if (Resolver.ResolvePath(m.RefinementBaseRoot, m.RefinementBaseName, out RefinedSig, reporter)) {
           if (RefinedSig.ModuleDef != null) {
             m.RefinementBase = RefinedSig.ModuleDef;
+            if (m.IsExclusiveRefinement) {
+              if (null == m.RefinementBase.ExclusiveRefinement) {
+                m.RefinementBase.ExclusiveRefinement = m;
+              } else {
+                this.reporter.Error(
+                    m.tok,
+                    "no more than one exclusive refinement may exist for a given module.");
+              }
+            }
             PreResolveWorker(m);
           } else {
             reporter.Error(m.RefinementBaseName[0], "module ({0}) named as refinement base is not a literal module or simple reference to a literal module", Util.Comma(".", m.RefinementBaseName, x => x.val));
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 29e36ccd..2d274ffe 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -305,6 +305,33 @@ namespace Microsoft.Dafny
 
       systemNameInfo = RegisterTopLevelDecls(prog.BuiltIns.SystemModule, false);
       prog.CompileModules.Add(prog.BuiltIns.SystemModule);
+
+      // first, we need to detect which top-level modules have exclusive refinement relationships.
+      foreach (ModuleDecl decl in sortedDecls) {
+        if (decl is LiteralModuleDecl) {
+          var literalDecl = (LiteralModuleDecl)decl;
+          var m = literalDecl.ModuleDef;
+          if (m.RefinementBaseRoot != null) {
+            if (m.IsExclusiveRefinement) {
+              foreach (var d in sortedDecls) {
+                // refinement dependencies won't be later in the sorted module list than the one we're looking at.
+                if (Object.ReferenceEquals(d, decl)) {
+                  break;
+                }
+                if (d is LiteralModuleDecl) {
+                  var ld = (LiteralModuleDecl)d;
+                  // currently, only exclusive refinements of top-level modules are supported.
+                  if (string.Equals(m.RefinementBaseName[0].val, m.RefinementBaseRoot.Name, StringComparison.InvariantCulture)
+                      && string.Equals(m.RefinementBaseName[0].val, ld.ModuleDef.Name, StringComparison.InvariantCulture)) {
+                    ld.ModuleDef.ExclusiveRefinementCount += 1;
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+
       foreach (var decl in sortedDecls) {
         if (decl is LiteralModuleDecl) {
           // The declaration is a literal module, so it has members and such that we need
@@ -360,20 +387,27 @@ namespace Microsoft.Dafny
           var abs = (ModuleFacadeDecl)decl;
           ModuleSignature p;
           if (ResolvePath(abs.Root, abs.Path, out p, this)) {
-            abs.Signature = MakeAbstractSignature(p, abs.FullCompileName, abs.Height, prog.Modules);
             abs.OriginalSignature = p;
-            ModuleSignature compileSig;
-            if (abs.CompilePath != null) {
-              if (ResolvePath(abs.CompileRoot, abs.CompilePath, out compileSig, this)) {
-                if (refinementTransformer.CheckIsRefinement(compileSig, p)) {
-                  abs.Signature.CompileSignature = compileSig;
-                } else {
-                  Error(abs.CompilePath[0],
-                  "module " + Util.Comma(".", abs.CompilePath, x => x.val) + " must be a refinement of " + Util.Comma(".", abs.Path, x => x.val));
+            // ModuleDefinition.ExclusiveRefinement may not be set at this point but ExclusiveRefinementCount will be.
+            if (0 == abs.Root.Signature.ModuleDef.ExclusiveRefinementCount) {
+              abs.Signature = MakeAbstractSignature(p, abs.FullCompileName, abs.Height, prog.Modules);
+              ModuleSignature compileSig;
+              if (abs.CompilePath != null) {
+                if (ResolvePath(abs.CompileRoot, abs.CompilePath, out compileSig, this)) {
+                  if (refinementTransformer.CheckIsRefinement(compileSig, p)) {
+                    abs.Signature.CompileSignature = compileSig;
+                  } else {
+                    Error(
+                      abs.CompilePath[0],
+                      "module " + Util.Comma(".", abs.CompilePath, x => x.val) + " must be a refinement of "
+                      + Util.Comma(".", abs.Path, x => x.val));
+                  }
+                  abs.Signature.IsGhost = compileSig.IsGhost;
+                  // always keep the ghost information, to supress a spurious error message when the compile module isn't actually a refinement
                 }
-                abs.Signature.IsGhost = compileSig.IsGhost;
-                // always keep the ghost information, to supress a spurious error message when the compile module isn't actually a refinement
               }
+            } else {
+              abs.Signature = p;
             }
           } else {
             abs.Signature = new ModuleSignature(); // there was an error, give it a valid but empty signature
@@ -1198,7 +1232,8 @@ namespace Microsoft.Dafny
     }
 
     private ModuleSignature MakeAbstractSignature(ModuleSignature p, string Name, int Height, List<ModuleDefinition> mods) {
-      var mod = new ModuleDefinition(Token.NoToken, Name + ".Abs", true, true, null, null, null, false);
+      var mod = new ModuleDefinition(Token.NoToken, Name + ".Abs", true, true, /*isExclusiveRefinement:*/ false, null, null, null, false);
+      mod.ClonedFrom = p.ModuleDef;
       mod.Height = Height;
       foreach (var kv in p.TopLevels) {
         mod.TopLevelDecls.Add(CloneDeclaration(kv.Value, mod, mods, Name));
@@ -1207,6 +1242,7 @@ namespace Microsoft.Dafny
       sig.Refines = p.Refines;
       sig.CompileSignature = p;
       sig.IsGhost = p.IsGhost;
+      sig.ExclusiveRefinement = p.ExclusiveRefinement;
       mods.Add(mod);
       ResolveModuleDefinition(mod, sig);
       return sig;
@@ -4200,8 +4236,15 @@ namespace Microsoft.Dafny
           } else if (r.Type is Resolver_IdentifierExpr.ResolverType_Type) {
             var d = r.Decl;
             if (d is OpaqueTypeDecl) {
-              t.ResolvedParam = ((OpaqueTypeDecl)d).TheType;  // resolve like a type parameter, and it may have type parameters if it's an opaque type              
-              t.ResolvedClass = d;  // Store the decl, so the compiler will generate the fully qualified name
+              var dd = (OpaqueTypeDecl)d;
+              if (dd.Module.ClonedFrom != null && dd.Module.ClonedFrom.ExclusiveRefinement != null) {
+                t.ResolvedParam = ((OpaqueTypeDecl)dd.ClonedFrom).TheType;
+                t.ResolvedClass = d;  // Store the decl, so the compiler will generate the fully qualified name
+              } else {
+                t.ResolvedParam = ((OpaqueTypeDecl)d).TheType;
+                // resolve like a type parameter, and it may have type parameters if it's an opaque type
+                t.ResolvedClass = d;  // Store the decl, so the compiler will generate the fully qualified name
+              }
             } else if (d is NewtypeDecl) {
               var dd = (NewtypeDecl)d;
               var caller = context as ICallable;
diff --git a/Source/Dafny/Scanner.cs b/Source/Dafny/Scanner.cs
index d0d2e4dd..325a2f2c 100644
--- a/Source/Dafny/Scanner.cs
+++ b/Source/Dafny/Scanner.cs
@@ -211,13 +211,13 @@ public class UTF8Buffer: Buffer {
 public class Scanner {
 	const char EOL = '\n';
 	const int eofSym = 0; /* pdt */
-	const int maxT = 137;
-	const int noSym = 137;
+	const int maxT = 138;
+	const int noSym = 138;
 
 
 	[ContractInvariantMethod]
 	void objectInvariant(){
-		Contract.Invariant(buffer!=null);
+		Contract.Invariant(this._buffer != null);
 		Contract.Invariant(t != null);
 		Contract.Invariant(start != null);
 		Contract.Invariant(tokens != null);
@@ -227,7 +227,18 @@ public class Scanner {
 		Contract.Invariant(errorHandler != null);
 	}
 
-	public Buffer/*!*/ buffer; // scanner buffer
+	private Buffer/*!*/ _buffer; // scanner buffer
+
+	public Buffer/*!*/ buffer {
+		get {
+			Contract.Ensures(Contract.Result<Buffer>() != null);
+			return this._buffer;
+		}
+		set {
+			Contract.Requires(value != null);
+			this._buffer = value;
+		}
+	}
 
 	Token/*!*/ t;          // current token
 	int ch;           // current input character
@@ -299,7 +310,7 @@ public class Scanner {
 	}
 
 //	[NotDelayed]
-	public Scanner (string/*!*/ fileName, Errors/*!*/ errorHandler) : base() {
+	public Scanner (string/*!*/ fileName, Errors/*!*/ errorHandler, bool useBaseName = false) : base() {
 	  Contract.Requires(fileName != null);
 	  Contract.Requires(errorHandler != null);
 		this.errorHandler = errorHandler;
@@ -307,8 +318,8 @@ public class Scanner {
 		t = new Token(); // dummy because t is a non-null field
 		try {
 			Stream stream = new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read);
-			buffer = new Buffer(stream, false);
-			Filename = fileName;
+			this._buffer = new Buffer(stream, false);
+			Filename = useBaseName? GetBaseName(fileName): fileName;
 			Init();
 		} catch (IOException) {
 			throw new FatalError("Cannot open file " + fileName);
@@ -316,18 +327,22 @@ public class Scanner {
 	}
 
 //	[NotDelayed]
-	public Scanner (Stream/*!*/ s, Errors/*!*/ errorHandler, string/*!*/ fileName) : base() {
+	public Scanner (Stream/*!*/ s, Errors/*!*/ errorHandler, string/*!*/ fileName, bool useBaseName = false) : base() {
 	  Contract.Requires(s != null);
 	  Contract.Requires(errorHandler != null);
 	  Contract.Requires(fileName != null);
 		pt = tokens = new Token();  // first token is a dummy
 		t = new Token(); // dummy because t is a non-null field
-		buffer = new Buffer(s, true);
+		this._buffer = new Buffer(s, true);
 		this.errorHandler = errorHandler;
-		this.Filename = fileName;
+		this.Filename = useBaseName? GetBaseName(fileName) : fileName;
 		Init();
 	}
 
+    string GetBaseName(string fileName) {
+        return System.IO.Path.GetFileName(fileName); // Return basename
+    }
+
 	void Init() {
 		pos = -1; line = 1; col = 0;
 		oldEols = 0;
@@ -522,53 +537,54 @@ public class Scanner {
 			case "include": t.kind = 59; break;
 			case "abstract": t.kind = 60; break;
 			case "module": t.kind = 61; break;
-			case "refines": t.kind = 62; break;
-			case "import": t.kind = 63; break;
-			case "opened": t.kind = 64; break;
-			case "as": t.kind = 66; break;
-			case "default": t.kind = 67; break;
-			case "class": t.kind = 68; break;
-			case "extends": t.kind = 69; break;
-			case "trait": t.kind = 70; break;
-			case "ghost": t.kind = 71; break;
-			case "static": t.kind = 72; break;
-			case "protected": t.kind = 73; break;
-			case "datatype": t.kind = 74; break;
-			case "codatatype": t.kind = 75; break;
-			case "var": t.kind = 76; break;
-			case "newtype": t.kind = 77; break;
-			case "type": t.kind = 78; break;
-			case "iterator": t.kind = 79; break;
-			case "yields": t.kind = 80; break;
-			case "returns": t.kind = 81; break;
-			case "method": t.kind = 82; break;
-			case "colemma": t.kind = 83; break;
-			case "comethod": t.kind = 84; break;
-			case "constructor": t.kind = 85; break;
-			case "free": t.kind = 86; break;
-			case "ensures": t.kind = 87; break;
-			case "yield": t.kind = 88; break;
-			case "label": t.kind = 90; break;
-			case "break": t.kind = 91; break;
-			case "where": t.kind = 92; break;
-			case "return": t.kind = 94; break;
-			case "new": t.kind = 96; break;
-			case "if": t.kind = 97; break;
-			case "while": t.kind = 98; break;
-			case "match": t.kind = 99; break;
-			case "assert": t.kind = 100; break;
-			case "print": t.kind = 101; break;
-			case "forall": t.kind = 102; break;
-			case "parallel": t.kind = 103; break;
-			case "modify": t.kind = 104; break;
-			case "exists": t.kind = 123; break;
-			case "in": t.kind = 125; break;
-			case "false": t.kind = 130; break;
-			case "true": t.kind = 131; break;
-			case "null": t.kind = 132; break;
-			case "this": t.kind = 133; break;
-			case "fresh": t.kind = 134; break;
-			case "old": t.kind = 135; break;
+			case "exclusively": t.kind = 62; break;
+			case "refines": t.kind = 63; break;
+			case "import": t.kind = 64; break;
+			case "opened": t.kind = 65; break;
+			case "as": t.kind = 67; break;
+			case "default": t.kind = 68; break;
+			case "class": t.kind = 69; break;
+			case "extends": t.kind = 70; break;
+			case "trait": t.kind = 71; break;
+			case "ghost": t.kind = 72; break;
+			case "static": t.kind = 73; break;
+			case "protected": t.kind = 74; break;
+			case "datatype": t.kind = 75; break;
+			case "codatatype": t.kind = 76; break;
+			case "var": t.kind = 77; break;
+			case "newtype": t.kind = 78; break;
+			case "type": t.kind = 79; break;
+			case "iterator": t.kind = 80; break;
+			case "yields": t.kind = 81; break;
+			case "returns": t.kind = 82; break;
+			case "method": t.kind = 83; break;
+			case "colemma": t.kind = 84; break;
+			case "comethod": t.kind = 85; break;
+			case "constructor": t.kind = 86; break;
+			case "free": t.kind = 87; break;
+			case "ensures": t.kind = 88; break;
+			case "yield": t.kind = 89; break;
+			case "label": t.kind = 91; break;
+			case "break": t.kind = 92; break;
+			case "where": t.kind = 93; break;
+			case "return": t.kind = 95; break;
+			case "new": t.kind = 97; break;
+			case "if": t.kind = 98; break;
+			case "while": t.kind = 99; break;
+			case "match": t.kind = 100; break;
+			case "assert": t.kind = 101; break;
+			case "print": t.kind = 102; break;
+			case "forall": t.kind = 103; break;
+			case "parallel": t.kind = 104; break;
+			case "modify": t.kind = 105; break;
+			case "exists": t.kind = 124; break;
+			case "in": t.kind = 126; break;
+			case "false": t.kind = 131; break;
+			case "true": t.kind = 132; break;
+			case "null": t.kind = 133; break;
+			case "this": t.kind = 134; break;
+			case "fresh": t.kind = 135; break;
+			case "old": t.kind = 136; break;
 			default: break;
 		}
 	}
@@ -829,52 +845,52 @@ public class Scanner {
 				else if (ch >= '0' && ch <= '9') {AddCh(); goto case 65;}
 				else {t.kind = 5; break;}
 			case 66:
-				{t.kind = 89; break;}
+				{t.kind = 90; break;}
 			case 67:
-				{t.kind = 93; break;}
+				{t.kind = 94; break;}
 			case 68:
-				{t.kind = 95; break;}
+				{t.kind = 96; break;}
 			case 69:
-				{t.kind = 105; break;}
+				{t.kind = 106; break;}
 			case 70:
-				{t.kind = 107; break;}
-			case 71:
 				{t.kind = 108; break;}
-			case 72:
+			case 71:
 				{t.kind = 109; break;}
-			case 73:
+			case 72:
 				{t.kind = 110; break;}
-			case 74:
+			case 73:
 				{t.kind = 111; break;}
-			case 75:
+			case 74:
 				{t.kind = 112; break;}
-			case 76:
+			case 75:
 				{t.kind = 113; break;}
+			case 76:
+				{t.kind = 114; break;}
 			case 77:
-				{t.kind = 115; break;}
+				{t.kind = 116; break;}
 			case 78:
 				if (ch == '&') {AddCh(); goto case 79;}
 				else {goto case 0;}
 			case 79:
-				{t.kind = 116; break;}
-			case 80:
 				{t.kind = 117; break;}
-			case 81:
+			case 80:
 				{t.kind = 118; break;}
-			case 82:
+			case 81:
 				{t.kind = 119; break;}
+			case 82:
+				{t.kind = 120; break;}
 			case 83:
-				{t.kind = 121; break;}
-			case 84:
 				{t.kind = 122; break;}
+			case 84:
+				{t.kind = 123; break;}
 			case 85:
-				{t.kind = 124; break;}
+				{t.kind = 125; break;}
 			case 86:
-				{t.kind = 126; break;}
+				{t.kind = 127; break;}
 			case 87:
-				{t.kind = 128; break;}
-			case 88:
 				{t.kind = 129; break;}
+			case 88:
+				{t.kind = 130; break;}
 			case 89:
 				recEnd = pos; recKind = 21;
 				if (ch == ':') {AddCh(); goto case 30;}
@@ -890,14 +906,14 @@ public class Scanner {
 				if (ch == '.') {AddCh(); goto case 97;}
 				else {t.kind = 26; break;}
 			case 92:
-				recEnd = pos; recKind = 65;
+				recEnd = pos; recKind = 66;
 				if (ch == '>') {AddCh(); goto case 33;}
 				else if (ch == '=') {AddCh(); goto case 98;}
-				else {t.kind = 65; break;}
+				else {t.kind = 66; break;}
 			case 93:
-				recEnd = pos; recKind = 127;
+				recEnd = pos; recKind = 128;
 				if (ch == '>') {AddCh(); goto case 34;}
-				else {t.kind = 127; break;}
+				else {t.kind = 128; break;}
 			case 94:
 				recEnd = pos; recKind = 51;
 				if (ch == '=') {AddCh(); goto case 99;}
@@ -907,26 +923,26 @@ public class Scanner {
 				if (ch == '=') {AddCh(); goto case 70;}
 				else {t.kind = 52; break;}
 			case 96:
-				recEnd = pos; recKind = 120;
+				recEnd = pos; recKind = 121;
 				if (ch == '=') {AddCh(); goto case 41;}
 				else if (ch == 'i') {AddCh(); goto case 44;}
-				else {t.kind = 120; break;}
+				else {t.kind = 121; break;}
 			case 97:
-				recEnd = pos; recKind = 136;
+				recEnd = pos; recKind = 137;
 				if (ch == '.') {AddCh(); goto case 47;}
-				else {t.kind = 136; break;}
+				else {t.kind = 137; break;}
 			case 98:
 				recEnd = pos; recKind = 53;
 				if (ch == '>') {AddCh(); goto case 75;}
 				else {t.kind = 53; break;}
 			case 99:
-				recEnd = pos; recKind = 106;
+				recEnd = pos; recKind = 107;
 				if (ch == '=') {AddCh(); goto case 100;}
-				else {t.kind = 106; break;}
+				else {t.kind = 107; break;}
 			case 100:
-				recEnd = pos; recKind = 114;
+				recEnd = pos; recKind = 115;
 				if (ch == '>') {AddCh(); goto case 73;}
-				else {t.kind = 114; break;}
+				else {t.kind = 115; break;}
 
 		}
 		t.val = new String(tval, 0, tlen);
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index c834d23e..cefce6b6 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -6250,9 +6250,7 @@ namespace Microsoft.Dafny {
           } else {
             bool splitHappened;  // we actually don't care
             foreach (var s in TrSplitExpr(p.E, etran, kind == MethodTranslationKind.InterModuleCall ? 0 : int.MaxValue, true /* kind == MethodTranslationKind.Implementation */, out splitHappened)) {
-              if ((kind == MethodTranslationKind.IntraModuleCall || kind == MethodTranslationKind.CoCall) && RefinementToken.IsInherited(s.E.tok, currentModule)) {
-                // this precondition was inherited into this module, so just ignore it
-              } else if (s.IsOnlyChecked && bodyKind) {
+              if (s.IsOnlyChecked && bodyKind) {
                 // don't include in split
               } else if (s.IsOnlyFree && !bodyKind) {
                 // don't include in split -- it would be ignored, anyhow
-- 
cgit v1.2.3


From e10098cde7bac9a7a1576000fa29d15f1fcd8970 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Thu, 2 Jul 2015 16:06:02 -0700
Subject: Type parameters in method/function signatures are no longer
 auto-declared.  Although convenient and concise, the auto-declare behavior
 has on many occasions caused confusion when a type name has accidentally been
 mistyped (and Dafny had then accepted and auto-declared the name). Note, the
 behavior of filling in missing type parameters is still supported.  This
 mode, although unusual (even original?) in languages, is different from the
 auto- declare behavior.  For auto-declare, identifiers could be used in the
 program without having a declaration.  For fill-in parameters, the implicitly
 declared type parameters remain anonymous.

---
 Source/Dafny/Resolver.cs          |  6 ----
 Test/dafny0/Basics.dfy            |  2 +-
 Test/dafny0/Modules0.dfy          | 14 ++++-----
 Test/dafny0/Modules0.dfy.expect   | 19 +++---------
 Test/dafny0/NestedMatch.dfy       |  2 +-
 Test/dafny0/NestedPatterns.dfy    |  8 ++---
 Test/dafny0/ResolutionErrors.dfy  | 10 +++---
 Test/hofs/Examples.dfy            | 14 ++++-----
 Test/hofs/Fold.dfy                |  2 +-
 Test/hofs/Monads.dfy              | 34 ++++++++++----------
 Test/hofs/ReadsReads.dfy          | 52 +++++++++++++++----------------
 Test/hofs/ResolveError.dfy        | 34 ++++++++++----------
 Test/hofs/ResolveError.dfy.expect |  6 ++--
 Test/hofs/Simple.dfy              | 20 ++++++------
 Test/hofs/TreeMapSimple.dfy       | 24 +++++++--------
 Test/hofs/Twice.dfy               |  4 +--
 Test/hofs/VectorUpdate.dfy        | 65 +++++++++++++++++++++++++++++----------
 Test/hofs/VectorUpdate.dfy.expect |  2 +-
 18 files changed, 166 insertions(+), 152 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 29e36ccd..7c78c1e2 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -8469,12 +8469,6 @@ namespace Microsoft.Dafny
           r = ResolveExprDotCall(expr.tok, receiver, member, expr.OptTypeArguments, opts.codeContext, allowMethodCall);
         }
 #endif
-      } else if (option.Opt == ResolveTypeOptionEnum.AllowPrefixExtend && expr.OptTypeArguments == null) {
-        // it woulc plausibly be a type parameter, but isn't; we will declare it automatically
-        tp = new TypeParameter(expr.tok, expr.Name, defaultTypeArguments.Count, option.Parent);
-        defaultTypeArguments.Add(tp);
-        r = new Resolver_IdentifierExpr(expr.tok, tp);
-        allTypeParameters.Push(expr.Name, tp);
       } else {
         // ----- None of the above
         Error(expr.tok, "Undeclared top-level type or type parameter: {0} (did you forget to qualify a name?)", expr.Name);
diff --git a/Test/dafny0/Basics.dfy b/Test/dafny0/Basics.dfy
index c8fa76c8..89b0f02a 100644
--- a/Test/dafny0/Basics.dfy
+++ b/Test/dafny0/Basics.dfy
@@ -100,7 +100,7 @@ method ExpliesAssociativityM(A: bool, B: bool, C: bool) {
   }
 }
 
-method ExpliesShortCircuiting(a: array<T>)
+method ExpliesShortCircuiting(a: array)
 {
   assert a == null || 0 <= a.Length;  // (W)
   assert a != null ==> 0 <= a.Length;  // (X) -- same as (W)
diff --git a/Test/dafny0/Modules0.dfy b/Test/dafny0/Modules0.dfy
index 34aba3de..dbbffd87 100644
--- a/Test/dafny0/Modules0.dfy
+++ b/Test/dafny0/Modules0.dfy
@@ -71,16 +71,17 @@ module X1 {
 }
 
 module X2 {
+  import opened X1
   class MyClass2 {
-    method Down(x1: MyClass1, x0: MyClass0) {
+    method Down(x1: MyClass1, x0: X0'.MyClass0) {
       x1.Down(x0);
     }
-    method WayDown(x0: MyClass0) {
+    method WayDown(x0: X0'.MyClass0) {
       x0.Down();
     }
     method Up() {
     }
-    method Somewhere(y: MyClassY) {
+    method Somewhere(y: MyClassY) {  // error: no such type in scope
       y.M();
     }
   }
@@ -97,8 +98,7 @@ module YY {
 class ClassG {
   method T() { }
   function method TFunc(): int { 10 }
-  method V(y: MyClassY) {  // Note, MyClassY is in scope, since we are in the _default
-                           // module, which imports everything
+  method V(y: MyClassY) {
     y.M();
   }
 }
@@ -141,10 +141,10 @@ class AClassWithSomeField {
     SomeField := SomeField + 4;
     var a := old(SomeField);  // error: old can only be used in ghost contexts
     var b := fresh(this);  // error: fresh can only be used in ghost contexts
-    var c := allocated(this);  // error: allocated can only be used in ghost contexts
+//    var c := allocated(this);  // error: allocated can only be used in ghost contexts
     if (fresh(this)) {  // this guard makes the if statement a ghost statement
       ghost var x := old(SomeField);  // this is a ghost context, so it's okay
-      ghost var y := allocated(this);  // this is a ghost context, so it's okay
+//      ghost var y := allocated(this);  // this is a ghost context, so it's okay
     }
   }
 }
diff --git a/Test/dafny0/Modules0.dfy.expect b/Test/dafny0/Modules0.dfy.expect
index 5d11f9c9..d2f0bcc8 100644
--- a/Test/dafny0/Modules0.dfy.expect
+++ b/Test/dafny0/Modules0.dfy.expect
@@ -9,13 +9,8 @@ Modules0.dfy(15,11): Error: Duplicate name of top-level declaration: WazzupB
 Modules0.dfy(56,21): Error: Undeclared top-level type or type parameter: MyClass1 (did you forget to qualify a name?)
 Modules0.dfy(57,21): Error: Undeclared top-level type or type parameter: MyClass2 (did you forget to qualify a name?)
 Modules0.dfy(68,21): Error: Undeclared top-level type or type parameter: MyClass2 (did you forget to qualify a name?)
-Modules0.dfy(76,9): Error: type MyClass1 does not have a member Down
-Modules0.dfy(76,13): Error: expected method call, found expression
-Modules0.dfy(79,9): Error: type MyClass0 does not have a member Down
-Modules0.dfy(79,13): Error: expected method call, found expression
-Modules0.dfy(84,8): Error: type MyClassY does not have a member M
-Modules0.dfy(84,9): Error: expected method call, found expression
-Modules0.dfy(92,19): Error: Undeclared top-level type or type parameter: ClassG (did you forget to qualify a name?)
+Modules0.dfy(84,24): Error: Undeclared top-level type or type parameter: MyClassY (did you forget to qualify a name?)
+Modules0.dfy(93,19): Error: Undeclared top-level type or type parameter: ClassG (did you forget to qualify a name?)
 Modules0.dfy(226,15): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name?)
 Modules0.dfy(226,8): Error: new can be applied only to reference types (got X)
 Modules0.dfy(235,13): Error: module 'B' does not declare a type 'X'
@@ -35,11 +30,5 @@ Modules0.dfy(320,11): Error: Undeclared top-level type or type parameter: Wazzup
 Modules0.dfy(321,17): Error: module 'Q_Imp' does not declare a type 'Edon'
 Modules0.dfy(323,10): Error: new can be applied only to reference types (got Q_Imp.List<?>)
 Modules0.dfy(324,30): Error: member Create does not exist in class Klassy
-Modules0.dfy(102,6): Error: type MyClassY does not have a member M
-Modules0.dfy(102,7): Error: expected method call, found expression
-Modules0.dfy(127,11): Error: ghost variables are allowed only in specification contexts
-Modules0.dfy(142,13): Error: old expressions are allowed only in specification and ghost contexts
-Modules0.dfy(143,13): Error: fresh expressions are allowed only in specification and ghost contexts
-Modules0.dfy(144,13): Error: unresolved identifier: allocated
-Modules0.dfy(147,21): Error: unresolved identifier: allocated
-42 resolution/type errors detected in Modules0.dfy
+Modules0.dfy(101,14): Error: Undeclared top-level type or type parameter: MyClassY (did you forget to qualify a name?)
+31 resolution/type errors detected in Modules0.dfy
diff --git a/Test/dafny0/NestedMatch.dfy b/Test/dafny0/NestedMatch.dfy
index e6e7c489..81319b4a 100644
--- a/Test/dafny0/NestedMatch.dfy
+++ b/Test/dafny0/NestedMatch.dfy
@@ -28,7 +28,7 @@ function last<T>(xs: List<T>): T
   case Cons(y, Cons(z, zs)) => last(Cons(z, zs))
 }
 
-method checkLast(y: T) {
+method checkLast<T>(y: T) {
   assert last(Cons(y, Nil)) == y;
   assert last(Cons(y, Cons(y, Nil))) == last(Cons(y, Nil));
 }
diff --git a/Test/dafny0/NestedPatterns.dfy b/Test/dafny0/NestedPatterns.dfy
index ef597936..d1d88b2a 100644
--- a/Test/dafny0/NestedPatterns.dfy
+++ b/Test/dafny0/NestedPatterns.dfy
@@ -69,7 +69,7 @@ method MethodG<T>(xs: List<T>) returns (xxs: List<List<T>>)
   case Cons(h, Cons(ht, tt)) => 
 }
 
-method AssertionFailure(xs: List<T>)
+method AssertionFailure(xs: List)
 {
   match xs
   case (Nil) =>  // BUG: this line causes an assertion in the Dafny implementation (what should happen is that "(Nil)" should not be allowed here)
@@ -100,7 +100,7 @@ method DuplicateIdentifierInPattern2<T>(xs: List<T>)
   case Cons(h, Cons(e, e)) =>  // BUG:  here, the duplicate identifier is detected, but the error message is shown 3 times, which is less than ideal
 }
 
-method Tuples0(xs: List<T>, ys: List<T>)
+method Tuples0(xs: List, ys: List)
 {
   match (xs, ys)
   case (Nil, Nil) =>
@@ -110,14 +110,14 @@ method Tuples0(xs: List<T>, ys: List<T>)
                                     // only the identifiers in the last constructors are
 }
 
-method Tuples1(xs: List<T>, ys: List<T>)
+method Tuples1(xs: List, ys: List)
 {
   match (xs, ys, 4)
   case (Nil, Nil) =>  // BUG: the mismatch of 3 versus 2 arguments in the previous line and this line causes Dafny to crash with an
                       // assertion failure "mc.CasePatterns.Count == e.Arguments.Count"
 }
 
-method Tuples2(xs: List<T>, ys: List<T>)
+method Tuples2(xs: List, ys: List)
 {
   match (xs, ys, ())
   case (Nil, Nil, ()) =>  // BUG: Dafny crashes with an assertion failure "e.Arguments.Count >= 1"
diff --git a/Test/dafny0/ResolutionErrors.dfy b/Test/dafny0/ResolutionErrors.dfy
index 761cffa0..8c910959 100644
--- a/Test/dafny0/ResolutionErrors.dfy
+++ b/Test/dafny0/ResolutionErrors.dfy
@@ -1253,14 +1253,14 @@ module SignatureCompletion {
   datatype Dt = Ctor(X -> Dt)  // error: X is not a declared type
   datatype Et<Y> = Ctor(X -> Et, Y)  // error: X is not a declared type
 
-  // For methods and functions, signatures can auto-declare type parameters
-  method My0(s: set, x: A -> B)
-  method My1(x: A -> B, s: set)
+
+  method My0<A,B>(s: set, x: A -> B)
+  method My1<A,B>(x: A -> B, s: set)
   method My2<A,B>(s: set, x: A -> B)
   method My3<A,B>(x: A -> B, s: set)
 
-  function F0(s: set, x: A -> B): int
-  function F1(x: A -> B, s: set): int
+  function F0<A,B>(s: set, x: A -> B): int
+  function F1<A,B>(x: A -> B, s: set): int
   function F2<A,B>(s: set, x: A -> B): int
   function F3<A,B>(x: A -> B, s: set): int
 }
diff --git a/Test/hofs/Examples.dfy b/Test/hofs/Examples.dfy
index be2672f5..306d278d 100644
--- a/Test/hofs/Examples.dfy
+++ b/Test/hofs/Examples.dfy
@@ -1,14 +1,14 @@
 // RUN: %dafny /print:"%t.print" "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
-function Apply(f: A -> B, x: A): B
+function Apply<A,B>(f: A -> B, x: A): B
   reads f.reads(x);
   requires f.requires(x);
 {
   f(x)
 }
 
-function Apply'(f: A -> B) : A -> B
+function Apply'<A,B>(f: A -> B) : A -> B
 {
   x reads f.reads(x)
     requires f.requires(x)
@@ -16,7 +16,7 @@ function Apply'(f: A -> B) : A -> B
 }
 
 
-function Compose(f: B -> C, g:A -> B): A -> C
+function Compose<A,B,C>(f: B -> C, g:A -> B): A -> C
 {
   x reads g.reads(x)
     reads if g.requires(x) then f.reads(g(x)) else {}
@@ -25,21 +25,21 @@ function Compose(f: B -> C, g:A -> B): A -> C
     => f(g(x))
 }
 
-function W(f : (A,A) -> A): A -> A
+function W<A>(f : (A,A) -> A): A -> A
 {
   x requires f.requires(x,x)
     reads f.reads(x,x)
     => f(x,x)
 }
 
-function Curry(f : (A,B) -> C) : A -> B -> C
+function Curry<A,B,C>(f : (A,B) -> C) : A -> B -> C
 {
   x => y requires f.requires(x,y)
          reads f.reads(x,y)
          => f(x,y)
 }
 
-function Uncurry(f : A -> B -> C) : (A,B) -> C
+function Uncurry<A,B,C>(f : A -> B -> C) : (A,B) -> C
 {
   (x,y) requires f.requires(x)
         requires f(x).requires(y)
@@ -48,7 +48,7 @@ function Uncurry(f : A -> B -> C) : (A,B) -> C
         => f(x)(y)
 }
 
-function S(f : (A,B) -> C, g : A -> B): A -> C
+function S<A,B,C>(f : (A,B) -> C, g : A -> B): A -> C
 {
   x requires g.requires(x)
     requires f.requires(x,g(x))
diff --git a/Test/hofs/Fold.dfy b/Test/hofs/Fold.dfy
index 6ca2d3b1..9bcd9e02 100644
--- a/Test/hofs/Fold.dfy
+++ b/Test/hofs/Fold.dfy
@@ -13,7 +13,7 @@ function method Eval(e : Expr): int
     case Lit(i)  => i
 }
 
-function method Fold(xs : List<A>, unit : B, f : (A,B) -> B): B
+function method Fold<A,B>(xs : List<A>, unit : B, f : (A,B) -> B): B
   reads f.reads;
   requires forall x, y :: x < xs ==> f.requires(x,y);
 {
diff --git a/Test/hofs/Monads.dfy b/Test/hofs/Monads.dfy
index 3598d2b3..633dd339 100644
--- a/Test/hofs/Monads.dfy
+++ b/Test/hofs/Monads.dfy
@@ -4,29 +4,29 @@
 abstract module Monad {
   type M<A>
 
-  function method Return(x: A): M<A>
-  function method Bind(m: M<A>, f:A -> M<B>):M<B>
-    reads f.reads;
-    requires forall a :: f.requires(a);
+  function method Return<A>(x: A): M<A>
+  function method Bind<A,B>(m: M<A>, f:A -> M<B>):M<B>
+    reads f.reads
+    requires forall a :: f.requires(a)
 
   // return x >>= f = f x
-  lemma LeftIdentity(x : A, f : A -> M<B>)
-    requires forall a :: f.requires(a);
-    ensures Bind(Return(x),f) == f(x);
+  lemma LeftIdentity<A,B>(x : A, f : A -> M<B>)
+    requires forall a :: f.requires(a)
+    ensures Bind(Return(x),f) == f(x)
 
   // m >>= return = m
-  lemma RightIdentity(m : M<A>)
-    ensures Bind(m,Return) == m;
+  lemma RightIdentity<A>(m : M<A>)
+    ensures Bind(m,Return) == m
 
   // (m >>= f) >>= g = m >>= (x => f(x) >>= g)
-  lemma Associativity(m : M<A>, f:A -> M<B>, g: B -> M<C>)
-    requires forall a :: f.requires(a);
-    requires forall b :: g.requires(b);
+  lemma Associativity<A,B,C>(m : M<A>, f:A -> M<B>, g: B -> M<C>)
+    requires forall a :: f.requires(a)
+    requires forall b :: g.requires(b)
 	ensures Bind(Bind(m,f),g) ==
 	        Bind(m,x reads f.reads(x)
 	                 reads g.reads
 					 requires f.requires(x)
-					 requires forall b :: g.requires(b) => Bind(f(x),g));
+					 requires forall b :: g.requires(b) => Bind(f(x),g))
 }
 
 module Identity refines Monad {
@@ -101,21 +101,21 @@ module List refines Monad {
   function method Return<A>(x: A): M<A>
   { Cons(x,Nil) }
 
-  function method Concat(xs: M<A>, ys: M<A>): M<A>
+  function method Concat<A>(xs: M<A>, ys: M<A>): M<A>
   {
     match xs
 	  case Nil => ys
 	  case Cons(x,xs) => Cons(x,Concat(xs,ys))
   }
 
-  function method Join(xss: M<M<A>>) : M<A>
+  function method Join<A>(xss: M<M<A>>) : M<A>
   {
     match xss
 	  case Nil => Nil
 	  case Cons(xs,xss) => Concat(xs,Join(xss))
   }
 
-  function method Map(xs: M<A>, f: A -> B):M<B>
+  function method Map<A,B>(xs: M<A>, f: A -> B):M<B>
     reads f.reads;
 	requires forall a :: f.requires(a);
   {
@@ -170,7 +170,7 @@ module List refines Monad {
     ensures Concat(Concat(xs,ys),zs) == Concat(xs,Concat(ys,zs));
   {}
 
-  lemma BindMorphism(xs : M<A>, ys: M<A>, f : A -> M<B>)
+  lemma BindMorphism<A,B>(xs : M<A>, ys: M<A>, f : A -> M<B>)
     requires forall a :: f.requires(a);
 	ensures Bind(Concat(xs,ys),f) == Concat(Bind(xs,f),Bind(ys,f));
   {
diff --git a/Test/hofs/ReadsReads.dfy b/Test/hofs/ReadsReads.dfy
index e11473bd..a6f8d922 100644
--- a/Test/hofs/ReadsReads.dfy
+++ b/Test/hofs/ReadsReads.dfy
@@ -2,58 +2,58 @@
 // RUN: %diff "%s.expect" "%t"
 
 module ReadsRequiresReads {
-  function MyReadsOk(f : A -> B, a : A) : set<object>
-    reads f.reads(a);
+  function MyReadsOk<A,B>(f : A -> B, a : A) : set<object>
+    reads f.reads(a)
   {
     f.reads(a)
   }
 
-  function MyReadsOk2(f : A -> B, a : A) : set<object>
-    reads f.reads(a);
+  function MyReadsOk2<A,B>(f : A -> B, a : A) : set<object>
+    reads f.reads(a)
   {
     (f.reads)(a)
   }
 
-  function MyReadsOk3(f : A -> B, a : A) : set<object>
-    reads (f.reads)(a);
+  function MyReadsOk3<A,B>(f : A -> B, a : A) : set<object>
+    reads (f.reads)(a)
   {
     f.reads(a)
   }
 
-  function MyReadsOk4(f : A -> B, a : A) : set<object>
-    reads (f.reads)(a);
+  function MyReadsOk4<A,B>(f : A -> B, a : A) : set<object>
+    reads (f.reads)(a)
   {
     (f.reads)(a)
   }
 
-  function MyReadsBad(f : A -> B, a : A) : set<object>
+  function MyReadsBad<A,B>(f : A -> B, a : A) : set<object>
   {
     f.reads(a)  // error: MyReadsBad does not have permission to read what f.reads(a) reads
   }
 
-  function MyReadsBad2(f : A -> B, a : A) : set<object>
+  function MyReadsBad2<A,B>(f : A -> B, a : A) : set<object>
   {
     (f.reads)(a)  // error: MyReadsBad2 does not have permission to read what f.reads(a) reads
   }
 
-  function MyReadsOk'(f : A -> B, a : A, o : object) : bool
-    reads f.reads(a);
+  function MyReadsOk'<A,B>(f : A -> B, a : A, o : object) : bool
+    reads f.reads(a)
   {
     o in f.reads(a)
   }
 
-  function MyReadsBad'(f : A -> B, a : A, o : object) : bool
+  function MyReadsBad'<A,B>(f : A -> B, a : A, o : object) : bool
   {
     o in f.reads(a)  // error: MyReadsBad' does not have permission to read what f.reads(a) reads
   }
 
-  function MyRequiresOk(f : A -> B, a : A) : bool
-    reads f.reads(a);
+  function MyRequiresOk<A,B>(f : A -> B, a : A) : bool
+    reads f.reads(a)
   {
     f.requires(a)
   }
 
-  function MyRequiresBad(f : A -> B, a : A) : bool
+  function MyRequiresBad<A,B>(f : A -> B, a : A) : bool
   {
     f.requires(a)  // error: MyRequiresBad does not have permission to read what f.requires(a) reads
   }
@@ -72,11 +72,11 @@ module WhatWeKnowAboutReads {
   }
 
   class S {
-    var s : S;
+    var s : S
   }
 
   function ReadsSomething(s : S):()
-    reads s;
+    reads s
   {()}
 
   method MaybeSomething() {
@@ -105,29 +105,29 @@ module WhatWeKnowAboutReads {
 
 module ReadsAll {
   function A(f: int -> int) : int
-    reads set o,x | o in f.reads(x) :: o;
-    requires forall x :: f.requires(x);
+    reads set o,x | o in f.reads(x) :: o
+    requires forall x :: f.requires(x)
   {
     f(0) + f(1) + f(2)
   }
 
   function method B(f: int -> int) : int
-    reads set o,x | o in f.reads(x) :: o;
-    requires forall x :: f.requires(x);
+    reads set o,x | o in f.reads(x) :: o
+    requires forall x :: f.requires(x)
   {
     f(0) + f(1) + f(2)
   }
 
   function C(f: int -> int) : int
-    reads f.reads;
-    requires forall x :: f.requires(x);
+    reads f.reads
+    requires forall x :: f.requires(x)
   {
     f(0) + f(1) + f(2)
   }
 
   function method D(f: int -> int) : int
-    reads f.reads;
-    requires forall x :: f.requires(x);
+    reads f.reads
+    requires forall x :: f.requires(x)
   {
     f(0) + f(1) + f(2)
   }
diff --git a/Test/hofs/ResolveError.dfy b/Test/hofs/ResolveError.dfy
index 3c0d7cd9..ae838eb3 100644
--- a/Test/hofs/ResolveError.dfy
+++ b/Test/hofs/ResolveError.dfy
@@ -3,9 +3,9 @@
 
 
 method ResolutionErrors() {
-    var x;
-    var g5 := x, y => (y, x);   // fail at resolution
-    var g6 := x, (y => (y, x)); // fail at resolution
+  var x;
+  var g5 := x, y => (y, x);   // fail at resolution
+  var g6 := x, (y => (y, x)); // fail at resolution
 }
 
 // cannot assign functions
@@ -23,20 +23,20 @@ method Nope3() {
 
 method RequiresFail(f : int -> int)
   // ok
-  requires f(0) == 0;
-  requires f.requires(0);
-  requires f.reads(0) == {};
+  requires f(0) == 0
+  requires f.requires(0)
+  requires f.reads(0) == {}
 
   // fail
-  requires f(0) == true;
-  requires f(1,2) == 0;
-  requires f(true) == 0;
-  requires f.requires(true);
-  requires f.requires(1) == 0;
-  requires f.requires(1,2);
-  requires f.reads(true) == {};
-  requires f.reads(1) == 0;
-  requires f.reads(1,2) == {};
+  requires f(0) == true
+  requires f(1,2) == 0
+  requires f(true) == 0
+  requires f.requires(true)
+  requires f.requires(1) == 0
+  requires f.requires(1,2)
+  requires f.reads(true) == {}
+  requires f.reads(1) == 0
+  requires f.reads(1,2) == {}
 {
 }
 
@@ -56,7 +56,7 @@ method Bla() {
   assert Bool;
 }
 
-method Pli(f : A -> B) requires f != null;
+method Pli<A,B>(f : A -> B) requires f != null
 {
   var o : object;
   assert f != o;
@@ -102,7 +102,7 @@ module AritySituations {
     w := V;  // error
   }
 
-  method P(r: T -> U, x: T) returns (u: U)
+  method P<T,U>(r: T -> U, x: T) returns (u: U)
     requires r.requires(x);
   {
     u := r(x);
diff --git a/Test/hofs/ResolveError.dfy.expect b/Test/hofs/ResolveError.dfy.expect
index c3e0c242..11471ffd 100644
--- a/Test/hofs/ResolveError.dfy.expect
+++ b/Test/hofs/ResolveError.dfy.expect
@@ -2,8 +2,8 @@ ResolveError.dfy(86,6): Error: RHS (of type ((int,bool)) -> real) not assignable
 ResolveError.dfy(91,15): Error: incorrect type of method in-parameter 0 (expected ? -> ?, got (int,bool) -> real)
 ResolveError.dfy(101,6): Error: RHS (of type (()) -> real) not assignable to LHS (of type () -> real)
 ResolveError.dfy(102,6): Error: RHS (of type () -> real) not assignable to LHS (of type (()) -> real)
-ResolveError.dfy(7,11): Error: the number of left-hand sides (1) and right-hand sides (2) must match for a multi-assignment
-ResolveError.dfy(8,11): Error: the number of left-hand sides (1) and right-hand sides (2) must match for a multi-assignment
+ResolveError.dfy(7,9): Error: the number of left-hand sides (1) and right-hand sides (2) must match for a multi-assignment
+ResolveError.dfy(8,9): Error: the number of left-hand sides (1) and right-hand sides (2) must match for a multi-assignment
 ResolveError.dfy(21,6): Error: LHS of assignment must denote a mutable field
 ResolveError.dfy(31,16): Error: arguments must have the same type (got int and bool)
 ResolveError.dfy(32,12): Error: wrong number of arguments to function application (function type 'int -> int' expects 1, got 2)
@@ -17,7 +17,7 @@ ResolveError.dfy(39,18): Error: wrong number of arguments to function applicatio
 ResolveError.dfy(46,15): Error: a reads-clause expression must denote an object or a collection of objects (instead got int)
 ResolveError.dfy(47,7): Error: Precondition must be boolean (got int)
 ResolveError.dfy(56,9): Error: condition is expected to be of type bool, but is () -> bool
-ResolveError.dfy(59,34): Error: arguments must have the same type (got A -> B and ?)
+ResolveError.dfy(59,39): Error: arguments must have the same type (got A -> B and ?)
 ResolveError.dfy(62,11): Error: arguments must have the same type (got A -> B and object)
 ResolveError.dfy(68,24): Error: unresolved identifier: _
 22 resolution/type errors detected in ResolveError.dfy
diff --git a/Test/hofs/Simple.dfy b/Test/hofs/Simple.dfy
index c27fa82c..6d98531e 100644
--- a/Test/hofs/Simple.dfy
+++ b/Test/hofs/Simple.dfy
@@ -50,7 +50,7 @@ method Main() {
 }
 
 function method succ(x : int) : int
-  requires x > 0;
+  requires x > 0
 {
   x + 1
 }
@@ -74,24 +74,24 @@ method Main3() {
 }
 
 
-function P(f: A -> B, x : A): B
-  reads (f.reads)(x);
-  requires (f.requires)(x);
+function P<A,B>(f: A -> B, x : A): B
+  reads (f.reads)(x)
+  requires (f.requires)(x)
 {
   f(x)
 }
 
 
-function Q(f: U -> V, x : U): V
-  reads P.reads(f,x);
-  requires f.requires(x);  // would be nice to be able to write P.requires(f,x)
+function Q<U,V>(f: U -> V, x : U): V
+  reads P.reads(f,x)
+  requires f.requires(x)  // would be nice to be able to write P.requires(f,x)
 {
   P(f,x)
 }
 
-function QQ(f: U -> V, x : U): V
-  reads ((() => ((()=>f)()).reads)())((()=>x)());
-  requires ((() => ((()=>f)()).requires)())((()=>x)());
+function QQ<U,V>(f: U -> V, x : U): V
+  reads ((() => ((()=>f)()).reads)())((()=>x)())
+  requires ((() => ((()=>f)()).requires)())((()=>x)())
 {
   ((() => P)())((()=>f)(),(()=>x)())
 }
diff --git a/Test/hofs/TreeMapSimple.dfy b/Test/hofs/TreeMapSimple.dfy
index a853b82c..6b8f1377 100644
--- a/Test/hofs/TreeMapSimple.dfy
+++ b/Test/hofs/TreeMapSimple.dfy
@@ -6,7 +6,7 @@ datatype List<A> = Nil | Cons(head: A,tail: List<A>)
 datatype Tree<A> = Branch(val: A,trees: List<Tree<A>>)
 
 function ListData(xs : List) : set
-  ensures forall x :: x in ListData(xs) ==> x < xs;
+  ensures forall x :: x in ListData(xs) ==> x < xs
 {
   match xs
     case Nil => {}
@@ -14,32 +14,32 @@ function ListData(xs : List) : set
 }
 
 function TreeData(t0 : Tree) : set
-  ensures forall t :: t in TreeData(t0) ==> t < t0;
+  ensures forall t :: t in TreeData(t0) ==> t < t0
 {
   var Branch(x,ts) := t0;
   {x} + set t, y | t in ListData(ts) && y in TreeData(t) :: y
 }
 
-function Pre(f : A -> B, s : set<A>) : bool
-  reads (set x, y | x in s && y in f.reads(x) :: y);
+function Pre<A,B>(f : A -> B, s : set<A>) : bool
+  reads (set x, y | x in s && y in f.reads(x) :: y)
 {
   forall x :: x in s ==> f.reads(x) == {} && f.requires(x)
 }
 
-function method Map(xs : List<A>, f : A -> B): List<B>
-  reads Pre.reads(f, ListData(xs));
-  requires Pre(f, ListData(xs));
-  decreases xs;
+function method Map<A,B>(xs : List<A>, f : A -> B): List<B>
+  reads Pre.reads(f, ListData(xs))
+  requires Pre(f, ListData(xs))
+  decreases xs
 {
   match xs
     case Nil => Nil
     case Cons(x,xs) => Cons(f(x),Map(xs,f))
 }
 
-function method TMap(t0 : Tree<A>, f : A -> B) : Tree<B>
-  reads Pre.reads(f, TreeData(t0));
-  requires Pre(f, TreeData(t0));
-  decreases t0;
+function method TMap<A,B>(t0 : Tree<A>, f : A -> B) : Tree<B>
+  reads Pre.reads(f, TreeData(t0))
+  requires Pre(f, TreeData(t0))
+  decreases t0
 {
   var Branch(x,ts) := t0;
   Branch(f(x),Map(ts, t  requires t in ListData(ts)
diff --git a/Test/hofs/Twice.dfy b/Test/hofs/Twice.dfy
index add7e83c..5d948a58 100644
--- a/Test/hofs/Twice.dfy
+++ b/Test/hofs/Twice.dfy
@@ -1,7 +1,7 @@
 // RUN: %dafny /print:"%t.print" "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
-function method Twice(f : A -> A): A -> A
+function method Twice<A>(f : A -> A): A -> A
 {
   x requires f.requires(x) && f.requires(f(x))
     reads f.reads(x) reads if f.requires(x) then f.reads(f(x)) else {}
@@ -29,7 +29,7 @@ method WithReads() {
 }
 
 
-function method Twice_bad(f : A -> A): A -> A
+function method Twice_bad<A>(f : A -> A): A -> A
 {
   x requires f.requires(x) && f.requires(f(x))
     reads f.reads(x) + f.reads(f(x))
diff --git a/Test/hofs/VectorUpdate.dfy b/Test/hofs/VectorUpdate.dfy
index 96edbe77..ca6b20b3 100644
--- a/Test/hofs/VectorUpdate.dfy
+++ b/Test/hofs/VectorUpdate.dfy
@@ -1,28 +1,59 @@
 // RUN: %dafny /compile:3 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
-method VectorUpdate(N: int, a : array<A>, f : (int,A) -> A)
-  requires a != null;
-  requires N == a.Length;
-  requires forall j :: 0 <= j < N ==> f.requires(j,a[j]);
-  requires forall j :: 0 <= j < N ==> a !in f.reads(j,a[j]);
-  modifies a;
-  ensures forall j :: 0 <= j < N ==> a[j] == f(j,old(a[j]));
+// this is a rather verbose version of the VectorUpdate method
+method VectorUpdate<A>(N: int, a : array<A>, f : (int,A) -> A)
+  requires a != null
+  requires N == a.Length
+  requires forall j :: 0 <= j < N ==> f.requires(j,a[j])
+  requires forall j :: 0 <= j < N ==> a !in f.reads(j,a[j])
+  modifies a
+  ensures forall j :: 0 <= j < N ==> a[j] == f(j,old(a[j]))
 {
   var i := 0;
-  while (i < N)
-    invariant 0 <= i <= N;
-    invariant forall j :: i <= j < N ==> f.requires(j,a[j]);
-    invariant forall j :: 0 <= j < N ==> f.requires(j,old(a[j]));
-    invariant forall j :: i <= j < N ==> a !in f.reads(j,a[j]);
-    invariant forall j :: i <= j < N ==> a[j] == old(a[j]);
-    invariant forall j :: 0 <= j < i ==> a[j] == f(j,old(a[j]));
+  while i < N
+    invariant 0 <= i <= N
+    invariant forall j :: i <= j < N ==> f.requires(j,a[j])
+    invariant forall j :: 0 <= j < N ==> f.requires(j,old(a[j]))
+    invariant forall j :: i <= j < N ==> a !in f.reads(j,a[j])
+    invariant forall j :: i <= j < N ==> a[j] == old(a[j])
+    invariant forall j :: 0 <= j < i ==> a[j] == f(j,old(a[j]))
   {
     a[i] := f(i,a[i]);
     i := i + 1;
   }
 }
 
+// here's a shorter version of the method above
+method VectorUpdate'<A>(a : array<A>, f : (int,A) -> A)
+  requires a != null
+  requires forall j :: 0 <= j < a.Length ==> a !in f.reads(j,a[j]) && f.requires(j,a[j])
+  modifies a
+  ensures forall j :: 0 <= j < a.Length ==> a[j] == f(j,old(a[j]))
+{
+  var i := 0;
+  while i < a.Length
+    invariant 0 <= i <= a.Length
+    invariant forall j :: i <= j < a.Length ==> a[j] == old(a[j])
+    invariant forall j :: 0 <= j < i ==> a[j] == f(j,old(a[j]))
+  {
+    a[i] := f(i,a[i]);
+    i := i + 1;
+  }
+}
+
+// here's yet another version
+method VectorUpdate''<A>(a : array<A>, f : (int,A) -> A)
+  requires a != null
+  requires forall j :: 0 <= j < a.Length ==> a !in f.reads(j,a[j]) && f.requires(j,a[j])
+  modifies a
+  ensures forall j :: 0 <= j < a.Length ==> a[j] == f(j,old(a[j]))
+{
+  forall i | 0 <= i < a.Length {
+    a[i] := f(i,a[i]);
+  }
+}
+
 method Main() 
 {
   var v := new int[10];
@@ -46,11 +77,11 @@ method Main()
 }
 
 method PrintArray(a : array<int>)
-  requires a != null;
+  requires a != null
 {
   var i := 0;
-  while (i < a.Length) {
-    if (i != 0) {
+  while i < a.Length {
+    if i != 0 {
 	  print ", ";
 	}
     print a[i];
diff --git a/Test/hofs/VectorUpdate.dfy.expect b/Test/hofs/VectorUpdate.dfy.expect
index b01ace00..18a7b110 100644
--- a/Test/hofs/VectorUpdate.dfy.expect
+++ b/Test/hofs/VectorUpdate.dfy.expect
@@ -1,5 +1,5 @@
 
-Dafny program verifier finished with 6 verified, 0 errors
+Dafny program verifier finished with 10 verified, 0 errors
 Program compiled successfully
 Running...
 
-- 
cgit v1.2.3


From 4d11b8d19bab3c4b37914f12226e19ac6d68ffb1 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Thu, 2 Jul 2015 20:00:11 -0700
Subject: Added command-line option /warnShadowing, which emits warnings if
 variables shadow other variables (Issue #86)

---
 Source/Dafny/DafnyOptions.cs   |   7 +++
 Source/Dafny/Resolver.cs       | 109 ++++++++++++++++++++++++-----------------
 Test/dafny0/Shadows.dfy        |  42 ++++++++++++++++
 Test/dafny0/Shadows.dfy.expect |  12 +++++
 4 files changed, 124 insertions(+), 46 deletions(-)
 create mode 100644 Test/dafny0/Shadows.dfy
 create mode 100644 Test/dafny0/Shadows.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index af940439..a3b26f2a 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -58,6 +58,7 @@ namespace Microsoft.Dafny
     public bool Optimize = false;
     public bool PrintStats = false;
     public bool PrintFunctionCallGraph = false;
+    public bool WarnShadowing = false;
 
     protected override bool ParseOption(string name, Bpl.CommandLineOptionEngine.CommandLineParseState ps) {
       var args = ps.args;  // convenient synonym
@@ -183,6 +184,10 @@ namespace Microsoft.Dafny
           PrintFunctionCallGraph = true;
           return true;
 
+        case "warnShadowing":
+          WarnShadowing = true;
+          return true;
+
         case "countVerificationErrors": {
           int countErrors = 1; // defaults to reporting verification errors
           if (ps.GetNumericArgument(ref countErrors, 2)) {
@@ -294,6 +299,8 @@ namespace Microsoft.Dafny
                   - passes /optimize flag to csc.exe.
   /stats        Print interesting statistics about the Dafny files supplied.
   /funcCallGraph Print out the function call graph.  Format is: func,mod=callee*
+  /warnShadowing  Emits a warning if the name of a declared variable caused another variable
+                to be shadowed
 ");
       base.Usage();  // also print the Boogie options
     }
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 7c78c1e2..91570a1e 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -1374,7 +1374,7 @@ namespace Microsoft.Dafny
             Contract.Assert(dd.Constraint != null);  // follows from NewtypeDecl invariant
             scope.PushMarker();
             var added = scope.Push(dd.Var.Name, dd.Var);
-            Contract.Assert(added);
+            Contract.Assert(added == Scope<IVariable>.PushResult.Success);
             ResolveType(dd.Var.tok, dd.Var.Type, dd, ResolveTypeOptionEnum.DontInfer, null);
             ResolveExpression(dd.Constraint, new ResolveOpts(dd, false, true));
             Contract.Assert(dd.Constraint.Type != null);  // follows from postcondition of ResolveExpression
@@ -3533,12 +3533,43 @@ namespace Microsoft.Dafny
           tp.Parent = parent;
           tp.PositionalIndex = index;
         }
-        if (!allTypeParameters.Push(tp.Name, tp) && emitErrors) {
-          Error(tp, "Duplicate type-parameter name: {0}", tp.Name);
+        var r = allTypeParameters.Push(tp.Name, tp);
+        if (emitErrors) {
+          if (r == Scope<TypeParameter>.PushResult.Duplicate) {
+            Error(tp, "Duplicate type-parameter name: {0}", tp.Name);
+          } else if (r == Scope<TypeParameter>.PushResult.Shadow) {
+            Warning(tp.tok, "Shadowed type-parameter name: {0}", tp.Name);
+          }
         }
       }
     }
 
+    void ScopePushAndReport(Scope<IVariable> scope, IVariable v, string kind) {
+      Contract.Requires(scope != null);
+      Contract.Requires(v != null);
+      Contract.Requires(kind != null);
+      ScopePushAndReport(scope, v.Name, v, v.Tok, kind);
+    }
+
+    void ScopePushAndReport<Thing>(Scope<Thing> scope, string name, Thing thing, IToken tok, string kind) where Thing : class {
+      Contract.Requires(scope != null);
+      Contract.Requires(name != null);
+      Contract.Requires(thing != null);
+      Contract.Requires(tok != null);
+      Contract.Requires(kind != null);
+      var r = scope.Push(name, thing);
+      switch (r) {
+        case Scope<Thing>.PushResult.Success:
+          break;
+        case Scope<Thing>.PushResult.Duplicate:
+          Error(tok, "Duplicate {0} name: {1}", kind, name);
+          break;
+        case Scope<Thing>.PushResult.Shadow:
+          Warning(tok, "Shadowed {0} name: {1}", kind, name);
+          break;
+      }
+    }
+
     /// <summary>
     /// Assumes type parameters have already been pushed
     /// </summary>
@@ -3550,9 +3581,7 @@ namespace Microsoft.Dafny
       }
       var option = f.TypeArgs.Count == 0 ? new ResolveTypeOption(f) : new ResolveTypeOption(ResolveTypeOptionEnum.AllowPrefix);
       foreach (Formal p in f.Formals) {
-        if (!scope.Push(p.Name, p)) {
-          Error(p, "Duplicate parameter name: {0}", p.Name);
-        }
+        ScopePushAndReport(scope, p, "parameter");
         ResolveType(p.tok, p.Type, f, option, f.TypeArgs);
       }
       ResolveType(f.tok, f.ResultType, f, option, f.TypeArgs);
@@ -3660,16 +3689,12 @@ namespace Microsoft.Dafny
       var option = m.TypeArgs.Count == 0 ? new ResolveTypeOption(m) : new ResolveTypeOption(ResolveTypeOptionEnum.AllowPrefix);
       // resolve in-parameters
       foreach (Formal p in m.Ins) {
-        if (!scope.Push(p.Name, p)) {
-          Error(p, "Duplicate parameter name: {0}", p.Name);
-        }
+        ScopePushAndReport(scope, p, "parameter");
         ResolveType(p.tok, p.Type, m, option, m.TypeArgs);
       }
       // resolve out-parameters
       foreach (Formal p in m.Outs) {
-        if (!scope.Push(p.Name, p)) {
-          Error(p, "Duplicate parameter name: {0}", p.Name);
-        }
+        ScopePushAndReport(scope, p, "parameter");
         ResolveType(p.tok, p.Type, m, option, m.TypeArgs);
       }
       scope.PopMarker();
@@ -4828,9 +4853,7 @@ namespace Microsoft.Dafny
         }
         // Add the locals to the scope
         foreach (var local in s.Locals) {
-          if (!scope.Push(local.Name, local)) {
-            Error(local.Tok, "Duplicate local-variable name: {0}", local.Name);
-          }
+          ScopePushAndReport(scope, local, "local-variable");
         }
         // With the new locals in scope, it's now time to resolve the attributes on all the locals
         foreach (var local in s.Locals) {
@@ -5121,9 +5144,7 @@ namespace Microsoft.Dafny
         int prevErrorCount = ErrorCount;
         scope.PushMarker();
         foreach (BoundVar v in s.BoundVars) {
-          if (!scope.Push(v.Name, v)) {
-            Error(v, "Duplicate bound-variable name: {0}", v.Name);
-          }
+          ScopePushAndReport(scope, v, "local-variable");
           ResolveType(v.tok, v.Type, codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
         }
         ResolveExpression(s.Range, new ResolveOpts(codeContext, true, specContextOnly));
@@ -5586,9 +5607,7 @@ namespace Microsoft.Dafny
       if (pat.Var != null) {
         BoundVar v = pat.Var;
         if (topLevel) {
-          if (!scope.Push(v.Name, v)) {
-            Error(v, "Duplicate parameter name: {0}", v.Name);
-          }
+          ScopePushAndReport(scope, v, "parameter");
         } else {
           if (scope.Find(v.Name) != null) {
             Error(v, "Duplicate parameter name: {0}", v.Name);
@@ -6202,8 +6221,8 @@ namespace Microsoft.Dafny
           } else if (prev != null) {
             Error(lnode.Tok, "label shadows an enclosing label");
           } else {
-            bool b = labeledStatements.Push(lnode.Name, ss);
-            Contract.Assert(b);  // since we just checked for duplicates, we expect the Push to succeed
+            var r = labeledStatements.Push(lnode.Name, ss);
+            Contract.Assert(r == Scope<Statement>.PushResult.Success);  // since we just checked for duplicates, we expect the Push to succeed
             if (l == ss.Labels) {  // add it only once
               inSpecOnlyContext.Add(ss, specContextOnly);
             }
@@ -7541,9 +7560,7 @@ namespace Microsoft.Dafny
             // Check for duplicate names now, because not until after resolving the case pattern do we know if identifiers inside it refer to bound variables or nullary constructors
             var c = 0;
             foreach (var v in lhs.Vars) {
-              if (!scope.Push(v.Name, v)) {
-                Error(v, "Duplicate let-variable name: {0}", v.Name);
-              }
+              ScopePushAndReport(scope, v, "let-variable");
               c++;
             }
             if (c == 0) {
@@ -7562,9 +7579,7 @@ namespace Microsoft.Dafny
           foreach (var lhs in e.LHSs) {
             Contract.Assert(lhs.Var != null);  // the parser already checked that every LHS is a BoundVar, not a general pattern
             var v = lhs.Var;
-            if (!scope.Push(v.Name, v)) {
-              Error(v, "Duplicate let-variable name: {0}", v.Name);
-            }
+            ScopePushAndReport(scope, v, "let-variable");
             ResolveType(v.tok, v.Type, opts.codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
           }
           foreach (var rhs in e.RHSs) {
@@ -7596,9 +7611,7 @@ namespace Microsoft.Dafny
         ResolveTypeParameters(e.TypeArgs, true, e);
         scope.PushMarker();
         foreach (BoundVar v in e.BoundVars) {
-          if (!scope.Push(v.Name, v)) {
-            Error(v, "Duplicate bound-variable name: {0}", v.Name);
-          }
+          ScopePushAndReport(scope, v, "bound-variable");
           var option = typeQuantifier ? new ResolveTypeOption(e) : new ResolveTypeOption(ResolveTypeOptionEnum.InferTypeProxies);
           ResolveType(v.tok, v.Type, opts.codeContext, option, typeQuantifier ? e.TypeArgs : null);
         }
@@ -7652,9 +7665,7 @@ namespace Microsoft.Dafny
         int prevErrorCount = ErrorCount;
         scope.PushMarker();
         foreach (BoundVar v in e.BoundVars) {
-          if (!scope.Push(v.Name, v)) {
-            Error(v, "Duplicate bound-variable name: {0}", v.Name);
-          }
+          ScopePushAndReport(scope, v, "bound-variable");
           ResolveType(v.tok, v.Type, opts.codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
         }
         ResolveExpression(e.Range, opts);
@@ -7683,9 +7694,7 @@ namespace Microsoft.Dafny
           Error(e.tok, "a map comprehension must have exactly one bound variable.");
         }
         foreach (BoundVar v in e.BoundVars) {
-          if (!scope.Push(v.Name, v)) {
-            Error(v, "Duplicate bound-variable name: {0}", v.Name);
-          }
+          ScopePushAndReport(scope, v, "bound-variable");
           ResolveType(v.tok, v.Type, opts.codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
         }
         ResolveExpression(e.Range, opts);
@@ -7718,9 +7727,7 @@ namespace Microsoft.Dafny
         int prevErrorCount = ErrorCount;
         scope.PushMarker();
         foreach (BoundVar v in e.BoundVars) {
-          if (!scope.Push(v.Name, v)) {
-            Error(v, "Duplicate bound-variable name: {0}", v.Name);
-          }
+          ScopePushAndReport(scope, v, "bound-variable");
           ResolveType(v.tok, v.Type, opts.codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
         }
 
@@ -10439,17 +10446,27 @@ namespace Microsoft.Dafny
       }
     }
 
-    // Pushes name-->thing association and returns "true", if name has not already been pushed since the last marker.
-    // If name already has been pushed since the last marker, does nothing and returns "false".
-    public bool Push(string name, Thing thing) {
+    public enum PushResult { Duplicate, Shadow, Success }
+
+    /// <summary>
+    /// Pushes name-->thing association and returns "Success", if name has not already been pushed since the last marker.
+    /// If name already has been pushed since the last marker, does nothing and returns "Duplicate".
+    /// If the appropriate command-line option is supplied, then this method will also check if "name" shadows a previous
+    /// name; if it does, then it will return "Shadow" instead of "Success".
+    /// </summary>
+    public PushResult Push(string name, Thing thing) {
       Contract.Requires(name != null);
       Contract.Requires(thing != null);
       if (Find(name, true) != null) {
-        return false;
+        return PushResult.Duplicate;
       } else {
+        var r = PushResult.Success;
+        if (DafnyOptions.O.WarnShadowing && Find(name, false) != null) {
+          r = PushResult.Shadow;
+        }
         names.Add(name);
         things.Add(thing);
-        return true;
+        return r;
       }
     }
 
diff --git a/Test/dafny0/Shadows.dfy b/Test/dafny0/Shadows.dfy
new file mode 100644
index 00000000..da1e74d6
--- /dev/null
+++ b/Test/dafny0/Shadows.dfy
@@ -0,0 +1,42 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /warnShadowing "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+module Module0 {
+  class C<alpha> {
+    method M<beta, beta>(x: beta)  // error: duplicate type parameter
+    method P<alpha>(x: alpha)  // shadowed type parameter
+    function F<beta, beta>(x: beta): int  // error: duplicate type parameter
+    function G<alpha>(x: alpha): int  // shadowed type parameter
+
+    method Q0(x: int) returns (x: int)  // error: duplicate variable name
+  }
+}
+module Module1 {
+  class D {
+    method Q1(x: int) returns (y: int)
+    {
+      var x;  // shadowed
+      var y;  // error: duplicate
+    }
+
+    var f: int
+    method R()
+    {
+      var f;  // okay
+      var f;  // error: duplicate
+    }
+    method S()
+    {
+      var x;
+      {
+        var x;  // shadow
+      }
+    }
+    method T()
+    {
+      var x;
+      ghost var b := forall x :: x < 10;  // shadow
+      ghost var c := forall y :: forall y :: y != y + 1;  // shadow
+    }
+  }
+}
diff --git a/Test/dafny0/Shadows.dfy.expect b/Test/dafny0/Shadows.dfy.expect
new file mode 100644
index 00000000..5083ac64
--- /dev/null
+++ b/Test/dafny0/Shadows.dfy.expect
@@ -0,0 +1,12 @@
+Shadows.dfy(6,19): Error: Duplicate type-parameter name: beta
+Shadows.dfy(7,13): Warning: Shadowed type-parameter name: alpha
+Shadows.dfy(8,21): Error: Duplicate type-parameter name: beta
+Shadows.dfy(9,15): Warning: Shadowed type-parameter name: alpha
+Shadows.dfy(11,31): Error: Duplicate parameter name: x
+Shadows.dfy(18,10): Warning: Shadowed local-variable name: x
+Shadows.dfy(19,10): Error: Duplicate local-variable name: y
+Shadows.dfy(26,10): Error: Duplicate local-variable name: f
+Shadows.dfy(32,12): Warning: Shadowed local-variable name: x
+Shadows.dfy(38,28): Warning: Shadowed bound-variable name: x
+Shadows.dfy(39,40): Warning: Shadowed bound-variable name: y
+5 resolution/type errors detected in Shadows.dfy
-- 
cgit v1.2.3


From 732ae479be4409214aea62a1f67df0e6a45c2ab4 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Mon, 6 Jul 2015 10:06:45 -0700
Subject: Small refactoring of Printer.cs

---
 Source/Dafny/Cloner.cs     |  2 +-
 Source/Dafny/DafnyAst.cs   | 24 +++++++++++++++++----
 Source/Dafny/Printer.cs    | 52 ++++++++++++++++++++--------------------------
 Source/Dafny/Resolver.cs   | 14 ++++++-------
 Source/Dafny/Translator.cs |  2 +-
 5 files changed, 52 insertions(+), 42 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index f13aa2f4..be77f6b4 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -243,7 +243,7 @@ namespace Microsoft.Dafny
         var e = (LiteralExpr)expr;
         if (e is StaticReceiverExpr) {
           var ee = (StaticReceiverExpr)e;
-          return new StaticReceiverExpr(e.tok, CloneType(ee.UnresolvedType));
+          return new StaticReceiverExpr(e.tok, CloneType(ee.UnresolvedType), ee.IsImplicit);
         } else if (e.Value == null) {          
           return new LiteralExpr(Tok(e.tok));
         } else if (e.Value is bool) {
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index b8660f98..eac64f80 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -5015,6 +5015,10 @@ namespace Microsoft.Dafny {
       get { yield break; }
     }
 
+    public virtual bool IsImplicit {
+      get { return false; }
+    }
+
     public static IEnumerable<Expression> Conjuncts(Expression expr) {
       Contract.Requires(expr != null);
       Contract.Requires(expr.Type.IsBoolType);
@@ -5391,19 +5395,21 @@ namespace Microsoft.Dafny {
   public class StaticReceiverExpr : LiteralExpr
   {
     public readonly Type UnresolvedType;
+    private bool Implicit;
 
-    public StaticReceiverExpr(IToken tok, Type t)
+    public StaticReceiverExpr(IToken tok, Type t, bool isImplicit)
       : base(tok) {
       Contract.Requires(tok != null);
       Contract.Requires(t != null);
       UnresolvedType = t;
+      Implicit = isImplicit;
     }
     
     /// <summary>
     /// Constructs a resolved LiteralExpr representing the 'null' literal whose type is "cl"
     /// parameterized by the type arguments of "cl" itself.
     /// </summary>
-    public StaticReceiverExpr(IToken tok, ClassDecl cl)
+    public StaticReceiverExpr(IToken tok, ClassDecl cl, bool isImplicit)
       : base(tok)
     {
       Contract.Requires(tok != null);
@@ -5411,6 +5417,7 @@ namespace Microsoft.Dafny {
       var typeArgs = cl.TypeArgs.ConvertAll(tp => (Type)new UserDefinedType(tp));
       Type = new UserDefinedType(tok, cl.Name, cl, typeArgs);
       UnresolvedType = Type;
+      Implicit = isImplicit;
     }
 
     /// <summary>
@@ -5427,7 +5434,7 @@ namespace Microsoft.Dafny {
     ///   a trait that in turn extends trait "W(g(Y))".  If "t" denotes type "C(G)" and "cl" denotes "W",
     ///   then type of the StaticReceiverExpr will be "T(g(f(G)))".
     /// </summary>
-    public StaticReceiverExpr(IToken tok, UserDefinedType t, ClassDecl cl)
+    public StaticReceiverExpr(IToken tok, UserDefinedType t, ClassDecl cl, bool isImplicit)
       : base(tok) {
       Contract.Requires(tok != null);
       Contract.Requires(t.ResolvedClass != null);
@@ -5441,6 +5448,11 @@ namespace Microsoft.Dafny {
       }
       Type = t;
       UnresolvedType = Type;
+      Implicit = isImplicit;
+    }
+
+    public override bool IsImplicit {
+      get { return Implicit; }
     }
   }
 
@@ -5597,6 +5609,10 @@ namespace Microsoft.Dafny {
       : base(tok) {
       Contract.Requires(tok != null);
     }
+
+    public override bool IsImplicit {
+      get { return true; }
+    }
   }
 
   public class IdentifierExpr : Expression
@@ -6534,7 +6550,7 @@ namespace Microsoft.Dafny {
       Contract.Invariant(Term != null);
     }
 
-    public readonly Attributes Attributes;
+    public Attributes Attributes;
 
     public abstract class BoundedPool {
       public virtual bool IsFinite {
diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index cdcdb9e8..1c7508eb 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -1271,6 +1271,11 @@ namespace Microsoft.Dafny {
       PrintExpr(expr, 0, false, true, isFollowedBySemicolon, indent);
     }
 
+    private bool ParensNeeded(int opBindingStrength, int contextBindingStrength, bool fragileContext) {
+      return opBindingStrength < contextBindingStrength ||
+             (fragileContext && opBindingStrength == contextBindingStrength);
+    }
+
     /// <summary>
     /// An indent of -1 means print the entire expression on one line.
     /// </summary>
@@ -1368,15 +1373,14 @@ namespace Microsoft.Dafny {
         PrintTypeInstantiation(e.OptTypeArguments);
 
       } else if (expr is ExprDotName) {
-        var e = (ExprDotName)expr;
+        var e = (ExprDotName)expr; //CLEMENT: Check the newly added Implicit parameter to make sure that we don't print "_default." DONE in FunctionCall. Where else?
         // determine if parens are needed
         int opBindingStrength = 0x70;
-        bool parensNeeded = !(e.Lhs is ImplicitThisExpr) &&
-          opBindingStrength < contextBindingStrength ||
-          (fragileContext && opBindingStrength == contextBindingStrength);
+        bool parensNeeded = !e.Lhs.IsImplicit && // KRML: I think that this never holds
+          ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
         if (parensNeeded) { wr.Write("("); }
-        if (!(e.Lhs is ImplicitThisExpr)) {
+        if (!e.Lhs.IsImplicit) {
           PrintExpr(e.Lhs, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
           wr.Write(".");
         }
@@ -1388,9 +1392,8 @@ namespace Microsoft.Dafny {
         var e = (ApplySuffix)expr;
         // determine if parens are needed
         int opBindingStrength = 0x70;
-        bool parensNeeded = !(e.Lhs is ImplicitThisExpr) &&
-          opBindingStrength < contextBindingStrength ||
-          (fragileContext && opBindingStrength == contextBindingStrength);
+        bool parensNeeded = !e.Lhs.IsImplicit &&  // KRML: I think that this never holds
+          ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
         if (parensNeeded) { wr.Write("("); }
         if (ParensMayMatter(e.Lhs)) {
@@ -1409,12 +1412,11 @@ namespace Microsoft.Dafny {
         MemberSelectExpr e = (MemberSelectExpr)expr;
         // determine if parens are needed
         int opBindingStrength = 0x70;
-        bool parensNeeded = !(e.Obj is ImplicitThisExpr) &&
-          opBindingStrength < contextBindingStrength ||
-          (fragileContext && opBindingStrength == contextBindingStrength);
+        bool parensNeeded = !e.Obj.IsImplicit &&
+          ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
         if (parensNeeded) { wr.Write("("); }
-        if (!(e.Obj is ImplicitThisExpr)) {
+        if (!(e.Obj.IsImplicit)) {
           PrintExpr(e.Obj, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
           wr.Write(".");
         }
@@ -1425,8 +1427,7 @@ namespace Microsoft.Dafny {
         SeqSelectExpr e = (SeqSelectExpr)expr;
         // determine if parens are needed
         int opBindingStrength = 0x70;
-        bool parensNeeded = opBindingStrength < contextBindingStrength ||
-          (fragileContext && opBindingStrength == contextBindingStrength);
+        bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
         if (parensNeeded) { wr.Write("("); }
         PrintExpr(e.Seq, 0x00, false, false, !parensNeeded && isFollowedBySemicolon, indent);  // BOGUS: fix me
@@ -1450,8 +1451,7 @@ namespace Microsoft.Dafny {
         MultiSelectExpr e = (MultiSelectExpr)expr;
         // determine if parens are needed
         int opBindingStrength = 0x70;
-        bool parensNeeded = opBindingStrength < contextBindingStrength ||
-          (fragileContext && opBindingStrength == contextBindingStrength);
+        bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
         if (parensNeeded) { wr.Write("("); }
         PrintExpr(e.Array, 0x00, false, false, !parensNeeded && isFollowedBySemicolon, indent);  // BOGUS: fix me
@@ -1475,8 +1475,7 @@ namespace Microsoft.Dafny {
         {
           // determine if parens are needed
           int opBindingStrength = 0x70;
-          bool parensNeeded = opBindingStrength < contextBindingStrength ||
-            (fragileContext && opBindingStrength == contextBindingStrength);
+          bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
           if (parensNeeded) { wr.Write("("); }
           PrintExpr(e.Seq, 00, false, false, !parensNeeded && isFollowedBySemicolon, indent);  // BOGUS: fix me
@@ -1491,9 +1490,7 @@ namespace Microsoft.Dafny {
         var e = (ApplyExpr)expr;
         // determine if parens are needed
         int opBindingStrength = 0x70;
-        bool parensNeeded =
-          opBindingStrength < contextBindingStrength ||
-          (fragileContext && opBindingStrength == contextBindingStrength);
+        bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
         if (parensNeeded) { wr.Write("("); }
 
@@ -1508,12 +1505,11 @@ namespace Microsoft.Dafny {
         var e = (FunctionCallExpr)expr;
         // determine if parens are needed
         int opBindingStrength = 0x70;
-        bool parensNeeded = !(e.Receiver is ImplicitThisExpr) &&
-          opBindingStrength < contextBindingStrength ||
-          (fragileContext && opBindingStrength == contextBindingStrength);
+        bool parensNeeded = !(e.Receiver.IsImplicit) &&
+          ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
         if (parensNeeded) { wr.Write("("); }
-        if (!(e.Receiver is ImplicitThisExpr)) {
+        if (!e.Receiver.IsImplicit) {
           PrintExpr(e.Receiver, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
           wr.Write(".");
         }
@@ -1562,8 +1558,7 @@ namespace Microsoft.Dafny {
             default:
               Contract.Assert(false); throw new cce.UnreachableException();  // unexpected unary opcode
           }
-          bool parensNeeded = opBindingStrength < contextBindingStrength ||
-            (fragileContext && opBindingStrength == contextBindingStrength);
+          bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
           bool containsNestedNot = e.E is ParensExpression &&
                                 ((ParensExpression)e.E).E is UnaryExpr &&
@@ -1849,8 +1844,7 @@ namespace Microsoft.Dafny {
         var e = (NegationExpression)expr;
         string op = "-";
         int opBindingStrength = 0x60;
-        bool parensNeeded = opBindingStrength < contextBindingStrength ||
-          (fragileContext && opBindingStrength == contextBindingStrength);
+        bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
         bool containsNestedNegation = e.E is ParensExpression && ((ParensExpression)e.E).E is NegationExpression;
 
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index ecb76ae8..5e08a38a 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -97,7 +97,7 @@ namespace Microsoft.Dafny
     {
       Contract.Requires(token != null);
       Contract.Requires(text != null);
-      Contract.Requires(0 <= length);
+      Contract.Requires(0 <= length); //FIXME: KRML: This should (probably) be the length of the token
       if (AdditionalInformationReporter != null) {
         AdditionalInformationReporter(new AdditionalInformation { Token = token, Text = text, Length = length });
       }
@@ -8172,7 +8172,7 @@ namespace Microsoft.Dafny
         // ----- 1. member of the enclosing class
         Expression receiver;
         if (member.IsStatic) {
-          receiver = new StaticReceiverExpr(expr.tok, (ClassDecl)member.EnclosingClass);
+          receiver = new StaticReceiverExpr(expr.tok, (ClassDecl)member.EnclosingClass, true);
         } else {
           if (!scope.AllowInstance) {
             Error(expr.tok, "'this' is not allowed in a 'static' context");
@@ -8220,7 +8220,7 @@ namespace Microsoft.Dafny
           var ambiguousMember = (AmbiguousMemberDecl)member;
           Error(expr.tok, "The name {0} ambiguously refers to a static member in one of the modules {1} (try qualifying the member name with the module name)", expr.Name, ambiguousMember.ModuleNames());
         } else {
-          var receiver = new StaticReceiverExpr(expr.tok, (ClassDecl)member.EnclosingClass);
+          var receiver = new StaticReceiverExpr(expr.tok, (ClassDecl)member.EnclosingClass, true);
           r = ResolveExprDotCall(expr.tok, receiver, member, expr.OptTypeArguments, opts.codeContext, allowMethodCall);
         }
 
@@ -8461,7 +8461,7 @@ namespace Microsoft.Dafny
             var ambiguousMember = (AmbiguousMemberDecl)member;
             Error(expr.tok, "The name {0} ambiguously refers to a static member in one of the modules {1} (try qualifying the member name with the module name)", expr.SuffixName, ambiguousMember.ModuleNames());
           } else {
-            var receiver = new StaticReceiverExpr(expr.tok, (ClassDecl)member.EnclosingClass);
+            var receiver = new StaticReceiverExpr(expr.tok, (ClassDecl)member.EnclosingClass, true);
             r = ResolveExprDotCall(expr.tok, receiver, member, expr.OptTypeArguments, opts.codeContext, allowMethodCall);
           }
         } else {
@@ -8484,10 +8484,10 @@ namespace Microsoft.Dafny
           Dictionary<string, MemberDecl> members;
           if (classMembers.TryGetValue(cd, out members) && members.TryGetValue(expr.SuffixName, out member)) {
             if (!member.IsStatic) {
-              Error(expr.tok, "accessing member '{0}' requires an instance expression", expr.SuffixName);
+              Error(expr.tok, "accessing member '{0}' requires an instance expression", expr.SuffixName); //FIXME Unify with similar error message
               // nevertheless, continue creating an expression that approximates a correct one
             }
-            var receiver = new StaticReceiverExpr(expr.tok, (UserDefinedType)ty.NormalizeExpand(), (ClassDecl)member.EnclosingClass);
+            var receiver = new StaticReceiverExpr(expr.tok, (UserDefinedType)ty.NormalizeExpand(), (ClassDecl)member.EnclosingClass, false);
             r = ResolveExprDotCall(expr.tok, receiver, member, expr.OptTypeArguments, opts.codeContext, allowMethodCall);
           }
         } else if (ty.IsDatatype) {
@@ -8522,7 +8522,7 @@ namespace Microsoft.Dafny
             receiver = expr.Lhs;
           } else {
             Contract.Assert(expr.Lhs.Type.IsRefType);  // only reference types have static methods
-            receiver = new StaticReceiverExpr(expr.tok, (UserDefinedType)expr.Lhs.Type.NormalizeExpand(), (ClassDecl)member.EnclosingClass);
+            receiver = new StaticReceiverExpr(expr.tok, (UserDefinedType)expr.Lhs.Type.NormalizeExpand(), (ClassDecl)member.EnclosingClass, false);
           }
           r = ResolveExprDotCall(expr.tok, receiver, member, expr.OptTypeArguments, opts.codeContext, allowMethodCall);
         }
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 4324b2b8..26412384 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -2781,7 +2781,7 @@ namespace Microsoft.Dafny {
             if (receiverReplacement != null) {
               recursiveCallReceiver = receiverReplacement;
             } else if (m.IsStatic) {
-              recursiveCallReceiver = new StaticReceiverExpr(m.tok, (ClassDecl)m.EnclosingClass);  // this also resolves it
+              recursiveCallReceiver = new StaticReceiverExpr(m.tok, (ClassDecl)m.EnclosingClass, true);  // this also resolves it
             } else {
               recursiveCallReceiver = new ImplicitThisExpr(m.tok);
               recursiveCallReceiver.Type = Resolver.GetThisType(m.tok, (ClassDecl)m.EnclosingClass);  // resolve here
-- 
cgit v1.2.3


From f177d7dc96b27f5ca3b777d31fcd9bad26be6ce5 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Mon, 6 Jul 2015 14:46:51 -0700
Subject: Report warnings only once. (This is the last step in fixing Issue
 #86.)

---
 Source/Dafny/Resolver.cs            | 26 ++++++++++++++++++++------
 Test/dafny0/JustWarnings.dfy        | 19 +++++++++++++++++++
 Test/dafny0/JustWarnings.dfy.expect |  4 ++++
 3 files changed, 43 insertions(+), 6 deletions(-)
 create mode 100644 Test/dafny0/JustWarnings.dfy
 create mode 100644 Test/dafny0/JustWarnings.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 66fd7959..3e308e76 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -50,15 +50,27 @@ namespace Microsoft.Dafny
       Contract.Requires(msg != null);
       Error(e.tok, msg, args);
     }
+
+    private bool reportWarnings = true;
+    /// <summary>
+    /// Set whether or not to report warnings. Return the state of the previous behavior.
+    /// </summary>
+    public bool ReportWarnings(bool b) {
+      var old = reportWarnings;
+      reportWarnings = b;
+      return old;
+    }
     public void Warning(IToken tok, string msg, params object[] args) {
       Contract.Requires(tok != null);
       Contract.Requires(msg != null);
-      ConsoleColor col = Console.ForegroundColor;
-      Console.ForegroundColor = ConsoleColor.Yellow;
-      Console.WriteLine("{0}({1},{2}): Warning: {3}",
-          DafnyOptions.Clo.UseBaseNameForFileName ? System.IO.Path.GetFileName(tok.filename) : tok.filename, tok.line, tok.col - 1,
-          string.Format(msg, args));
-      Console.ForegroundColor = col;
+      if (reportWarnings) {
+        ConsoleColor col = Console.ForegroundColor;
+        Console.ForegroundColor = ConsoleColor.Yellow;
+        Console.WriteLine("{0}({1},{2}): Warning: {3}",
+            DafnyOptions.Clo.UseBaseNameForFileName ? System.IO.Path.GetFileName(tok.filename) : tok.filename, tok.line, tok.col - 1,
+            string.Format(msg, args));
+        Console.ForegroundColor = col;
+      }
     }
   }
 
@@ -366,6 +378,7 @@ namespace Microsoft.Dafny
             // compilation should only proceed if everything is good, including the signature (which preResolveErrorCount does not include);
             Contract.Assert(!useCompileSignatures);
             useCompileSignatures = true;  // set Resolver-global flag to indicate that Signatures should be followed to their CompiledSignature
+            var oldWarnings = ReportWarnings(false);  // turn off warning reporting for the clone
             var nw = new Cloner().CloneModuleDefinition(m, m.CompileName + "_Compile");
             var compileSig = RegisterTopLevelDecls(nw, true);
             compileSig.Refines = refinementTransformer.RefinedSig;
@@ -373,6 +386,7 @@ namespace Microsoft.Dafny
             ResolveModuleDefinition(nw, compileSig);
             prog.CompileModules.Add(nw);
             useCompileSignatures = false;  // reset the flag
+            ReportWarnings(oldWarnings);
           }
         } else if (decl is AliasModuleDecl) {
           var alias = (AliasModuleDecl)decl;
diff --git a/Test/dafny0/JustWarnings.dfy b/Test/dafny0/JustWarnings.dfy
new file mode 100644
index 00000000..86523f5b
--- /dev/null
+++ b/Test/dafny0/JustWarnings.dfy
@@ -0,0 +1,19 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /warnShadowing "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// This file tests the behavior where the Resolver reports some warnings
+// but no errors.  In the case of errors, resolution does not continue
+// to clone modules and resolve them, but the cloning does proceed if there
+// are only warnings.  Dafny should report only one copy of these warnings,
+// and warnings are therefore turned off when processing the clones.  This
+// test file makes sure the warnings don't appear twice.
+
+method M(x: int)
+{
+  var x := 10;  // warning: this shadows the parameter 'x'
+}
+
+class C<T> {
+  var u: T
+  method P<T>(t: T)  // warning: this shadows the type parameter 'T'
+}
diff --git a/Test/dafny0/JustWarnings.dfy.expect b/Test/dafny0/JustWarnings.dfy.expect
new file mode 100644
index 00000000..5f0e66d8
--- /dev/null
+++ b/Test/dafny0/JustWarnings.dfy.expect
@@ -0,0 +1,4 @@
+JustWarnings.dfy(18,11): Warning: Shadowed type-parameter name: T
+JustWarnings.dfy(13,6): Warning: Shadowed local-variable name: x
+
+Dafny program verifier finished with 3 verified, 0 errors
-- 
cgit v1.2.3


From f235dfbc792bb885f3c76e4267658c1a9ef838d8 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Tue, 7 Jul 2015 15:27:58 -0700
Subject: Fixed crashes in overrides checking of function decreases clauses,
 and improved the error message reported to users

---
 Source/Dafny/DafnyAst.cs                     |  2 ++
 Source/Dafny/Translator.cs                   | 46 ++++++----------------------
 Test/dafny0/Trait/TraitsDecreases.dfy        | 46 ++++++++++++++++++++++++++++
 Test/dafny0/Trait/TraitsDecreases.dfy.expect | 20 +++++++++++-
 4 files changed, 76 insertions(+), 38 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 134fb4c1..d14d82a3 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -2223,6 +2223,7 @@ namespace Microsoft.Dafny {
   public interface ICallable : ICodeContext
   {
     IToken Tok { get; }
+    string WhatKind { get; }
     string NameRelativeToModule { get; }
     Specification<Expression> Decreases { get; }
     /// <summary>
@@ -2234,6 +2235,7 @@ namespace Microsoft.Dafny {
   }
   public class DontUseICallable : ICallable
   {
+    public string WhatKind { get { throw new cce.UnreachableException(); } }
     public bool IsGhost { get { throw new cce.UnreachableException(); } }
     public List<TypeParameter> TypeArgs { get { throw new cce.UnreachableException(); } }
     public List<Formal> Ins { get { throw new cce.UnreachableException(); } }
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index cefce6b6..a4cf3700 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -3018,7 +3018,7 @@ namespace Microsoft.Dafny {
         AddFunctionOverrideReqsChk(f, builder, etran, substMap);
 
         //adding assert R <= Rank’;
-        AddFunctionOverrideTerminationChk(f, builder, etran, substMap);
+        AddOverrideTerminationChk(f, f.OverriddenFunction, builder, etran, substMap);
 
         //adding assert W <= Frame’
         AddFunctionOverrideSubsetChk(f, builder, etran, localVariables, substMap);
@@ -3181,35 +3181,6 @@ namespace Microsoft.Dafny {
         builder.Add(Assert(tok, q, "expression may read an object not in the parent trait context's reads clause", kv));
     }
 
-    private void AddFunctionOverrideTerminationChk(Function f, StmtListBuilder builder, ExpressionTranslator etran, Dictionary<IVariable, Expression> substMap)
-    {
-        var decrToks = new List<IToken>();
-        var decrTypes1 = new List<Type>();
-        var decrTypes2 = new List<Type>();
-        var decrClass = new List<Expr>();
-        var decrTrait = new List<Expr>();
-        if (f.Decreases != null)
-        {
-            foreach (var decC in f.Decreases.Expressions)
-            {
-                decrToks.Add(decC.tok);
-                decrTypes1.Add(decC.Type);
-                decrClass.Add(etran.TrExpr(decC));
-            }
-        }
-        if (f.OverriddenFunction.Decreases != null)
-        {
-            foreach (var decT in f.OverriddenFunction.Decreases.Expressions)
-            {
-                var decCNew = Substitute(decT, null, substMap);
-                decrTypes2.Add(decCNew.Type);
-                decrTrait.Add(etran.TrExpr(decCNew));
-            }
-        }
-        var decrChk = DecreasesCheck(decrToks, decrTypes1, decrTypes2, decrClass, decrTrait, null, null, true, false);
-        builder.Add(new Bpl.AssertCmd(f.tok, decrChk));
-    }
-
     private void AddFunctionOverrideReqsChk(Function f, StmtListBuilder builder, ExpressionTranslator etran, Dictionary<IVariable, Expression> substMap)
     {
         //generating trait pre-conditions with class variables
@@ -3277,7 +3248,7 @@ namespace Microsoft.Dafny {
         AddMethodOverrideReqsChk(m, builder, etran, substMap);
 
         //adding assert R <= Rank’;
-        AddMethodOverrideTerminationChk(m, builder, etran, substMap);
+        AddOverrideTerminationChk(m, m.OverriddenMethod, builder, etran, substMap);
 
         //adding assert W <= Frame’
         AddMethodOverrideSubsetChk(m, builder, etran, localVariables, substMap);
@@ -3364,14 +3335,15 @@ namespace Microsoft.Dafny {
         }
     }
 
-    private void AddMethodOverrideTerminationChk(Method m, Bpl.StmtListBuilder builder, ExpressionTranslator etran, Dictionary<IVariable, Expression> substMap) {
-      Contract.Requires(m != null);
+    private void AddOverrideTerminationChk(ICallable original, ICallable overryd, Bpl.StmtListBuilder builder, ExpressionTranslator etran, Dictionary<IVariable, Expression> substMap) {
+      Contract.Requires(original != null);
+      Contract.Requires(overryd != null);
       Contract.Requires(builder != null);
       Contract.Requires(etran != null);
       Contract.Requires(substMap != null);
       // Note, it is as if the trait's method is calling the class's method.
-      var contextDecreases = m.OverriddenMethod.Decreases.Expressions;
-      var calleeDecreases = m.Decreases.Expressions;
+      var contextDecreases = overryd.Decreases.Expressions;
+      var calleeDecreases = original.Decreases.Expressions;
       // We want to check:  calleeDecreases <= contextDecreases (note, we can allow equality, since there is a bounded, namely 1, number of dynamic dispatches)
       if (Contract.Exists(contextDecreases, e => e is WildcardExpr)) {
         // no check needed
@@ -3392,7 +3364,7 @@ namespace Microsoft.Dafny {
           N = i;
           break;
         }
-        toks.Add(new NestedToken(m.tok, e1.tok));
+        toks.Add(new NestedToken(original.Tok, e1.tok));
         types0.Add(e0.Type.NormalizeExpand());
         types1.Add(e1.Type.NormalizeExpand());
         callee.Add(etran.TrExpr(e0));
@@ -3425,7 +3397,7 @@ namespace Microsoft.Dafny {
       //   as "false".
       bool allowNoChange = N == decrCountT && decrCountT <= decrCountC;
       var decrChk = DecreasesCheck(toks, types0, types1, callee, caller, null, null, allowNoChange, false);
-      builder.Add(Assert(m.tok, decrChk, "method's decreases clause must be below or equal to that in the trait"));
+      builder.Add(Assert(original.Tok, decrChk, string.Format("{0}'s decreases clause must be below or equal to that in the trait", original.WhatKind)));
     }
 
     private void AddMethodOverrideSubsetChk(Method m, Bpl.StmtListBuilder builder, ExpressionTranslator etran, List<Variable> localVariables, Dictionary<IVariable, Expression> substMap)
diff --git a/Test/dafny0/Trait/TraitsDecreases.dfy b/Test/dafny0/Trait/TraitsDecreases.dfy
index 53ce28be..8ab3672a 100644
--- a/Test/dafny0/Trait/TraitsDecreases.dfy
+++ b/Test/dafny0/Trait/TraitsDecreases.dfy
@@ -106,3 +106,49 @@ class CC extends TT {
     decreases *
   { }
 }
+
+
+// The following module contains various regression tests
+module More {
+  trait A0 {
+    predicate P() decreases 5
+  }
+  class B0 extends A0 {
+    predicate P()  // error: rank is not lower
+  }
+
+  trait A1 {
+    predicate P() decreases 5
+  }
+  class B1 extends A1 {
+    predicate P() reads this  // error: rank is not lower
+  }
+
+  trait A2 {
+    predicate P(x: int)
+  }
+  class B2 extends A2 {
+    predicate P(x: int) reads this  // error: rank is not lower
+  }
+
+  trait A3 {
+    predicate P() reads this
+  }
+  class B3 extends A3 {
+    predicate P()  // error: rank is not lower
+  }
+
+  trait A4 {
+    predicate P(x: int) decreases 5
+  }
+  class B4 extends A4 {
+    predicate P(x: int)  // error: rank is not lower
+  }
+
+  trait A5 {
+    method M(x: int) decreases 5
+  }
+  class B5 extends A5 {
+    method M(x: int)  // error: rank is not lower
+  }
+}
diff --git a/Test/dafny0/Trait/TraitsDecreases.dfy.expect b/Test/dafny0/Trait/TraitsDecreases.dfy.expect
index 6c76f9a8..2607a0c6 100644
--- a/Test/dafny0/Trait/TraitsDecreases.dfy.expect
+++ b/Test/dafny0/Trait/TraitsDecreases.dfy.expect
@@ -1,3 +1,21 @@
+TraitsDecreases.dfy(117,15): Error: predicate's decreases clause must be below or equal to that in the trait
+Execution trace:
+    (0,0): anon0
+TraitsDecreases.dfy(124,15): Error: predicate's decreases clause must be below or equal to that in the trait
+Execution trace:
+    (0,0): anon0
+TraitsDecreases.dfy(131,15): Error: predicate's decreases clause must be below or equal to that in the trait
+Execution trace:
+    (0,0): anon0
+TraitsDecreases.dfy(138,15): Error: predicate's decreases clause must be below or equal to that in the trait
+Execution trace:
+    (0,0): anon0
+TraitsDecreases.dfy(145,15): Error: predicate's decreases clause must be below or equal to that in the trait
+Execution trace:
+    (0,0): anon0
+TraitsDecreases.dfy(152,12): Error: method's decreases clause must be below or equal to that in the trait
+Execution trace:
+    (0,0): anon0
 TraitsDecreases.dfy(57,10): Error: method's decreases clause must be below or equal to that in the trait
 Execution trace:
     (0,0): anon0
@@ -14,4 +32,4 @@ TraitsDecreases.dfy(88,10): Error: method's decreases clause must be below or eq
 Execution trace:
     (0,0): anon0
 
-Dafny program verifier finished with 63 verified, 5 errors
+Dafny program verifier finished with 75 verified, 11 errors
-- 
cgit v1.2.3


From fe501d243c0413db8ae85bda174d0761da00d330 Mon Sep 17 00:00:00 2001
From: Michael Lowell Roberts <mirobert@microsoft.com>
Date: Mon, 13 Jul 2015 10:40:35 -0700
Subject: [IronDafny] implemented workaround for "import opened" bug(s).

---
 Source/Dafny/Cloner.cs                       |  8 ++--
 Source/Dafny/Dafny.atg                       | 16 ++++----
 Source/Dafny/DafnyAst.cs                     | 52 +++++++++++++++++++-----
 Source/Dafny/DafnyOptions.cs                 | 27 +++++++++++-
 Source/Dafny/Parser.cs                       | 16 ++++----
 Source/Dafny/Resolver.cs                     | 61 ++++++++++++++++++++--------
 Test/irondafny0/FIFO.dfy                     |  2 +-
 Test/irondafny0/LIFO.dfy                     |  2 +-
 Test/irondafny0/opened_workaround.dfy        | 21 ++++++++++
 Test/irondafny0/opened_workaround.dfy.expect |  3 ++
 Test/irondafny0/xrefine0.dfy                 |  2 +-
 Test/irondafny0/xrefine1.dfy                 |  2 +-
 Test/irondafny0/xrefine2.dfy                 |  2 +-
 Test/irondafny0/xrefine3.dfy                 |  2 +-
 14 files changed, 161 insertions(+), 55 deletions(-)
 create mode 100644 Test/irondafny0/opened_workaround.dfy
 create mode 100644 Test/irondafny0/opened_workaround.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index 6e64c7ec..fe9795d3 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -44,9 +44,9 @@ namespace Microsoft.Dafny
       } else if (d is NewtypeDecl) {
         var dd = (NewtypeDecl)d;
         if (dd.Var == null) {
-          return new NewtypeDecl(Tok(dd.tok), dd.Name, m, CloneType(dd.BaseType), CloneAttributes(dd.Attributes));
+          return new NewtypeDecl(Tok(dd.tok), dd.Name, m, CloneType(dd.BaseType), CloneAttributes(dd.Attributes), dd);
         } else {
-          return new NewtypeDecl(Tok(dd.tok), dd.Name, m, CloneBoundVar(dd.Var), CloneExpr(dd.Constraint), CloneAttributes(dd.Attributes));
+          return new NewtypeDecl(Tok(dd.tok), dd.Name, m, CloneBoundVar(dd.Var), CloneExpr(dd.Constraint), CloneAttributes(dd.Attributes), dd);
         }
       } else if (d is TupleTypeDecl) {
         var dd = (TupleTypeDecl)d;
@@ -55,7 +55,7 @@ namespace Microsoft.Dafny
         var dd = (IndDatatypeDecl)d;
         var tps = dd.TypeArgs.ConvertAll(CloneTypeParam);
         var ctors = dd.Ctors.ConvertAll(CloneCtor);
-        var dt = new IndDatatypeDecl(Tok(dd.tok), dd.Name, m, tps, ctors, CloneAttributes(dd.Attributes));
+        var dt = new IndDatatypeDecl(Tok(dd.tok), dd.Name, m, tps, ctors, CloneAttributes(dd.Attributes), dd);
         return dt;
       } else if (d is CoDatatypeDecl) {
         var dd = (CoDatatypeDecl)d;
@@ -108,7 +108,7 @@ namespace Microsoft.Dafny
         if (d is DefaultClassDecl) {
           return new DefaultClassDecl(m, mm);
         } else {
-          return new ClassDecl(Tok(dd.tok), dd.Name, m, tps, mm, CloneAttributes(dd.Attributes), dd.TraitsTyp.ConvertAll(CloneType));
+          return new ClassDecl(Tok(dd.tok), dd.Name, m, tps, mm, CloneAttributes(dd.Attributes), dd.TraitsTyp.ConvertAll(CloneType), dd);
         }
       } else if (d is ModuleDecl) {
         if (d is LiteralModuleDecl) {
diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index 7b51fb5e..6e939968 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -515,7 +515,7 @@ Dafny
   | OtherTypeDecl<defaultModule, out td>        (. defaultModule.TopLevelDecls.Add(td); .)
   | IteratorDecl<defaultModule, out iter>       (. defaultModule.TopLevelDecls.Add(iter); .)
   | TraitDecl<defaultModule, out trait>    (. defaultModule.TopLevelDecls.Add(trait); .)
-  | ClassMemberDecl<membersDefaultClass, false, !DafnyOptions.O.AllowGlobals>
+  | ClassMemberDecl<membersDefaultClass, false, !DafnyOptions.O.AllowGlobals, false>
   }
   (. // find the default class in the default module, then append membersDefaultClass to its member list
      DefaultClassDecl defaultClass = null;
@@ -561,7 +561,7 @@ SubModuleDecl<ModuleDefinition parent, out ModuleDecl submodule>
         | NewtypeDecl<module, out td>                  (. module.TopLevelDecls.Add(td); .)
         | OtherTypeDecl<module, out td>                (. module.TopLevelDecls.Add(td); .)
         | IteratorDecl<module, out iter>               (. module.TopLevelDecls.Add(iter); .)
-        | ClassMemberDecl<namedModuleDefaultClassMembers, false, !DafnyOptions.O.AllowGlobals>
+        | ClassMemberDecl<namedModuleDefaultClassMembers, false, !DafnyOptions.O.AllowGlobals, true>
         }
       "}"                                  (. module.BodyEndTok = t;
                                               module.TopLevelDecls.Add(new DefaultClassDecl(module, namedModuleDefaultClassMembers));
@@ -618,7 +618,7 @@ ClassDecl<ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c>
   {"," Type<out trait>  (. traits.Add(trait); .) }
   ]         
   "{"                                            (. bodyStart = t;  .)
-  { ClassMemberDecl<members, true, false>
+  { ClassMemberDecl<members, true, false, false>
   }
   "}"
   (. c = new ClassDecl(id, id.val, module, typeArgs, members, attrs, traits);
@@ -642,7 +642,7 @@ ClassDecl<ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c>
 	NoUSIdent<out id>
 	[ GenericParameters<typeArgs> ]
 	"{"                                            (. bodyStart = t; .)
-    { ClassMemberDecl<members, true, false>
+    { ClassMemberDecl<members, true, false, false>
     }
     "}"
 	(. trait = new TraitDecl(id, id.val, module, typeArgs, members, attrs);
@@ -651,7 +651,7 @@ ClassDecl<ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c>
     .)
 	.
 
-ClassMemberDecl<.List<MemberDecl> mm, bool allowConstructors, bool moduleLevelDecl.>
+ClassMemberDecl<.List<MemberDecl> mm, bool allowConstructors, bool moduleLevelDecl, bool permitAbstractDecl.>
 = (. Contract.Requires(cce.NonNullElements(mm));
      Method/*!*/ m;
      Function/*!*/ f;
@@ -685,7 +685,7 @@ ClassMemberDecl<.List<MemberDecl> mm, bool allowConstructors, bool moduleLevelDe
          mmod.IsProtected = false;
        }
     .)
-    MethodDecl<mmod, allowConstructors, out m>  (. mm.Add(m); .)
+    MethodDecl<mmod, allowConstructors, permitAbstractDecl, out m>  (. mm.Add(m); .)
   )
   .
 DatatypeDecl<ModuleDefinition/*!*/ module, out DatatypeDecl/*!*/ dt>
@@ -937,7 +937,7 @@ GenericParameters<.List<TypeParameter/*!*/>/*!*/ typeArgs.>
   ">"
   .
 /*------------------------------------------------------------------------*/
-MethodDecl<MemberModifiers mmod, bool allowConstructor, out Method/*!*/ m>
+MethodDecl<MemberModifiers mmod, bool allowConstructor, bool permitAbstractDecl, out Method/*!*/ m>
 = (. Contract.Ensures(Contract.ValueAtReturn(out m) !=null);
      IToken/*!*/ id = Token.NoToken;
      bool hasName = false;  IToken keywordToken;
@@ -1018,7 +1018,7 @@ MethodDecl<MemberModifiers mmod, bool allowConstructor, out Method/*!*/ m>
   [ BlockStmt<out body, out bodyStart, out bodyEnd>
   ]
   (.
-     if (DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported") && !Attributes.Contains(attrs, "decl") && theVerifyThisFile) {
+     if (!permitAbstractDecl && DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported") && !Attributes.Contains(attrs, "decl") && theVerifyThisFile) {
         SemErr(t, "a method with an ensures clause must have a body, unless given the :axiom attribute");
      }
 
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index d14d82a3..c90755a3 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -1777,6 +1777,14 @@ namespace Microsoft.Dafny {
       this.refinementBase = null;
       Includes = new List<Include>();
       IsBuiltinName = isBuiltinName;
+
+      if (isExclusiveRefinement && !DafnyOptions.O.IronDafny) {
+        parser.errors.SynErr(
+          tok.filename,
+          tok.line,
+          tok.col,
+          "The exclusively keyword is experimental and only available when IronDafny features are enabled (/ironDafny).");
+      }
     }
     public virtual bool IsDefaultModule {
       get {
@@ -1990,8 +1998,8 @@ namespace Microsoft.Dafny {
     }
 
     public ClassDecl(IToken tok, string name, ModuleDefinition module,
-      List<TypeParameter> typeArgs, [Captured] List<MemberDecl> members, Attributes attributes, List<Type> traits)
-      : base(tok, name, module, typeArgs, attributes) {
+      List<TypeParameter> typeArgs, [Captured] List<MemberDecl> members, Attributes attributes, List<Type> traits, ClassDecl clonedFrom = null)
+      : base(tok, name, module, typeArgs, attributes, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(module != null);
@@ -2005,6 +2013,12 @@ namespace Microsoft.Dafny {
         return false;
       }
     }
+
+    public new ClassDecl ClonedFrom {
+      get {
+        return (ClassDecl)base.ClonedFrom; 
+      }
+    }
   }
 
   public class DefaultClassDecl : ClassDecl {
@@ -2067,8 +2081,8 @@ namespace Microsoft.Dafny {
     }
 
     public DatatypeDecl(IToken tok, string name, ModuleDefinition module, List<TypeParameter> typeArgs,
-      [Captured] List<DatatypeCtor> ctors, Attributes attributes)
-      : base(tok, name, module, typeArgs, attributes) {
+      [Captured] List<DatatypeCtor> ctors, Attributes attributes, DatatypeDecl clonedFrom = null)
+      : base(tok, name, module, typeArgs, attributes, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(module != null);
@@ -2082,6 +2096,12 @@ namespace Microsoft.Dafny {
         return (TypeArgs.Count == 0 && Ctors.TrueForAll(ctr => ctr.Formals.Count == 0));
       }
     }
+
+    public new DatatypeDecl ClonedFrom {
+      get {
+        return (DatatypeDecl)base.ClonedFrom; 
+      }
+    }
   }
 
   public class IndDatatypeDecl : DatatypeDecl
@@ -2094,8 +2114,8 @@ namespace Microsoft.Dafny {
     public ES EqualitySupport = ES.NotYetComputed;
 
     public IndDatatypeDecl(IToken tok, string name, ModuleDefinition module, List<TypeParameter> typeArgs,
-      [Captured] List<DatatypeCtor> ctors, Attributes attributes)
-      : base(tok, name, module, typeArgs, ctors, attributes) {
+      [Captured] List<DatatypeCtor> ctors, Attributes attributes, IndDatatypeDecl clonedFrom = null)
+      : base(tok, name, module, typeArgs, ctors, attributes, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(module != null);
@@ -2103,6 +2123,12 @@ namespace Microsoft.Dafny {
       Contract.Requires(cce.NonNullElements(ctors));
       Contract.Requires(1 <= ctors.Count);
     }
+
+    public new IndDatatypeDecl ClonedFrom {
+      get {
+        return (IndDatatypeDecl)base.ClonedFrom;
+      }
+    }
   }
 
   public class TupleTypeDecl : IndDatatypeDecl
@@ -2578,16 +2604,16 @@ namespace Microsoft.Dafny {
     public readonly BoundVar Var;  // can be null (if non-null, then object.ReferenceEquals(Var.Type, BaseType))
     public readonly Expression Constraint;  // is null iff Var is
     public NativeType NativeType; // non-null for fixed-size representations (otherwise, use BigIntegers for integers)
-    public NewtypeDecl(IToken tok, string name, ModuleDefinition module, Type baseType, Attributes attributes)
-      : base(tok, name, module, new List<TypeParameter>(), attributes) {
+    public NewtypeDecl(IToken tok, string name, ModuleDefinition module, Type baseType, Attributes attributes, NewtypeDecl clonedFrom = null)
+      : base(tok, name, module, new List<TypeParameter>(), attributes, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(module != null);
       Contract.Requires(baseType != null);
       BaseType = baseType;
     }
-    public NewtypeDecl(IToken tok, string name, ModuleDefinition module, BoundVar bv, Expression constraint, Attributes attributes)
-      : base(tok, name, module, new List<TypeParameter>(), attributes) {
+    public NewtypeDecl(IToken tok, string name, ModuleDefinition module, BoundVar bv, Expression constraint, Attributes attributes, NewtypeDecl clonedFrom = null)
+      : base(tok, name, module, new List<TypeParameter>(), attributes, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(module != null);
@@ -2618,6 +2644,12 @@ namespace Microsoft.Dafny {
       get { throw new cce.UnreachableException(); }  // see comment above about ICallable.Decreases
       set { throw new cce.UnreachableException(); }  // see comment above about ICallable.Decreases
     }
+
+    public new NewtypeDecl ClonedFrom {
+      get {
+        return (NewtypeDecl)base.ClonedFrom;
+      }
+    }
   }
 
   public class TypeSynonymDecl : TopLevelDecl, RedirectingTypeDecl
diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index a3b26f2a..978525f3 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -15,7 +15,11 @@ namespace Microsoft.Dafny
 
     public override string VersionNumber {
       get {
-        return System.Diagnostics.FileVersionInfo.GetVersionInfo(System.Reflection.Assembly.GetExecutingAssembly().Location).FileVersion;
+        return System.Diagnostics.FileVersionInfo.GetVersionInfo(System.Reflection.Assembly.GetExecutingAssembly().Location).FileVersion
+#if ENABLE_IRONDAFNY
+          + "[IronDafny]"
+#endif
+          ;
       }
     }
     public override string VersionSuffix {
@@ -59,6 +63,13 @@ namespace Microsoft.Dafny
     public bool PrintStats = false;
     public bool PrintFunctionCallGraph = false;
     public bool WarnShadowing = false;
+    public bool IronDafny = 
+#if ENABLE_IRONDAFNY 
+      true
+#else
+      false
+#endif
+    ;
 
     protected override bool ParseOption(string name, Bpl.CommandLineOptionEngine.CommandLineParseState ps) {
       var args = ps.args;  // convenient synonym
@@ -201,6 +212,16 @@ namespace Microsoft.Dafny
             return true;
         }
 
+        case "noIronDafny": {
+            IronDafny = false;
+            return true;
+        }
+
+        case "ironDafny": {
+            IronDafny = true;
+            return true;
+        }
+
         default:
           break;
       }
@@ -301,6 +322,10 @@ namespace Microsoft.Dafny
   /funcCallGraph Print out the function call graph.  Format is: func,mod=callee*
   /warnShadowing  Emits a warning if the name of a declared variable caused another variable
                 to be shadowed
+  /ironDafny    Enable experimental features needed to support Ironclad/Ironfleet. Use of
+                these features may cause your code to become incompatible with future
+                releases of Dafny.
+  /noIronDafny  Disable Ironclad/Ironfleet features, if enabled by default.
 ");
       base.Usage();  // also print the Boogie options
     }
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index a90e650a..0c88cc22 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -576,7 +576,7 @@ bool IsType(ref IToken pt) {
 				break;
 			}
 			case 37: case 38: case 39: case 40: case 41: case 72: case 73: case 74: case 77: case 83: case 84: case 85: case 86: {
-				ClassMemberDecl(membersDefaultClass, false, !DafnyOptions.O.AllowGlobals);
+				ClassMemberDecl(membersDefaultClass, false, !DafnyOptions.O.AllowGlobals, false);
 				break;
 			}
 			}
@@ -672,7 +672,7 @@ bool IsType(ref IToken pt) {
 					break;
 				}
 				case 37: case 38: case 39: case 40: case 41: case 72: case 73: case 74: case 77: case 83: case 84: case 85: case 86: {
-					ClassMemberDecl(namedModuleDefaultClassMembers, false, !DafnyOptions.O.AllowGlobals);
+					ClassMemberDecl(namedModuleDefaultClassMembers, false, !DafnyOptions.O.AllowGlobals, true);
 					break;
 				}
 				}
@@ -750,7 +750,7 @@ bool IsType(ref IToken pt) {
 		Expect(45);
 		bodyStart = t;  
 		while (StartOf(2)) {
-			ClassMemberDecl(members, true, false);
+			ClassMemberDecl(members, true, false, false);
 		}
 		Expect(46);
 		c = new ClassDecl(id, id.val, module, typeArgs, members, attrs, traits);
@@ -961,7 +961,7 @@ bool IsType(ref IToken pt) {
 		Expect(45);
 		bodyStart = t; 
 		while (StartOf(2)) {
-			ClassMemberDecl(members, true, false);
+			ClassMemberDecl(members, true, false, false);
 		}
 		Expect(46);
 		trait = new TraitDecl(id, id.val, module, typeArgs, members, attrs);
@@ -970,7 +970,7 @@ bool IsType(ref IToken pt) {
 		
 	}
 
-	void ClassMemberDecl(List<MemberDecl> mm, bool allowConstructors, bool moduleLevelDecl) {
+	void ClassMemberDecl(List<MemberDecl> mm, bool allowConstructors, bool moduleLevelDecl, bool permitAbstractDecl) {
 		Contract.Requires(cce.NonNullElements(mm));
 		Method/*!*/ m;
 		Function/*!*/ f;
@@ -1015,7 +1015,7 @@ bool IsType(ref IToken pt) {
 			 mmod.IsProtected = false;
 			}
 			
-			MethodDecl(mmod, allowConstructors, out m);
+			MethodDecl(mmod, allowConstructors, permitAbstractDecl, out m);
 			mm.Add(m); 
 		} else SynErr(151);
 	}
@@ -1273,7 +1273,7 @@ bool IsType(ref IToken pt) {
 		
 	}
 
-	void MethodDecl(MemberModifiers mmod, bool allowConstructor, out Method/*!*/ m) {
+	void MethodDecl(MemberModifiers mmod, bool allowConstructor, bool permitAbstractDecl, out Method/*!*/ m) {
 		Contract.Ensures(Contract.ValueAtReturn(out m) !=null);
 		IToken/*!*/ id = Token.NoToken;
 		bool hasName = false;  IToken keywordToken;
@@ -1393,7 +1393,7 @@ bool IsType(ref IToken pt) {
 		if (la.kind == 45) {
 			BlockStmt(out body, out bodyStart, out bodyEnd);
 		}
-		if (DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported") && !Attributes.Contains(attrs, "decl") && theVerifyThisFile) {
+		if (!permitAbstractDecl && DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported") && !Attributes.Contains(attrs, "decl") && theVerifyThisFile) {
 		  SemErr(t, "a method with an ensures clause must have a body, unless given the :axiom attribute");
 		}
 		
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 3e308e76..460859db 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -919,20 +919,27 @@ namespace Microsoft.Dafny
       sig.IsGhost = moduleDef.IsAbstract;
       List<TopLevelDecl> declarations = moduleDef.TopLevelDecls;
 
-      if (useImports) {
-        // First go through and add anything from the opened imports
-        foreach (var im in declarations) {
-          if (im is ModuleDecl && ((ModuleDecl)im).Opened) {
-            var s = GetSignature(((ModuleDecl)im).Signature);
+      // First go through and add anything from the opened imports
+      foreach (var im in declarations) {
+        if (im is ModuleDecl && ((ModuleDecl)im).Opened) {
+          var s = GetSignature(((ModuleDecl)im).Signature);
+
+          if (useImports || DafnyOptions.O.IronDafny) {
             // classes:
             foreach (var kv in s.TopLevels) {
-              TopLevelDecl d;
-              if (sig.TopLevels.TryGetValue(kv.Key, out d)) {
-                sig.TopLevels[kv.Key] = AmbiguousTopLevelDecl.Create(moduleDef, d, kv.Value);
-              } else {
-                sig.TopLevels.Add(kv.Key, kv.Value);
+              // IronDafny: we need to pull the members of the opened module's _default class in so that they can be merged.
+              if (useImports || string.Equals(kv.Key, "_default", StringComparison.InvariantCulture)) {
+                TopLevelDecl d;
+                if (sig.TopLevels.TryGetValue(kv.Key, out d)) {
+                  sig.TopLevels[kv.Key] = AmbiguousTopLevelDecl.Create(moduleDef, d, kv.Value);
+                } else {
+                  sig.TopLevels.Add(kv.Key, kv.Value);
+                }
               }
             }
+          }
+
+          if (useImports) {
             // constructors:
             foreach (var kv in s.Ctors) {
               Tuple<DatatypeCtor, bool> pair;
@@ -948,6 +955,9 @@ namespace Microsoft.Dafny
                 sig.Ctors.Add(kv.Key, kv.Value);
               }
             }
+          }
+
+          if (useImports || DafnyOptions.O.IronDafny) {
             // static members:
             foreach (var kv in s.StaticMembers) {
               MemberDecl md;
@@ -957,7 +967,7 @@ namespace Microsoft.Dafny
                 // add new
                 sig.StaticMembers.Add(kv.Key, kv.Value);
               }
-            }
+            }              
           }
         }
       }
@@ -4406,8 +4416,23 @@ namespace Microsoft.Dafny
           return false;
         }
         var aa = (UserDefinedType)a;
+        var rca = aa.ResolvedClass;
         var bb = (UserDefinedType)b;
-        if (aa.ResolvedClass != null && aa.ResolvedClass == bb.ResolvedClass) {
+        var rcb = bb.ResolvedClass;
+        if (DafnyOptions.O.IronDafny)
+        {
+          while (rca != null && rca.Module.IsAbstract && rca.ClonedFrom != null)
+          {
+            // todo: should ClonedFrom be a TopLevelDecl?
+            // todo: should ClonedFrom be moved to TopLevelDecl?
+            rca = (TopLevelDecl)rca.ClonedFrom;
+          }
+          while (rcb != null && rcb.Module.IsAbstract && rcb.ClonedFrom != null)
+          {
+            rcb = (TopLevelDecl)rcb.ClonedFrom;
+          }
+        }
+        if (rca != null && rca == rcb) {
           // these are both resolved class/datatype types
           Contract.Assert(aa.TypeArgs.Count == bb.TypeArgs.Count);
           bool successSoFar = true;
@@ -4416,12 +4441,12 @@ namespace Microsoft.Dafny
           }
           return successSoFar;
         }
-        else if ((bb.ResolvedClass is TraitDecl) && (aa.ResolvedClass is TraitDecl)) {
-            return ((TraitDecl)bb.ResolvedClass).FullCompileName == ((TraitDecl)aa.ResolvedClass).FullCompileName;
-        } else if ((bb.ResolvedClass is ClassDecl) && (aa.ResolvedClass is TraitDecl)) {
-            return ((ClassDecl)bb.ResolvedClass).TraitsObj.Any(tr => tr.FullCompileName == ((TraitDecl)aa.ResolvedClass).FullCompileName);
-        } else if ((aa.ResolvedClass is ClassDecl) && (bb.ResolvedClass is TraitDecl)) {
-            return ((ClassDecl)aa.ResolvedClass).TraitsObj.Any(tr => tr.FullCompileName == ((TraitDecl)bb.ResolvedClass).FullCompileName);
+        else if ((rcb is TraitDecl) && (rca is TraitDecl)) {
+            return ((TraitDecl)rcb).FullCompileName == ((TraitDecl)rca).FullCompileName;
+        } else if ((rcb is ClassDecl) && (rca is TraitDecl)) {
+            return ((ClassDecl)rcb).TraitsObj.Any(tr => tr.FullCompileName == ((TraitDecl)rca).FullCompileName);
+        } else if ((rca is ClassDecl) && (rcb is TraitDecl)) {
+            return ((ClassDecl)rca).TraitsObj.Any(tr => tr.FullCompileName == ((TraitDecl)rcb).FullCompileName);
         } else if (aa.ResolvedParam != null && aa.ResolvedParam == bb.ResolvedParam) {
           // type parameters
           if (aa.TypeArgs.Count != bb.TypeArgs.Count) {
diff --git a/Test/irondafny0/FIFO.dfy b/Test/irondafny0/FIFO.dfy
index 1256b55d..ded8f567 100644
--- a/Test/irondafny0/FIFO.dfy
+++ b/Test/irondafny0/FIFO.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /ironDafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 include "Queue.dfyi"
diff --git a/Test/irondafny0/LIFO.dfy b/Test/irondafny0/LIFO.dfy
index bac08fba..8c0a08e8 100644
--- a/Test/irondafny0/LIFO.dfy
+++ b/Test/irondafny0/LIFO.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /ironDafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 include "Queue.dfyi"
diff --git a/Test/irondafny0/opened_workaround.dfy b/Test/irondafny0/opened_workaround.dfy
new file mode 100644
index 00000000..7464c346
--- /dev/null
+++ b/Test/irondafny0/opened_workaround.dfy
@@ -0,0 +1,21 @@
+// RUN: %dafny /ironDafny /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+module A {
+
+    predicate P() 
+
+    class C
+    {
+        static method{:axiom} M()
+            ensures P();
+    } 
+}
+
+abstract module B {
+    import opened A
+}
+
+abstract module C {
+    import Bee as B       // Works
+}
diff --git a/Test/irondafny0/opened_workaround.dfy.expect b/Test/irondafny0/opened_workaround.dfy.expect
new file mode 100644
index 00000000..0be94b4c
--- /dev/null
+++ b/Test/irondafny0/opened_workaround.dfy.expect
@@ -0,0 +1,3 @@
+
+Dafny program verifier finished with 3 verified, 0 errors
+Compilation error: Function _0_A_Compile._default.P has no body
diff --git a/Test/irondafny0/xrefine0.dfy b/Test/irondafny0/xrefine0.dfy
index 35993ce8..b849111c 100644
--- a/Test/irondafny0/xrefine0.dfy
+++ b/Test/irondafny0/xrefine0.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /ironDafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 abstract module Delicious {}
diff --git a/Test/irondafny0/xrefine1.dfy b/Test/irondafny0/xrefine1.dfy
index 10d25f53..4b085e6b 100644
--- a/Test/irondafny0/xrefine1.dfy
+++ b/Test/irondafny0/xrefine1.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /ironDafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 abstract module ProtocolSpec {
diff --git a/Test/irondafny0/xrefine2.dfy b/Test/irondafny0/xrefine2.dfy
index 7578b424..1de4e201 100644
--- a/Test/irondafny0/xrefine2.dfy
+++ b/Test/irondafny0/xrefine2.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /ironDafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 abstract module ProtocolSpec {
diff --git a/Test/irondafny0/xrefine3.dfy b/Test/irondafny0/xrefine3.dfy
index 69c5bc27..44add7cc 100644
--- a/Test/irondafny0/xrefine3.dfy
+++ b/Test/irondafny0/xrefine3.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /ironDafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 abstract module AlphaSpec {
-- 
cgit v1.2.3


From dfef591e33e79f03877c65e584521068a6114d50 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Mon, 13 Jul 2015 21:02:50 +0100
Subject: Make attributes enumerable.

Use an extension method to properly deal with null attributes
---
 Source/Dafny/DafnyAst.cs   | 49 +++++++++++++++++++++++-----------------------
 Source/Dafny/Resolver.cs   |  6 +++---
 Source/Dafny/Rewriter.cs   | 12 ++++++------
 Source/Dafny/Translator.cs | 30 +++++++++++++---------------
 4 files changed, 48 insertions(+), 49 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index eac64f80..af51d650 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -10,6 +10,7 @@ using System.Diagnostics.Contracts;
 using System.Numerics;
 using System.Linq;
 using Microsoft.Boogie;
+using System.Diagnostics;
 
 namespace Microsoft.Dafny {
   public class Program {
@@ -232,21 +233,12 @@ namespace Microsoft.Dafny {
     }
 
     public static IEnumerable<Expression> SubExpressions(Attributes attrs) {
-      for (; attrs != null; attrs = attrs.Prev) {
-        foreach (var arg in attrs.Args) {
-          yield return arg;
-        }
-      }
+      return attrs.AsEnumerable().SelectMany(aa => attrs.Args);
     }
 
     public static bool Contains(Attributes attrs, string nm) {
       Contract.Requires(nm != null);
-      for (; attrs != null; attrs = attrs.Prev) {
-        if (attrs.Name == nm) {
-          return true;
-        }
-      }
-      return false;
+      return attrs.AsEnumerable().Any(aa => aa.Name == nm);
     }
 
     /// <summary>
@@ -258,10 +250,10 @@ namespace Microsoft.Dafny {
     [Pure]
     public static bool ContainsBool(Attributes attrs, string nm, ref bool value) {
       Contract.Requires(nm != null);
-      for (; attrs != null; attrs = attrs.Prev) {
-        if (attrs.Name == nm) {
-          if (attrs.Args.Count == 1) {
-            var arg = attrs.Args[0] as LiteralExpr;
+      foreach (var attr in attrs.AsEnumerable()) {
+        if (attr.Name == nm) {
+          if (attr.Args.Count == 1) {
+            var arg = attr.Args[0] as LiteralExpr;
             if (arg != null && arg.Value is bool) {
               value = (bool)arg.Value;
             }
@@ -306,9 +298,9 @@ namespace Microsoft.Dafny {
     /// </summary>
     public static List<Expression> FindExpressions(Attributes attrs, string nm) {
       Contract.Requires(nm != null);
-      for (; attrs != null; attrs = attrs.Prev) {
-        if (attrs.Name == nm) {
-          return attrs.Args;
+      foreach (var attr in attrs.AsEnumerable()) {
+        if (attr.Name == nm) {
+          return attr.Args;
         }
       }
       return null;
@@ -366,6 +358,15 @@ namespace Microsoft.Dafny {
     }
   }
 
+  internal static class AttributesExtensions {
+    public static IEnumerable<Attributes> AsEnumerable(this Attributes attr) {
+      while (attr != null) {
+        yield return attr;
+        attr = attr.Prev;
+      }
+    }
+  }
+
   // ------------------------------------------------------------------------------------------------------
 
   public abstract class Type {
@@ -3042,7 +3043,7 @@ namespace Microsoft.Dafny {
       prefixPredCall.TypeArgumentSubstitutions = new Dictionary<TypeParameter, Type>();
       var old_to_new = new Dictionary<TypeParameter, TypeParameter>();
       for (int i = 0; i < this.TypeArgs.Count; i++) {
-	 old_to_new[this.TypeArgs[i]] = this.PrefixPredicate.TypeArgs[i];
+   old_to_new[this.TypeArgs[i]] = this.PrefixPredicate.TypeArgs[i];
       }
       foreach (var p in fexp.TypeArgumentSubstitutions) {
         prefixPredCall.TypeArgumentSubstitutions[old_to_new[p.Key]] = p.Value;
@@ -4950,7 +4951,7 @@ namespace Microsoft.Dafny {
   }
 
   // ------------------------------------------------------------------------------------------------------
-
+  [DebuggerDisplay("{Printer.ExprToString(this)}")]
   public abstract class Expression
   {
     public readonly IToken tok;
@@ -5568,8 +5569,8 @@ namespace Microsoft.Dafny {
       Contract.Invariant(cce.NonNullElements(Arguments));
       Contract.Invariant(cce.NonNullElements(InferredTypeArgs));
       Contract.Invariant(
-	Ctor == null ||
-	InferredTypeArgs.Count == Ctor.EnclosingDatatype.TypeArgs.Count);
+  Ctor == null ||
+  InferredTypeArgs.Count == Ctor.EnclosingDatatype.TypeArgs.Count);
     }
 
     public DatatypeValue(IToken tok, string datatypeName, string memberName, [Captured] List<Expression> arguments)
@@ -6003,10 +6004,10 @@ namespace Microsoft.Dafny {
         Function == null || TypeArgumentSubstitutions == null ||
         Contract.ForAll(
           Function.TypeArgs,
-        	  a => TypeArgumentSubstitutions.ContainsKey(a)) &&
+            a => TypeArgumentSubstitutions.ContainsKey(a)) &&
         Contract.ForAll(
           TypeArgumentSubstitutions.Keys,
-        	  a => Function.TypeArgs.Contains(a) || Function.EnclosingClass.TypeArgs.Contains(a)));
+            a => Function.TypeArgs.Contains(a) || Function.EnclosingClass.TypeArgs.Contains(a)));
     }
 
     public Function Function;  // filled in by resolution
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 5e08a38a..c5535808 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -3429,9 +3429,9 @@ namespace Microsoft.Dafny
       Contract.Requires(opts != null);
       Contract.Requires(opts.DontCareAboutCompilation);  // attributes are never compiled
       // order does not matter much for resolution, so resolve them in reverse order
-      for (; attrs != null; attrs = attrs.Prev) {
-        if (attrs.Args != null) {
-          ResolveAttributeArgs(attrs.Args, opts, true);
+      foreach (var attr in attrs.AsEnumerable()) {
+        if (attr.Args != null) {
+          ResolveAttributeArgs(attr.Args, opts, true);
         }
       }
     }
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 1dd985cb..c0a25a82 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -1087,15 +1087,15 @@ namespace Microsoft.Dafny
               // Check for the timeLimitMultiplier attribute
               if (Attributes.Contains(member.Attributes, "timeLimitMultiplier")) {
                 Attributes attrs = member.Attributes;
-                for (; attrs != null; attrs = attrs.Prev) {
-                  if (attrs.Name == "timeLimitMultiplier") {
-                    if (attrs.Args.Count == 1 && attrs.Args[0] is LiteralExpr) {
-                      var arg = attrs.Args[0] as LiteralExpr;
+                foreach (var attr in attrs.AsEnumerable()) {
+                  if (attr.Name == "timeLimitMultiplier") {
+                    if (attr.Args.Count == 1 && attr.Args[0] is LiteralExpr) {
+                      var arg = attr.Args[0] as LiteralExpr;
                       System.Numerics.BigInteger value = (System.Numerics.BigInteger)arg.Value;
                       if (value.Sign > 0) {
                         int current_limit = DafnyOptions.O.ProverKillTime > 0 ? DafnyOptions.O.ProverKillTime : 10;  // Default to 10 seconds
-                        attrs.Args[0] = new LiteralExpr(attrs.Args[0].tok, value * current_limit);
-                        attrs.Name = "timeLimit";
+                        attr.Args[0] = new LiteralExpr(attr.Args[0].tok, value * current_limit);
+                        attr.Name = "timeLimit";
                       }
                     }
                   }
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 26412384..d375c2bb 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -11774,13 +11774,13 @@ namespace Microsoft.Dafny {
 
       public Bpl.QKeyValue TrAttributes(Attributes attrs, string skipThisAttribute) {
         Bpl.QKeyValue kv = null;
-        for ( ; attrs != null; attrs = attrs.Prev) {
-          if (attrs.Name == skipThisAttribute
-           || attrs.Name == "axiom") {  // Dafny's axiom attribute clashes with Boogie's axiom keyword
+        foreach (var attr in attrs.AsEnumerable()) {
+          if (attr.Name == skipThisAttribute
+           || attr.Name == "axiom") {  // Dafny's axiom attribute clashes with Boogie's axiom keyword
             continue;
           }
           List<object> parms = new List<object>();
-          foreach (var arg in attrs.Args) {
+          foreach (var arg in attr.Args) {
             var s = arg.AsStringLiteral();
             if (s != null) {
               // pass string literals down to Boogie as string literals, not as their expression translation
@@ -11791,7 +11791,7 @@ namespace Microsoft.Dafny {
               parms.Add(e);
             }
           }
-          kv = new Bpl.QKeyValue(Token.NoToken, attrs.Name, parms, kv);
+          kv = new Bpl.QKeyValue(Token.NoToken, attr.Name, parms, kv);
         }
         return kv;
       }
@@ -12470,18 +12470,16 @@ namespace Microsoft.Dafny {
     Bpl.Trigger TrTrigger(ExpressionTranslator etran, Attributes attribs, IToken tok, Dictionary<IVariable, Expression> substMap = null)
     {
       Bpl.Trigger tr = null;
-      for (Attributes aa = attribs; aa != null; aa = aa.Prev) {
-        if (aa.Name == "trigger") {
-          List<Bpl.Expr> tt = new List<Bpl.Expr>();
-          foreach (var arg in aa.Args) {
-            if (substMap == null) {
-              tt.Add(etran.TrExpr(arg));
-            } else {
-              tt.Add(etran.TrExpr(Substitute(arg, null, substMap)));
-            }
+      foreach (var trigger in attribs.AsEnumerable().Where(aa => aa.Name == "trigger").Select(aa => aa.Args)) {
+        List<Bpl.Expr> tt = new List<Bpl.Expr>();
+        foreach (var arg in trigger) {
+          if (substMap == null) {
+            tt.Add(etran.TrExpr(arg));
+          } else {
+            tt.Add(etran.TrExpr(Substitute(arg, null, substMap)));
           }
-          tr = new Bpl.Trigger(tok, true, tt, tr);
         }
+        tr = new Bpl.Trigger(tok, true, tt, tr);
       }
       return tr;
     }
@@ -12920,7 +12918,7 @@ namespace Microsoft.Dafny {
         return new List<VarType>();  // don't apply induction
       }
 
-      for (var a = attributes; a != null; a = a.Prev) {
+      foreach (var a in attributes.AsEnumerable()) {
         if (a.Name == "induction") {
           // Here are the supported forms of the :induction attribute.
           //    :induction           -- apply induction to all bound variables
-- 
cgit v1.2.3


From e90a947a54044487e8ccf984033b1113eac0d49e Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Mon, 13 Jul 2015 11:50:06 -0700
Subject: Initial import of the TriggerGenerator code.

Includes trigger generation, basic cycle detection, and basic equality
comparison for Dafny expressions.
---
 Source/Dafny/TriggerGenerator.cs | 971 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 971 insertions(+)
 create mode 100644 Source/Dafny/TriggerGenerator.cs

(limited to 'Source')

diff --git a/Source/Dafny/TriggerGenerator.cs b/Source/Dafny/TriggerGenerator.cs
new file mode 100644
index 00000000..1783a00c
--- /dev/null
+++ b/Source/Dafny/TriggerGenerator.cs
@@ -0,0 +1,971 @@
+#define DEBUG_AUTO_TRIGGERS
+#define THROW_UNSUPPORTED_COMPARISONS
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using Microsoft.Boogie;
+using System.Diagnostics.Contracts;
+using System.Text;
+using System.Diagnostics;
+
+//FIXME No LitInts in triggers
+//FIXME Generated triggers should be _triggers, and if a predicate is called with something that can't be a trigger head we shouldn't inline it (see .\Test\dafny2\SnapshotableTrees.dfy)
+//FIXME: When scoring, do not consider old(x) to be higher than x.
+
+/* High level note: There are really two processes going on here. One is finding quantifiers; 
+ * the other is walking the subtree corresponding to each quantifier, and finding trigger candidates.
+ * These two processes are interleaved, because we can look for trigger candidates as we look for 
+ * quantifiers. Since the visitor starts from the bottom of the tree, the recursive annotation 
+ * procedure never causes deep recursion; every call it makes hits the cache that has been built 
+ * during the visiting of lower level nodes.
+ * 
+ * Note also that it wouldn't be enough to just use the recursive procedure: it doesn't visit 
+ * statements, for example.
+ */
+
+namespace Microsoft.Dafny {
+  class TriggerCandidate { // TODO Hashing is broken (duplicates can pop up)
+    internal Expression Expr;
+    internal ISet<IVariable> Variables;
+    internal Expression[] PotentialMatchingLoops;
+
+    public override string ToString() {
+      return Printer.ExprToString(Expr);
+    }
+  }
+  
+  struct MultiTriggerCandidate {
+    internal ISet<TriggerCandidate> Candidates;
+    internal double Score;
+
+    public override string ToString() {
+      return String.Format("[{0:G2}] {1}", Score, String.Join(", ", Candidates));
+    }
+  }
+
+  class TriggerAnnotation {
+    internal bool IsTriggerKiller;
+    internal ISet<IVariable> Variables;
+    internal readonly HashSet<TriggerCandidate> PrivateCandidates;
+    internal readonly HashSet<TriggerCandidate> ExportedCandidates;
+
+    internal TriggerAnnotation(bool IsTriggerKiller, IEnumerable<IVariable> Variables, 
+                               IEnumerable<TriggerCandidate> AllCandidates, IEnumerable<TriggerCandidate> PrivateCandidates = null) {
+      this.IsTriggerKiller = IsTriggerKiller;
+      this.Variables = new HashSet<IVariable>(Variables);
+
+      this.ExportedCandidates = new HashSet<TriggerCandidate>(AllCandidates == null ? Enumerable.Empty<TriggerCandidate>() : AllCandidates);
+      this.PrivateCandidates = new HashSet<TriggerCandidate>(PrivateCandidates == null ? Enumerable.Empty<TriggerCandidate>() : PrivateCandidates);
+      this.ExportedCandidates.ExceptWith(this.PrivateCandidates);
+    }
+
+    public override string ToString() {
+      StringBuilder sb = new StringBuilder();
+      string indent = "  {0}", nindent = "\n  - {0}", subindent = "\n    * {0}";
+
+      sb.AppendFormat(indent, IsTriggerKiller);
+
+      sb.AppendFormat(nindent, "Variables:");
+      foreach (var bv in Variables) {
+        sb.AppendFormat(subindent, bv.Name);
+      }
+
+      sb.AppendFormat(nindent, "Exported candidates:");
+      foreach (var candidate in ExportedCandidates) {
+        sb.AppendFormat(subindent, candidate);
+      }
+
+      if (PrivateCandidates.Any()) {
+        sb.AppendFormat(nindent, "Private candidates:");
+        foreach (var candidate in PrivateCandidates) {
+          sb.AppendFormat(subindent, candidate);
+        }
+      }
+
+      return sb.ToString();
+    }
+  }
+
+  public class TriggerGenerator : BottomUpVisitor {
+    List<QuantifierExpr> quantifiers;
+    Dictionary<Expression, TriggerAnnotation> annotations;
+
+    Resolver Resolver;
+
+    private TriggerGenerator(Resolver resolver) {
+      Contract.Requires(Resolver != null);
+      this.quantifiers = new List<QuantifierExpr>();
+      this.annotations = new Dictionary<Expression, TriggerAnnotation>();
+      this.Resolver = resolver;
+    }
+
+    private ISet<T> MergeAlterFirst<T>(ISet<T> a, ISet<T> b) {
+      Contract.Requires(a != null);
+      Contract.Requires(b != null);
+      a.UnionWith(b);
+      return a;
+    }
+
+    private ISet<T> WithOneExtraElement<T>(ISet<T> set, T elem) {
+      Contract.Requires(set != null);
+      set.Add(elem);
+      return set;
+    }
+
+    private T ReduceAnnotatedSubExpressions<T>(Expression expr, T seed, Func<TriggerAnnotation, T> map, Func<T, T, T> reduce) {
+      return expr.SubExpressions.Select(e => map(Annotate(e)))
+                                .Aggregate(seed, (acc, e) => reduce(acc, e));
+    }
+
+    private ISet<TriggerCandidate> CollectExportedCandidates(Expression expr) {
+      return ReduceAnnotatedSubExpressions<ISet<TriggerCandidate>>(expr, new HashSet<TriggerCandidate>(), a => a.ExportedCandidates, MergeAlterFirst);
+    }
+
+    private ISet<IVariable> CollectVariables(Expression expr) {
+      return ReduceAnnotatedSubExpressions(expr, new HashSet<IVariable>(), a => a.Variables, MergeAlterFirst);
+    }
+
+    private bool CollectIsKiller(Expression expr) {
+      return ReduceAnnotatedSubExpressions(expr, false, a => a.IsTriggerKiller, (a, b) => a || b);
+    }
+
+    private IEnumerable<TriggerCandidate> OnlyPrivateCandidates(ISet<TriggerCandidate> candidates, IEnumerable<IVariable> privateVars) {
+      return candidates.Where(c => privateVars.Intersect(c.Variables).Any()); //TODO Check perf
+    }
+
+    private TriggerAnnotation Annotate(Expression expr) {
+      TriggerAnnotation cached;
+      if (annotations.TryGetValue(expr, out cached)) {
+        return cached;
+      }
+
+      expr.SubExpressions.Iter(e => Annotate(e)); //NOTE: These values are all cached
+
+      TriggerAnnotation annotation; // TODO: Using ApplySuffix fixes the unresolved members problem in GenericSort
+      if (expr is FunctionCallExpr || expr is SeqSelectExpr || expr is MemberSelectExpr || expr is OldExpr ||
+          (expr is UnaryOpExpr && (((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Cardinality)) || // FIXME || ((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Fresh oesn't work, as fresh is a pretty tricky predicate when it's not about datatypes. See translator.cs:10944
+          (expr is BinaryExpr  && (((BinaryExpr)expr).Op == BinaryExpr.Opcode.NotIn || ((BinaryExpr)expr).Op == BinaryExpr.Opcode.In))) {
+        annotation = AnnotatePotentialCandidate(expr);
+      } else if (expr is QuantifierExpr) {
+        annotation = AnnotateQuantifier((QuantifierExpr)expr);
+      } else if (expr is LetExpr) {
+        annotation = AnnotateLetExpr((LetExpr)expr);
+      } else if (expr is IdentifierExpr) {
+        annotation = AnnotateIdentifier((IdentifierExpr)expr);
+      } else if (expr is ApplySuffix) {
+        annotation = AnnotateApplySuffix((ApplySuffix)expr);
+      } else if (expr is ConcreteSyntaxExpression ||
+                 expr is LiteralExpr ||
+                 expr is OldExpr ||
+                 expr is ThisExpr ||
+                 expr is DatatypeValue) {
+        annotation = AnnotateOther(expr, false);
+      } else {
+        annotation = AnnotateOther(expr, true);
+      }
+
+      DebugTriggers("{0} ({1})\n{2}", Printer.ExprToString(expr), expr.GetType(), annotation);
+      annotations[expr] = annotation;
+      return annotation;
+    }
+
+    [Conditional("DEBUG_AUTO_TRIGGERS")]
+    private static void DebugTriggers(string format, params object[] more) {
+      Console.Error.WriteLine(format, more);
+    }
+
+    private BinaryExpr.ResolvedOpcode RemoveNotInBinaryExprIn(BinaryExpr.ResolvedOpcode opcode) {
+      switch(opcode) {
+        case BinaryExpr.ResolvedOpcode.NotInMap:
+          return BinaryExpr.ResolvedOpcode.InMap;
+        case BinaryExpr.ResolvedOpcode.NotInSet:
+          return BinaryExpr.ResolvedOpcode.InSet;
+        case BinaryExpr.ResolvedOpcode.NotInSeq:
+          return BinaryExpr.ResolvedOpcode.InSeq;
+        case BinaryExpr.ResolvedOpcode.NotInMultiSet:
+          return BinaryExpr.ResolvedOpcode.InMultiSet;  
+      }
+
+      Contract.Assert(false);
+      throw new ArgumentException();
+    }
+
+    private Expression CleanupExpr(Expression expr, out bool isKiller) {
+      isKiller = false;
+
+      if (!(expr is BinaryExpr)) {
+        return expr;
+      }
+
+      var bexpr = expr as BinaryExpr;
+
+      BinaryExpr new_expr = bexpr;
+      if (bexpr.Op == BinaryExpr.Opcode.NotIn) {
+        new_expr = new BinaryExpr(bexpr.tok, BinaryExpr.Opcode.In, bexpr.E0, bexpr.E1);
+        new_expr.ResolvedOp = RemoveNotInBinaryExprIn(bexpr.ResolvedOp);
+        new_expr.Type = bexpr.Type;
+      }
+
+      Expression returned_expr = new_expr;
+      if (new_expr.ResolvedOp == BinaryExpr.ResolvedOpcode.InMultiSet) {
+        returned_expr = new SeqSelectExpr(new_expr.tok, true, new_expr.E1, new_expr.E0, null);
+        returned_expr.Type = bexpr.Type;
+        isKiller = true; // [a in s] becomes [s[a] > 0], which is a trigger killer
+      }
+
+      return returned_expr;
+    }
+
+    private TriggerAnnotation AnnotatePotentialCandidate(Expression expr) {
+      bool expr_is_killer = false;
+      var new_expr = CleanupExpr(expr, out expr_is_killer);
+      var new_candidate = new TriggerCandidate { Expr = new_expr, Variables = CollectVariables(expr) }; 
+
+      ISet<TriggerCandidate> collected_candidates = CollectExportedCandidates(expr);
+      var children_contain_killers = CollectIsKiller(expr);
+
+      if (!children_contain_killers) {
+        // Add only if the children are not killers; the head has been cleaned up into non-killer form
+        collected_candidates = WithOneExtraElement(collected_candidates, new_candidate);
+      }
+
+      // This new node is a killer if its children were killers, or if it's non-cleaned-up head is a killer
+      return new TriggerAnnotation(children_contain_killers || expr_is_killer, new_candidate.Variables, collected_candidates);
+    }
+
+    private TriggerAnnotation AnnotateApplySuffix(ApplySuffix expr) {
+      // This is a bit tricky. A funcall node is generally meaningful as a trigger candidate, 
+      // but when it's part of an ApplySuffix the function call itself may not resolve properly
+      // when the second round of resolving is done after modules are duplicated.
+      // Thus first we annotate expr and create a trigger candidate, and then we remove the 
+      // candidate matching its direct subexpression if needed. Not that function calls are not the 
+      // only possible child here; there can be DatatypeValue nodes, for example (see vstte2012/Combinators.dfy).
+      var annotation = AnnotatePotentialCandidate(expr);
+      annotation.ExportedCandidates.RemoveWhere(candidate => expr.SubExpressions.Contains(candidate.Expr));
+      return annotation;
+    }
+
+    private TriggerAnnotation AnnotateQuantifierOrLetExpr(Expression expr, IEnumerable<BoundVar> boundVars) {
+      var candidates = CollectExportedCandidates(expr);
+      return new TriggerAnnotation(true, CollectVariables(expr), candidates, OnlyPrivateCandidates(candidates, boundVars));
+    }
+
+    private TriggerAnnotation AnnotateQuantifier(QuantifierExpr expr) {
+      quantifiers.Add(expr);
+      return AnnotateQuantifierOrLetExpr(expr, expr.BoundVars);
+    }
+
+    private TriggerAnnotation AnnotateLetExpr(LetExpr expr) {
+       return AnnotateQuantifierOrLetExpr(expr, expr.BoundVars);
+    }
+
+    private TriggerAnnotation AnnotateIdentifier(IdentifierExpr expr) {
+      return new TriggerAnnotation(false, Enumerable.Repeat(expr.Var, 1), null);
+    }
+
+    private TriggerAnnotation AnnotateOther(Expression expr, bool isTriggerKiller) {
+      return new TriggerAnnotation(isTriggerKiller || CollectIsKiller(expr), CollectVariables(expr), CollectExportedCandidates(expr));
+    }
+
+    private static List<T> CopyAndAdd<T>(List<T> seq, T elem) {
+      var copy = new List<T>(seq);
+      copy.Add(elem);
+      return copy;
+    }
+
+    private static IEnumerable<List<T>> AllSubsets<T>(IList<T> source, int offset) {
+      if (offset >= source.Count) {
+        yield return new List<T>();
+        yield break;
+      }
+
+      foreach (var subset in AllSubsets<T>(source, offset + 1)) {
+        yield return CopyAndAdd(subset, source[offset]);
+        yield return new List<T>(subset);
+      }
+    }
+
+    private static IEnumerable<ISet<T>> AllSubsets<T>(IEnumerable<T> source) {
+      List<T> all = new List<T>(source);
+      foreach (var subset in AllSubsets(all, 0)) {
+        yield return new HashSet<T>(subset);
+      }
+    }
+
+    private static bool MentionsAll(ISet<TriggerCandidate> multiCandidate, List<BoundVar> vars) {
+      return vars.All(x => multiCandidate.Any(candidate => candidate.Variables.Contains(x))); //TODO Perfs?
+    }
+
+    private static bool DefaultCandidateFilteringFunction(TriggerCandidate candidate, QuantifierExpr quantifier) {
+      //FIXME this will miss rewritten expressions (CleanupExpr)
+      //FIXME does PotentialMatchingLoops really need to be a field?
+
+      return true;
+
+
+      candidate.PotentialMatchingLoops = ExprExtensions.CouldCauseCycle(candidate.Expr, quantifier).ToArray(); 
+      if (candidate.PotentialMatchingLoops.Any()) {
+         DebugTriggers("Trigger {0} for quantifier {1} could cause a matching loop, due to terms {2}.", 
+         Printer.ExprToString(candidate.Expr), Printer.ExprToString(quantifier), 
+           String.Join(", ", candidate.PotentialMatchingLoops.Select(e => Printer.ExprToString(e))));
+      }
+      return !candidate.PotentialMatchingLoops.Any();
+    }
+
+    private static bool DefaultMultiCandidateFilteringFunction(ISet<TriggerCandidate> multiCandidate, QuantifierExpr quantifier) {
+      return MentionsAll(multiCandidate, quantifier.BoundVars);
+    }
+
+    private static double DefaultMultiCandidateScoringFunction(ISet<TriggerCandidate> multi_candidates) {
+      return 1;
+    }
+
+    private static IEnumerable<MultiTriggerCandidate> DefaultMultiCandidateSelectionFunction(List<MultiTriggerCandidate> multi_candidates) {
+      return multi_candidates;
+    }
+
+    // CLEMENT: Make these customizable
+    internal Func<TriggerCandidate, QuantifierExpr, bool> CandidateFilteringFunction = DefaultCandidateFilteringFunction;
+    internal Func<ISet<TriggerCandidate>, QuantifierExpr, bool> MultiCandidateFilteringFunction = DefaultMultiCandidateFilteringFunction;
+    internal Func<ISet<TriggerCandidate>, double> MultiCandidateScoringFunction = DefaultMultiCandidateScoringFunction;
+    internal Func<List<MultiTriggerCandidate>, IEnumerable<MultiTriggerCandidate>> MultiCandidateSelectionFunction = DefaultMultiCandidateSelectionFunction;
+
+    struct MultiCandidatesCollection {
+      internal ISet<TriggerCandidate> AllCandidates;
+      internal List<TriggerCandidate> SelectedCandidates;
+      internal List<TriggerCandidate> RejectedCandidates;
+      internal List<ISet<TriggerCandidate>> FilteredMultiCandidates;
+      internal List<MultiTriggerCandidate> ScoredMultiCandidates;
+      internal List<MultiTriggerCandidate> SelectedMultiCandidates;
+
+      public MultiCandidatesCollection(QuantifierExpr quantifier,
+        TriggerAnnotation annotation,
+        Func<TriggerCandidate, QuantifierExpr, bool> CandidateFilteringFunction,
+        Func<ISet<TriggerCandidate>, QuantifierExpr, bool> MultiCandidateFilteringFunction,
+        Func<ISet<TriggerCandidate>, double> MultiCandidateScoringFunction,
+        Func<List<MultiTriggerCandidate>, IEnumerable<MultiTriggerCandidate>> MultiCandidateSelectionFunction) {
+
+        Contract.Requires(annotation != null);
+        Contract.Requires(quantifier != null);
+        Contract.Requires(CandidateFilteringFunction != null);
+        Contract.Requires(MultiCandidateFilteringFunction != null);
+        Contract.Requires(MultiCandidateScoringFunction != null);
+        Contract.Requires(MultiCandidateSelectionFunction != null);
+
+        AllCandidates = annotation.PrivateCandidates;
+        Partition(AllCandidates, x => CandidateFilteringFunction(x, quantifier), out SelectedCandidates, out RejectedCandidates);
+        FilteredMultiCandidates = AllSubsets(SelectedCandidates).Where(t => MultiCandidateFilteringFunction(t, quantifier)).ToList();
+        ScoredMultiCandidates = FilteredMultiCandidates.Select(candidates => new MultiTriggerCandidate { Candidates = candidates, Score = MultiCandidateScoringFunction(candidates) }).ToList();
+        SelectedMultiCandidates = MultiCandidateSelectionFunction(ScoredMultiCandidates).ToList();
+      }
+
+      private static void Partition<T>(IEnumerable<T> AllCandidates, Func<T, bool> CandidateFilteringFunction, out List<T> SelectedCandidates, out List<T> RejectedCandidates) {
+        SelectedCandidates = new List<T>();
+        RejectedCandidates = new List<T>();
+        foreach (var c in AllCandidates) {
+          (CandidateFilteringFunction(c) ? SelectedCandidates : RejectedCandidates).Add(c);
+        }
+      }
+
+      internal string Warning() {
+        if (AllCandidates.Count == 0) {
+          return "No triggers found in the body of this quantifier.";
+        } else if (SelectedCandidates.Count == 0) {
+          return String.Format("No suitable triggers found. Candidate building blocks for a good trigger where [{0}], but no subset of these terms passed the initial selection stage.", String.Join(", ", SelectedCandidates));
+        } else if (FilteredMultiCandidates.Count == 0) {
+          return String.Format("No suitable set of triggers found. Candidate building blocks for a good trigger where [{0}], but no subset of these terms passed the subset selection stage.", String.Join(", ", SelectedCandidates));
+        } else if (SelectedMultiCandidates.Count == 0) {
+          return String.Format("No suitable set of triggers found. Candidates where [{0}], but none passed the final selection stage.", String.Join(", ", ScoredMultiCandidates));
+        } else {
+          return null;
+        }
+      }
+
+      private void WriteIndented<T>(StringBuilder builder, string indent, IEnumerable<T> elements) {
+        foreach (var element in elements) {
+          builder.Append(indent).AppendLine(element.ToString());
+        }
+      }
+
+      private void WriteListOfCandidates<T>(StringBuilder builder, string indent, IEnumerable<T> elements) {
+        if (elements.Any()) {
+          builder.AppendLine();
+          WriteIndented(builder, indent, elements);
+        } else {
+          builder.AppendLine(" (None)");
+        }
+      }
+
+      public override string ToString() {
+        var repr = new StringBuilder();
+        var indent = "      ";
+        repr.Append("    All:");
+        WriteListOfCandidates(repr, indent, AllCandidates);
+        repr.Append("    PreFilter:");
+        WriteListOfCandidates(repr, indent, AllSubsets(AllCandidates).Select(c => String.Join(", ", c)));
+        repr.Append("    Filtered:");
+        WriteListOfCandidates(repr, indent, FilteredMultiCandidates.Select(c => String.Join(", ", c))); 
+        repr.Append("    Scored:");
+        WriteListOfCandidates(repr, indent, ScoredMultiCandidates);
+        repr.Append("    Selected:");
+        WriteListOfCandidates(repr, indent, SelectedMultiCandidates);
+        return repr.ToString();
+      }
+    }
+
+    private MultiCandidatesCollection PickMultiTriggers(QuantifierExpr quantifier) {
+      var annotation = Annotate(quantifier);
+      DebugTriggers("Quantifier {0}:\n{1}", Printer.ExprToString(quantifier), annotation);
+      return new MultiCandidatesCollection(quantifier, annotation, CandidateFilteringFunction, MultiCandidateFilteringFunction, MultiCandidateScoringFunction, MultiCandidateSelectionFunction);
+    }
+
+    private void AddTrigger(QuantifierExpr quantifier) {
+      // This call is elided when triggers debugging is disabled.
+      DebugTriggers("  Final results:\n{0}", PickMultiTriggers(quantifier));
+
+      if (quantifier.Attributes.AsEnumerable().Any(aa => aa.Name == "trigger" || aa.Name == "no_trigger")) {
+        DebugTriggers("Not generating triggers for {0}", Printer.ExprToString(quantifier)); //FIXME: no_trigger is passed down to Boogie
+        return;
+      }
+
+      var multi_candidates = PickMultiTriggers(quantifier);
+      foreach (var multi_candidate in multi_candidates.SelectedMultiCandidates) { //TODO: error message for when no triggers found
+        quantifier.Attributes = new Attributes("trigger", multi_candidate.Candidates.Select(t => t.Expr).ToList(), quantifier.Attributes);
+      }
+
+      // FIXME: Cleanup
+      if (multi_candidates.RejectedCandidates.Any()) {
+        var tooltip = "Rejected: " + String.Join(Environment.NewLine + "          ", multi_candidates.RejectedCandidates.Select(
+          candidate => "{:trigger " + Printer.ExprToString(candidate.Expr) + "} (could loop with " + Printer.ExprToString(candidate.PotentialMatchingLoops[0]) + ")"));
+        Resolver.ReportAdditionalInformation(quantifier.tok, tooltip, quantifier.tok.val.Length); //CLEMENT Check this
+      }
+
+      if (multi_candidates.SelectedMultiCandidates.Any()) {
+        var tooltip = "Triggers: " + String.Join(Environment.NewLine + "          ", multi_candidates.SelectedMultiCandidates.Select(
+          multi_candidate => "{:trigger " + String.Join(", ", multi_candidate.Candidates.Select(t => Printer.ExprToString(t.Expr))) + "}"));
+        Resolver.ReportAdditionalInformation(quantifier.tok, tooltip, quantifier.tok.val.Length); //CLEMENT Check this
+      }
+
+      string warning = multi_candidates.Warning();
+      if (warning != null) {
+        // FIXME reenable Resolver.Warning(quantifier.tok, warning);
+      }
+    }
+
+    private void AddTriggers_Internal() {
+      foreach (var quantifier in quantifiers) {
+        AddTrigger(quantifier);
+      }
+    }
+
+    private void AddTriggers_Internal(Expression root) {
+      Visit(root);
+      AddTriggers_Internal();
+    }
+
+    private void AddTriggers_Internal(Statement root) {
+      Visit(root);
+      AddTriggers_Internal();
+    }
+
+    internal static void AddTriggers(Expression root, Resolver resolver) {
+      if (root == null)
+        return;
+
+      DebugTriggers("== From {0} visiting expr: {1}", new StackFrame(1).GetMethod().Name, Printer.ExprToString(root));
+      TriggerGenerator generator = new TriggerGenerator(resolver);
+      generator.AddTriggers_Internal(root);
+    }
+
+    internal static void AddTriggers(Statement root, Resolver resolver) {
+      if (root == null)
+        return;
+
+      DebugTriggers("== From {0} visiting statement: {1}", new StackFrame(1).GetMethod().Name, Printer.StatementToString(root));
+      TriggerGenerator generator = new TriggerGenerator(resolver);
+      generator.AddTriggers_Internal(root);
+    }
+
+    internal static void AddTriggers(IEnumerable<Expression> roots, Resolver resolver) {
+      DebugTriggers("== From {0} visiting expressions: {1}", new StackFrame(1).GetMethod().Name, 
+        String.Join(", ", roots.Select(root => Printer.ExprToString(root))));
+      foreach (var expr in roots) {
+        AddTriggers(expr, resolver);
+      }
+    }
+
+    internal static void AddTriggers(IEnumerable<MaybeFreeExpression> roots, Resolver resolver) {
+      DebugTriggers("== From {0} visiting expressions: {1}", new StackFrame(1).GetMethod().Name,
+        String.Join(", ", roots.Select(root => Printer.ExprToString(root.E))));
+      foreach (var expr in roots) {
+        AddTriggers(expr.E, resolver);
+      }
+    }
+
+    protected override void VisitOneExpr(Expression expr) {
+      Annotate(expr);
+    }
+  }
+
+  static class ExprExtensions {
+    static IEnumerable<Expression> AllSubExpressions(this Expression expr, bool strict = false) {
+      foreach (var subexpr in expr.SubExpressions) {
+        foreach (var r_subexpr in AllSubExpressions(subexpr, false)) {
+          yield return r_subexpr;
+        }
+        yield return subexpr;
+      }
+
+      if (expr is StmtExpr) {
+        foreach (var r_subexpr in AllSubExpressions(((StmtExpr)expr).S, false)) {
+          yield return r_subexpr;
+        }
+      }
+
+      if (!strict) {
+        yield return expr;
+      }
+    }
+
+    private static IEnumerable<Expression> AllSubExpressions(this Statement stmt, bool strict = false) {
+      foreach (var subexpr in stmt.SubExpressions) {
+        foreach (var r_subexpr in AllSubExpressions(subexpr, false)) {
+          yield return r_subexpr;
+        }
+        yield return subexpr;
+      }
+
+      foreach (var substmt in stmt.SubStatements) {
+        foreach (var r_subexpr in AllSubExpressions(substmt, false)) {
+          yield return r_subexpr;
+        }
+      }
+    }
+
+    private static bool ExpressionEq(this Expression expr1, Expression expr2) {
+      expr1 = GetResolved(expr1);
+      expr2 = GetResolved(expr2);
+      
+      return ShallowEq_Top(expr1, expr2) && SameLists(expr1.SubExpressions, expr2.SubExpressions, (e1, e2) => ExpressionEq(e1, e2));
+    }
+
+    private static bool MatchesTrigger(this Expression expr, Expression trigger, ISet<BoundVar> holes, Dictionary<IVariable, Expression> bindings) {
+      expr = GetResolved(expr);
+      trigger = GetResolved(trigger);
+      
+      if (trigger is IdentifierExpr) {
+        var var = ((IdentifierExpr)trigger).Var;
+
+        if (holes.Contains(var)) {
+          Expression existing_binding = null;
+          if (bindings.TryGetValue(var, out existing_binding)) {
+            return ExpressionEq(expr, existing_binding);
+          } else {
+            bindings[var] = expr;
+            return true;
+          }
+        }
+      }
+
+      return ShallowEq_Top(expr, trigger) && SameLists(expr.SubExpressions, trigger.SubExpressions, (e1, e2) => MatchesTrigger(e1, e2, holes, bindings));
+    }
+
+    private static bool MatchesTrigger(this Expression expr, Expression trigger, ISet<BoundVar> holes) {
+      return expr.MatchesTrigger(trigger, holes, new Dictionary<IVariable, Expression>());
+    }
+
+    internal static IEnumerable<Expression> CouldCauseCycle(Expression trigger, QuantifierExpr quantifier) { //FIXME Term or bound?
+      //FIXME could be optimized by looking at the bindings instead of doing full equality
+      return quantifier.Term.AllSubExpressions().Where(e => e.MatchesTrigger(trigger, new HashSet<BoundVar>(quantifier.BoundVars)) && !e.ExpressionEq(trigger));
+    }
+
+    private static bool SameLists<T>(IEnumerable<T> list1, IEnumerable<T> list2, Func<T, T, bool> comparer) {
+      var it1 = list1.GetEnumerator();
+      var it2 = list2.GetEnumerator();
+      bool it1_has, it2_has;
+      bool acc = true;
+
+      do {
+        it1_has = it1.MoveNext();
+        it2_has = it2.MoveNext();
+
+        if (it1_has == true && it2_has == true) {
+          acc = acc && comparer(it1.Current, it2.Current);
+        }
+      } while (it1_has && it2_has);
+
+      return it1_has == it2_has && acc;
+    }
+
+    private static bool SameNullity<T>(T x1, T x2) where T : class {
+      return (x1 == null) == (x2 == null);
+    }
+
+    private static bool ShallowSameAttributes(Attributes attributes1, Attributes attributes2) {
+      return SameLists(attributes1.AsEnumerable(), attributes2.AsEnumerable(), ShallowSameSingleAttribute);
+    }
+
+    private static bool ShallowSameSingleAttribute(Attributes arg1, Attributes arg2) {
+      return arg1.Name == arg2.Name;
+    }
+
+    private static bool SameBoundVar(IVariable arg1, IVariable arg2) {
+      return arg1 == arg2 || 
+             (arg1.Name == arg2.Name &&
+              arg1.CompileName == arg2.CompileName &&
+              arg1.DisplayName == arg2.DisplayName &&
+              arg1.UniqueName == arg2.UniqueName &&
+              arg1.IsGhost == arg2.IsGhost &&
+              arg1.IsMutable == arg2.IsMutable); //FIXME compare types?
+    }
+
+    private static Expression GetResolved(Expression expr) {
+      if (expr is ConcreteSyntaxExpression) {
+        return ((ConcreteSyntaxExpression)expr).ResolvedExpression;
+      }
+      return expr;
+    }
+
+    /// <summary>
+    /// Compares two abstract syntax expressions, looking only at their direct members. Subexpressions and substatements are not compared.
+    /// </summary>
+    /// <returns></returns>
+    internal static bool ShallowEq_Top(Expression expr1, Expression expr2) {
+      Contract.Requires(expr1 != null);
+      Contract.Requires(expr2 != null);
+
+      // We never compare concrete expressions
+      Contract.Requires(!(expr1 is ConcreteSyntaxExpression));
+      Contract.Requires(!(expr2 is ConcreteSyntaxExpression));
+
+      // CPC: Hey future editor: the following block of code is auto-generated. Just add your own cases at the end.
+      //      This could be a visitor pattern, except I need to visit a pair of nodes. 
+      //      It could also be implemented in each individual class. I'd have a slight preference for that.
+      //      This really just wants to use double dispatch.
+      if (expr1 is UnboxingCastExpr && expr2 is UnboxingCastExpr) {
+        return ShallowEq((UnboxingCastExpr)expr1, (UnboxingCastExpr)expr2);
+      } else if (expr1 is BoxingCastExpr && expr2 is BoxingCastExpr) {
+        return ShallowEq((BoxingCastExpr)expr1, (BoxingCastExpr)expr2);
+      } else if (expr1 is MatchExpr && expr2 is MatchExpr) {
+        return ShallowEq((MatchExpr)expr1, (MatchExpr)expr2);
+      } else if (expr1 is ITEExpr && expr2 is ITEExpr) {
+        return ShallowEq((ITEExpr)expr1, (ITEExpr)expr2);
+      } else if (expr1 is StmtExpr && expr2 is StmtExpr) {
+        return ShallowEq((StmtExpr)expr1, (StmtExpr)expr2);
+      } else if (expr1 is WildcardExpr && expr2 is WildcardExpr) {
+        return ShallowEq((WildcardExpr)expr1, (WildcardExpr)expr2);
+      } else if (expr1 is ComprehensionExpr && expr2 is ComprehensionExpr) {
+        return ShallowEq((ComprehensionExpr)expr1, (ComprehensionExpr)expr2);
+      } else if (expr1 is NamedExpr && expr2 is NamedExpr) {
+        return ShallowEq((NamedExpr)expr1, (NamedExpr)expr2);
+      } else if (expr1 is LetExpr && expr2 is LetExpr) {
+        return ShallowEq((LetExpr)expr1, (LetExpr)expr2);
+      } else if (expr1 is TernaryExpr && expr2 is TernaryExpr) {
+        return ShallowEq((TernaryExpr)expr1, (TernaryExpr)expr2);
+      } else if (expr1 is BinaryExpr && expr2 is BinaryExpr) {
+        return ShallowEq((BinaryExpr)expr1, (BinaryExpr)expr2);
+      } else if (expr1 is UnaryExpr && expr2 is UnaryExpr) {
+        return ShallowEq((UnaryExpr)expr1, (UnaryExpr)expr2);
+      } else if (expr1 is MultiSetFormingExpr && expr2 is MultiSetFormingExpr) {
+        return ShallowEq((MultiSetFormingExpr)expr1, (MultiSetFormingExpr)expr2);
+      } else if (expr1 is OldExpr && expr2 is OldExpr) {
+        return ShallowEq((OldExpr)expr1, (OldExpr)expr2);
+      } else if (expr1 is FunctionCallExpr && expr2 is FunctionCallExpr) {
+        return ShallowEq((FunctionCallExpr)expr1, (FunctionCallExpr)expr2);
+      } else if (expr1 is ApplyExpr && expr2 is ApplyExpr) {
+        return ShallowEq((ApplyExpr)expr1, (ApplyExpr)expr2);
+      } else if (expr1 is SeqUpdateExpr && expr2 is SeqUpdateExpr) {
+        return ShallowEq((SeqUpdateExpr)expr1, (SeqUpdateExpr)expr2);
+      } else if (expr1 is MultiSelectExpr && expr2 is MultiSelectExpr) {
+        return ShallowEq((MultiSelectExpr)expr1, (MultiSelectExpr)expr2);
+      } else if (expr1 is SeqSelectExpr && expr2 is SeqSelectExpr) {
+        return ShallowEq((SeqSelectExpr)expr1, (SeqSelectExpr)expr2);
+      } else if (expr1 is MemberSelectExpr && expr2 is MemberSelectExpr) {
+        return ShallowEq((MemberSelectExpr)expr1, (MemberSelectExpr)expr2);
+      } else if (expr1 is MapDisplayExpr && expr2 is MapDisplayExpr) {
+        return ShallowEq((MapDisplayExpr)expr1, (MapDisplayExpr)expr2);
+      } else if (expr1 is DisplayExpression && expr2 is DisplayExpression) {
+        return ShallowEq((DisplayExpression)expr1, (DisplayExpression)expr2);
+      } else if (expr1 is IdentifierExpr && expr2 is IdentifierExpr) {
+        return ShallowEq((IdentifierExpr)expr1, (IdentifierExpr)expr2);
+      } else if (expr1 is ThisExpr && expr2 is ThisExpr) {
+        return ShallowEq((ThisExpr)expr1, (ThisExpr)expr2);
+      } else if (expr1 is DatatypeValue && expr2 is DatatypeValue) {
+        return ShallowEq((DatatypeValue)expr1, (DatatypeValue)expr2);
+      } else if (expr1 is LiteralExpr && expr2 is LiteralExpr) {
+        return ShallowEq((LiteralExpr)expr1, (LiteralExpr)expr2);
+      } else {
+        // If this assertion fail, then a new abstract AST node was probably introduced but not registered here.
+        Contract.Assert(expr1.GetType() != expr2.GetType());
+        return false;
+      }
+    }
+
+    private static bool ShallowEq(UnboxingCastExpr expr1, UnboxingCastExpr expr2) {
+      Contract.Requires(false);
+      throw new InvalidOperationException();
+    }
+
+    private static bool ShallowEq(BoxingCastExpr expr1, BoxingCastExpr expr2) {
+      return expr1.FromType == expr2.FromType &&
+             expr1.ToType == expr2.ToType;
+    }
+
+    private static bool ShallowEq(MatchExpr expr1, MatchExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(ITEExpr expr1, ITEExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(StmtExpr expr1, StmtExpr expr2) {
+#if THROW_UNSUPPORTED_COMPARISONS
+      Contract.Assume(false); // This kind of expression never appears in a trigger
+      throw new NotImplementedException();
+#else
+      return expr1.S == expr2.S;
+#endif
+    }
+
+    private static bool ShallowEq(WildcardExpr expr1, WildcardExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(LambdaExpr expr1, LambdaExpr expr2) {
+#if THROW_UNSUPPORTED_COMPARISONS
+      Contract.Assume(false); // This kind of expression never appears in a trigger
+      throw new NotImplementedException();
+#else
+      return expr1.OneShot == expr2.OneShot &&
+             SameLists(expr1.Reads, expr2.Reads, SameFrameExpression);
+#endif
+    }
+
+    private static bool ShallowEq(MapComprehension expr1, MapComprehension expr2) {
+      return expr1.Finite == expr2.Finite;
+    }
+
+    private static bool ShallowEq(SetComprehension expr1, SetComprehension expr2) {
+      return expr1.TermIsImplicit == expr2.TermIsImplicit && //TODO
+             expr1.Finite == expr2.Finite;
+    }
+
+    private static bool ShallowEq(ExistsExpr expr1, ExistsExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(ForallExpr expr1, ForallExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(QuantifierExpr expr1, QuantifierExpr expr2) { //FIXME are these TypeArgs still useful?
+      if (expr1.TypeArgs.Count != expr2.TypeArgs.Count ||
+          !SameNullity(expr1.Range, expr2.Range)) {
+        return false;
+      }
+
+      if (expr1 is ExistsExpr && expr2 is ExistsExpr) {
+        return ShallowEq((ExistsExpr)expr1, (ExistsExpr)expr2);
+      } else if (expr1 is ForallExpr && expr2 is ForallExpr) {
+        return ShallowEq((ForallExpr)expr1, (ForallExpr)expr2);
+      } else {
+        return false;
+      }
+    }
+
+    private static bool ShallowEq(ComprehensionExpr expr1, ComprehensionExpr expr2) {
+      if (!SameLists(expr1.BoundVars, expr2.BoundVars, SameBoundVar) ||
+          !ShallowSameAttributes(expr1.Attributes, expr2.Attributes) ||
+          // Filled in during resolution: !SameLists(expr1.Bounds, expr2.Bounds, ReferenceCompare) ||
+          //                              !SameLists(expr1.MissingBounds, expr2.MissingBounds, SameBoundVar) ||
+          !SameNullity(expr1.Range, expr2.Range)) { //TODO Check
+        return false;
+      }
+
+      if (expr1 is LambdaExpr && expr2 is LambdaExpr) {
+        return ShallowEq((LambdaExpr)expr1, (LambdaExpr)expr2);
+      } else if (expr1 is MapComprehension && expr2 is MapComprehension) {
+        return ShallowEq((MapComprehension)expr1, (MapComprehension)expr2);
+      } else if (expr1 is SetComprehension && expr2 is SetComprehension) {
+        return ShallowEq((SetComprehension)expr1, (SetComprehension)expr2);
+      } else if (expr1 is QuantifierExpr && expr2 is QuantifierExpr) {
+        return ShallowEq((QuantifierExpr)expr1, (QuantifierExpr)expr2);
+      } else {
+        return false; // ComprehensionExpr is abstract
+      }
+    }
+
+    private static bool ShallowEq(NamedExpr expr1, NamedExpr expr2) {
+      return expr1.Name == expr2.Name &&
+             SameNullity(expr1.Contract, expr2.Contract);
+    }
+
+    private static bool ShallowEq(LetExpr expr1, LetExpr expr2) {
+      return expr1.Exact == expr2.Exact &&
+             ShallowSameAttributes(expr1.Attributes, expr2.Attributes);
+    }
+
+    private static bool ShallowEq(TernaryExpr expr1, TernaryExpr expr2) {
+      return expr1.Op == expr2.Op;
+    }
+
+    private static bool ShallowEq(BinaryExpr expr1, BinaryExpr expr2) {
+      Contract.Requires(expr1.ResolvedOp != BinaryExpr.ResolvedOpcode.YetUndetermined);
+      Contract.Requires(expr2.ResolvedOp != BinaryExpr.ResolvedOpcode.YetUndetermined);
+      return expr1.ResolvedOp == expr2.ResolvedOp;
+    }
+
+    private static bool ShallowEq(ConversionExpr expr1, ConversionExpr expr2) {
+      return expr1.Type == expr2.Type; //TODO equality on types?
+    }
+
+    private static bool ShallowEq(UnaryOpExpr expr1, UnaryOpExpr expr2) {
+      return expr1.Op == expr2.Op;
+    }
+
+    private static bool ShallowEq(UnaryExpr expr1, UnaryExpr expr2) {
+      if (expr1 is ConversionExpr && expr2 is ConversionExpr) {
+        return ShallowEq((ConversionExpr)expr1, (ConversionExpr)expr2);
+      } else if (expr1 is UnaryOpExpr && expr2 is UnaryOpExpr) {
+        return ShallowEq((UnaryOpExpr)expr1, (UnaryOpExpr)expr2);
+      } else {
+        return false; // UnaryExpr is abstract
+      }
+    }
+
+    private static bool ShallowEq(MultiSetFormingExpr expr1, MultiSetFormingExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(OldExpr expr1, OldExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(FunctionCallExpr expr1, FunctionCallExpr expr2) {
+      return expr1.Name == expr2.Name &&
+             expr1.CoCall == expr2.CoCall && //TODO
+             expr1.Function == expr2.Function; // TODO TypeArgumentSubstitutions?
+    }
+
+    private static bool ShallowEq(ApplyExpr expr1, ApplyExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(SeqUpdateExpr expr1, SeqUpdateExpr expr2) {
+      Contract.Requires(expr1.ResolvedUpdateExpr != null && expr2.ResolvedUpdateExpr != null);
+      return true;
+    }
+
+    private static bool ShallowEq(MultiSelectExpr expr1, MultiSelectExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(SeqSelectExpr expr1, SeqSelectExpr expr2) {
+      return expr1.SelectOne == expr2.SelectOne &&
+             SameNullity(expr1.Seq, expr2.Seq) &&
+             SameNullity(expr1.E0, expr2.E0) &&
+             SameNullity(expr1.E1, expr2.E1);
+    }
+
+    private static bool ShallowEq(MemberSelectExpr expr1, MemberSelectExpr expr2) {
+      return expr1.MemberName == expr2.MemberName &&
+             expr1.Member == expr2.Member &&
+             SameLists(expr1.TypeApplication, expr2.TypeApplication, Type.Equals);
+    }
+
+    private static bool ShallowEq(SeqDisplayExpr expr1, SeqDisplayExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(MapDisplayExpr expr1, MapDisplayExpr expr2) {
+      return expr1.Finite == expr2.Finite;
+    }
+
+    private static bool ShallowEq(MultiSetDisplayExpr expr1, MultiSetDisplayExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(SetDisplayExpr expr1, SetDisplayExpr expr2) {
+      return expr1.Finite == expr2.Finite;
+    }
+
+    private static bool ShallowEq(DisplayExpression expr1, DisplayExpression expr2) {
+      if (expr1 is SeqDisplayExpr && expr2 is SeqDisplayExpr) {
+        return ShallowEq((SeqDisplayExpr)expr1, (SeqDisplayExpr)expr2);
+      } else if (expr1 is MultiSetDisplayExpr && expr2 is MultiSetDisplayExpr) { //FIXME MultiSetDisplayExpr is not a DisplayExpression ??!
+        return ShallowEq((MultiSetDisplayExpr)expr1, (MultiSetDisplayExpr)expr2);
+      } else if (expr1 is SetDisplayExpr && expr2 is SetDisplayExpr) {
+        return ShallowEq((SetDisplayExpr)expr1, (SetDisplayExpr)expr2);
+      } else {
+        return false;
+      }
+    }
+
+    private static bool ShallowEq(AutoGhostIdentifierExpr expr1, AutoGhostIdentifierExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(IdentifierExpr expr1, IdentifierExpr expr2) {
+      if (expr1.Name != expr2.Name ||
+          expr1.Var != expr2.Var) {
+            return false;
+      }
+
+      if (expr1 is AutoGhostIdentifierExpr && expr2 is AutoGhostIdentifierExpr) {
+        return ShallowEq((AutoGhostIdentifierExpr)expr1, (AutoGhostIdentifierExpr)expr2);
+      } else {
+        return true;
+      }
+    }
+
+    private static bool ShallowEq(ImplicitThisExpr expr1, ImplicitThisExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(ThisExpr expr1, ThisExpr expr2) {
+      if (expr1 is ImplicitThisExpr && expr2 is ImplicitThisExpr) {
+        return ShallowEq((ImplicitThisExpr)expr1, (ImplicitThisExpr)expr2);
+      } else {
+        return (expr1.GetType() == expr2.GetType()); // LiteralExpr is not abstract
+      }
+    }
+
+    private static bool ShallowEq(DatatypeValue expr1, DatatypeValue expr2) {
+      return // Implied by Ctor equality: expr1.DatatypeName == expr2.DatatypeName &&
+             // Implied by Ctor equality: expr1.MemberName == expr2.MemberName &&
+             expr1.Ctor == expr2.Ctor &&
+             // Contextual information: expr1.IsCoCall == expr2.IsCoCall &&
+             SameLists(expr1.InferredTypeArgs, expr2.InferredTypeArgs, Type.Equals);
+    }
+
+    private static bool ShallowEq(StringLiteralExpr expr1, StringLiteralExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(CharLiteralExpr expr1, CharLiteralExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(StaticReceiverExpr expr1, StaticReceiverExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(LiteralExpr expr1, LiteralExpr expr2) {
+      if (expr1.Value != expr2.Value) {
+        return false;
+      }
+
+      if (expr1 is StringLiteralExpr && expr2 is StringLiteralExpr) {
+        return ShallowEq((StringLiteralExpr)expr1, (StringLiteralExpr)expr2);
+      } else if (expr1 is CharLiteralExpr && expr2 is CharLiteralExpr) {
+        return ShallowEq((CharLiteralExpr)expr1, (CharLiteralExpr)expr2);
+      } else if (expr1 is StaticReceiverExpr && expr2 is StaticReceiverExpr) {
+        return ShallowEq((StaticReceiverExpr)expr1, (StaticReceiverExpr)expr2);
+      } else {
+        return (expr1.GetType() == expr2.GetType()); // LiteralExpr is not abstract
+      }
+    }
+  }
+}
-- 
cgit v1.2.3


From e4cefb56b4312d7c2bf88d9ba3c3bfd2e00940e9 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Mon, 13 Jul 2015 11:51:04 -0700
Subject: Register the trigger generator as a a rewriter in the Resolver.

---
 Source/Dafny/DafnyPipeline.csproj |  5 +++--
 Source/Dafny/Rewriter.cs          | 29 +++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 2 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyPipeline.csproj b/Source/Dafny/DafnyPipeline.csproj
index f9540aa0..a1452b8a 100644
--- a/Source/Dafny/DafnyPipeline.csproj
+++ b/Source/Dafny/DafnyPipeline.csproj
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <PropertyGroup>
     <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
@@ -143,6 +143,7 @@
   </ItemGroup>
   <ItemGroup>
     <Compile Include="Cloner.cs" />
+    <Compile Include="TriggerGenerator.cs" />
     <Compile Include="Util.cs" />
     <Compile Include="Compiler.cs" />
     <Compile Include="BigIntegerParser.cs" />
@@ -192,4 +193,4 @@
   <Target Name="AfterBuild">
   </Target>
   -->
-</Project>
+</Project>
\ No newline at end of file
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index c0a25a82..480b3f61 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -36,6 +36,35 @@ namespace Microsoft.Dafny
     }
   }
 
+  public class TriggersRewriter : IRewriter {
+    Resolver Resolver;
+
+    internal TriggersRewriter(Resolver resolver) {
+      Contract.Requires(Resolver != null);
+      this.Resolver = resolver;
+    }
+
+    public void PreResolve(ModuleDefinition m) { }
+
+    public void PostResolve(ModuleDefinition m) {
+      foreach (var decl in ModuleDefinition.AllCallables(m.TopLevelDecls)) {
+        if (decl is Function) {
+          var function = (Function)decl;
+          TriggerGenerator.AddTriggers(function.Ens, Resolver);
+          TriggerGenerator.AddTriggers(function.Req, Resolver);
+          TriggerGenerator.AddTriggers(function.Body, Resolver);
+        } else if (decl is Method) {
+          var method = (Method)decl;
+          TriggerGenerator.AddTriggers(method.Ens, Resolver);
+          TriggerGenerator.AddTriggers(method.Req, Resolver);
+          TriggerGenerator.AddTriggers(method.Body, Resolver);
+        }
+      }
+    }
+
+    public void PostCyclicityResolve(ModuleDefinition m) { }
+  }
+
   /// <summary>
   /// AutoContracts is an experimental feature that will fill much of the dynamic-frames boilerplate
   /// into a class.  From the user's perspective, what needs to be done is simply:
-- 
cgit v1.2.3


From 64495ae998749da057b3a717aba6ef53a3e8006e Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Mon, 13 Jul 2015 21:04:11 +0100
Subject: Add /printTooltips and /autoTriggers to the CLI

---
 Source/Dafny/DafnyOptions.cs | 21 +++++++++++++++++++++
 Source/Dafny/Resolver.cs     | 22 ++++++++++++++++++----
 2 files changed, 39 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index 125ab11e..b2593705 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -56,6 +56,8 @@ namespace Microsoft.Dafny
     public bool AllowGlobals = false;
     public bool CountVerificationErrors = true;
     public bool Optimize = false;
+    public bool AutoTriggers = true;
+    public bool PrintTooltips = false;
 
     protected override bool ParseOption(string name, Bpl.CommandLineOptionEngine.CommandLineParseState ps) {
       var args = ps.args;  // convenient synonym
@@ -181,6 +183,18 @@ namespace Microsoft.Dafny
           return true;
         }
 
+        case "printTooltips":
+          PrintTooltips = true;
+          return true;
+
+        case "autoTriggers": {
+            int autoTriggers = 1; // defaults to reporting verification errors
+            if (ps.GetNumericArgument(ref autoTriggers, 2)) {
+              AutoTriggers = autoTriggers == 1;
+            }
+            return true;
+          }
+
         case "optimize": {
             Optimize = true;
             return true;
@@ -276,12 +290,19 @@ namespace Microsoft.Dafny
                     of verification errors.
                 1 (default) - If preprocessing succeeds, set exit code to the number of
                               verification errors.
+  /autoTriggers:<n>
+                0 - Do not generate {:trigger} annotations for user-level quantifiers.
+                1 (default) - Add a {:trigger} to each user-level quantifier. Existing
+                              annotations are preserved.
   /optimize     Produce optimized C# code, meaning:
                   - selects optimized C# prelude by passing 
                     /define:DAFNY_USE_SYSTEM_COLLECTIONS_IMMUTABLE to csc.exe (requires 
                     System.Collections.Immutable.dll in the source directory to successfully 
                     compile).
                   - passes /optimize flag to csc.exe.
+  /printTooltips    
+                Dump additional positional information (displayed as mouse-over tooltips by 
+                the VS plugin) to stdout as 'Info' messages.
 ");
       base.Usage();  // also print the Boogie options
     }
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index c5535808..300d4985 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -25,7 +25,7 @@ namespace Microsoft.Dafny
       ConsoleColor col = Console.ForegroundColor;
       Console.ForegroundColor = ConsoleColor.Red;
       Console.WriteLine("{0}({1},{2}): Error: {3}",
-          DafnyOptions.Clo.UseBaseNameForFileName ? System.IO.Path.GetFileName(tok.filename) : tok.filename, tok.line, tok.col - 1,
+          DafnyOptions.Clo.UseBaseNameForFileName ? System.IO.Path.GetFileName(tok.filename) : tok.filename, tok.line, tok.col,
           string.Format(msg, args));
       Console.ForegroundColor = col;
       ErrorCount++;
@@ -254,6 +254,10 @@ namespace Microsoft.Dafny
       // Populate the members of the basic types
       var trunc = new SpecialField(Token.NoToken, "Trunc", "ToBigInteger()", "", "", false, false, false, Type.Int, null);
       basicTypeMembers[(int)BasicTypeVariety.Real].Add(trunc.Name, trunc);
+
+      if (DafnyOptions.O.PrintTooltips) {
+        AdditionalInformationReporter = DefaultInformationReporter;
+      }
     }
 
     [ContractInvariantMethod]
@@ -264,6 +268,12 @@ namespace Microsoft.Dafny
       Contract.Invariant(cce.NonNullDictionaryAndValues(datatypeCtors) && Contract.ForAll(datatypeCtors.Values, v => cce.NonNullDictionaryAndValues(v)));
     }
 
+    public void DefaultInformationReporter(AdditionalInformation info) {
+      Console.WriteLine("{0}({1},{2}): Info: {3}",
+                        DafnyOptions.Clo.UseBaseNameForFileName ? System.IO.Path.GetFileName(info.Token.filename) : info.Token.filename,
+                        info.Token.line, info.Token.col, info.Text);
+    }
+
     public void ResolveProgram(Program prog) {
       Contract.Requires(prog != null);
       var origErrorCount = ErrorCount;
@@ -303,6 +313,10 @@ namespace Microsoft.Dafny
       rewriters.Add(opaqueRewriter);
       rewriters.Add(new TimeLimitRewriter());
 
+      if (DafnyOptions.O.AutoTriggers) {
+        rewriters.Add(new TriggersRewriter(this));
+      }
+
       systemNameInfo = RegisterTopLevelDecls(prog.BuiltIns.SystemModule, false);
       prog.CompileModules.Add(prog.BuiltIns.SystemModule);
       foreach (var decl in sortedDecls) {
@@ -2048,7 +2062,7 @@ namespace Microsoft.Dafny
           foreach (var p in e.TypeArgumentSubstitutions) {
             if (!IsDetermined(p.Value.Normalize())) {
               Error(e.tok, "type variable '{0}' in the function call to '{1}' could not be determined{2}", p.Key.Name, e.Name,
-                (e.Name.Contains("reveal_") || e.Name.Contains("_FULL"))
+                (e.Name.Contains("reveal_") || e.Name.Contains("_FULL")) //CLEMENT should this be StartsWith and EndsWith?
                 ? ". If you are making an opaque function, make sure that the function can be called."
                 : ""
               );
@@ -8135,7 +8149,7 @@ namespace Microsoft.Dafny
       Contract.Requires(!expr.WasResolved());
       Contract.Requires(opts != null);
       Contract.Ensures(Contract.Result<Expression>() == null || args != null);
-
+      
       if (expr.OptTypeArguments != null) {
         foreach (var ty in expr.OptTypeArguments) {
           ResolveType(expr.tok, ty, opts.codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
@@ -8175,7 +8189,7 @@ namespace Microsoft.Dafny
           receiver = new StaticReceiverExpr(expr.tok, (ClassDecl)member.EnclosingClass, true);
         } else {
           if (!scope.AllowInstance) {
-            Error(expr.tok, "'this' is not allowed in a 'static' context");
+            Error(expr.tok, "'this' is not allowed in a 'static' context"); //FIXME: Rephrase this
             // nevertheless, set "receiver" to a value so we can continue resolution
           }
           receiver = new ImplicitThisExpr(expr.tok);
-- 
cgit v1.2.3


From 795682c4739dfc4f3fff4241108e8d5efd593265 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Mon, 13 Jul 2015 21:03:25 +0100
Subject: Start adding missing triggers to the translator

---
 Source/Dafny/Translator.cs | 136 ++++++++++++++++++++++++++++-----------------
 1 file changed, 86 insertions(+), 50 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index d375c2bb..8042033b 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -659,7 +659,8 @@ namespace Microsoft.Dafny {
             ie.Var = oVarDafny; ie.Type = ie.Var.Type;  // resolve ie here
             var constraint = etran.TrExpr(Substitute(dd.Constraint, dd.Var, ie));
             var heap = new Bpl.BoundVariable(dd.tok, new Bpl.TypedIdent(dd.tok, predef.HeapVarName, predef.HeapType));
-            var ex = new Bpl.ExistsExpr(dd.tok, new List<Variable> { heap }, BplAnd(FunctionCall(dd.tok, BuiltinFunction.IsGoodHeap, null, etran.HeapExpr), constraint));
+            //TRIG (exists $Heap: Heap :: $IsGoodHeap($Heap) && LitInt(0) <= $o#0 && $o#0 < 100)
+            var ex = new Bpl.ExistsExpr(dd.tok, new List<Variable> { heap }, BplAnd(FunctionCall(dd.tok, BuiltinFunction.IsGoodHeap, null, etran.HeapExpr), constraint));  // LL_TRIGGER
             rhs = BplAnd(rhs, ex);
           }
           body = BplIff(is_o, rhs);
@@ -727,10 +728,10 @@ namespace Microsoft.Dafny {
           {
             // Add:  axiom (forall params :: DatatypeCtorId(#dt.ctor(params)) == ##dt.ctor);
             CreateBoundVariables(ctor.Formals, out bvs, out args);
-            Bpl.Expr lhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
-            lhs = FunctionCall(ctor.tok, BuiltinFunction.DatatypeCtorId, null, lhs);
+            var constructor_call = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
+            var lhs = FunctionCall(ctor.tok, BuiltinFunction.DatatypeCtorId, null, constructor_call);
             Bpl.Expr q = Bpl.Expr.Eq(lhs, c);
-            sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, BplForall(bvs, q), "Constructor identifier"));
+            sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, BplForall(bvs, BplTrigger(constructor_call), q), "Constructor identifier")); // NEW_TRIGGER
           }
 
           {
@@ -760,10 +761,11 @@ namespace Microsoft.Dafny {
           Bpl.Expr dId; var dBv = BplBoundVar("d", predef.DatatypeType, out dId);
           Bpl.Expr q = Bpl.Expr.Eq(dId, lhs);
           if (bvs.Count != 0) {
-            q = new Bpl.ExistsExpr(ctor.tok, bvs, q);
+            // TRIG (exists a#6#0#0: Box, a#6#1#0: DatatypeType :: d == #OnceBuggy.MyDt.Cons(a#6#0#0, a#6#1#0))'
+            q = new Bpl.ExistsExpr(ctor.tok, bvs, BplTrigger(lhs), q);  // NEW_TRIGGER
           }
           Bpl.Expr dtq = FunctionCall(ctor.tok, ctor.QueryField.FullSanitizedName, Bpl.Type.Bool, dId);
-          q = BplForall(dBv, null, BplImp(dtq, q));
+          q = BplForall(dBv, BplTrigger(dtq), BplImp(dtq, q)); // NEW_TRIGGER
           sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Constructor questionmark has arguments"));
         }
 
@@ -854,7 +856,9 @@ namespace Microsoft.Dafny {
               */
               Bpl.Expr rhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
               rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, rhs);
-              q = new Bpl.ForallExpr(ctor.tok, bvs, Bpl.Expr.Lt(lhs, rhs));
+              // TRIG (forall a#11#0#0: Box, a#11#1#0: DatatypeType :: BoxRank(a#11#0#0) < DtRank(#_module.List.Cons(a#11#0#0, a#11#1#0)))
+              var trigger = new Bpl.Trigger(ctor.tok, true, new List<Bpl.Expr> { lhs, rhs }); // TRIGGERS: THIS IS BROKEN
+              q = new Bpl.ForallExpr(ctor.tok, bvs, null, Bpl.Expr.Lt(lhs, rhs));  // NEW_TRIGGER // CLEMENT: Trigger not use because breaks termination checks for match statements
               sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Inductive rank"));
             } else if (argType is SeqType) {
               // axiom (forall params, i: int :: 0 <= i && i < |arg| ==> DtRank(arg[i]) < DtRank(#dt.ctor(params)));
@@ -879,7 +883,7 @@ namespace Microsoft.Dafny {
               lhs = FunctionCall(ctor.tok, BuiltinFunction.SeqRank, null, args[i]);
               rhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
               rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, rhs);
-              q = new Bpl.ForallExpr(ctor.tok, bvs, Bpl.Expr.Lt(lhs, rhs));
+              q = new Bpl.ForallExpr(ctor.tok, bvs, new Trigger(lhs.tok, true, new List<Bpl.Expr> { lhs, rhs }), Bpl.Expr.Lt(lhs, rhs));  // NEW_TRIGGER
               sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Inductive seq rank"));
             } else if (argType is SetType) {
               // axiom (forall params, d: Datatype :: arg[d] ==> DtRank(d) < DtRank(#dt.ctor(params)));
@@ -893,7 +897,9 @@ namespace Microsoft.Dafny {
               Bpl.Expr lhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, ie);
               Bpl.Expr rhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
               rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, rhs);
-              q = new Bpl.ForallExpr(ctor.tok, bvs, Bpl.Expr.Imp(ante, Bpl.Expr.Lt(lhs, rhs)));
+              // TRIG (forall a#50#0#0: Set Box, d: DatatypeType :: a#50#0#0[$Box(d)] ==> DtRank(d) < DtRank(#_module.d3.B3(a#50#0#0)))
+              var trigger = new Bpl.Trigger(ctor.tok, true, new List<Bpl.Expr> { lhs, rhs }); //TRIGGERS: Should this mention the precondition ("ante") too?
+              q = new Bpl.ForallExpr(ctor.tok, bvs, trigger, Bpl.Expr.Imp(ante, Bpl.Expr.Lt(lhs, rhs)));  // NEW_TRIGGER
               sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Inductive set rank"));
             } else if (argType is MultiSetType) {
               // axiom (forall params, d: Datatype :: 0 < arg[d] ==> DtRank(d) < DtRank(#dt.ctor(params)));
@@ -907,8 +913,10 @@ namespace Microsoft.Dafny {
               Bpl.Expr lhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, ie);
               Bpl.Expr rhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
               rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, rhs);
-              q = new Bpl.ForallExpr(ctor.tok, bvs, Bpl.Expr.Imp(ante, Bpl.Expr.Lt(lhs, rhs)));
+              // CLEMENT: Does the test suite cover this?
+              q = new Bpl.ForallExpr(ctor.tok, bvs, Bpl.Expr.Imp(ante, Bpl.Expr.Lt(lhs, rhs)));  // W_TRIGGER
               sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Inductive multiset rank"));
+              // CLEMENT: I don't understand what this case disjunction does here; I don't think it's covered by the test suite
             }
           }
 
@@ -1113,8 +1121,8 @@ namespace Microsoft.Dafny {
           var equal = Bpl.Expr.Eq(d0, d1);
           var PEq = CoEqualCall(codecl, lexprs, rexprs, k, LayerSucc(ly), d0, d1);
           sink.AddTopLevelDeclaration(new Axiom(dt.tok,
-            BplForall(vars, null, BplImp(BplAnd(equal, kGtZero), PEq)),
-            "Prefix equality shortcut"));
+            BplForall(vars, BplTrigger(PEq), BplImp(BplAnd(equal, kGtZero), PEq)),
+            "Prefix equality shortcut")); // NEW_TRIGGER
         });
       }
     }
@@ -2017,15 +2025,15 @@ namespace Microsoft.Dafny {
 
       Bpl.Trigger tr = new Bpl.Trigger(f.tok, true, new List<Bpl.Expr> { funcAppl });
       var typeParams = TrTypeParamDecls(f.TypeArgs);
-      Bpl.Expr meat = Bpl.Expr.True;
+      Bpl.Expr post = Bpl.Expr.True;
       foreach (Expression p in ens) {
         Bpl.Expr q = etran.TrExpr(Substitute(p, null, substMap));
-        meat = BplAnd(meat, q);
+        post = BplAnd(post, q);
       }
       Bpl.Expr whr = GetWhereClause(f.tok, funcAppl, f.ResultType, etran);
-      if (whr != null) { meat = Bpl.Expr.And(meat, whr); }
+      if (whr != null) { post = Bpl.Expr.And(post, whr); }
 
-      Bpl.Expr ax = new Bpl.ForallExpr(f.tok, typeParams, formals, null, tr, Bpl.Expr.Imp(ante, meat));
+      Bpl.Expr ax = new Bpl.ForallExpr(f.tok, typeParams, formals, null, tr, Bpl.Expr.Imp(ante, post));
       var activate = AxiomActivation(f, true, true, etran);
       string comment = "consequence axiom for " + f.FullSanitizedName;
       return new Bpl.Axiom(f.tok, Bpl.Expr.Imp(activate, ax), comment);
@@ -2489,11 +2497,10 @@ namespace Microsoft.Dafny {
       moreBvs.Add(k);
       var z = Bpl.Expr.Eq(kId, Bpl.Expr.Literal(0));
       funcID = new Bpl.IdentifierExpr(tok, pp.FullSanitizedName, TrType(pp.ResultType));
-      Bpl.Expr prefixLimited = new Bpl.NAryExpr(tok, new Bpl.FunctionCall(funcID), prefixArgsLimited);
-      if (pp.FixpointPred is InductivePredicate) {
-        prefixLimited = Bpl.Expr.Not(prefixLimited);
-      }
-      var trueAtZero = new Bpl.ForallExpr(tok, moreBvs, BplImp(BplAnd(ante, z), prefixLimited));
+      Bpl.Expr prefixLimitedBody = new Bpl.NAryExpr(tok, new Bpl.FunctionCall(funcID), prefixArgsLimited);
+      Bpl.Expr prefixLimited = pp.FixpointPred is InductivePredicate ? Bpl.Expr.Not(prefixLimitedBody) : prefixLimitedBody;
+      
+      var trueAtZero = new Bpl.ForallExpr(tok, moreBvs, BplTrigger(prefixLimitedBody), BplImp(BplAnd(ante, z), prefixLimited));  // NEW_TRIGGER
       sink.AddTopLevelDeclaration(new Bpl.Axiom(tok, Bpl.Expr.Imp(activation, trueAtZero),
         "3rd prefix predicate axiom"));
     }
@@ -3946,7 +3953,8 @@ namespace Microsoft.Dafny {
           Bpl.Expr iBounds = InSeqRange(tok, i, etran.TrExpr(e), true, null, false);
           Bpl.Expr XsubI = FunctionCall(tok, BuiltinFunction.SeqIndex, predef.BoxType, etran.TrExpr(e), i);
           // TODO: the equality in the next line should be changed to one that understands extensionality
-          disjunct = new Bpl.ExistsExpr(tok, new List<Variable> { iVar }, Bpl.Expr.And(iBounds, Bpl.Expr.Eq(XsubI, boxO)));
+          //TRIG (exists $i: int :: 0 <= $i && $i < Seq#Length(read($h0, this, _module.DoublyLinkedList.Nodes)) && Seq#Index(read($h0, this, _module.DoublyLinkedList.Nodes), $i) == $Box($o))
+          disjunct = new Bpl.ExistsExpr(tok, new List<Variable> { iVar }, Bpl.Expr.And(iBounds, Bpl.Expr.Eq(XsubI, boxO)));  // LL_TRIGGER
         } else {
           // o == e
           disjunct = Bpl.Expr.Eq(o, etran.TrExpr(e));
@@ -4421,7 +4429,10 @@ namespace Microsoft.Dafny {
           var d = LetDesugaring(e);  // call LetDesugaring to prepare the desugaring and populate letSuchThatExprInfo with something for e
           var info = letSuchThatExprInfo[e];
           var canCallFunction = info.CanCallFunctionCall(this, etran);
-          var cc = new Bpl.ForallExpr(e.tok, bvars, Bpl.Expr.Imp(typeAntecedent, BplAnd(BplAnd(canCallRHS, canCallBody), canCallFunction)));
+          //TRIG (forall d#0: int :: true ==> _module.__default.DividesBoth#canCall($Heap, d#0, a#0, b#0) && (_module.__default.DividesBoth($Heap, d#0, a#0, b#0) ==> (forall m#1: int :: true ==> _module.__default.DividesBoth#canCall($Heap, m#1, a#0, b#0) && (_module.__default.DividesBoth($Heap, m#1, a#0, b#0) ==> true))) && (_module.__default.DividesBoth($Heap, d#0, a#0, b#0) && (forall m#1: int :: true ==> _module.__default.DividesBoth($Heap, m#1, a#0, b#0) ==> m#1 <= d#0) ==> true) && $let#0$canCall($Heap, a#0, b#0))
+          //TRIG (forall g#0: int :: true ==> (x#0 == g#0 ==> true) && $let#0$canCall($Heap, x#0))
+          //TRIGGERS: Not clear what would be good here
+          var cc = new Bpl.ForallExpr(e.tok, bvars, Bpl.Expr.Imp(typeAntecedent, BplAnd(BplAnd(canCallRHS, canCallBody), canCallFunction)));  // LL_TRIGGER
           return cc;
         }
 
@@ -4450,7 +4461,11 @@ namespace Microsoft.Dafny {
 
         ExpressionTranslator et = new ExpressionTranslator(etran, heap);
         var ebody = CanCallAssumption(Substitute(e.Body, null, subst), et);
-        return BplForall(bvars, ebody);
+
+        //TRIG (forall $l#0#heap#0: Heap, $l#0#x#0: int :: true)
+        //TRIG (forall $l#0#heap#0: Heap, $l#0#t#0: DatatypeType :: _module.__default.TMap#canCall(_module._default.TMap$A, _module._default.TMap$B, $l#0#heap#0, $l#0#t#0, f#0))
+        //TRIG (forall $l#4#heap#0: Heap, $l#4#x#0: Box :: _0_Monad.__default.Bind#canCall(Monad._default.Associativity$B, Monad._default.Associativity$C, $l#4#heap#0, Apply1(Monad._default.Associativity$A, #$M$B, f#0, $l#4#heap#0, $l#4#x#0), g#0))
+        return BplForall(bvars, ebody); // L_TRIGGER
       } else if (expr is ComprehensionExpr) {
         var e = (ComprehensionExpr)expr;
         var canCall = CanCallAssumption(e.Term, etran);
@@ -4466,7 +4481,7 @@ namespace Microsoft.Dafny {
             Bpl.Trigger tr = TrTrigger(etran, e.Attributes, expr.tok);
             canCall = new Bpl.ForallExpr(expr.tok, Concat(tyvars, bvars), tr, Bpl.Expr.Imp(typeAntecedent, canCall));
           } else {
-            canCall = new Bpl.ForallExpr(expr.tok, Concat(tyvars, bvars), Bpl.Expr.Imp(typeAntecedent, canCall));
+            canCall = new Bpl.ForallExpr(expr.tok, Concat(tyvars, bvars), Bpl.Expr.Imp(typeAntecedent, canCall));  // SMART_TRIGGER
           }
         }
         return canCall;
@@ -4879,7 +4894,9 @@ namespace Microsoft.Dafny {
             var range = BplAnd(Bpl.Expr.Le(lowerBound, i), Bpl.Expr.Lt(i, upperBound));
             var fieldName = FunctionCall(e.tok, BuiltinFunction.IndexField, null, i);
             var allowedToRead = Bpl.Expr.SelectTok(e.tok, etran.TheFrame(e.tok), seq, fieldName);
-            var qq = new Bpl.ForallExpr(e.tok, new List<Variable> { iVar }, Bpl.Expr.Imp(range, allowedToRead));
+            //TRIG (forall $i: int :: read($Heap, this, _module.RingBuffer.start) <= $i && $i < read($Heap, this, _module.RingBuffer.start) + read($Heap, this, _module.RingBuffer.len) ==> $_Frame[read($Heap, this, _module.RingBuffer.data), IndexField($i)])
+            //TRIGGERS: Should this be more specific?
+            var qq = new Bpl.ForallExpr(e.tok, new List<Variable> { iVar }, BplTrigger(fieldName), Bpl.Expr.Imp(range, allowedToRead));  // NEW_TRIGGER
             options.AssertSink(this, builder)(expr.tok, qq, "insufficient reads clause to read the indicated range of array elements", options.AssertKv);
           }
         }
@@ -6106,8 +6123,9 @@ namespace Microsoft.Dafny {
           // axiom (forall o: Ref :: 0 <= array.Length(o));
           Bpl.BoundVariable oVar = new Bpl.BoundVariable(f.tok, new Bpl.TypedIdent(f.tok, "o", predef.RefType));
           Bpl.IdentifierExpr o = new Bpl.IdentifierExpr(f.tok, oVar);
-          Bpl.Expr body = Bpl.Expr.Le(Bpl.Expr.Literal(0), new Bpl.NAryExpr(f.tok, new Bpl.FunctionCall(ff), new List<Bpl.Expr> { o }));
-          Bpl.Expr qq = new Bpl.ForallExpr(f.tok, new List<Variable> { oVar }, body);
+          var rhs = new Bpl.NAryExpr(f.tok, new Bpl.FunctionCall(ff), new List<Bpl.Expr> { o });
+          Bpl.Expr body = Bpl.Expr.Le(Bpl.Expr.Literal(0), rhs);
+          Bpl.Expr qq = new Bpl.ForallExpr(f.tok, new List<Variable> { oVar }, BplTrigger(rhs), body);  // NEW_TRIGGER
           sink.AddTopLevelDeclaration(new Bpl.Axiom(f.tok, qq));
         }
       }
@@ -7890,7 +7908,8 @@ namespace Microsoft.Dafny {
       GetObjFieldDetails(s0.Lhs.Resolved, prevEtran, out xObj, out xField);
       xBody = BplAnd(xBody, Bpl.Expr.Eq(o, xObj));
       xBody = BplAnd(xBody, Bpl.Expr.Eq(f, xField));
-      Bpl.Expr xObjField = new Bpl.ExistsExpr(s.Tok, xBvars, xBody);
+      //TRIG (exists k#2: int :: (k#2 == LitInt(0 - 3) || k#2 == LitInt(4)) && $o == read($prevHeap, this, _module.MyClass.arr) && $f == MultiIndexField(IndexField(i#0), j#0))
+      Bpl.Expr xObjField = new Bpl.ExistsExpr(s.Tok, xBvars, xBody);  // LL_TRIGGER
       Bpl.Expr body = Bpl.Expr.Or(Bpl.Expr.Eq(heapOF, oldHeapOF), xObjField);
       var tr = new Trigger(s.Tok, true, new List<Expr>() { heapOF });
       Bpl.Expr qq = new Bpl.ForallExpr(s.Tok, new List<TypeVariable> { alpha }, new List<Variable> { oVar, fVar }, null, tr, body);
@@ -7957,6 +7976,13 @@ namespace Microsoft.Dafny {
       }
     }
 
+    //CLEMENT: Remove
+    //public static Expr PrintAndDie(Expr expr, [System.Runtime.CompilerServices.CallerMemberName] string caller = "", [System.Runtime.CompilerServices.CallerLineNumber] int linum = 0) {
+    //  Console.Error.WriteLine("In {0} at line {1}: {2}", caller, linum, expr.ToString());
+    //  Environment.Exit(1);
+    //  return expr;
+    //}
+
     /// <summary>
     /// Generate:
     ///   assume (forall x,y :: Range(x,y)[$Heap:=oldHeap] ==>
@@ -8231,7 +8257,7 @@ namespace Microsoft.Dafny {
           ante = BplAnd(ante, additionalRange(substMap, initEtran));
         }
 
-        // Note, in the following, we need to do a bit of a song and dance.  The actual arguements of the
+        // Note, in the following, we need to do a bit of a song and dance.  The actual arguments of the
         // call should be translated using "initEtran", whereas the method postcondition should be translated
         // using "callEtran".  To accomplish this, we translate the argument and then tuck the resulting
         // Boogie expressions into BoogieExprWrappers that are used in the DafnyExpr-to-DafnyExpr substitution.
@@ -8250,7 +8276,10 @@ namespace Microsoft.Dafny {
           post = BplAnd(post, callEtran.TrExpr(p));
         }
 
-        Bpl.Expr qq = new Bpl.ForallExpr(tok, bvars, Bpl.Expr.Imp(ante, post));
+        // TRIG (forall $ih#s0#0: Seq Box :: $Is($ih#s0#0, TSeq(TChar)) && $IsAlloc($ih#s0#0, TSeq(TChar), $initHeapForallStmt#0) && Seq#Length($ih#s0#0) != 0 && Seq#Rank($ih#s0#0) < Seq#Rank(s#0) ==> (forall i#2: int :: true ==> LitInt(0) <= i#2 && i#2 < Seq#Length($ih#s0#0) ==> char#ToInt(_module.CharChar.MinChar($LS($LZ), $Heap, this, $ih#s0#0)) <= char#ToInt($Unbox(Seq#Index($ih#s0#0, i#2)): char)))
+        // TRIG (forall $ih#pat0#0: Seq Box, $ih#a0#0: Seq Box :: $Is($ih#pat0#0, TSeq(_module._default.Same0$T)) && $IsAlloc($ih#pat0#0, TSeq(_module._default.Same0$T), $initHeapForallStmt#0) && $Is($ih#a0#0, TSeq(_module._default.Same0$T)) && $IsAlloc($ih#a0#0, TSeq(_module._default.Same0$T), $initHeapForallStmt#0) && Seq#Length($ih#pat0#0) <= Seq#Length($ih#a0#0) && Seq#SameUntil($ih#pat0#0, $ih#a0#0, Seq#Length($ih#pat0#0)) && (Seq#Rank($ih#pat0#0) < Seq#Rank(pat#0) || (Seq#Rank($ih#pat0#0) == Seq#Rank(pat#0) && Seq#Rank($ih#a0#0) < Seq#Rank(a#0))) ==> _module.__default.IsRelaxedPrefixAux(_module._default.Same0$T, $LS($LZ), $Heap, $ih#pat0#0, $ih#a0#0, LitInt(1)))'
+        // TRIG (forall $ih#m0#0: DatatypeType, $ih#n0#0: DatatypeType :: $Is($ih#m0#0, Tclass._module.Nat()) && $IsAlloc($ih#m0#0, Tclass._module.Nat(), $initHeapForallStmt#0) && $Is($ih#n0#0, Tclass._module.Nat()) && $IsAlloc($ih#n0#0, Tclass._module.Nat(), $initHeapForallStmt#0) && Lit(true) && (DtRank($ih#m0#0) < DtRank(m#0) || (DtRank($ih#m0#0) == DtRank(m#0) && DtRank($ih#n0#0) < DtRank(n#0))) ==> _module.__default.mult($LS($LZ), $Heap, $ih#m0#0, _module.__default.plus($LS($LZ), $Heap, $ih#n0#0, $ih#n0#0)) == _module.__default.mult($LS($LZ), $Heap, _module.__default.plus($LS($LZ), $Heap, $ih#m0#0, $ih#m0#0), $ih#n0#0))
+        Bpl.Expr qq = new Bpl.ForallExpr(tok, bvars, Bpl.Expr.Imp(ante, post));  // SMART_TRIGGER
         exporter.Add(new Bpl.AssumeCmd(tok, qq));
       }
     }
@@ -10889,26 +10918,31 @@ namespace Microsoft.Dafny {
               var eeType = e.E.Type.NormalizeExpand();
               if (eeType is SetType) {
                 // generate:  (forall $o: ref :: $o != null && X[Box($o)] ==> !old($Heap)[$o,alloc])
-                // TODO: trigger?
                 Bpl.Variable oVar = new Bpl.BoundVariable(expr.tok, new Bpl.TypedIdent(expr.tok, "$o", predef.RefType));
                 Bpl.Expr o = new Bpl.IdentifierExpr(expr.tok, oVar);
                 Bpl.Expr oNotNull = Bpl.Expr.Neq(o, predef.Null);
                 Bpl.Expr oInSet = TrInSet(expr.tok, o, e.E, ((SetType)eeType).Arg);
-                Bpl.Expr oIsFresh = Bpl.Expr.Not(Old.IsAlloced(expr.tok, o));
+                Bpl.Expr oNotFresh = Old.IsAlloced(expr.tok, o);
+                Bpl.Expr oIsFresh = Bpl.Expr.Not(oNotFresh);
                 Bpl.Expr body = Bpl.Expr.Imp(Bpl.Expr.And(oNotNull, oInSet), oIsFresh);
-                return new Bpl.ForallExpr(expr.tok, new List<Variable> { oVar }, body);
+                // TRIGGERS: Does this make sense? VSI-Benchmarks\b7
+                // TRIG (forall $o: ref :: $o != null && read($Heap, this, _module.List.Repr)[$Box($o)] && $o != this ==> !read(old($Heap), $o, alloc))
+                // TRIG (forall $o: ref :: $o != null && read($Heap, this, _module.Stream.footprint)[$Box($o)] && $o != this ==> !read(old($Heap), $o, alloc))
+                return new Bpl.ForallExpr(expr.tok, new List<Variable> { oVar }, BplTrigger(oNotFresh), body); // NEW_TRIGGER
               } else if (eeType is SeqType) {
                 // generate:  (forall $i: int :: 0 <= $i && $i < Seq#Length(X) && Unbox(Seq#Index(X,$i)) != null ==> !old($Heap)[Unbox(Seq#Index(X,$i)),alloc])
-                // TODO: trigger?
                 Bpl.Variable iVar = new Bpl.BoundVariable(expr.tok, new Bpl.TypedIdent(expr.tok, "$i", Bpl.Type.Int));
                 Bpl.Expr i = new Bpl.IdentifierExpr(expr.tok, iVar);
                 Bpl.Expr iBounds = translator.InSeqRange(expr.tok, i, TrExpr(e.E), true, null, false);
                 Bpl.Expr XsubI = translator.FunctionCall(expr.tok, BuiltinFunction.SeqIndex, predef.RefType, TrExpr(e.E), i);
                 XsubI = translator.FunctionCall(expr.tok, BuiltinFunction.Unbox, predef.RefType, XsubI);
-                Bpl.Expr oIsFresh = Bpl.Expr.Not(Old.IsAlloced(expr.tok, XsubI));
+                Bpl.Expr oNotFresh = Old.IsAlloced(expr.tok, XsubI);
+                Bpl.Expr oIsFresh = Bpl.Expr.Not(oNotFresh);
                 Bpl.Expr xsubiNotNull = Bpl.Expr.Neq(XsubI, predef.Null);
                 Bpl.Expr body = Bpl.Expr.Imp(Bpl.Expr.And(iBounds, xsubiNotNull), oIsFresh);
-                return new Bpl.ForallExpr(expr.tok, new List<Variable> { iVar }, body);
+                //TRIGGERS: Does this make sense? dafny0\SmallTests
+                //TRIG (forall $i: int :: 0 <= $i && $i < Seq#Length(Q#0) && $Unbox(Seq#Index(Q#0, $i)): ref != null ==> !read(old($Heap), $Unbox(Seq#Index(Q#0, $i)): ref, alloc))
+                return new Bpl.ForallExpr(expr.tok, new List<Variable> { iVar }, body); // NEW_TRIGGER
               } else if (eeType.IsDatatype) {
                 // translator.FunctionCall(e.tok, BuiltinFunction.DtAlloc, null, TrExpr(e.E), Old.HeapExpr);
                 Bpl.Expr alloc = translator.MkIsAlloc(TrExpr(e.E), eeType, Old.HeapExpr);
@@ -11332,7 +11366,7 @@ namespace Microsoft.Dafny {
 
           Bpl.QKeyValue kv = TrAttributes(e.Attributes, "trigger");
           Bpl.Trigger tr = null;
-          for (Attributes aa = e.Attributes; aa != null; aa = aa.Prev) {
+          foreach (var aa in e.Attributes.AsEnumerable()) {
             if (aa.Name == "trigger") {
               List<Bpl.Expr> tt = new List<Bpl.Expr>();
               foreach (var arg in aa.Args) {
@@ -11345,12 +11379,12 @@ namespace Microsoft.Dafny {
             antecedent = BplAnd(antecedent, bodyEtran.TrExpr(e.Range));
           }
           Bpl.Expr body = bodyEtran.TrExpr(e.Term);
-
+          
           if (e is ForallExpr) {
-            return new Bpl.ForallExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars,bvars), kv, tr, Bpl.Expr.Imp(antecedent, body));
+            return new Bpl.ForallExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars, bvars), kv, tr, Bpl.Expr.Imp(antecedent, body)); // SMART_TRIGGER
           } else {
             Contract.Assert(e is ExistsExpr);
-            return new Bpl.ExistsExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars,bvars), kv, tr, Bpl.Expr.And(antecedent, body));
+            return new Bpl.ExistsExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars, bvars), kv, tr, Bpl.Expr.And(antecedent, body)); // SMART_TRIGGER
           }
 
         } else if (expr is SetComprehension) {
@@ -11436,7 +11470,7 @@ namespace Microsoft.Dafny {
           Contract.Assert(false); throw new cce.UnreachableException();  // unexpected expression
         }
       }
-
+      
       private Expr TrLambdaExpr(LambdaExpr e) {
         var bvars = new List<Bpl.Variable>();
         var bargs = new List<Bpl.Expr>();
@@ -12667,6 +12701,7 @@ namespace Microsoft.Dafny {
             // Don't inline opaque functions or foreign protected functions
           } else {
             // inline this body
+            // CLEMENT: This is a problem for triggers
             var body = GetSubstitutedBody(fexp, f, false);
             var typeSpecializedBody = GetSubstitutedBody(fexp, f, true);
             var typeSpecializedResultType = Resolver.SubstType(f.ResultType, fexp.TypeArgumentSubstitutions);
@@ -12778,7 +12813,7 @@ namespace Microsoft.Dafny {
             Bpl.Trigger tr = TrTrigger(etran, e.Attributes, expr.tok, substMap);
             ih = new Bpl.ForallExpr(expr.tok, bvars, tr, Bpl.Expr.Imp(typeAntecedent, ihBody));
           } else {
-            ih = new Bpl.ForallExpr(expr.tok, bvars, Bpl.Expr.Imp(typeAntecedent, ihBody));
+            ih = new Bpl.ForallExpr(expr.tok, bvars, Bpl.Expr.Imp(typeAntecedent, ihBody));  // SMART_TRIGGER
           }
 
           // More precisely now:
@@ -12815,10 +12850,10 @@ namespace Microsoft.Dafny {
                 Bpl.Trigger tr = TrTrigger(etran, e.Attributes, expr.tok);
                 q = new Bpl.ForallExpr(kase.tok, bvars, tr, Bpl.Expr.Imp(ante, bdy));
               } else {
-                q = new Bpl.ForallExpr(kase.tok, bvars, Bpl.Expr.Imp(ante, bdy));
+                q = new Bpl.ForallExpr(kase.tok, bvars, Bpl.Expr.Imp(ante, bdy)); // SMART_TRIGGER
               }
             } else {
-              q = new Bpl.ExistsExpr(kase.tok, bvars, Bpl.Expr.And(ante, bdy));
+              q = new Bpl.ExistsExpr(kase.tok, bvars, Bpl.Expr.And(ante, bdy));  // SMART_TRIGGER
             }
             splits.Add(new SplitExprInfo(SplitExprInfo.K.Checked, q));
           }
@@ -13218,7 +13253,8 @@ namespace Microsoft.Dafny {
               }
               i++;
             }
-            q = new Bpl.ExistsExpr(ctor.tok, bvs, BplAnd(typeAntecedent, q));
+            // TRIG (exists a#0#0#0: Box :: $IsBox(a#0#0#0, _module.DatatypeInduction$T) && $IsAllocBox(a#0#0#0, _module.DatatypeInduction$T, $Heap) && #_module.Tree.Leaf(a#0#0#0) == t#1)
+            q = new Bpl.ExistsExpr(ctor.tok, bvs, BplTrigger(ct), BplAnd(typeAntecedent, q));  // NEW_TRIGGER
           }
           yield return q;
         }
@@ -14141,19 +14177,19 @@ namespace Microsoft.Dafny {
 
     // Bpl-making-utilities
 
-    static Bpl.Expr BplForall(IEnumerable<Bpl.Variable> args_in, Bpl.Expr body) {
+    static Bpl.Expr BplForall(IEnumerable<Bpl.Variable> args_in, Bpl.Expr body) {  // NO_TRIGGER
       var args = new List<Bpl.Variable>(args_in);
-      if (args.Count == 0) {
+      if (args.Count == 0) { // CLEMENT don't add quantifiers if the body is trivial
         return body;
       } else {
-        return new Bpl.ForallExpr(body.tok, args, body);
+        return new Bpl.ForallExpr(body.tok, args, body); // NO_TRIGGER
       }
     }
 
     // Note: if the trigger is null, makes a forall without any triggers
     static Bpl.Expr BplForall(IEnumerable<Bpl.Variable> args_in, Bpl.Trigger trg, Bpl.Expr body) {
       if (trg == null) {
-        return BplForall(args_in, body);
+        return BplForall(args_in, body); // NO_TRIGGER
       } else {
         var args = new List<Bpl.Variable>(args_in);
         if (args.Count == 0) {
-- 
cgit v1.2.3


From aa2bfc0930e932be72cfd2d796352a0aa4182477 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Mon, 13 Jul 2015 23:44:47 +0100
Subject: Detect matching loops at the mutli-trigger level

Stop using HashSet, as we don't currently have a good HashCode implementation.
Instead, excplicitly call distinct where needed. Improve reporting a bit.
---
 Source/Dafny/TriggerGenerator.cs | 238 +++++++++++++++++++++++++--------------
 1 file changed, 156 insertions(+), 82 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/TriggerGenerator.cs b/Source/Dafny/TriggerGenerator.cs
index 1783a00c..4697b149 100644
--- a/Source/Dafny/TriggerGenerator.cs
+++ b/Source/Dafny/TriggerGenerator.cs
@@ -28,36 +28,90 @@ namespace Microsoft.Dafny {
   class TriggerCandidate { // TODO Hashing is broken (duplicates can pop up)
     internal Expression Expr;
     internal ISet<IVariable> Variables;
-    internal Expression[] PotentialMatchingLoops;
+    internal List<Expression> PotentialMatchingLoops;
 
     public override string ToString() {
       return Printer.ExprToString(Expr);
     }
   }
-  
-  struct MultiTriggerCandidate {
-    internal ISet<TriggerCandidate> Candidates;
+
+  class TriggerCandidateComparer : IEqualityComparer<TriggerCandidate> {
+    private static TriggerCandidateComparer singleton;
+    internal static TriggerCandidateComparer Instance {
+      get { return singleton == null ? (singleton = new TriggerCandidateComparer()) : singleton; }
+    }
+
+    private TriggerCandidateComparer() { }
+
+    public bool Equals(TriggerCandidate x, TriggerCandidate y) {
+      return x == null && y == null ||
+        x != null && y != null && x.Expr.ExpressionEq(y.Expr);
+    }
+
+    public int GetHashCode(TriggerCandidate obj) {
+      return 1; // FIXME: Force collisions. Use until we have a proper hashing strategy for expressions.
+    }
+  }
+
+  class MultiTriggerCandidate {
+    internal List<TriggerCandidate> Candidates;
+    internal List<string> Tags;
     internal double Score;
+    
+    private List<Expression> potentialMatchingLoops;
+    internal List<Expression> PotentialMatchingLoops {
+      get {
+        if (potentialMatchingLoops == null) {
+          //FIXME could be optimized by looking at the bindings instead of doing full equality
+          var candidates = Candidates.Distinct(TriggerCandidateComparer.Instance);
+          potentialMatchingLoops = candidates.SelectMany(candidate => candidate.PotentialMatchingLoops)
+            .Distinct(ExprExtensions.EqExpressionComparer.Instance).Where(e => !candidates.Any(c => c.Expr.ExpressionEq(e))).ToList();
+        }
+        
+        return potentialMatchingLoops;
+      }
+    }
+
+    internal MultiTriggerCandidate(List<TriggerCandidate> candidates) {
+      Candidates = candidates;
+      Tags = new List<string>();
+    }
+
+    internal bool MentionsAll(List<BoundVar> vars) {
+      var candidates = Candidates;
+      return vars.All(x => candidates.Any(candidate => candidate.Variables.Contains(x))); //TODO Perfs?
+    }
 
     public override string ToString() {
       return String.Format("[{0:G2}] {1}", Score, String.Join(", ", Candidates));
     }
+
+    public String AsDafnyAttributeString(bool wrap = true, bool includeTags = false) {
+      var repr = String.Join(", ", Candidates.Select(t => Printer.ExprToString(t.Expr)));
+      if (wrap) {
+        repr = "{:trigger " + repr + "}";
+      }
+      if (includeTags && Tags != null) {
+        repr += " (" + String.Join("; ", Tags) + ")";
+      }
+      return repr;
+    }
   }
+  
 
   class TriggerAnnotation {
     internal bool IsTriggerKiller;
     internal ISet<IVariable> Variables;
-    internal readonly HashSet<TriggerCandidate> PrivateCandidates;
-    internal readonly HashSet<TriggerCandidate> ExportedCandidates;
+    internal readonly List<TriggerCandidate> PrivateCandidates;
+    internal readonly List<TriggerCandidate> ExportedCandidates; //FIXME using a hashset is useless here
 
     internal TriggerAnnotation(bool IsTriggerKiller, IEnumerable<IVariable> Variables, 
                                IEnumerable<TriggerCandidate> AllCandidates, IEnumerable<TriggerCandidate> PrivateCandidates = null) {
       this.IsTriggerKiller = IsTriggerKiller;
       this.Variables = new HashSet<IVariable>(Variables);
 
-      this.ExportedCandidates = new HashSet<TriggerCandidate>(AllCandidates == null ? Enumerable.Empty<TriggerCandidate>() : AllCandidates);
-      this.PrivateCandidates = new HashSet<TriggerCandidate>(PrivateCandidates == null ? Enumerable.Empty<TriggerCandidate>() : PrivateCandidates);
-      this.ExportedCandidates.ExceptWith(this.PrivateCandidates);
+      this.PrivateCandidates = new List<TriggerCandidate>(PrivateCandidates == null ? Enumerable.Empty<TriggerCandidate>() : PrivateCandidates);
+      this.ExportedCandidates = new List<TriggerCandidate>(AllCandidates == null ? Enumerable.Empty<TriggerCandidate>() : AllCandidates.Except(this.PrivateCandidates));
     }
 
     public override string ToString() {
@@ -100,17 +154,18 @@ namespace Microsoft.Dafny {
       this.Resolver = resolver;
     }
 
-    private ISet<T> MergeAlterFirst<T>(ISet<T> a, ISet<T> b) {
+    private List<T> MergeAlterFirst<T>(List<T> a, List<T> b) {
       Contract.Requires(a != null);
       Contract.Requires(b != null);
-      a.UnionWith(b);
+      a.AddRange(b);
       return a;
     }
 
-    private ISet<T> WithOneExtraElement<T>(ISet<T> set, T elem) {
-      Contract.Requires(set != null);
-      set.Add(elem);
-      return set;
+    private ISet<T> MergeAlterFirst<T>(ISet<T> a, ISet<T> b) {
+      Contract.Requires(a != null);
+      Contract.Requires(b != null);
+      a.UnionWith(b);
+      return a;
     }
 
     private T ReduceAnnotatedSubExpressions<T>(Expression expr, T seed, Func<TriggerAnnotation, T> map, Func<T, T, T> reduce) {
@@ -118,8 +173,8 @@ namespace Microsoft.Dafny {
                                 .Aggregate(seed, (acc, e) => reduce(acc, e));
     }
 
-    private ISet<TriggerCandidate> CollectExportedCandidates(Expression expr) {
-      return ReduceAnnotatedSubExpressions<ISet<TriggerCandidate>>(expr, new HashSet<TriggerCandidate>(), a => a.ExportedCandidates, MergeAlterFirst);
+    private List<TriggerCandidate> CollectExportedCandidates(Expression expr) {
+      return ReduceAnnotatedSubExpressions<List<TriggerCandidate>>(expr, new List<TriggerCandidate>(), a => a.ExportedCandidates, MergeAlterFirst);
     }
 
     private ISet<IVariable> CollectVariables(Expression expr) {
@@ -130,7 +185,7 @@ namespace Microsoft.Dafny {
       return ReduceAnnotatedSubExpressions(expr, false, a => a.IsTriggerKiller, (a, b) => a || b);
     }
 
-    private IEnumerable<TriggerCandidate> OnlyPrivateCandidates(ISet<TriggerCandidate> candidates, IEnumerable<IVariable> privateVars) {
+    private IEnumerable<TriggerCandidate> OnlyPrivateCandidates(List<TriggerCandidate> candidates, IEnumerable<IVariable> privateVars) {
       return candidates.Where(c => privateVars.Intersect(c.Variables).Any()); //TODO Check perf
     }
 
@@ -222,12 +277,12 @@ namespace Microsoft.Dafny {
       var new_expr = CleanupExpr(expr, out expr_is_killer);
       var new_candidate = new TriggerCandidate { Expr = new_expr, Variables = CollectVariables(expr) }; 
 
-      ISet<TriggerCandidate> collected_candidates = CollectExportedCandidates(expr);
+      List<TriggerCandidate> collected_candidates = CollectExportedCandidates(expr);
       var children_contain_killers = CollectIsKiller(expr);
 
       if (!children_contain_killers) {
         // Add only if the children are not killers; the head has been cleaned up into non-killer form
-        collected_candidates = WithOneExtraElement(collected_candidates, new_candidate);
+        collected_candidates.Add(new_candidate);
       }
 
       // This new node is a killer if its children were killers, or if it's non-cleaned-up head is a killer
@@ -242,7 +297,8 @@ namespace Microsoft.Dafny {
       // candidate matching its direct subexpression if needed. Not that function calls are not the 
       // only possible child here; there can be DatatypeValue nodes, for example (see vstte2012/Combinators.dfy).
       var annotation = AnnotatePotentialCandidate(expr);
-      annotation.ExportedCandidates.RemoveWhere(candidate => expr.SubExpressions.Contains(candidate.Expr));
+      // Comparing by reference is fine here. Using sets could yield a small speedup
+      annotation.ExportedCandidates.RemoveAll(candidate => expr.SubExpressions.Contains(candidate.Expr));
       return annotation;
     }
 
@@ -286,39 +342,30 @@ namespace Microsoft.Dafny {
       }
     }
 
-    private static IEnumerable<ISet<T>> AllSubsets<T>(IEnumerable<T> source) {
+    private static IEnumerable<List<T>> AllNonEmptySubsets<T>(IEnumerable<T> source) {
       List<T> all = new List<T>(source);
       foreach (var subset in AllSubsets(all, 0)) {
-        yield return new HashSet<T>(subset);
+        if (subset.Count > 0) {
+          yield return subset;
+        }
       }
     }
 
-    private static bool MentionsAll(ISet<TriggerCandidate> multiCandidate, List<BoundVar> vars) {
-      return vars.All(x => multiCandidate.Any(candidate => candidate.Variables.Contains(x))); //TODO Perfs?
-    }
-
     private static bool DefaultCandidateFilteringFunction(TriggerCandidate candidate, QuantifierExpr quantifier) {
       //FIXME this will miss rewritten expressions (CleanupExpr)
-      //FIXME does PotentialMatchingLoops really need to be a field?
-
+      candidate.PotentialMatchingLoops = ExprExtensions.SubexpressionsMatchingTrigger(candidate.Expr, quantifier).ToList();
       return true;
-
-
-      candidate.PotentialMatchingLoops = ExprExtensions.CouldCauseCycle(candidate.Expr, quantifier).ToArray(); 
-      if (candidate.PotentialMatchingLoops.Any()) {
-         DebugTriggers("Trigger {0} for quantifier {1} could cause a matching loop, due to terms {2}.", 
-         Printer.ExprToString(candidate.Expr), Printer.ExprToString(quantifier), 
-           String.Join(", ", candidate.PotentialMatchingLoops.Select(e => Printer.ExprToString(e))));
-      }
-      return !candidate.PotentialMatchingLoops.Any();
     }
 
-    private static bool DefaultMultiCandidateFilteringFunction(ISet<TriggerCandidate> multiCandidate, QuantifierExpr quantifier) {
-      return MentionsAll(multiCandidate, quantifier.BoundVars);
+    private static bool DefaultMultiCandidateFilteringFunction(MultiTriggerCandidate multiCandidate, QuantifierExpr quantifier) {
+      if (multiCandidate.PotentialMatchingLoops.Any()) {
+        multiCandidate.Tags.Add(String.Format("matching loop with {0}", String.Join(", ", multiCandidate.PotentialMatchingLoops.Select(Printer.ExprToString))));
+      }
+      return multiCandidate.MentionsAll(quantifier.BoundVars) && !multiCandidate.PotentialMatchingLoops.Any();
     }
 
-    private static double DefaultMultiCandidateScoringFunction(ISet<TriggerCandidate> multi_candidates) {
-      return 1;
+    private static double DefaultMultiCandidateScoringFunction(MultiTriggerCandidate multi_candidate) {
+      return 1.0;
     }
 
     private static IEnumerable<MultiTriggerCandidate> DefaultMultiCandidateSelectionFunction(List<MultiTriggerCandidate> multi_candidates) {
@@ -327,23 +374,23 @@ namespace Microsoft.Dafny {
 
     // CLEMENT: Make these customizable
     internal Func<TriggerCandidate, QuantifierExpr, bool> CandidateFilteringFunction = DefaultCandidateFilteringFunction;
-    internal Func<ISet<TriggerCandidate>, QuantifierExpr, bool> MultiCandidateFilteringFunction = DefaultMultiCandidateFilteringFunction;
-    internal Func<ISet<TriggerCandidate>, double> MultiCandidateScoringFunction = DefaultMultiCandidateScoringFunction;
+    internal Func<MultiTriggerCandidate, QuantifierExpr, bool> MultiCandidateFilteringFunction = DefaultMultiCandidateFilteringFunction;
+    internal Func<MultiTriggerCandidate, double> MultiCandidateScoringFunction = DefaultMultiCandidateScoringFunction;
     internal Func<List<MultiTriggerCandidate>, IEnumerable<MultiTriggerCandidate>> MultiCandidateSelectionFunction = DefaultMultiCandidateSelectionFunction;
 
     struct MultiCandidatesCollection {
-      internal ISet<TriggerCandidate> AllCandidates;
+      internal List<TriggerCandidate> AllCandidates;
       internal List<TriggerCandidate> SelectedCandidates;
       internal List<TriggerCandidate> RejectedCandidates;
-      internal List<ISet<TriggerCandidate>> FilteredMultiCandidates;
-      internal List<MultiTriggerCandidate> ScoredMultiCandidates;
       internal List<MultiTriggerCandidate> SelectedMultiCandidates;
+      internal List<MultiTriggerCandidate> RejectedMultiCandidates;
+      internal List<MultiTriggerCandidate> FinalMultiCandidates;
 
       public MultiCandidatesCollection(QuantifierExpr quantifier,
         TriggerAnnotation annotation,
         Func<TriggerCandidate, QuantifierExpr, bool> CandidateFilteringFunction,
-        Func<ISet<TriggerCandidate>, QuantifierExpr, bool> MultiCandidateFilteringFunction,
-        Func<ISet<TriggerCandidate>, double> MultiCandidateScoringFunction,
+        Func<MultiTriggerCandidate, QuantifierExpr, bool> MultiCandidateFilteringFunction,
+        Func<MultiTriggerCandidate, double> MultiCandidateScoringFunction,
         Func<List<MultiTriggerCandidate>, IEnumerable<MultiTriggerCandidate>> MultiCandidateSelectionFunction) {
 
         Contract.Requires(annotation != null);
@@ -353,18 +400,20 @@ namespace Microsoft.Dafny {
         Contract.Requires(MultiCandidateScoringFunction != null);
         Contract.Requires(MultiCandidateSelectionFunction != null);
 
-        AllCandidates = annotation.PrivateCandidates;
-        Partition(AllCandidates, x => CandidateFilteringFunction(x, quantifier), out SelectedCandidates, out RejectedCandidates);
-        FilteredMultiCandidates = AllSubsets(SelectedCandidates).Where(t => MultiCandidateFilteringFunction(t, quantifier)).ToList();
-        ScoredMultiCandidates = FilteredMultiCandidates.Select(candidates => new MultiTriggerCandidate { Candidates = candidates, Score = MultiCandidateScoringFunction(candidates) }).ToList();
-        SelectedMultiCandidates = MultiCandidateSelectionFunction(ScoredMultiCandidates).ToList();
+        AllCandidates = annotation.PrivateCandidates.Distinct(TriggerCandidateComparer.Instance).ToList();
+        Partition(AllCandidates, 
+          x => CandidateFilteringFunction(x, quantifier), out SelectedCandidates, out RejectedCandidates);
+        Partition(AllNonEmptySubsets(SelectedCandidates).Select(s => new MultiTriggerCandidate(s)), 
+          x => MultiCandidateFilteringFunction(x, quantifier), out SelectedMultiCandidates, out RejectedMultiCandidates);
+        SelectedMultiCandidates.Iter(x => x.Score = MultiCandidateScoringFunction(x));
+        FinalMultiCandidates = MultiCandidateSelectionFunction(SelectedMultiCandidates).ToList();
       }
 
-      private static void Partition<T>(IEnumerable<T> AllCandidates, Func<T, bool> CandidateFilteringFunction, out List<T> SelectedCandidates, out List<T> RejectedCandidates) {
-        SelectedCandidates = new List<T>();
-        RejectedCandidates = new List<T>();
-        foreach (var c in AllCandidates) {
-          (CandidateFilteringFunction(c) ? SelectedCandidates : RejectedCandidates).Add(c);
+      private static void Partition<T>(IEnumerable<T> elements, Func<T, bool> predicate, out List<T> positive, out List<T> negative) {
+        positive = new List<T>();
+        negative = new List<T>();
+        foreach (var c in elements) {
+          (predicate(c) ? positive : negative).Add(c);
         }
       }
 
@@ -372,11 +421,11 @@ namespace Microsoft.Dafny {
         if (AllCandidates.Count == 0) {
           return "No triggers found in the body of this quantifier.";
         } else if (SelectedCandidates.Count == 0) {
-          return String.Format("No suitable triggers found. Candidate building blocks for a good trigger where [{0}], but no subset of these terms passed the initial selection stage.", String.Join(", ", SelectedCandidates));
-        } else if (FilteredMultiCandidates.Count == 0) {
-          return String.Format("No suitable set of triggers found. Candidate building blocks for a good trigger where [{0}], but no subset of these terms passed the subset selection stage.", String.Join(", ", SelectedCandidates));
+          return String.Format("No suitable triggers found. Candidate building blocks for a good trigger where [{0}], but none these terms passed the initial selection stage.", String.Join(", ", AllCandidates));
         } else if (SelectedMultiCandidates.Count == 0) {
-          return String.Format("No suitable set of triggers found. Candidates where [{0}], but none passed the final selection stage.", String.Join(", ", ScoredMultiCandidates));
+          return String.Format("No suitable set of triggers found. Candidate building blocks for a good trigger where [{0}], but no subset of these terms passed the subset selection stage.", String.Join(", ", SelectedCandidates));
+        } else if (FinalMultiCandidates.Count == 0) {
+          return String.Format("No suitable set of triggers found. Candidates where [{0}], but none passed the final selection stage.", String.Join(", ", SelectedMultiCandidates));
         } else {
           return null;
         }
@@ -402,14 +451,14 @@ namespace Microsoft.Dafny {
         var indent = "      ";
         repr.Append("    All:");
         WriteListOfCandidates(repr, indent, AllCandidates);
+        repr.Append("    Selected1:");
+        WriteListOfCandidates(repr, indent, SelectedCandidates);
         repr.Append("    PreFilter:");
-        WriteListOfCandidates(repr, indent, AllSubsets(AllCandidates).Select(c => String.Join(", ", c)));
-        repr.Append("    Filtered:");
-        WriteListOfCandidates(repr, indent, FilteredMultiCandidates.Select(c => String.Join(", ", c))); 
-        repr.Append("    Scored:");
-        WriteListOfCandidates(repr, indent, ScoredMultiCandidates);
-        repr.Append("    Selected:");
-        WriteListOfCandidates(repr, indent, SelectedMultiCandidates);
+        WriteListOfCandidates(repr, indent, AllNonEmptySubsets(AllCandidates).Select(c => String.Join(", ", c)));
+        repr.Append("    SelectedMulti:");
+        WriteListOfCandidates(repr, indent, SelectedMultiCandidates.Select(c => String.Join(", ", c)));
+        repr.Append("    Final:");
+        WriteListOfCandidates(repr, indent, FinalMultiCandidates);
         return repr.ToString();
       }
     }
@@ -430,20 +479,18 @@ namespace Microsoft.Dafny {
       }
 
       var multi_candidates = PickMultiTriggers(quantifier);
-      foreach (var multi_candidate in multi_candidates.SelectedMultiCandidates) { //TODO: error message for when no triggers found
+      foreach (var multi_candidate in multi_candidates.FinalMultiCandidates) { //TODO: error message for when no triggers found
         quantifier.Attributes = new Attributes("trigger", multi_candidate.Candidates.Select(t => t.Expr).ToList(), quantifier.Attributes);
       }
 
-      // FIXME: Cleanup
-      if (multi_candidates.RejectedCandidates.Any()) {
-        var tooltip = "Rejected: " + String.Join(Environment.NewLine + "          ", multi_candidates.RejectedCandidates.Select(
-          candidate => "{:trigger " + Printer.ExprToString(candidate.Expr) + "} (could loop with " + Printer.ExprToString(candidate.PotentialMatchingLoops[0]) + ")"));
+      if (multi_candidates.RejectedMultiCandidates.Any()) {
+        var tooltip = JoinStringsWithHeader("Rejected: ", multi_candidates.RejectedMultiCandidates.Where(candidate => candidate.Tags != null)
+          .Select(candidate => candidate.AsDafnyAttributeString(true, true)));
         Resolver.ReportAdditionalInformation(quantifier.tok, tooltip, quantifier.tok.val.Length); //CLEMENT Check this
       }
 
-      if (multi_candidates.SelectedMultiCandidates.Any()) {
-        var tooltip = "Triggers: " + String.Join(Environment.NewLine + "          ", multi_candidates.SelectedMultiCandidates.Select(
-          multi_candidate => "{:trigger " + String.Join(", ", multi_candidate.Candidates.Select(t => Printer.ExprToString(t.Expr))) + "}"));
+      if (multi_candidates.FinalMultiCandidates.Any()) {
+        var tooltip = JoinStringsWithHeader("Triggers: ", multi_candidates.FinalMultiCandidates.Select(multi_candidate => multi_candidate.AsDafnyAttributeString()));
         Resolver.ReportAdditionalInformation(quantifier.tok, tooltip, quantifier.tok.val.Length); //CLEMENT Check this
       }
 
@@ -453,6 +500,10 @@ namespace Microsoft.Dafny {
       }
     }
 
+    private string JoinStringsWithHeader(string header, IEnumerable<string> lines) {
+      return header + String.Join(Environment.NewLine + new String(' ', header.Length), lines);
+    }
+
     private void AddTriggers_Internal() {
       foreach (var quantifier in quantifiers) {
         AddTrigger(quantifier);
@@ -543,7 +594,25 @@ namespace Microsoft.Dafny {
       }
     }
 
-    private static bool ExpressionEq(this Expression expr1, Expression expr2) {
+    internal class EqExpressionComparer : IEqualityComparer<Expression> { //FIXME
+      private static EqExpressionComparer singleton;
+      internal static EqExpressionComparer Instance { 
+        get { return singleton == null ? (singleton = new EqExpressionComparer()) : singleton; }
+      }
+
+      private EqExpressionComparer() { }
+
+      public bool Equals(Expression x, Expression y) {
+        return x == null && y == null ||
+               x != null && y != null && x.ExpressionEq(y);
+      }
+
+      public int GetHashCode(Expression obj) {
+        return 1;
+      }
+    }
+
+    internal static bool ExpressionEq(this Expression expr1, Expression expr2) {
       expr1 = GetResolved(expr1);
       expr2 = GetResolved(expr2);
       
@@ -575,12 +644,17 @@ namespace Microsoft.Dafny {
       return expr.MatchesTrigger(trigger, holes, new Dictionary<IVariable, Expression>());
     }
 
-    internal static IEnumerable<Expression> CouldCauseCycle(Expression trigger, QuantifierExpr quantifier) { //FIXME Term or bound?
-      //FIXME could be optimized by looking at the bindings instead of doing full equality
-      return quantifier.Term.AllSubExpressions().Where(e => e.MatchesTrigger(trigger, new HashSet<BoundVar>(quantifier.BoundVars)) && !e.ExpressionEq(trigger));
+    internal static IEnumerable<Expression> SubexpressionsMatchingTrigger(Expression trigger, QuantifierExpr quantifier) {
+      return quantifier.Term.AllSubExpressions().Where(e => e.MatchesTrigger(trigger, new HashSet<BoundVar>(quantifier.BoundVars)));
     }
 
     private static bool SameLists<T>(IEnumerable<T> list1, IEnumerable<T> list2, Func<T, T, bool> comparer) {
+      if (ReferenceEquals(list1, list2)) {
+        return true;
+      } else if ((list1 == null) != (list2 == null)) {
+        return false;
+      }
+
       var it1 = list1.GetEnumerator();
       var it2 = list2.GetEnumerator();
       bool it1_has, it2_has;
-- 
cgit v1.2.3


From dc721907edfd78d6e12ed4155b14c960416791c4 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Tue, 14 Jul 2015 19:46:49 -0700
Subject: Fix broken interaction between triggers and inlining of function
 calls

The problem was that inlining would replace formals with arguments in triggers
as well, causing invalid expressions ("trigger killers") to pop up in triggers
after inlining.

This fix disables inlining if it can't be determined that it won't lead to an
invalid trigger. If that procedure is incomplete, then that's only by a narrow
margin, as the checks actually ensure that the formals that are getting trigger
killers are indeed used in triggers.
---
 Source/Dafny/Resolver.cs                       |  2 +-
 Source/Dafny/Translator.cs                     | 59 +++++++++++++++++++++++++-
 Source/Dafny/TriggerGenerator.cs               | 24 ++++++-----
 Test/new-tests/trigger-in-predicate.dfy        | 15 +++++++
 Test/new-tests/trigger-in-predicate.dfy.expect |  4 ++
 5 files changed, 91 insertions(+), 13 deletions(-)
 create mode 100644 Test/new-tests/trigger-in-predicate.dfy
 create mode 100644 Test/new-tests/trigger-in-predicate.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 300d4985..c5b19d8c 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -268,7 +268,7 @@ namespace Microsoft.Dafny
       Contract.Invariant(cce.NonNullDictionaryAndValues(datatypeCtors) && Contract.ForAll(datatypeCtors.Values, v => cce.NonNullDictionaryAndValues(v)));
     }
 
-    public void DefaultInformationReporter(AdditionalInformation info) {
+    public static void DefaultInformationReporter(AdditionalInformation info) {
       Console.WriteLine("{0}({1},{2}): Info: {3}",
                         DafnyOptions.Clo.UseBaseNameForFileName ? System.IO.Path.GetFileName(info.Token.filename) : info.Token.filename,
                         info.Token.line, info.Token.col, info.Text);
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 8042033b..861e2859 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -12699,9 +12699,8 @@ namespace Microsoft.Dafny {
             // that needed to be proved about the function was proved already in the previous module, even without the body definition).
           } else if (!FunctionBodyIsAvailable(f, currentModule)) {
             // Don't inline opaque functions or foreign protected functions
-          } else {
+          } else if (CanSafelyInline(fexp, f)) {
             // inline this body
-            // CLEMENT: This is a problem for triggers
             var body = GetSubstitutedBody(fexp, f, false);
             var typeSpecializedBody = GetSubstitutedBody(fexp, f, true);
             var typeSpecializedResultType = Resolver.SubstType(f.ResultType, fexp.TypeArgumentSubstitutions);
@@ -12762,6 +12761,15 @@ namespace Microsoft.Dafny {
             splits.Add(new SplitExprInfo(SplitExprInfo.K.Free, fr));
 
             return true;
+          } else {
+            // Skip inlining, as it would cause arbitrary expressions to pop up in the trigger
+            // CLEMENT: Report inlining issue in a VS plugin friendly way
+            var info = new AdditionalInformation {
+              Token = fexp.tok,
+              Length = fexp.tok.val.Length,
+              Text = "This call cannot be safely inlined.",
+            };
+            Resolver.DefaultInformationReporter(info);
           }
         }
 
@@ -12902,6 +12910,53 @@ namespace Microsoft.Dafny {
       return splitHappened;
     }
 
+    private bool CanSafelyInline(FunctionCallExpr fexp, Function f) {
+      var visitor = new TriggersExplorer();
+
+      visitor.Visit(f.Body);
+      foreach (var expr in f.Ens) { visitor.Visit(expr); }
+      foreach (var expr in f.Req) { visitor.Visit(expr); }
+      // CLEMENT: Anything else?
+
+      return f.Formals.Zip(fexp.Args).All(formal_concrete => CanSafelySubstitute(visitor.TriggerVariables, formal_concrete.Item1, formal_concrete.Item2));
+    }
+
+    private bool CanSafelySubstitute(ISet<IVariable> protectedVariables, IVariable variable, Expression substitution) {
+      return !(protectedVariables.Contains(variable) && TriggerGenerator.IsTriggerKiller(substitution));
+    }
+
+    private class VariablesCollector: BottomUpVisitor {
+      internal ISet<IVariable> variables;
+
+      internal VariablesCollector() {
+        this.variables = new HashSet<IVariable>();
+      }
+
+      protected override void VisitOneExpr(Expression expr) {
+        if (expr is IdentifierExpr) {
+          variables.Add((expr as IdentifierExpr).Var);
+        }
+      }
+    }
+
+    private class TriggersExplorer : BottomUpVisitor {
+      VariablesCollector collector;
+
+      internal ISet<IVariable> TriggerVariables { get { return collector.variables; } }
+
+      internal TriggersExplorer() {
+        collector = new VariablesCollector();
+      }
+
+      protected override void VisitOneExpr(Expression expr) {
+        if (expr is QuantifierExpr) {
+          foreach (var trigger in (expr as QuantifierExpr).Attributes.AsEnumerable().Where(a => a.Name == "trigger").SelectMany(a => a.Args)) {
+            collector.Visit(trigger);
+          }
+        }
+      }
+    }
+
     private Expression GetSubstitutedBody(FunctionCallExpr fexp, Function f, bool specializeTypeParameters) {
       Contract.Requires(fexp != null);
       Contract.Requires(f != null);
diff --git a/Source/Dafny/TriggerGenerator.cs b/Source/Dafny/TriggerGenerator.cs
index 4697b149..40cd67e4 100644
--- a/Source/Dafny/TriggerGenerator.cs
+++ b/Source/Dafny/TriggerGenerator.cs
@@ -145,13 +145,13 @@ namespace Microsoft.Dafny {
     List<QuantifierExpr> quantifiers;
     Dictionary<Expression, TriggerAnnotation> annotations;
 
-    Resolver Resolver;
+    Action<IToken, string, int> AdditionalInformationReporter;
 
-    private TriggerGenerator(Resolver resolver) {
-      Contract.Requires(Resolver != null);
+    private TriggerGenerator(Action<IToken, string, int> additionalInformationReporter) {
+      Contract.Requires(additionalInformationReporter != null);
       this.quantifiers = new List<QuantifierExpr>();
       this.annotations = new Dictionary<Expression, TriggerAnnotation>();
-      this.Resolver = resolver;
+      this.AdditionalInformationReporter = additionalInformationReporter;
     }
 
     private List<T> MergeAlterFirst<T>(List<T> a, List<T> b) {
@@ -470,7 +470,6 @@ namespace Microsoft.Dafny {
     }
 
     private void AddTrigger(QuantifierExpr quantifier) {
-      // This call is elided when triggers debugging is disabled.
       DebugTriggers("  Final results:\n{0}", PickMultiTriggers(quantifier));
 
       if (quantifier.Attributes.AsEnumerable().Any(aa => aa.Name == "trigger" || aa.Name == "no_trigger")) {
@@ -486,12 +485,12 @@ namespace Microsoft.Dafny {
       if (multi_candidates.RejectedMultiCandidates.Any()) {
         var tooltip = JoinStringsWithHeader("Rejected: ", multi_candidates.RejectedMultiCandidates.Where(candidate => candidate.Tags != null)
           .Select(candidate => candidate.AsDafnyAttributeString(true, true)));
-        Resolver.ReportAdditionalInformation(quantifier.tok, tooltip, quantifier.tok.val.Length); //CLEMENT Check this
+        AdditionalInformationReporter(quantifier.tok, tooltip, quantifier.tok.val.Length); //CLEMENT Check this
       }
 
       if (multi_candidates.FinalMultiCandidates.Any()) {
         var tooltip = JoinStringsWithHeader("Triggers: ", multi_candidates.FinalMultiCandidates.Select(multi_candidate => multi_candidate.AsDafnyAttributeString()));
-        Resolver.ReportAdditionalInformation(quantifier.tok, tooltip, quantifier.tok.val.Length); //CLEMENT Check this
+        AdditionalInformationReporter(quantifier.tok, tooltip, quantifier.tok.val.Length); //CLEMENT Check this
       }
 
       string warning = multi_candidates.Warning();
@@ -500,6 +499,11 @@ namespace Microsoft.Dafny {
       }
     }
 
+    internal static bool IsTriggerKiller(Expression expr) {
+      var annotation = new TriggerGenerator((x, y, z) => { }).Annotate(expr);
+      return annotation.IsTriggerKiller;
+    }
+
     private string JoinStringsWithHeader(string header, IEnumerable<string> lines) {
       return header + String.Join(Environment.NewLine + new String(' ', header.Length), lines);
     }
@@ -525,7 +529,7 @@ namespace Microsoft.Dafny {
         return;
 
       DebugTriggers("== From {0} visiting expr: {1}", new StackFrame(1).GetMethod().Name, Printer.ExprToString(root));
-      TriggerGenerator generator = new TriggerGenerator(resolver);
+      TriggerGenerator generator = new TriggerGenerator(resolver.ReportAdditionalInformation);
       generator.AddTriggers_Internal(root);
     }
 
@@ -534,7 +538,7 @@ namespace Microsoft.Dafny {
         return;
 
       DebugTriggers("== From {0} visiting statement: {1}", new StackFrame(1).GetMethod().Name, Printer.StatementToString(root));
-      TriggerGenerator generator = new TriggerGenerator(resolver);
+      TriggerGenerator generator = new TriggerGenerator(resolver.ReportAdditionalInformation);
       generator.AddTriggers_Internal(root);
     }
 
@@ -596,7 +600,7 @@ namespace Microsoft.Dafny {
 
     internal class EqExpressionComparer : IEqualityComparer<Expression> { //FIXME
       private static EqExpressionComparer singleton;
-      internal static EqExpressionComparer Instance { 
+      internal static EqExpressionComparer Instance {
         get { return singleton == null ? (singleton = new EqExpressionComparer()) : singleton; }
       }
 
diff --git a/Test/new-tests/trigger-in-predicate.dfy b/Test/new-tests/trigger-in-predicate.dfy
new file mode 100644
index 00000000..880d3d1d
--- /dev/null
+++ b/Test/new-tests/trigger-in-predicate.dfy
@@ -0,0 +1,15 @@
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+predicate A(x: bool, y: bool) { x }
+
+predicate B(x: bool, z: bool) { forall y {:trigger A(x, y) } :: A(x, y) && z }
+
+// Inlining is disabled here to prevent pollution of the trigger in B
+method C() requires B(true || false, true) {}
+
+// Inlining should work fine here
+method C'() requires B(true, true) {}
+
+// Inlining should work fine here
+method C''() requires B(true, true && false) {}
diff --git a/Test/new-tests/trigger-in-predicate.dfy.expect b/Test/new-tests/trigger-in-predicate.dfy.expect
new file mode 100644
index 00000000..211bc9a2
--- /dev/null
+++ b/Test/new-tests/trigger-in-predicate.dfy.expect
@@ -0,0 +1,4 @@
+c:/MSR/dafny-triggers/Test/new-tests/trigger-in-predicate.dfy(9,21): Info: This call cannot be safely inlined.
+c:/MSR/dafny-triggers/Test/new-tests/trigger-in-predicate.dfy(9,21): Info: This call cannot be safely inlined.
+
+Dafny program verifier finished with 8 verified, 0 errors
-- 
cgit v1.2.3


From 7a739b4e396554ee004abc42829351f126a224b7 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Wed, 15 Jul 2015 10:03:30 -0700
Subject: Weaken the trigger cycling check to allow more patterns

---
 Source/Dafny/TriggerGenerator.cs | 80 +++++++++++++++++++++++++++++++++-------
 1 file changed, 66 insertions(+), 14 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/TriggerGenerator.cs b/Source/Dafny/TriggerGenerator.cs
index 40cd67e4..dc99e609 100644
--- a/Source/Dafny/TriggerGenerator.cs
+++ b/Source/Dafny/TriggerGenerator.cs
@@ -1,4 +1,4 @@
-#define DEBUG_AUTO_TRIGGERS
+// #define DEBUG_AUTO_TRIGGERS
 #define THROW_UNSUPPORTED_COMPARISONS
 
 using System;
@@ -28,7 +28,7 @@ namespace Microsoft.Dafny {
   class TriggerCandidate { // TODO Hashing is broken (duplicates can pop up)
     internal Expression Expr;
     internal ISet<IVariable> Variables;
-    internal List<Expression> PotentialMatchingLoops;
+    internal List<ExprExtensions.TriggerMatch> MatchesInQuantifierBody;
 
     public override string ToString() {
       return Printer.ExprToString(Expr);
@@ -57,15 +57,15 @@ namespace Microsoft.Dafny {
     internal List<TriggerCandidate> Candidates;
     internal List<string> Tags;
     internal double Score;
-    
-    private List<Expression> potentialMatchingLoops;
-    internal List<Expression> PotentialMatchingLoops {
+
+    private List<ExprExtensions.TriggerMatch> potentialMatchingLoops;
+    internal List<ExprExtensions.TriggerMatch> PotentialMatchingLoops {
       get {
         if (potentialMatchingLoops == null) {
           //FIXME could be optimized by looking at the bindings instead of doing full equality
           var candidates = Candidates.Distinct(TriggerCandidateComparer.Instance);
-          potentialMatchingLoops = candidates.SelectMany(candidate => candidate.PotentialMatchingLoops)
-            .Distinct(ExprExtensions.EqExpressionComparer.Instance).Where(e => !candidates.Any(c => c.Expr.ExpressionEq(e))).ToList();
+          potentialMatchingLoops = candidates.SelectMany(candidate => candidate.MatchesInQuantifierBody)
+            .Distinct(ExprExtensions.TriggerMatchComparer.Instance).Where(tm => tm.CouldCauseLoops(candidates)).ToList();
         }
         
         return potentialMatchingLoops;
@@ -353,13 +353,13 @@ namespace Microsoft.Dafny {
 
     private static bool DefaultCandidateFilteringFunction(TriggerCandidate candidate, QuantifierExpr quantifier) {
       //FIXME this will miss rewritten expressions (CleanupExpr)
-      candidate.PotentialMatchingLoops = ExprExtensions.SubexpressionsMatchingTrigger(candidate.Expr, quantifier).ToList();
+      candidate.MatchesInQuantifierBody = quantifier.SubexpressionsMatchingTrigger(candidate.Expr).ToList();
       return true;
     }
 
     private static bool DefaultMultiCandidateFilteringFunction(MultiTriggerCandidate multiCandidate, QuantifierExpr quantifier) {
       if (multiCandidate.PotentialMatchingLoops.Any()) {
-        multiCandidate.Tags.Add(String.Format("matching loop with {0}", String.Join(", ", multiCandidate.PotentialMatchingLoops.Select(Printer.ExprToString))));
+        multiCandidate.Tags.Add(String.Format("matching loop with {0}", String.Join(", ", multiCandidate.PotentialMatchingLoops.Select(tm => Printer.ExprToString(tm.Expr)))));
       }
       return multiCandidate.MentionsAll(quantifier.BoundVars) && !multiCandidate.PotentialMatchingLoops.Any();
     }
@@ -616,13 +616,41 @@ namespace Microsoft.Dafny {
       }
     }
 
+    internal class TriggerMatchComparer : IEqualityComparer<TriggerMatch> { //FIXME
+      private static TriggerMatchComparer singleton;
+      internal static TriggerMatchComparer Instance {
+        get { return singleton == null ? (singleton = new TriggerMatchComparer()) : singleton; }
+      }
+
+      private TriggerMatchComparer() { }
+
+      public bool Equals(TriggerMatch x, TriggerMatch y) {
+        return ExpressionEq(x.Expr, y.Expr);
+      }
+
+      public int GetHashCode(TriggerMatch obj) {
+        return 1;
+      }
+    }
+
     internal static bool ExpressionEq(this Expression expr1, Expression expr2) {
       expr1 = GetResolved(expr1);
       expr2 = GetResolved(expr2);
-      
+
       return ShallowEq_Top(expr1, expr2) && SameLists(expr1.SubExpressions, expr2.SubExpressions, (e1, e2) => ExpressionEq(e1, e2));
     }
 
+    internal static bool ExpressionEqModuloVariableNames(this Expression expr1, Expression expr2) {
+      expr1 = GetResolved(expr1);
+      expr2 = GetResolved(expr2);
+
+      if (expr1 is IdentifierExpr) {
+        return expr2 is IdentifierExpr;
+      }
+
+      return ShallowEq_Top(expr1, expr2) && SameLists(expr1.SubExpressions, expr2.SubExpressions, (e1, e2) => ExpressionEqModuloVariableNames(e1, e2));
+    }
+
     private static bool MatchesTrigger(this Expression expr, Expression trigger, ISet<BoundVar> holes, Dictionary<IVariable, Expression> bindings) {
       expr = GetResolved(expr);
       trigger = GetResolved(trigger);
@@ -644,12 +672,36 @@ namespace Microsoft.Dafny {
       return ShallowEq_Top(expr, trigger) && SameLists(expr.SubExpressions, trigger.SubExpressions, (e1, e2) => MatchesTrigger(e1, e2, holes, bindings));
     }
 
-    private static bool MatchesTrigger(this Expression expr, Expression trigger, ISet<BoundVar> holes) {
-      return expr.MatchesTrigger(trigger, holes, new Dictionary<IVariable, Expression>());
+    internal struct TriggerMatch {
+      internal Expression Expr;
+      internal Dictionary<IVariable, Expression> Bindings;
+
+      internal bool CouldCauseLoops(IEnumerable<TriggerCandidate> candidates) {
+        // A match for a trigger in the body of a quantifier can be a problem if 
+        // it yields to a matching loop: for example, f(x) is a bad trigger in 
+        //   forall x, y :: f(x) = f(f(x))
+        // In general, any such match can lead to a loop, but two special cases 
+        // will only lead to a finite number of instantiations:
+        // 1. The match equals one of the triggers in the set of triggers under
+        //    consideration. For example, { f(x) } a bad trigger above, but the
+        //    pair { f(x), f(f(x)) } is fine (instantiating won't yield new 
+        //    matches)
+        // 2. The match only differs from one of these triggers by variable 
+        //    names. This is a superset of the previous case.
+        var expr = Expr;
+        return !candidates.Any(c => c.Expr.ExpressionEqModuloVariableNames(expr));
+      }
+    }
+
+    private static TriggerMatch? MatchAgainst(this Expression expr, Expression trigger, ISet<BoundVar> holes) {
+      var bindings = new Dictionary<IVariable, Expression>();
+      return expr.MatchesTrigger(trigger, holes, bindings) ? new TriggerMatch { Expr = expr, Bindings = bindings } : (TriggerMatch?)null;
     }
 
-    internal static IEnumerable<Expression> SubexpressionsMatchingTrigger(Expression trigger, QuantifierExpr quantifier) {
-      return quantifier.Term.AllSubExpressions().Where(e => e.MatchesTrigger(trigger, new HashSet<BoundVar>(quantifier.BoundVars)));
+    internal static IEnumerable<TriggerMatch> SubexpressionsMatchingTrigger(this QuantifierExpr quantifier, Expression trigger) {
+      return quantifier.Term.AllSubExpressions()
+        .Select(e => e.MatchAgainst(trigger, new HashSet<BoundVar>(quantifier.BoundVars)))
+        .Where(e => e.HasValue).Select(e => e.Value);
     }
 
     private static bool SameLists<T>(IEnumerable<T> list1, IEnumerable<T> list2, Func<T, T, bool> comparer) {
-- 
cgit v1.2.3


From 6138ea13b5116eef41eeec5b59a13cc9c12ffcfa Mon Sep 17 00:00:00 2001
From: Michael Lowell Roberts <mirobert@microsoft.com>
Date: Wed, 15 Jul 2015 10:30:35 -0700
Subject: [IronDafny] fix for ambiguous identifier error.

---
 Source/Dafny/Resolver.cs | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 460859db..78bc02ff 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -931,7 +931,11 @@ namespace Microsoft.Dafny
               if (useImports || string.Equals(kv.Key, "_default", StringComparison.InvariantCulture)) {
                 TopLevelDecl d;
                 if (sig.TopLevels.TryGetValue(kv.Key, out d)) {
-                  sig.TopLevels[kv.Key] = AmbiguousTopLevelDecl.Create(moduleDef, d, kv.Value);
+                  if (DafnyOptions.O.IronDafny && kv.Value.ClonedFrom == d) {
+                    sig.TopLevels[kv.Key] = kv.Value;
+                  } else {
+                    sig.TopLevels[kv.Key] = AmbiguousTopLevelDecl.Create(moduleDef, d, kv.Value);
+                  }
                 } else {
                   sig.TopLevels.Add(kv.Key, kv.Value);
                 }
-- 
cgit v1.2.3


From 9f8cb23ad0662cea28f681872236277c2af2432e Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 16 Jul 2015 14:27:28 -0700
Subject: Strip literals from triggers

---
 Source/Dafny/Translator.cs         | 78 +++++++++++++++++++++++---------------
 Test/dafny0/LitTriggers.dfy        | 35 +++++++++++++++++
 Test/dafny0/LitTriggers.dfy.expect |  2 +
 3 files changed, 85 insertions(+), 30 deletions(-)
 create mode 100644 Test/dafny0/LitTriggers.dfy
 create mode 100644 Test/dafny0/LitTriggers.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 861e2859..4a7ac006 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -10302,7 +10302,8 @@ namespace Microsoft.Dafny {
       public readonly Bpl.Expr layerInterCluster;
       public readonly Bpl.Expr layerIntraCluster = null;  // a value of null says to do the same as for inter-cluster calls
       public int Statistics_CustomLayerFunctionCount = 0;
-      public readonly bool ProducingCoCertificates = false;
+      public readonly bool ProducingCoCertificates = false; // CLEMENT Where is this used?
+      public readonly bool stripLits = false;
       [ContractInvariantMethod]
       void ObjectInvariant()
       {
@@ -10320,7 +10321,7 @@ namespace Microsoft.Dafny {
       /// This is a general constructor, but takes the layerInterCluster as an int.
       /// </summary>
       ExpressionTranslator(Translator translator, PredefinedDecls predef, Bpl.Expr heap, string thisVar,
-        Function applyLimited_CurrentFunction, int layerInterCluster, Bpl.Expr layerIntraCluster, string modifiesFrame) {
+        Function applyLimited_CurrentFunction, int layerInterCluster, Bpl.Expr layerIntraCluster, string modifiesFrame, bool stripLits) {
 
         Contract.Requires(translator != null);
         Contract.Requires(predef != null);
@@ -10337,6 +10338,7 @@ namespace Microsoft.Dafny {
         this.layerInterCluster = LayerN(layerInterCluster);
         this.layerIntraCluster = layerIntraCluster;
         this.modifiesFrame = modifiesFrame;
+        this.stripLits = stripLits;
       }
 
       /// <summary>
@@ -10344,7 +10346,7 @@ namespace Microsoft.Dafny {
       /// one ExpressionTranslator is constructed from another, unchanged parameters are just copied in.
       /// </summary>
       ExpressionTranslator(Translator translator, PredefinedDecls predef, Bpl.Expr heap, string thisVar,
-        Function applyLimited_CurrentFunction, Bpl.Expr layerInterCluster, Bpl.Expr layerIntraCluster, string modifiesFrame) {
+        Function applyLimited_CurrentFunction, Bpl.Expr layerInterCluster, Bpl.Expr layerIntraCluster, string modifiesFrame, bool stripLits) {
 
         Contract.Requires(translator != null);
         Contract.Requires(predef != null);
@@ -10365,6 +10367,7 @@ namespace Microsoft.Dafny {
           this.layerIntraCluster = layerIntraCluster;
         }
         this.modifiesFrame = modifiesFrame;
+        this.stripLits = stripLits;
       }
 
       public ExpressionTranslator(Translator translator, PredefinedDecls predef, IToken heapToken)
@@ -10394,7 +10397,7 @@ namespace Microsoft.Dafny {
       }
 
       public ExpressionTranslator(Translator translator, PredefinedDecls predef, Bpl.Expr heap, string thisVar)
-        : this(translator, predef, heap, thisVar, null, 1, null, "$_Frame") {
+        : this(translator, predef, heap, thisVar, null, 1, null, "$_Frame", false) {
         Contract.Requires(translator != null);
         Contract.Requires(predef != null);
         Contract.Requires(heap != null);
@@ -10402,14 +10405,14 @@ namespace Microsoft.Dafny {
       }
 
       public ExpressionTranslator(ExpressionTranslator etran, Bpl.Expr heap)
-        : this(etran.translator, etran.predef, heap, etran.This, etran.applyLimited_CurrentFunction, etran.layerInterCluster, etran.layerIntraCluster, etran.modifiesFrame)
+        : this(etran.translator, etran.predef, heap, etran.This, etran.applyLimited_CurrentFunction, etran.layerInterCluster, etran.layerIntraCluster, etran.modifiesFrame, etran.stripLits)
       {
         Contract.Requires(etran != null);
         Contract.Requires(heap != null);
       }
 
       public ExpressionTranslator(ExpressionTranslator etran, string modifiesFrame)
-        : this(etran.translator, etran.predef, etran.HeapExpr, etran.This, etran.applyLimited_CurrentFunction, etran.layerInterCluster, etran.layerIntraCluster, modifiesFrame) {
+        : this(etran.translator, etran.predef, etran.HeapExpr, etran.This, etran.applyLimited_CurrentFunction, etran.layerInterCluster, etran.layerIntraCluster, modifiesFrame, etran.stripLits) {
         Contract.Requires(etran != null);
         Contract.Requires(modifiesFrame != null);
       }
@@ -10420,7 +10423,7 @@ namespace Microsoft.Dafny {
           Contract.Ensures(Contract.Result<ExpressionTranslator>() != null);
 
           if (oldEtran == null) {
-            oldEtran = new ExpressionTranslator(translator, predef, new Bpl.OldExpr(HeapExpr.tok, HeapExpr), This, applyLimited_CurrentFunction, layerInterCluster, layerIntraCluster, modifiesFrame);
+            oldEtran = new ExpressionTranslator(translator, predef, new Bpl.OldExpr(HeapExpr.tok, HeapExpr), This, applyLimited_CurrentFunction, layerInterCluster, layerIntraCluster, modifiesFrame, stripLits);
             oldEtran.oldEtran = oldEtran;
           }
           return oldEtran;
@@ -10438,7 +10441,12 @@ namespace Microsoft.Dafny {
         Contract.Requires(layerArgument != null);
         Contract.Ensures(Contract.Result<ExpressionTranslator>() != null);
 
-        return new ExpressionTranslator(translator, predef, HeapExpr, This, null, layerArgument, layerArgument, modifiesFrame);
+        return new ExpressionTranslator(translator, predef, HeapExpr, This, null, layerArgument, layerArgument, modifiesFrame, stripLits);
+      }
+
+      public ExpressionTranslator WithNoLits() {
+        Contract.Ensures(Contract.Result<ExpressionTranslator>() != null);
+        return new ExpressionTranslator(translator, predef, HeapExpr, This, null, layerInterCluster, layerIntraCluster, modifiesFrame, true);
       }
 
       public ExpressionTranslator LimitedFunctions(Function applyLimited_CurrentFunction, Bpl.Expr layerArgument) {
@@ -10446,16 +10454,16 @@ namespace Microsoft.Dafny {
         Contract.Requires(layerArgument != null);
         Contract.Ensures(Contract.Result<ExpressionTranslator>() != null);
 
-        return new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, /* layerArgument */ layerInterCluster, layerArgument, modifiesFrame);
+        return new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, /* layerArgument */ layerInterCluster, layerArgument, modifiesFrame, stripLits);
       }
 
       public ExpressionTranslator LayerOffset(int offset) {
         Contract.Requires(0 <= offset);
         Contract.Ensures(Contract.Result<ExpressionTranslator>() != null);
 
-        var et = new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, translator.LayerSucc(layerInterCluster, offset), layerIntraCluster, modifiesFrame);
+        var et = new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, translator.LayerSucc(layerInterCluster, offset), layerIntraCluster, modifiesFrame, stripLits);
         if (this.oldEtran != null) {
-          var etOld = new ExpressionTranslator(translator, predef, Old.HeapExpr, This, applyLimited_CurrentFunction, translator.LayerSucc(layerInterCluster, offset), layerIntraCluster, modifiesFrame);
+          var etOld = new ExpressionTranslator(translator, predef, Old.HeapExpr, This, applyLimited_CurrentFunction, translator.LayerSucc(layerInterCluster, offset), layerIntraCluster, modifiesFrame, stripLits);
           etOld.oldEtran = etOld;
           et.oldEtran = etOld;
         }
@@ -10538,6 +10546,14 @@ namespace Microsoft.Dafny {
         return translator.Substitute(e.Body, null, substMap);
       }
 
+      public Expr MaybeLit(Expr expr, Bpl.Type type) {
+        return stripLits ? expr : translator.Lit(expr, type);
+      }
+
+      public Expr MaybeLit(Expr expr) {
+        return stripLits ? expr : translator.Lit(expr);
+      }
+
       /// <summary>
       /// Translates Dafny expression "expr" into a Boogie expression.  If the type of "expr" can be a boolean, then the
       /// token (source location) of the resulting expression is filled in (it wouldn't hurt if the token were always
@@ -10554,7 +10570,7 @@ namespace Microsoft.Dafny {
           if (e.Value == null) {
             return predef.Null;
           } else if (e.Value is bool) {
-            return translator.Lit(new Bpl.LiteralExpr(e.tok, (bool)e.Value));
+            return MaybeLit(new Bpl.LiteralExpr(e.tok, (bool)e.Value));
           } else if (e is CharLiteralExpr) {
             // we expect e.Value to be a string representing exactly one char
             Bpl.Expr rawElement = null;  // assignment to please compiler's definite assignment rule
@@ -10563,7 +10579,7 @@ namespace Microsoft.Dafny {
               rawElement = translator.FunctionCall(expr.tok, BuiltinFunction.CharFromInt, null, Bpl.Expr.Literal((int)ch));
             }
             Contract.Assert(rawElement != null);  // there should have been an iteration of the loop above
-            return translator.Lit(rawElement, predef.CharType);
+            return MaybeLit(rawElement, predef.CharType);
           } else if (e is StringLiteralExpr) {
             var str = (StringLiteralExpr)e;
             Bpl.Expr seq = translator.FunctionCall(expr.tok, BuiltinFunction.SeqEmpty, predef.BoxType);
@@ -10572,11 +10588,11 @@ namespace Microsoft.Dafny {
               Bpl.Expr elt = BoxIfNecessary(expr.tok, rawElement, Type.Char);
               seq = translator.FunctionCall(expr.tok, BuiltinFunction.SeqBuild, predef.BoxType, seq, elt);
             }
-            return translator.Lit(seq, translator.TrType(new SeqType(Type.Char)));
+            return MaybeLit(seq, translator.TrType(new SeqType(Type.Char)));
           } else if (e.Value is BigInteger) {
-            return translator.Lit(Bpl.Expr.Literal(Microsoft.Basetypes.BigNum.FromBigInt((BigInteger)e.Value)));
+            return MaybeLit(Bpl.Expr.Literal(Microsoft.Basetypes.BigNum.FromBigInt((BigInteger)e.Value)));
           } else if (e.Value is Basetypes.BigDec) {
-            return translator.Lit(Bpl.Expr.Literal((Basetypes.BigDec)e.Value));
+            return MaybeLit(Bpl.Expr.Literal((Basetypes.BigDec)e.Value));
           } else {
             Contract.Assert(false); throw new cce.UnreachableException();  // unexpected literal
           }
@@ -10642,7 +10658,7 @@ namespace Microsoft.Dafny {
             s = translator.FunctionCall(expr.tok, BuiltinFunction.SeqBuild, predef.BoxType, s, elt);
           }
           if (isLit) {
-            s = translator.Lit(s, predef.BoxType);
+            s = MaybeLit(s, predef.BoxType);
           }
           return s;
 
@@ -10671,7 +10687,7 @@ namespace Microsoft.Dafny {
                   new List<Bpl.Expr> {obj});
                 result = translator.CondApplyUnbox(expr.tok, result, field.Type, expr.Type);
                 if (translator.IsLit(obj)) {
-                  result = translator.Lit(result, translator.TrType(expr.Type));
+                  result = MaybeLit(result, translator.TrType(expr.Type));
                 }
                 return result;
               }
@@ -10746,7 +10762,7 @@ namespace Microsoft.Dafny {
             // if e0 == null && e1 == null, then we have the identity operation seq[..] == seq;
             if (isLit && (e0 != null || e1 != null)) {
               // Lit-lift the expression
-              seq = translator.Lit(seq, translator.TrType(expr.Type));
+              seq = MaybeLit(seq, translator.TrType(expr.Type));
             }
             return seq;
           }
@@ -10857,7 +10873,7 @@ namespace Microsoft.Dafny {
           Expr result = new Bpl.NAryExpr(e.tok, new Bpl.FunctionCall(id), args);
           result = translator.CondApplyUnbox(e.tok, result, e.Function.ResultType, e.Type);
           if (returnLit && Translator.FunctionBodyIsAvailable(e.Function, translator.currentModule)) {
-            result = translator.Lit(result, ty);
+            result = MaybeLit(result, ty);
           }
           return result;
         } else if (expr is DatatypeValue) {
@@ -10875,7 +10891,7 @@ namespace Microsoft.Dafny {
           Bpl.IdentifierExpr id = new Bpl.IdentifierExpr(dtv.tok, dtv.Ctor.FullName, predef.DatatypeType);
           Bpl.Expr ret = new Bpl.NAryExpr(dtv.tok, new Bpl.FunctionCall(id), args);
           if (isLit) {
-            ret = translator.Lit(ret, predef.DatatypeType);
+            ret = MaybeLit(ret, predef.DatatypeType);
           }
           return ret;
         } else if (expr is OldExpr) {
@@ -10898,7 +10914,7 @@ namespace Microsoft.Dafny {
           Bpl.Expr arg = TrExpr(e.E);
           switch (e.Op) {
             case UnaryOpExpr.Opcode.Lit:
-              return translator.Lit(arg);
+              return MaybeLit(arg);
             case UnaryOpExpr.Opcode.Not:
               return Bpl.Expr.Unary(expr.tok, UnaryOperator.Opcode.Not, arg);
             case UnaryOpExpr.Opcode.Cardinality:
@@ -10999,7 +11015,7 @@ namespace Microsoft.Dafny {
           bool liftLit = lit0 != null && lit1 != null;
           // NOTE(namin): We usually avoid keeping literals, because their presence might mess up triggers that do not expect them.
           //              Still for equality-related operations, it's useful to keep them instead of lifting them, so that they can be propagated.
-          bool keepLits = false;
+          bool keepLits = false; // CLEMENT: I don't really understand this
           if (lit0 != null) {
             e0 = lit0;
           }
@@ -11301,7 +11317,7 @@ namespace Microsoft.Dafny {
           var ae1 = keepLits ? oe1 : e1;
           Bpl.Expr re = Bpl.Expr.Binary(expr.tok, bOpcode, ae0, ae1);
           if (liftLit) {
-            re = translator.Lit(re, typ);
+            re = MaybeLit(re, typ);
           }
           return re;
         } else if (expr is TernaryExpr) {
@@ -11350,7 +11366,7 @@ namespace Microsoft.Dafny {
             // If this is a layer quantifier, quantify over layers here, and use $LS(ly) layers in the translation of the body
             var ly = BplBoundVar(e.Refresh("q$ly#", translator.CurrentIdGenerator), predef.LayerType, bvars);
             Expr layer = translator.LayerSucc(ly);
-            bodyEtran = new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, layer, layer, modifiesFrame);
+            bodyEtran = new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, layer, layer, modifiesFrame, stripLits);
           }
           if (Attributes.ContainsBool(e.Attributes, "heapQuantifier", ref _scratch)) {
             var h = BplBoundVar(e.Refresh("q$heap#", translator.CurrentIdGenerator), predef.HeapType, bvars);
@@ -11366,11 +11382,12 @@ namespace Microsoft.Dafny {
 
           Bpl.QKeyValue kv = TrAttributes(e.Attributes, "trigger");
           Bpl.Trigger tr = null;
+          var argsEtran = bodyEtran.WithNoLits();
           foreach (var aa in e.Attributes.AsEnumerable()) {
             if (aa.Name == "trigger") {
               List<Bpl.Expr> tt = new List<Bpl.Expr>();
               foreach (var arg in aa.Args) {
-                tt.Add(bodyEtran.TrExpr(arg));
+                tt.Add(argsEtran.TrExpr(arg));
               }
               tr = new Bpl.Trigger(expr.tok, true, tt, tr);
             }
@@ -11516,7 +11533,7 @@ namespace Microsoft.Dafny {
           new Bpl.LambdaExpr(e.tok, new List<TypeVariable>(), rdvars, null,
             BplImp(ante, consequent));
 
-        return translator.Lit(
+        return MaybeLit(
           translator.FunctionCall(e.tok, BuiltinFunction.AtLayer, predef.HandleType,
             new Bpl.LambdaExpr(e.tok, new List<TypeVariable>(), lvars, null,
               translator.FunctionCall(e.tok, translator.Handle(e.BoundVars.Count), predef.BoxType,
@@ -11821,7 +11838,7 @@ namespace Microsoft.Dafny {
               parms.Add(s);
             } else {
               var e = TrExpr(arg);
-              e = translator.RemoveLit(e);
+              e = translator.RemoveLit(e); // CLEMENT: Why?
               parms.Add(e);
             }
           }
@@ -12503,14 +12520,15 @@ namespace Microsoft.Dafny {
 
     Bpl.Trigger TrTrigger(ExpressionTranslator etran, Attributes attribs, IToken tok, Dictionary<IVariable, Expression> substMap = null)
     {
+      var argsEtran = etran.WithNoLits();
       Bpl.Trigger tr = null;
       foreach (var trigger in attribs.AsEnumerable().Where(aa => aa.Name == "trigger").Select(aa => aa.Args)) {
         List<Bpl.Expr> tt = new List<Bpl.Expr>();
         foreach (var arg in trigger) {
           if (substMap == null) {
-            tt.Add(etran.TrExpr(arg));
+            tt.Add(argsEtran.TrExpr(arg));
           } else {
-            tt.Add(etran.TrExpr(Substitute(arg, null, substMap)));
+            tt.Add(argsEtran.TrExpr(Substitute(arg, null, substMap)));
           }
         }
         tr = new Bpl.Trigger(tok, true, tt, tr);
diff --git a/Test/dafny0/LitTriggers.dfy b/Test/dafny0/LitTriggers.dfy
new file mode 100644
index 00000000..14880d68
--- /dev/null
+++ b/Test/dafny0/LitTriggers.dfy
@@ -0,0 +1,35 @@
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// Imported from bug 76. LitInt would be triggered on, causing matching failures.
+
+predicate P(x:int, y:int)
+
+lemma L1(x:int, y:int)
+    requires y == 2;
+    requires forall i :: P(i, 3);
+{
+    assert P(x, y + 1);
+}
+
+lemma L2(x:int, y:int)
+    requires y == 2;
+    requires forall i {:trigger P(i, 3)} :: P(i, 3);
+{
+    assert P(x, y + 1);
+}
+
+lemma L3(x:int, y:int)
+    requires y == 2;
+    requires forall i :: P(i, 3);
+{
+    var dummy := 3;
+    assert P(x, y + 1);
+}
+
+lemma L4(x:int, y:int)
+    requires y == 2;
+    requires forall i, j :: j == 3 ==> P(i, j);
+{
+    assert P(x, y + 1);
+}
diff --git a/Test/dafny0/LitTriggers.dfy.expect b/Test/dafny0/LitTriggers.dfy.expect
new file mode 100644
index 00000000..249e77e5
--- /dev/null
+++ b/Test/dafny0/LitTriggers.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 9 verified, 0 errors
-- 
cgit v1.2.3


From 7950b3a320c9753cd1a05ce70c1a8db5df1f031b Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 16 Jul 2015 14:34:30 -0700
Subject: Use MapConcat instead of String.Join in TriggerGenerator

---
 Source/Dafny/TriggerGenerator.cs | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/TriggerGenerator.cs b/Source/Dafny/TriggerGenerator.cs
index dc99e609..98354cad 100644
--- a/Source/Dafny/TriggerGenerator.cs
+++ b/Source/Dafny/TriggerGenerator.cs
@@ -87,7 +87,7 @@ namespace Microsoft.Dafny {
     }
 
     public String AsDafnyAttributeString(bool wrap = true, bool includeTags = false) {
-      var repr = String.Join(", ", Candidates.Select(t => Printer.ExprToString(t.Expr)));
+      var repr = Candidates.MapConcat(t => Printer.ExprToString(t.Expr), ", ");
       if (wrap) {
         repr = "{:trigger " + repr + "}";
       }
@@ -358,10 +358,12 @@ namespace Microsoft.Dafny {
     }
 
     private static bool DefaultMultiCandidateFilteringFunction(MultiTriggerCandidate multiCandidate, QuantifierExpr quantifier) {
-      if (multiCandidate.PotentialMatchingLoops.Any()) {
-        multiCandidate.Tags.Add(String.Format("matching loop with {0}", String.Join(", ", multiCandidate.PotentialMatchingLoops.Select(tm => Printer.ExprToString(tm.Expr)))));
+      var allowsLoops = quantifier.Attributes.AsEnumerable().Any(a => a.Name == "loop");
+
+      if (!allowsLoops && multiCandidate.PotentialMatchingLoops.Any()) {
+        multiCandidate.Tags.Add(String.Format("matching loop with {0}", multiCandidate.PotentialMatchingLoops.MapConcat(tm => Printer.ExprToString(tm.Expr), ", ")));
       }
-      return multiCandidate.MentionsAll(quantifier.BoundVars) && !multiCandidate.PotentialMatchingLoops.Any();
+      return multiCandidate.MentionsAll(quantifier.BoundVars) && (allowsLoops || !multiCandidate.PotentialMatchingLoops.Any());
     }
 
     private static double DefaultMultiCandidateScoringFunction(MultiTriggerCandidate multi_candidate) {
@@ -544,7 +546,7 @@ namespace Microsoft.Dafny {
 
     internal static void AddTriggers(IEnumerable<Expression> roots, Resolver resolver) {
       DebugTriggers("== From {0} visiting expressions: {1}", new StackFrame(1).GetMethod().Name, 
-        String.Join(", ", roots.Select(root => Printer.ExprToString(root))));
+        roots.MapConcat(Printer.ExprToString, ", "));
       foreach (var expr in roots) {
         AddTriggers(expr, resolver);
       }
@@ -552,7 +554,7 @@ namespace Microsoft.Dafny {
 
     internal static void AddTriggers(IEnumerable<MaybeFreeExpression> roots, Resolver resolver) {
       DebugTriggers("== From {0} visiting expressions: {1}", new StackFrame(1).GetMethod().Name,
-        String.Join(", ", roots.Select(root => Printer.ExprToString(root.E))));
+        roots.MapConcat(root => Printer.ExprToString(root.E), ", "));
       foreach (var expr in roots) {
         AddTriggers(expr.E, resolver);
       }
-- 
cgit v1.2.3


From 6a2c5d90e90045ae972176935ea315fc6db8452d Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 16 Jul 2015 14:36:11 -0700
Subject: Force IsTriggerKiller to return false when /autoTriggers is off

This is a temporary measure to ensure that the trigger related machinery
is entirely disabled when /autoTriggers is off.
---
 Source/Dafny/TriggerGenerator.cs | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'Source')

diff --git a/Source/Dafny/TriggerGenerator.cs b/Source/Dafny/TriggerGenerator.cs
index 98354cad..d8a29d75 100644
--- a/Source/Dafny/TriggerGenerator.cs
+++ b/Source/Dafny/TriggerGenerator.cs
@@ -502,6 +502,10 @@ namespace Microsoft.Dafny {
     }
 
     internal static bool IsTriggerKiller(Expression expr) {
+      // CLEMENT: This should be removed once trigger generation becomes the default
+      if (!DafnyOptions.O.AutoTriggers) {
+        return false;
+      }
       var annotation = new TriggerGenerator((x, y, z) => { }).Annotate(expr);
       return annotation.IsTriggerKiller;
     }
-- 
cgit v1.2.3


From 8f18456b7e89412855abc9993447512bdb835da9 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Thu, 16 Jul 2015 15:37:50 -0700
Subject: Fixed bugs in the parsing of explicit type arguments. Fixed
 resolution bug where some type arguments were not checked to have been
 determined. Fixed resolution bugs where checking for equality-supporting
 types was missing.

---
 Source/Dafny/Dafny.atg               |  14 ++++-
 Source/Dafny/Parser.cs               |  82 ++++++++++++++-----------
 Source/Dafny/Resolver.cs             |  35 +++++++----
 Test/dafny0/EqualityTypes.dfy        | 112 +++++++++++++++++++++++++++++++++++
 Test/dafny0/EqualityTypes.dfy.expect |  24 +++++++-
 5 files changed, 220 insertions(+), 47 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index 7b51fb5e..1710be05 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -299,6 +299,9 @@ bool IsGenericInstantiation() {
       return false;
   }
 }
+/* Returns true if the next thing is of the form:
+ *     "<" Type { "," Type } ">"
+ */
 bool IsTypeList(ref IToken pt) {
   if (pt.kind != _openAngleBracket) {
     return false;
@@ -306,6 +309,10 @@ bool IsTypeList(ref IToken pt) {
   pt = scanner.Peek();
   return IsTypeSequence(ref pt, _closeAngleBracket);
 }
+/* Returns true if the next thing is of the form:
+ *     Type { "," Type }
+ * followed by an endBracketKind.
+ */
 bool IsTypeSequence(ref IToken pt, int endBracketKind) {
   while (true) {
     if (!IsType(ref pt)) {
@@ -343,7 +350,7 @@ bool IsType(ref IToken pt) {
     case _map:
     case _imap:
       pt = scanner.Peek();
-      return IsTypeList(ref pt);
+      return pt.kind != _openAngleBracket || IsTypeList(ref pt);
     case _ident:
       while (true) {
         // invariant: next token is an ident
@@ -362,6 +369,11 @@ bool IsType(ref IToken pt) {
       }
     case _openparen:
       pt = scanner.Peek();
+      if (pt.kind == _closeparen) {
+        // end of type list
+        pt = scanner.Peek();
+        return true;
+      }
       return IsTypeSequence(ref pt, _closeparen);
     default:
       return false;
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index a90e650a..8d14b9df 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -74,8 +74,8 @@ public class Parser {
 	public const int _ellipsis = 58;
 	public const int maxT = 138;
 
-	const bool _T = true;
-	const bool _x = false;
+	const bool T = true;
+	const bool x = false;
 	const int minErrDist = 2;
 
 	public Scanner/*!*/ scanner;
@@ -370,6 +370,9 @@ bool IsGenericInstantiation() {
       return false;
   }
 }
+/* Returns true if the next thing is of the form:
+ *     "<" Type { "," Type } ">"
+ */
 bool IsTypeList(ref IToken pt) {
   if (pt.kind != _openAngleBracket) {
     return false;
@@ -377,6 +380,10 @@ bool IsTypeList(ref IToken pt) {
   pt = scanner.Peek();
   return IsTypeSequence(ref pt, _closeAngleBracket);
 }
+/* Returns true if the next thing is of the form:
+ *     Type { "," Type }
+ * followed by an endBracketKind.
+ */
 bool IsTypeSequence(ref IToken pt, int endBracketKind) {
   while (true) {
     if (!IsType(ref pt)) {
@@ -414,7 +421,7 @@ bool IsType(ref IToken pt) {
     case _map:
     case _imap:
       pt = scanner.Peek();
-      return IsTypeList(ref pt);
+      return pt.kind != _openAngleBracket || IsTypeList(ref pt);
     case _ident:
       while (true) {
         // invariant: next token is an ident
@@ -433,6 +440,11 @@ bool IsType(ref IToken pt) {
       }
     case _openparen:
       pt = scanner.Peek();
+      if (pt.kind == _closeparen) {
+        // end of type list
+        pt = scanner.Peek();
+        return true;
+      }
       return IsTypeSequence(ref pt, _closeparen);
     default:
       return false;
@@ -4377,38 +4389,38 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 	}
 
 	static readonly bool[,]/*!*/ set = {
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_T, _x,_x,_T,_T, _T,_x,_x,_T, _T,_x,_x,_T, _T,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_x, _x,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_T,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_x,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x}
+		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,T, x,x,T,T, T,x,x,T, T,x,x,T, T,x,T,T, T,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,T,x,T, T,x,x,T, T,T,x,x, T,x,x,T, T,T,T,T, T,T,x,T, T,x,x,T, x,x,T,T, T,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,x,x, T,x,x,x, x,T,x,T, T,T,T,T, T,T,T,T, T,x,x,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,T,x, x,T,x,x, x,x,x,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{x,T,x,x, x,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, x,x,T,x, x,x,x,T, x,x,x,x, x,x,x,x, T,T,x,x, T,x,T,x, x,T,x,T, T,T,T,T, T,T,T,T, T,x,x,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,T,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, T,x,x,T, T,T,T,T, T,x,x,x},
+		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,T,T,T, T,T,x,T, T,T,T,x, x,T,x,T, x,x,x,x, x,x,x,x, T,T,x,x, T,x,x,x, x,T,x,T, T,T,T,T, T,T,T,T, T,x,x,T, T,T,T,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{x,T,T,x, x,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,T,x,T, T,x,x,T, x,x,T,T, T,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,x,x,x},
+		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,T,T, x,x,x,x, x,x,T,x, T,T,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, T,x,x,T, T,T,T,T, T,x,x,x},
+		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,T,x,T, T,x,x,T, x,x,T,T, T,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,T,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, T,x,x,T, T,T,T,T, T,x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,T,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, T,x,x,T, T,T,T,T, T,x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,T,x,T, T,x,x,T, x,x,T,T, T,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,T, T,T,x,T, T,x,x,T, x,x,T,T, T,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,T,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,T,T,x, T,T,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, T,x,x,T, T,T,T,T, T,x,x,x},
+		{x,x,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,x,x,x},
+		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,T,x,T, T,x,x,T, x,x,T,T, T,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,x,x,x},
+		{x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,T,x, x,x,x,x, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,T,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
+		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, T,T,x,x, T,x,x,x, x,T,x,T, T,T,T,T, T,T,T,T, T,x,x,T, T,T,T,T, T,T,T,T, T,x,T,T, T,x,T,T, T,T,T,T, T,T,x,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,x,x, x,x,T,T, T,T,T,T, T,T,T,T, T,T,x,x},
+		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,T,T,T, T,T,x,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, T,T,T,T, T,T,T,T, T,T,T,x, T,T,x,x, T,x,x,x, x,T,x,T, T,T,T,T, T,T,T,T, T,x,x,T, T,T,T,T, T,T,T,T, T,x,T,T, x,x,T,T, T,T,T,T, T,T,x,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,x,x, x,x,T,T, T,T,T,T, T,T,T,T, T,T,x,x}
 
 	};
 } // end Parser
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 3e308e76..99b8ba1e 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -2166,7 +2166,8 @@ namespace Microsoft.Dafny
           proxy.T = new ObjectType();
           return true;
         }
-        return !(t is TypeProxy);  // all other proxies indicate the type has not yet been determined
+        // all other proxies indicate the type has not yet been determined, provided their type parameters have been
+        return !(t is TypeProxy) && t.TypeArgs.All(tt => IsDetermined(tt.Normalize()));
       }
       ISet<TypeProxy> UnderspecifiedTypeProxies = new HashSet<TypeProxy>();
       bool CheckTypeIsDetermined(IToken tok, Type t, string what) {
@@ -2738,6 +2739,14 @@ namespace Microsoft.Dafny
           foreach (var v in s.BoundVars) {
             CheckEqualityTypes_Type(v.Tok, v.Type);
           }
+          // do substatements and subexpressions, except attributes and ensures clauses, since they are not compiled
+          foreach (var ss in s.SubStatements) {
+            Visit(ss, st);
+          }
+          if (s.Range != null) {
+            Visit(s.Range, st);
+          }
+          return false;  // we're done
         }
         return true;
       }
@@ -2796,6 +2805,18 @@ namespace Microsoft.Dafny
           foreach (var bv in e.BoundVars) {
             CheckEqualityTypes_Type(bv.tok, bv.Type);
           }
+        } else if (expr is MemberSelectExpr) {
+          var e = (MemberSelectExpr)expr;
+          if (e.Member is Function || e.Member is Method) {
+            var i = 0;
+            foreach (var tp in ((ICallable)e.Member).TypeArgs) {
+              var actualTp = e.TypeApplication[e.Member.EnclosingClass.TypeArgs.Count + i];
+              if (tp.MustSupportEquality && !actualTp.SupportsEquality) {
+                Error(e.tok, "type parameter {0} ({1}) passed to {5} '{2}' must support equality (got {3}){4}", i, tp.Name, e.Member.Name, actualTp, TypeEqualityErrorMessageHint(actualTp), e.Member.WhatKind);
+              }
+              i++;
+            }
+          }
         } else if (expr is FunctionCallExpr) {
           var e = (FunctionCallExpr)expr;
           Contract.Assert(e.Function.TypeArgs.Count <= e.TypeArgumentSubstitutions.Count);
@@ -2818,7 +2839,7 @@ namespace Microsoft.Dafny
             i++;
           }
           return false;  // we've done what there is to be done
-        } else if (expr is SetDisplayExpr || expr is MultiSetDisplayExpr || expr is MapDisplayExpr || expr is MultiSetFormingExpr) {
+        } else if (expr is SetDisplayExpr || expr is MultiSetDisplayExpr || expr is MapDisplayExpr || expr is MultiSetFormingExpr || expr is StaticReceiverExpr) {
           // This catches other expressions whose type may potentially be illegal
           CheckEqualityTypes_Type(expr.tok, expr.Type);
         }
@@ -2834,11 +2855,8 @@ namespace Microsoft.Dafny
         } else if (type is SetType) {
           var st = (SetType)type;
           var argType = st.Arg;
-          if (!st.Finite) {
-            Error(tok, "isets do not support equality: {0}", st);
-          }
           if (!argType.SupportsEquality) {
-            Error(tok, "set argument type must support equality (got {0}){1}", argType, TypeEqualityErrorMessageHint(argType));
+            Error(tok, "{2}set argument type must support equality (got {0}){1}", argType, TypeEqualityErrorMessageHint(argType), st.Finite ? "" : "i");
           }
           CheckEqualityTypes_Type(tok, argType);
 
@@ -2851,11 +2869,8 @@ namespace Microsoft.Dafny
 
         } else if (type is MapType) {
           var mt = (MapType)type;
-          if (!mt.Finite) {
-            Error(tok, "imaps do not support equality: {0}", mt);
-          }
           if (!mt.Domain.SupportsEquality) {
-            Error(tok, "map domain type must support equality (got {0}){1}", mt.Domain, TypeEqualityErrorMessageHint(mt.Domain));
+            Error(tok, "{2}map domain type must support equality (got {0}){1}", mt.Domain, TypeEqualityErrorMessageHint(mt.Domain), mt.Finite ? "" : "i");
           }
           CheckEqualityTypes_Type(tok, mt.Domain);
           CheckEqualityTypes_Type(tok, mt.Range);
diff --git a/Test/dafny0/EqualityTypes.dfy b/Test/dafny0/EqualityTypes.dfy
index b2812759..c510cfb1 100644
--- a/Test/dafny0/EqualityTypes.dfy
+++ b/Test/dafny0/EqualityTypes.dfy
@@ -241,3 +241,115 @@ module Deep {
     var m1 := map[ko := 5];  // error: bad type
   }
 }
+
+//--------------------------
+
+module UnderspecifiedTypeParameters {
+  method UP<T>()
+  function method UG<T>(): int
+  method Callee<T(==)>()
+  class TakesParam<U> { }
+  
+  method MPG()
+  {
+    var g := UG();  // error: type parameter underspecified
+    UP();  // error: type parameter underspecified
+  }
+  method M() {
+    var zs: set;  // error: type is underspecified
+    Callee<(int)>();
+    Callee<set>();  // error: type is underspecified
+    Callee<()>();
+    // The following 
+    Callee<TakesParam>();  // error: type is underspecified
+  }
+}
+
+module EqualitySupportingTypes {
+  method P<T>()
+  function method G<T>(): int
+  class AClass<V(==),Y> {
+    static function method H<W,X(==)>(): bool
+    static method Q<A,B(==)>()
+  }
+
+  method Callee<T(==)>()
+  function method FCallee<T>(): T
+
+  datatype Dt = Dt(f: int -> int)
+  codatatype Stream<T> = Cons(T, Stream)
+
+  method M<ArbitraryTypeArg>()
+  {
+    Callee<Dt>();  // error:  Dt is not an equality-supporting type
+    Callee<Stream<int>>();  // error: specified type does not support equality
+
+    // set<X> is allowed in a non-ghost context only if X is equality supporting.
+    // Ditto for multiset<X> and map<X,Y>.
+    var s3x: set<Dt>;  // error: this type not allowed in a non-ghost context
+    var is3x: iset<Dt>;  // error: this type not allowed in a non-ghost context
+    var mast: multiset<ArbitraryTypeArg>;  // error: this type not allowed in a non-ghost context
+    var qt: seq<Stream<int>>;  // allowed
+    var mp0: map<Dt,int>;  // error: this type not allowed in a non-ghost context
+    var mp1: map<int,Dt>;  // allowed
+    var imp0: imap<Dt,int>;  // error: this type not allowed in a non-ghost context
+    var imp1: imap<int,Dt>;  // allowed
+
+    var S := FCallee<set>();  // this gives s:set<?>
+    if 4 in S {              // this constrains the type further to be s:set<int>
+    }
+
+    var xy: set<set<int>>;
+    var xz: set<set<Stream<int>>>;  // error: set type argument must support equality
+    
+    Callee<set<Stream<int>>>();  // bogus: a set shouldn't ever be allowed to take a Stream as an argument (this check seems to be missing for explicit type arguments)  -- Note: language definition should be changed, because it doesn't make sense for it to talk about a type appearing in a ghost or non-ghost context. Instead, set/iset/multiset/map/imap should always be allowed to take any type argument, but these types may or may not support equality.
+    var xg := G<set<Stream<int>>>();
+    
+    var ac0: AClass<int,int>;
+    var ac1: AClass<Stream<int>,int>;  // error: type parameter 0 is required to support equality
+    var ac2: AClass<int,Stream<int>>;
+    var xd0 := ac0.H<real,real>();
+    var xd1 := ac1.H<Stream<real>,real>();  // error (remnant of the fact that the type of ac1 is not allowed)
+    var xd2 := ac2.H<real,Stream<real>>();  // error: type parameter 1 is required to support equality
+    var xe0 := ac0.H<real,real>;
+    var xe1 := ac1.H<Stream<real>,real>;  // error (remnant of the fact that the type of ac1 is not allowed)
+    var xe2 := ac2.H<real,Stream<real>>;  // error: type parameter 1 is required to support equality
+    var xh0 := AClass<int,int>.H<real,real>();
+    var xh1 := AClass<int,int>.H<Stream<real>,real>();
+    var xh2 := AClass<int,int>.H<real,Stream<real>>();  // error: type parameter 1 is required to support equality
+    var xk0 := AClass<real,real>.H<int,int>;
+    var xk1 := AClass<Stream<real>,real>.H<int,int>;  // error: class type param 0 wants an equality-supporting type
+    var xk2 := AClass<real,Stream<real>>.H<int,int>;
+    AClass<Stream<int>,int>.Q<real,real>();  // error: class type param 0 wants an equality-supporting type
+    AClass<int,Stream<int>>.Q<real,real>();
+    AClass<int,Stream<int>>.Q<Stream<real>,real>();
+    AClass<int,Stream<int>>.Q<real,Stream<real>>();  // error: method type param 1 wants an equality-supporting type
+  
+/*************************** TESTS YET TO COME
+    var ac8: AClass<real,real>;
+    var xd8 := (if 5/0 == 3 then ac0 else ac8).H<real,real>();  // error: this should be checked by the verifier
+
+    AClass<int,set<Stream<int>>>.Q<real,real>();  // error: cannot utter "set<Stream<int>>"   Or is that okay???
+    AClass<int,int>.Q<set<Stream<real>>,real>();  // error: cannot utter "set<Stream<real>>"   Or is that okay???
+    var xi0 := AClass<int,set<Stream<int>>>.H<real,real>();  // error: cannot utter "set<Stream<int>>"   Or is that okay???
+    var xi1 := AClass<int,int>.H<real,set<Stream<real>>>();  // error: cannot utter "set<Stream<real>>"   Or is that okay???
+
+    var x, t, s: seq<int -> int>, fii: int -> int;
+    if s == t {
+      x := 5;  // error: assigning to non-ghost variable in ghost context
+    }
+    if fii in s {
+      x := 4;  // error: assigning to non-ghost variable in ghost context
+    }
+    if !(fii in s) {
+      x := 3;  // error: assigning to non-ghost variable in ghost context
+    }
+
+    ghost var ghostset: set<Stream<int>> := {};  // fine, since this is ghost
+    forall u | 0 <= u < 100
+      ensures var lets: set<Stream<int>> := {}; lets == lets  // this is ghost, so the equality requirement doesn't apply
+    {
+    }
+*********************************************/
+  }
+}
diff --git a/Test/dafny0/EqualityTypes.dfy.expect b/Test/dafny0/EqualityTypes.dfy.expect
index 9f277582..1c02f3a0 100644
--- a/Test/dafny0/EqualityTypes.dfy.expect
+++ b/Test/dafny0/EqualityTypes.dfy.expect
@@ -35,4 +35,26 @@ EqualityTypes.dfy(238,24): Error: set argument type must support equality (got C
 EqualityTypes.dfy(239,21): Error: multiset argument type must support equality (got Co)
 EqualityTypes.dfy(241,8): Error: map domain type must support equality (got Co)
 EqualityTypes.dfy(241,14): Error: map domain type must support equality (got Co)
-37 resolution/type errors detected in EqualityTypes.dfy
+EqualityTypes.dfy(255,13): Error: type variable 'T' in the function call to 'UG' could not be determined
+EqualityTypes.dfy(256,4): Error: type '?' to the method 'UP' is not determined
+EqualityTypes.dfy(259,8): Error: the type of this local variable is underspecified
+EqualityTypes.dfy(261,4): Error: type 'set<?>' to the method 'Callee' is not determined
+EqualityTypes.dfy(264,4): Error: type 'TakesParam<?>' to the method 'Callee' is not determined
+EqualityTypes.dfy(284,14): Error: type parameter 0 (T) passed to method Callee must support equality (got Dt)
+EqualityTypes.dfy(285,23): Error: type parameter 0 (T) passed to method Callee must support equality (got Stream<int>)
+EqualityTypes.dfy(289,8): Error: set argument type must support equality (got Dt)
+EqualityTypes.dfy(290,8): Error: iset argument type must support equality (got Dt)
+EqualityTypes.dfy(291,8): Error: multiset argument type must support equality (got ArbitraryTypeArg) (perhaps try declaring type parameter 'ArbitraryTypeArg' on line 282 as 'ArbitraryTypeArg(==)', which says it can only be instantiated with a type that supports equality)
+EqualityTypes.dfy(293,8): Error: map domain type must support equality (got Dt)
+EqualityTypes.dfy(295,8): Error: imap domain type must support equality (got Dt)
+EqualityTypes.dfy(303,8): Error: set argument type must support equality (got Stream<int>)
+EqualityTypes.dfy(309,8): Error: type parameter 0 (V) passed to type AClass must support equality (got Stream<int>)
+EqualityTypes.dfy(312,19): Error: type parameter 0 (V) passed to type AClass must support equality (got Stream<int>)
+EqualityTypes.dfy(313,19): Error: type parameter 1 (X) passed to function H must support equality (got Stream<real>)
+EqualityTypes.dfy(315,19): Error: type parameter 0 (V) passed to type AClass must support equality (got Stream<int>)
+EqualityTypes.dfy(316,19): Error: type parameter 1 (X) passed to function 'H' must support equality (got Stream<real>)
+EqualityTypes.dfy(319,31): Error: type parameter 1 (X) passed to function H must support equality (got Stream<real>)
+EqualityTypes.dfy(321,41): Error: type parameter 0 (V) passed to type AClass must support equality (got Stream<real>)
+EqualityTypes.dfy(323,28): Error: type parameter 0 (V) passed to type AClass must support equality (got Stream<int>)
+EqualityTypes.dfy(326,48): Error: type parameter 1 (B) passed to method Q must support equality (got Stream<real>)
+59 resolution/type errors detected in EqualityTypes.dfy
-- 
cgit v1.2.3


From a22d071b3eac50ce1fd6c759c58873ae6c584ced Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 16 Jul 2015 17:44:17 -0700
Subject: Clean up a few thing and set proper defaults before merging

---
 Source/Dafny/DafnyOptions.cs     | 8 ++++----
 Source/Dafny/TriggerGenerator.cs | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index b2593705..a809cbd6 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -56,7 +56,7 @@ namespace Microsoft.Dafny
     public bool AllowGlobals = false;
     public bool CountVerificationErrors = true;
     public bool Optimize = false;
-    public bool AutoTriggers = true;
+    public bool AutoTriggers = false;
     public bool PrintTooltips = false;
 
     protected override bool ParseOption(string name, Bpl.CommandLineOptionEngine.CommandLineParseState ps) {
@@ -188,7 +188,7 @@ namespace Microsoft.Dafny
           return true;
 
         case "autoTriggers": {
-            int autoTriggers = 1; // defaults to reporting verification errors
+            int autoTriggers = 0;
             if (ps.GetNumericArgument(ref autoTriggers, 2)) {
               AutoTriggers = autoTriggers == 1;
             }
@@ -291,8 +291,8 @@ namespace Microsoft.Dafny
                 1 (default) - If preprocessing succeeds, set exit code to the number of
                               verification errors.
   /autoTriggers:<n>
-                0 - Do not generate {:trigger} annotations for user-level quantifiers.
-                1 (default) - Add a {:trigger} to each user-level quantifier. Existing
+                0 (default) - Do not generate {:trigger} annotations for user-level quantifiers.
+                1 - Add a {:trigger} to each user-level quantifier. Existing
                               annotations are preserved.
   /optimize     Produce optimized C# code, meaning:
                   - selects optimized C# prelude by passing 
diff --git a/Source/Dafny/TriggerGenerator.cs b/Source/Dafny/TriggerGenerator.cs
index d8a29d75..a777b4ae 100644
--- a/Source/Dafny/TriggerGenerator.cs
+++ b/Source/Dafny/TriggerGenerator.cs
@@ -25,7 +25,7 @@ using System.Diagnostics;
  */
 
 namespace Microsoft.Dafny {
-  class TriggerCandidate { // TODO Hashing is broken (duplicates can pop up)
+  class TriggerCandidate {
     internal Expression Expr;
     internal ISet<IVariable> Variables;
     internal List<ExprExtensions.TriggerMatch> MatchesInQuantifierBody;
@@ -35,7 +35,7 @@ namespace Microsoft.Dafny {
     }
   }
 
-  class TriggerCandidateComparer : IEqualityComparer<TriggerCandidate> {
+  class TriggerCandidateComparer : IEqualityComparer<TriggerCandidate> { //FIXME: There is a bunch of these comparers.
     private static TriggerCandidateComparer singleton;
     internal static TriggerCandidateComparer Instance {
       get { return singleton == null ? (singleton = new TriggerCandidateComparer()) : singleton; }
-- 
cgit v1.2.3


From c450e2718c6c047af95e948f87cad53ade07a1c5 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 16 Jul 2015 17:19:08 -0700
Subject: Fix column numbers in warning and info messages

This brings them in line with error column numbers.
---
 Source/Dafny/Resolver.cs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index c5b19d8c..9d560561 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -25,7 +25,7 @@ namespace Microsoft.Dafny
       ConsoleColor col = Console.ForegroundColor;
       Console.ForegroundColor = ConsoleColor.Red;
       Console.WriteLine("{0}({1},{2}): Error: {3}",
-          DafnyOptions.Clo.UseBaseNameForFileName ? System.IO.Path.GetFileName(tok.filename) : tok.filename, tok.line, tok.col,
+          DafnyOptions.Clo.UseBaseNameForFileName ? System.IO.Path.GetFileName(tok.filename) : tok.filename, tok.line, tok.col - 1,
           string.Format(msg, args));
       Console.ForegroundColor = col;
       ErrorCount++;
@@ -271,7 +271,7 @@ namespace Microsoft.Dafny
     public static void DefaultInformationReporter(AdditionalInformation info) {
       Console.WriteLine("{0}({1},{2}): Info: {3}",
                         DafnyOptions.Clo.UseBaseNameForFileName ? System.IO.Path.GetFileName(info.Token.filename) : info.Token.filename,
-                        info.Token.line, info.Token.col, info.Text);
+                        info.Token.line, info.Token.col - 1, info.Text);
     }
 
     public void ResolveProgram(Program prog) {
-- 
cgit v1.2.3


From fc6ebea9b9ec614e4e014c64d9cad7940deb86fb Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 17 Jul 2015 11:50:46 -0700
Subject: Clean up new trigger declarations in Translator.cs

---
 Source/Dafny/Translator.cs | 44 +++++++++++++++++++++++++++-----------------
 1 file changed, 27 insertions(+), 17 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 4a7ac006..4d35549c 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -731,7 +731,8 @@ namespace Microsoft.Dafny {
             var constructor_call = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
             var lhs = FunctionCall(ctor.tok, BuiltinFunction.DatatypeCtorId, null, constructor_call);
             Bpl.Expr q = Bpl.Expr.Eq(lhs, c);
-            sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, BplForall(bvs, BplTrigger(constructor_call), q), "Constructor identifier")); // NEW_TRIGGER
+            var trigger = BplTrigger(constructor_call); // NEW_TRIGGER
+            sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, BplForall(bvs, trigger, q), "Constructor identifier"));
           }
 
           {
@@ -762,10 +763,12 @@ namespace Microsoft.Dafny {
           Bpl.Expr q = Bpl.Expr.Eq(dId, lhs);
           if (bvs.Count != 0) {
             // TRIG (exists a#6#0#0: Box, a#6#1#0: DatatypeType :: d == #OnceBuggy.MyDt.Cons(a#6#0#0, a#6#1#0))'
-            q = new Bpl.ExistsExpr(ctor.tok, bvs, BplTrigger(lhs), q);  // NEW_TRIGGER
+            var trigger = BplTrigger(lhs); // NEW_TRIGGER
+            q = new Bpl.ExistsExpr(ctor.tok, bvs, trigger, q);
           }
           Bpl.Expr dtq = FunctionCall(ctor.tok, ctor.QueryField.FullSanitizedName, Bpl.Type.Bool, dId);
-          q = BplForall(dBv, BplTrigger(dtq), BplImp(dtq, q)); // NEW_TRIGGER
+          var triggerb = BplTrigger(dtq);
+          q = BplForall(dBv, triggerb, BplImp(dtq, q)); // NEW_TRIGGER
           sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Constructor questionmark has arguments"));
         }
 
@@ -857,8 +860,8 @@ namespace Microsoft.Dafny {
               Bpl.Expr rhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
               rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, rhs);
               // TRIG (forall a#11#0#0: Box, a#11#1#0: DatatypeType :: BoxRank(a#11#0#0) < DtRank(#_module.List.Cons(a#11#0#0, a#11#1#0)))
-              var trigger = new Bpl.Trigger(ctor.tok, true, new List<Bpl.Expr> { lhs, rhs }); // TRIGGERS: THIS IS BROKEN
-              q = new Bpl.ForallExpr(ctor.tok, bvs, null, Bpl.Expr.Lt(lhs, rhs));  // NEW_TRIGGER // CLEMENT: Trigger not use because breaks termination checks for match statements
+              var trigger = (Trigger)null; // FIXME new Bpl.Trigger(ctor.tok, true, new List<Bpl.Expr> { lhs, rhs }); // TRIGGERS: THIS IS BROKEN // NEW_TRIGGER 
+              q = new Bpl.ForallExpr(ctor.tok, bvs, trigger, Bpl.Expr.Lt(lhs, rhs)); // CLEMENT: Trigger not is use, because it breaks termination checks for match statements
               sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Inductive rank"));
             } else if (argType is SeqType) {
               // axiom (forall params, i: int :: 0 <= i && i < |arg| ==> DtRank(arg[i]) < DtRank(#dt.ctor(params)));
@@ -883,7 +886,8 @@ namespace Microsoft.Dafny {
               lhs = FunctionCall(ctor.tok, BuiltinFunction.SeqRank, null, args[i]);
               rhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
               rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, rhs);
-              q = new Bpl.ForallExpr(ctor.tok, bvs, new Trigger(lhs.tok, true, new List<Bpl.Expr> { lhs, rhs }), Bpl.Expr.Lt(lhs, rhs));  // NEW_TRIGGER
+              var trigger = new Trigger(lhs.tok, true, new List<Bpl.Expr> { lhs, rhs }); // NEW_TRIGGER
+              q = new Bpl.ForallExpr(ctor.tok, bvs, trigger, Bpl.Expr.Lt(lhs, rhs));
               sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Inductive seq rank"));
             } else if (argType is SetType) {
               // axiom (forall params, d: Datatype :: arg[d] ==> DtRank(d) < DtRank(#dt.ctor(params)));
@@ -898,8 +902,8 @@ namespace Microsoft.Dafny {
               Bpl.Expr rhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
               rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, rhs);
               // TRIG (forall a#50#0#0: Set Box, d: DatatypeType :: a#50#0#0[$Box(d)] ==> DtRank(d) < DtRank(#_module.d3.B3(a#50#0#0)))
-              var trigger = new Bpl.Trigger(ctor.tok, true, new List<Bpl.Expr> { lhs, rhs }); //TRIGGERS: Should this mention the precondition ("ante") too?
-              q = new Bpl.ForallExpr(ctor.tok, bvs, trigger, Bpl.Expr.Imp(ante, Bpl.Expr.Lt(lhs, rhs)));  // NEW_TRIGGER
+              var trigger = new Bpl.Trigger(ctor.tok, true, new List<Bpl.Expr> { lhs, rhs }); // NEW_TRIGGER //TRIGGERS: Should this mention the precondition ("ante") too?
+              q = new Bpl.ForallExpr(ctor.tok, bvs, trigger, Bpl.Expr.Imp(ante, Bpl.Expr.Lt(lhs, rhs)));
               sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Inductive set rank"));
             } else if (argType is MultiSetType) {
               // axiom (forall params, d: Datatype :: 0 < arg[d] ==> DtRank(d) < DtRank(#dt.ctor(params)));
@@ -1120,9 +1124,9 @@ namespace Microsoft.Dafny {
         CoAxHelper(true, (tyargs, vars, lexprs, rexprs, kVar, k, kGtZero, ly, d0, d1) => {
           var equal = Bpl.Expr.Eq(d0, d1);
           var PEq = CoEqualCall(codecl, lexprs, rexprs, k, LayerSucc(ly), d0, d1);
+          var trigger = BplTrigger(PEq);
           sink.AddTopLevelDeclaration(new Axiom(dt.tok,
-            BplForall(vars, BplTrigger(PEq), BplImp(BplAnd(equal, kGtZero), PEq)),
-            "Prefix equality shortcut")); // NEW_TRIGGER
+            BplForall(vars, trigger, BplImp(BplAnd(equal, kGtZero), PEq)), "Prefix equality shortcut")); // NEW_TRIGGER
         });
       }
     }
@@ -2499,8 +2503,9 @@ namespace Microsoft.Dafny {
       funcID = new Bpl.IdentifierExpr(tok, pp.FullSanitizedName, TrType(pp.ResultType));
       Bpl.Expr prefixLimitedBody = new Bpl.NAryExpr(tok, new Bpl.FunctionCall(funcID), prefixArgsLimited);
       Bpl.Expr prefixLimited = pp.FixpointPred is InductivePredicate ? Bpl.Expr.Not(prefixLimitedBody) : prefixLimitedBody;
-      
-      var trueAtZero = new Bpl.ForallExpr(tok, moreBvs, BplTrigger(prefixLimitedBody), BplImp(BplAnd(ante, z), prefixLimited));  // NEW_TRIGGER
+
+      var trigger = BplTrigger(prefixLimitedBody); // NEW_TRIGGER
+      var trueAtZero = new Bpl.ForallExpr(tok, moreBvs, trigger, BplImp(BplAnd(ante, z), prefixLimited));
       sink.AddTopLevelDeclaration(new Bpl.Axiom(tok, Bpl.Expr.Imp(activation, trueAtZero),
         "3rd prefix predicate axiom"));
     }
@@ -4896,7 +4901,8 @@ namespace Microsoft.Dafny {
             var allowedToRead = Bpl.Expr.SelectTok(e.tok, etran.TheFrame(e.tok), seq, fieldName);
             //TRIG (forall $i: int :: read($Heap, this, _module.RingBuffer.start) <= $i && $i < read($Heap, this, _module.RingBuffer.start) + read($Heap, this, _module.RingBuffer.len) ==> $_Frame[read($Heap, this, _module.RingBuffer.data), IndexField($i)])
             //TRIGGERS: Should this be more specific?
-            var qq = new Bpl.ForallExpr(e.tok, new List<Variable> { iVar }, BplTrigger(fieldName), Bpl.Expr.Imp(range, allowedToRead));  // NEW_TRIGGER
+            var trigger = BplTrigger(fieldName); // NEW_TRIGGER
+            var qq = new Bpl.ForallExpr(e.tok, new List<Variable> { iVar }, trigger, Bpl.Expr.Imp(range, allowedToRead));
             options.AssertSink(this, builder)(expr.tok, qq, "insufficient reads clause to read the indicated range of array elements", options.AssertKv);
           }
         }
@@ -6125,7 +6131,8 @@ namespace Microsoft.Dafny {
           Bpl.IdentifierExpr o = new Bpl.IdentifierExpr(f.tok, oVar);
           var rhs = new Bpl.NAryExpr(f.tok, new Bpl.FunctionCall(ff), new List<Bpl.Expr> { o });
           Bpl.Expr body = Bpl.Expr.Le(Bpl.Expr.Literal(0), rhs);
-          Bpl.Expr qq = new Bpl.ForallExpr(f.tok, new List<Variable> { oVar }, BplTrigger(rhs), body);  // NEW_TRIGGER
+          var trigger = BplTrigger(rhs); // NEW_TRIGGER
+          Bpl.Expr qq = new Bpl.ForallExpr(f.tok, new List<Variable> { oVar }, trigger, body);
           sink.AddTopLevelDeclaration(new Bpl.Axiom(f.tok, qq));
         }
       }
@@ -10944,7 +10951,8 @@ namespace Microsoft.Dafny {
                 // TRIGGERS: Does this make sense? VSI-Benchmarks\b7
                 // TRIG (forall $o: ref :: $o != null && read($Heap, this, _module.List.Repr)[$Box($o)] && $o != this ==> !read(old($Heap), $o, alloc))
                 // TRIG (forall $o: ref :: $o != null && read($Heap, this, _module.Stream.footprint)[$Box($o)] && $o != this ==> !read(old($Heap), $o, alloc))
-                return new Bpl.ForallExpr(expr.tok, new List<Variable> { oVar }, BplTrigger(oNotFresh), body); // NEW_TRIGGER
+                var trigger = BplTrigger(oNotFresh); // NEW_TRIGGER
+                return new Bpl.ForallExpr(expr.tok, new List<Variable> { oVar }, trigger, body);
               } else if (eeType is SeqType) {
                 // generate:  (forall $i: int :: 0 <= $i && $i < Seq#Length(X) && Unbox(Seq#Index(X,$i)) != null ==> !old($Heap)[Unbox(Seq#Index(X,$i)),alloc])
                 Bpl.Variable iVar = new Bpl.BoundVariable(expr.tok, new Bpl.TypedIdent(expr.tok, "$i", Bpl.Type.Int));
@@ -10957,8 +10965,9 @@ namespace Microsoft.Dafny {
                 Bpl.Expr xsubiNotNull = Bpl.Expr.Neq(XsubI, predef.Null);
                 Bpl.Expr body = Bpl.Expr.Imp(Bpl.Expr.And(iBounds, xsubiNotNull), oIsFresh);
                 //TRIGGERS: Does this make sense? dafny0\SmallTests
+                // BROKEN // NEW_TRIGGER
                 //TRIG (forall $i: int :: 0 <= $i && $i < Seq#Length(Q#0) && $Unbox(Seq#Index(Q#0, $i)): ref != null ==> !read(old($Heap), $Unbox(Seq#Index(Q#0, $i)): ref, alloc))
-                return new Bpl.ForallExpr(expr.tok, new List<Variable> { iVar }, body); // NEW_TRIGGER
+                return new Bpl.ForallExpr(expr.tok, new List<Variable> { iVar }, body); 
               } else if (eeType.IsDatatype) {
                 // translator.FunctionCall(e.tok, BuiltinFunction.DtAlloc, null, TrExpr(e.E), Old.HeapExpr);
                 Bpl.Expr alloc = translator.MkIsAlloc(TrExpr(e.E), eeType, Old.HeapExpr);
@@ -13327,7 +13336,8 @@ namespace Microsoft.Dafny {
               i++;
             }
             // TRIG (exists a#0#0#0: Box :: $IsBox(a#0#0#0, _module.DatatypeInduction$T) && $IsAllocBox(a#0#0#0, _module.DatatypeInduction$T, $Heap) && #_module.Tree.Leaf(a#0#0#0) == t#1)
-            q = new Bpl.ExistsExpr(ctor.tok, bvs, BplTrigger(ct), BplAnd(typeAntecedent, q));  // NEW_TRIGGER
+            var trigger = BplTrigger(ct); // NEW_TRIGGER
+            q = new Bpl.ExistsExpr(ctor.tok, bvs, trigger, BplAnd(typeAntecedent, q));
           }
           yield return q;
         }
-- 
cgit v1.2.3


From 4dd4262daa0247cd78eef104ddf6083d90ee8972 Mon Sep 17 00:00:00 2001
From: Michael Lowell Roberts <mirobert@microsoft.com>
Date: Mon, 20 Jul 2015 14:05:57 -0700
Subject: fix for apparent typo in Rewriter.cs

---
 Source/Dafny/Rewriter.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index d6f54aa7..4223fb7f 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -41,7 +41,7 @@ namespace Microsoft.Dafny
     Resolver Resolver;
 
     internal TriggersRewriter(Resolver resolver) {
-      Contract.Requires(Resolver != null);
+      Contract.Requires(resolver != null);
       this.Resolver = resolver;
     }
 
-- 
cgit v1.2.3


From 701741248e5831c1976b8cb2a2cc412987a1332e Mon Sep 17 00:00:00 2001
From: Michael Lowell Roberts <mirobert@microsoft.com>
Date: Mon, 20 Jul 2015 14:06:06 -0700
Subject: clarified error message that occurs when the "opened" keyword is left
 off of a module import.

---
 Source/Dafny/Resolver.cs                           |  2 +-
 Test/dafny0/Modules0.dfy.expect                    | 20 ++++++++++----------
 Test/dafny0/ResolutionErrors.dfy.expect            | 10 +++++-----
 Test/dafny0/Trait/TraitBasix.dfy.expect            |  2 +-
 Test/dafny0/UserSpecifiedTypeParameters.dfy.expect |  4 ++--
 5 files changed, 19 insertions(+), 19 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 8d23f374..26349ef5 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -8593,7 +8593,7 @@ namespace Microsoft.Dafny
 #endif
       } else {
         // ----- None of the above
-        Error(expr.tok, "Undeclared top-level type or type parameter: {0} (did you forget to qualify a name?)", expr.Name);
+        Error(expr.tok, "Undeclared top-level type or type parameter: {0} (did you forget to qualify a name or declare a module import 'opened?')", expr.Name);
       }
 
       if (r == null) {
diff --git a/Test/dafny0/Modules0.dfy.expect b/Test/dafny0/Modules0.dfy.expect
index d2f0bcc8..c63ed937 100644
--- a/Test/dafny0/Modules0.dfy.expect
+++ b/Test/dafny0/Modules0.dfy.expect
@@ -6,17 +6,17 @@ Modules0.dfy(10,7): Error: Duplicate name of top-level declaration: WazzupA
 Modules0.dfy(13,7): Error: Duplicate name of top-level declaration: WazzupB
 Modules0.dfy(14,8): Error: Duplicate name of top-level declaration: WazzupB
 Modules0.dfy(15,11): Error: Duplicate name of top-level declaration: WazzupB
-Modules0.dfy(56,21): Error: Undeclared top-level type or type parameter: MyClass1 (did you forget to qualify a name?)
-Modules0.dfy(57,21): Error: Undeclared top-level type or type parameter: MyClass2 (did you forget to qualify a name?)
-Modules0.dfy(68,21): Error: Undeclared top-level type or type parameter: MyClass2 (did you forget to qualify a name?)
-Modules0.dfy(84,24): Error: Undeclared top-level type or type parameter: MyClassY (did you forget to qualify a name?)
-Modules0.dfy(93,19): Error: Undeclared top-level type or type parameter: ClassG (did you forget to qualify a name?)
-Modules0.dfy(226,15): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name?)
+Modules0.dfy(56,21): Error: Undeclared top-level type or type parameter: MyClass1 (did you forget to qualify a name or declare a module import 'opened?')
+Modules0.dfy(57,21): Error: Undeclared top-level type or type parameter: MyClass2 (did you forget to qualify a name or declare a module import 'opened?')
+Modules0.dfy(68,21): Error: Undeclared top-level type or type parameter: MyClass2 (did you forget to qualify a name or declare a module import 'opened?')
+Modules0.dfy(84,24): Error: Undeclared top-level type or type parameter: MyClassY (did you forget to qualify a name or declare a module import 'opened?')
+Modules0.dfy(93,19): Error: Undeclared top-level type or type parameter: ClassG (did you forget to qualify a name or declare a module import 'opened?')
+Modules0.dfy(226,15): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name or declare a module import 'opened?')
 Modules0.dfy(226,8): Error: new can be applied only to reference types (got X)
 Modules0.dfy(235,13): Error: module 'B' does not declare a type 'X'
 Modules0.dfy(245,13): Error: unresolved identifier: X
 Modules0.dfy(246,15): Error: member DoesNotExist does not exist in class X
-Modules0.dfy(285,19): Error: Undeclared top-level type or type parameter: D (did you forget to qualify a name?)
+Modules0.dfy(285,19): Error: Undeclared top-level type or type parameter: D (did you forget to qualify a name or declare a module import 'opened?')
 Modules0.dfy(285,12): Error: new can be applied only to reference types (got D)
 Modules0.dfy(288,25): Error: type of the receiver is not fully determined at this program point
 Modules0.dfy(289,16): Error: type of the receiver is not fully determined at this program point
@@ -25,10 +25,10 @@ Modules0.dfy(290,16): Error: type of the receiver is not fully determined at thi
 Modules0.dfy(290,17): Error: expected method call, found expression
 Modules0.dfy(314,18): Error: second argument to "in" must be a set, multiset, or sequence with elements of type Q_Imp.Node, or a map with domain Q_Imp.Node (instead got set<Node>)
 Modules0.dfy(318,13): Error: arguments must have the same type (got Q_Imp.Node and Node)
-Modules0.dfy(319,11): Error: Undeclared top-level type or type parameter: LongLostModule (did you forget to qualify a name?)
-Modules0.dfy(320,11): Error: Undeclared top-level type or type parameter: Wazzup (did you forget to qualify a name?)
+Modules0.dfy(319,11): Error: Undeclared top-level type or type parameter: LongLostModule (did you forget to qualify a name or declare a module import 'opened?')
+Modules0.dfy(320,11): Error: Undeclared top-level type or type parameter: Wazzup (did you forget to qualify a name or declare a module import 'opened?')
 Modules0.dfy(321,17): Error: module 'Q_Imp' does not declare a type 'Edon'
 Modules0.dfy(323,10): Error: new can be applied only to reference types (got Q_Imp.List<?>)
 Modules0.dfy(324,30): Error: member Create does not exist in class Klassy
-Modules0.dfy(101,14): Error: Undeclared top-level type or type parameter: MyClassY (did you forget to qualify a name?)
+Modules0.dfy(101,14): Error: Undeclared top-level type or type parameter: MyClassY (did you forget to qualify a name or declare a module import 'opened?')
 31 resolution/type errors detected in Modules0.dfy
diff --git a/Test/dafny0/ResolutionErrors.dfy.expect b/Test/dafny0/ResolutionErrors.dfy.expect
index c215d354..ae3e8cbf 100644
--- a/Test/dafny0/ResolutionErrors.dfy.expect
+++ b/Test/dafny0/ResolutionErrors.dfy.expect
@@ -58,8 +58,8 @@ ResolutionErrors.dfy(987,11): Error: Wrong number of type arguments (2 instead o
 ResolutionErrors.dfy(988,11): Error: Wrong number of type arguments (2 instead of 1) passed to class: C
 ResolutionErrors.dfy(999,7): Error: Duplicate name of top-level declaration: BadSyn2
 ResolutionErrors.dfy(996,17): Error: Wrong number of type arguments (0 instead of 1) passed to datatype: List
-ResolutionErrors.dfy(997,17): Error: Undeclared top-level type or type parameter: badName (did you forget to qualify a name?)
-ResolutionErrors.dfy(998,22): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name?)
+ResolutionErrors.dfy(997,17): Error: Undeclared top-level type or type parameter: badName (did you forget to qualify a name or declare a module import 'opened?')
+ResolutionErrors.dfy(998,22): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name or declare a module import 'opened?')
 ResolutionErrors.dfy(1005,7): Error: Cycle among redirecting types (newtypes, type synonyms): A -> A
 ResolutionErrors.dfy(1008,7): Error: Cycle among redirecting types (newtypes, type synonyms): A -> B -> A
 ResolutionErrors.dfy(1012,7): Error: Cycle among redirecting types (newtypes, type synonyms): A -> B -> A
@@ -68,7 +68,7 @@ ResolutionErrors.dfy(1024,7): Error: Cycle among redirecting types (newtypes, ty
 ResolutionErrors.dfy(1029,7): Error: Cycle among redirecting types (newtypes, type synonyms): A -> B -> A
 ResolutionErrors.dfy(1048,21): Error: unresolved identifier: x
 ResolutionErrors.dfy(1055,35): Error: Wrong number of type arguments (2 instead of 1) passed to opaque type: P
-ResolutionErrors.dfy(1067,13): Error: Undeclared top-level type or type parameter: BX (did you forget to qualify a name?)
+ResolutionErrors.dfy(1067,13): Error: Undeclared top-level type or type parameter: BX (did you forget to qualify a name or declare a module import 'opened?')
 ResolutionErrors.dfy(1077,6): Error: RHS (of type P<int>) not assignable to LHS (of type P<bool>)
 ResolutionErrors.dfy(1082,6): Error: RHS (of type P<A>) not assignable to LHS (of type P<B>)
 ResolutionErrors.dfy(1087,6): Error: RHS (of type P<A>) not assignable to LHS (of type P<int>)
@@ -82,8 +82,8 @@ ResolutionErrors.dfy(1225,26): Error: the type of this variable is underspecifie
 ResolutionErrors.dfy(1226,31): Error: the type of this variable is underspecified
 ResolutionErrors.dfy(1227,29): Error: the type of this variable is underspecified
 ResolutionErrors.dfy(1237,34): Error: the type of this variable is underspecified
-ResolutionErrors.dfy(1253,21): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name?)
-ResolutionErrors.dfy(1254,24): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name?)
+ResolutionErrors.dfy(1253,21): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name or declare a module import 'opened?')
+ResolutionErrors.dfy(1254,24): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name or declare a module import 'opened?')
 ResolutionErrors.dfy(1291,16): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (y)
 ResolutionErrors.dfy(1301,18): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (x)
 ResolutionErrors.dfy(1329,15): Error: The name Inner ambiguously refers to a type in one of the modules A, B (try qualifying the type name with the module name)
diff --git a/Test/dafny0/Trait/TraitBasix.dfy.expect b/Test/dafny0/Trait/TraitBasix.dfy.expect
index 69af0dc5..dbb11c21 100644
--- a/Test/dafny0/Trait/TraitBasix.dfy.expect
+++ b/Test/dafny0/Trait/TraitBasix.dfy.expect
@@ -1,4 +1,4 @@
-TraitBasix.dfy(91,24): Error: Undeclared top-level type or type parameter: IX (did you forget to qualify a name?)
+TraitBasix.dfy(91,24): Error: Undeclared top-level type or type parameter: IX (did you forget to qualify a name or declare a module import 'opened?')
 TraitBasix.dfy(77,8): Error: field 'x' is inherited from trait 'I2' and is not allowed to be re-declared
 TraitBasix.dfy(70,8): Error: class 'I0Child' does not implement trait method 'I2.Customizable'
 TraitBasix.dfy(80,8): Error: class 'I0Child2' does not implement trait function 'I2.F'
diff --git a/Test/dafny0/UserSpecifiedTypeParameters.dfy.expect b/Test/dafny0/UserSpecifiedTypeParameters.dfy.expect
index 2504fbfb..347252aa 100644
--- a/Test/dafny0/UserSpecifiedTypeParameters.dfy.expect
+++ b/Test/dafny0/UserSpecifiedTypeParameters.dfy.expect
@@ -1,8 +1,8 @@
 UserSpecifiedTypeParameters.dfy(27,12): Error: the type of this variable is underspecified
 UserSpecifiedTypeParameters.dfy(27,26): Error: type variable 'T' in the function call to 'H' could not be determined
 UserSpecifiedTypeParameters.dfy(27,26): Error: type variable 'U' in the function call to 'H' could not be determined
-UserSpecifiedTypeParameters.dfy(48,22): Error: Undeclared top-level type or type parameter: b (did you forget to qualify a name?)
-UserSpecifiedTypeParameters.dfy(48,26): Error: Undeclared top-level type or type parameter: c (did you forget to qualify a name?)
+UserSpecifiedTypeParameters.dfy(48,22): Error: Undeclared top-level type or type parameter: b (did you forget to qualify a name or declare a module import 'opened?')
+UserSpecifiedTypeParameters.dfy(48,26): Error: Undeclared top-level type or type parameter: c (did you forget to qualify a name or declare a module import 'opened?')
 UserSpecifiedTypeParameters.dfy(48,18): Error: variable 'a' does not take any type parameters
 UserSpecifiedTypeParameters.dfy(48,30): Error: non-function expression (of type int) is called with parameters
 UserSpecifiedTypeParameters.dfy(48,16): Error: wrong number of arguments to function application (function 'F' expects 2, got 1)
-- 
cgit v1.2.3


From 91654565e2a5a6f36c582fe0c5d0b7eaf57caa09 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Mon, 20 Jul 2015 14:08:47 -0700
Subject: Add calc's attributes to its SubExpressions.

---
 Source/Dafny/DafnyAst.cs | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 21f5fadd..8d68e3e2 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -4807,6 +4807,8 @@ namespace Microsoft.Dafny {
     {
       get {
         foreach (var e in base.SubExpressions) { yield return e; }
+        foreach (var e in Attributes.SubExpressions(Attributes)) { yield return e; }
+        
         foreach (var l in Lines) {
           yield return l;
         }
-- 
cgit v1.2.3


From 95db5928541c9e19532e474269c68b8c446427c1 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Tue, 21 Jul 2015 16:51:19 -0700
Subject: Code reviewed some of the triggers added by changeset 1dacb6d3cc3c

---
 Source/Dafny/Translator.cs | 59 ++++++++++++++++++++--------------------------
 1 file changed, 25 insertions(+), 34 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index e295d25a..b1298784 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -738,7 +738,7 @@ namespace Microsoft.Dafny {
             var constructor_call = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
             var lhs = FunctionCall(ctor.tok, BuiltinFunction.DatatypeCtorId, null, constructor_call);
             Bpl.Expr q = Bpl.Expr.Eq(lhs, c);
-            var trigger = BplTrigger(constructor_call); // NEW_TRIGGER
+            var trigger = BplTrigger(constructor_call);
             sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, BplForall(bvs, trigger, q), "Constructor identifier"));
           }
 
@@ -765,17 +765,15 @@ namespace Microsoft.Dafny {
         {
           // Add:  axiom (forall d: DatatypeType :: dt.ctor?(d) ==> (exists params :: d == #dt.ctor(params));
           CreateBoundVariables(ctor.Formals, out bvs, out args);
-          Bpl.Expr lhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
+          Bpl.Expr rhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
           Bpl.Expr dId; var dBv = BplBoundVar("d", predef.DatatypeType, out dId);
-          Bpl.Expr q = Bpl.Expr.Eq(dId, lhs);
+          Bpl.Expr q = Bpl.Expr.Eq(dId, rhs);
           if (bvs.Count != 0) {
-            // TRIG (exists a#6#0#0: Box, a#6#1#0: DatatypeType :: d == #OnceBuggy.MyDt.Cons(a#6#0#0, a#6#1#0))'
-            var trigger = BplTrigger(lhs); // NEW_TRIGGER
-            q = new Bpl.ExistsExpr(ctor.tok, bvs, trigger, q);
+            q = new Bpl.ExistsExpr(ctor.tok, bvs, null/*always in a Skolemization context*/, q);
           }
           Bpl.Expr dtq = FunctionCall(ctor.tok, ctor.QueryField.FullSanitizedName, Bpl.Type.Bool, dId);
-          var triggerb = BplTrigger(dtq);
-          q = BplForall(dBv, triggerb, BplImp(dtq, q)); // NEW_TRIGGER
+          var trigger = BplTrigger(dtq);
+          q = BplForall(dBv, trigger, BplImp(dtq, q));
           sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Constructor questionmark has arguments"));
         }
 
@@ -893,7 +891,7 @@ namespace Microsoft.Dafny {
               lhs = FunctionCall(ctor.tok, BuiltinFunction.SeqRank, null, args[i]);
               rhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
               rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, rhs);
-              var trigger = new Trigger(lhs.tok, true, new List<Bpl.Expr> { lhs, rhs }); // NEW_TRIGGER
+              var trigger = new Trigger(lhs.tok, true, new List<Bpl.Expr> { lhs, rhs });
               q = new Bpl.ForallExpr(ctor.tok, bvs, trigger, Bpl.Expr.Lt(lhs, rhs));
               sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Inductive seq rank"));
             } else if (argType is SetType) {
@@ -908,8 +906,7 @@ namespace Microsoft.Dafny {
               Bpl.Expr lhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, ie);
               Bpl.Expr rhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
               rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, rhs);
-              // TRIG (forall a#50#0#0: Set Box, d: DatatypeType :: a#50#0#0[$Box(d)] ==> DtRank(d) < DtRank(#_module.d3.B3(a#50#0#0)))
-              var trigger = new Bpl.Trigger(ctor.tok, true, new List<Bpl.Expr> { lhs, rhs }); // NEW_TRIGGER //TRIGGERS: Should this mention the precondition ("ante") too?
+              var trigger = new Bpl.Trigger(ctor.tok, true, new List<Bpl.Expr> { lhs, rhs });
               q = new Bpl.ForallExpr(ctor.tok, bvs, trigger, Bpl.Expr.Imp(ante, Bpl.Expr.Lt(lhs, rhs)));
               sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Inductive set rank"));
             } else if (argType is MultiSetType) {
@@ -1133,7 +1130,7 @@ namespace Microsoft.Dafny {
           var PEq = CoEqualCall(codecl, lexprs, rexprs, k, LayerSucc(ly), d0, d1);
           var trigger = BplTrigger(PEq);
           sink.AddTopLevelDeclaration(new Axiom(dt.tok,
-            BplForall(vars, trigger, BplImp(BplAnd(equal, kGtZero), PEq)), "Prefix equality shortcut")); // NEW_TRIGGER
+            BplForall(vars, trigger, BplImp(BplAnd(equal, kGtZero), PEq)), "Prefix equality shortcut"));
         });
       }
     }
@@ -2522,7 +2519,7 @@ namespace Microsoft.Dafny {
       Bpl.Expr prefixLimitedBody = new Bpl.NAryExpr(tok, new Bpl.FunctionCall(funcID), prefixArgsLimited);
       Bpl.Expr prefixLimited = pp.FixpointPred is InductivePredicate ? Bpl.Expr.Not(prefixLimitedBody) : prefixLimitedBody;
 
-      var trigger = BplTrigger(prefixLimitedBody); // NEW_TRIGGER
+      var trigger = BplTrigger(prefixLimitedBody);
       var trueAtZero = new Bpl.ForallExpr(tok, moreBvs, trigger, BplImp(BplAnd(ante, z), prefixLimited));
       sink.AddTopLevelDeclaration(new Bpl.Axiom(tok, Bpl.Expr.Imp(activation, trueAtZero),
         "3rd prefix predicate axiom"));
@@ -4889,9 +4886,7 @@ namespace Microsoft.Dafny {
             var range = BplAnd(Bpl.Expr.Le(lowerBound, i), Bpl.Expr.Lt(i, upperBound));
             var fieldName = FunctionCall(e.tok, BuiltinFunction.IndexField, null, i);
             var allowedToRead = Bpl.Expr.SelectTok(e.tok, etran.TheFrame(e.tok), seq, fieldName);
-            //TRIG (forall $i: int :: read($Heap, this, _module.RingBuffer.start) <= $i && $i < read($Heap, this, _module.RingBuffer.start) + read($Heap, this, _module.RingBuffer.len) ==> $_Frame[read($Heap, this, _module.RingBuffer.data), IndexField($i)])
-            //TRIGGERS: Should this be more specific?
-            var trigger = BplTrigger(fieldName); // NEW_TRIGGER
+            var trigger = BplTrigger(allowedToRead); // Note, the assertion we're about to produce only seems useful in the check-only mode (that is, with subsumption 0), but if it were to be assumed, we'll use this entire RHS as the trigger
             var qq = new Bpl.ForallExpr(e.tok, new List<Variable> { iVar }, trigger, Bpl.Expr.Imp(range, allowedToRead));
             options.AssertSink(this, builder)(expr.tok, qq, "insufficient reads clause to read the indicated range of array elements", options.AssertKv);
           }
@@ -6107,7 +6102,7 @@ namespace Microsoft.Dafny {
           Bpl.IdentifierExpr o = new Bpl.IdentifierExpr(f.tok, oVar);
           var rhs = new Bpl.NAryExpr(f.tok, new Bpl.FunctionCall(ff), new List<Bpl.Expr> { o });
           Bpl.Expr body = Bpl.Expr.Le(Bpl.Expr.Literal(0), rhs);
-          var trigger = BplTrigger(rhs); // NEW_TRIGGER
+          var trigger = BplTrigger(rhs);
           Bpl.Expr qq = new Bpl.ForallExpr(f.tok, new List<Variable> { oVar }, trigger, body);
           sink.AddTopLevelDeclaration(new Bpl.Axiom(f.tok, qq));
         }
@@ -11572,10 +11567,10 @@ namespace Microsoft.Dafny {
           Bpl.Expr body = bodyEtran.TrExpr(e.Term);
           
           if (e is ForallExpr) {
-            return new Bpl.ForallExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars, bvars), kv, tr, Bpl.Expr.Imp(antecedent, body)); // SMART_TRIGGER
+            return new Bpl.ForallExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars, bvars), kv, tr, Bpl.Expr.Imp(antecedent, body));
           } else {
             Contract.Assert(e is ExistsExpr);
-            return new Bpl.ExistsExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars, bvars), kv, tr, Bpl.Expr.And(antecedent, body)); // SMART_TRIGGER
+            return new Bpl.ExistsExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars, bvars), kv, tr, Bpl.Expr.And(antecedent, body));
           }
 
         } else if (expr is SetComprehension) {
@@ -12691,6 +12686,8 @@ namespace Microsoft.Dafny {
 
     Bpl.Trigger TrTrigger(ExpressionTranslator etran, Attributes attribs, IToken tok, Dictionary<IVariable, Expression> substMap = null)
     {
+      Contract.Requires(etran != null);
+      Contract.Requires(tok != null);
       var argsEtran = etran.WithNoLits();
       Bpl.Trigger tr = null;
       foreach (var trigger in attribs.AsEnumerable().Where(aa => aa.Name == "trigger").Select(aa => aa.Args)) {
@@ -13005,12 +13002,8 @@ namespace Microsoft.Dafny {
           List<Variable> bvars = new List<Variable>();
           Bpl.Expr typeAntecedent = etran.TrBoundVariables(kvars, bvars);
           Bpl.Expr ih;
-          if (Attributes.Contains(e.Attributes, "trigger")) {
-            Bpl.Trigger tr = TrTrigger(etran, e.Attributes, expr.tok, substMap);
-            ih = new Bpl.ForallExpr(expr.tok, bvars, tr, Bpl.Expr.Imp(typeAntecedent, ihBody));
-          } else {
-            ih = new Bpl.ForallExpr(expr.tok, bvars, Bpl.Expr.Imp(typeAntecedent, ihBody));  // SMART_TRIGGER
-          }
+          var tr = TrTrigger(etran, e.Attributes, expr.tok, substMap);
+          ih = new Bpl.ForallExpr(expr.tok, bvars, tr, Bpl.Expr.Imp(typeAntecedent, ihBody));
 
           // More precisely now:
           //   (forall n :: n-has-expected-type && (forall k :: k < n ==> P(k)) && case0(n)   ==> P(n))
@@ -13041,15 +13034,11 @@ namespace Microsoft.Dafny {
             var ante = BplAnd(BplAnd(typeAntecedent, ih), kase);
             var bdy = etran.LayerOffset(1).TrExpr(e.LogicalBody());
             Bpl.Expr q;
+            var trig = TrTrigger(etran, e.Attributes, expr.tok);
             if (position) {
-              if (Attributes.Contains(e.Attributes, "trigger")) {
-                Bpl.Trigger tr = TrTrigger(etran, e.Attributes, expr.tok);
-                q = new Bpl.ForallExpr(kase.tok, bvars, tr, Bpl.Expr.Imp(ante, bdy));
-              } else {
-                q = new Bpl.ForallExpr(kase.tok, bvars, Bpl.Expr.Imp(ante, bdy)); // SMART_TRIGGER
-              }
+              q = new Bpl.ForallExpr(kase.tok, bvars, trig, Bpl.Expr.Imp(ante, bdy));
             } else {
-              q = new Bpl.ExistsExpr(kase.tok, bvars, Bpl.Expr.And(ante, bdy));  // SMART_TRIGGER
+              q = new Bpl.ExistsExpr(kase.tok, bvars, trig, Bpl.Expr.And(ante, bdy));
             }
             splits.Add(new SplitExprInfo(SplitExprInfo.K.Checked, q));
           }
@@ -13496,8 +13485,7 @@ namespace Microsoft.Dafny {
               }
               i++;
             }
-            // TRIG (exists a#0#0#0: Box :: $IsBox(a#0#0#0, _module.DatatypeInduction$T) && $IsAllocBox(a#0#0#0, _module.DatatypeInduction$T, $Heap) && #_module.Tree.Leaf(a#0#0#0) == t#1)
-            var trigger = BplTrigger(ct); // NEW_TRIGGER
+            var trigger = BplTrigger(ct);  // this is probably never used, because this quantifier is not expected ever to appear in a context where it needs to be instantiated
             q = new Bpl.ExistsExpr(ctor.tok, bvs, trigger, BplAnd(typeAntecedent, q));
           }
           yield return q;
@@ -14422,6 +14410,9 @@ namespace Microsoft.Dafny {
     // Bpl-making-utilities
 
     static Bpl.Expr BplForall(IEnumerable<Bpl.Variable> args_in, Bpl.Expr body) {  // NO_TRIGGER
+      Contract.Requires(args_in != null);
+      Contract.Requires(body != null);
+      Contract.Ensures(Contract.Result<Bpl.Expr>() != null);
       var args = new List<Bpl.Variable>(args_in);
       if (args.Count == 0) { // CLEMENT don't add quantifiers if the body is trivial
         return body;
-- 
cgit v1.2.3


From 8e25cc2331e4f90d7674f3b3bb218f65f7e93797 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Tue, 21 Jul 2015 18:55:28 -0700
Subject: Improved rank axioms for containers

---
 Source/Dafny/Translator.cs            | 111 +++++++++++++++++-----------------
 Test/dafny0/ContainerRanks.dfy        |  33 ++++++++++
 Test/dafny0/ContainerRanks.dfy.expect |   2 +
 3 files changed, 90 insertions(+), 56 deletions(-)
 create mode 100644 Test/dafny0/ContainerRanks.dfy
 create mode 100644 Test/dafny0/ContainerRanks.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index b1298784..b2c688d9 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -706,8 +706,6 @@ namespace Microsoft.Dafny {
       sink.AddTopLevelDeclaration(dt_const);
 
       foreach (DatatypeCtor ctor in dt.Ctors) {
-        int i;
-
         // Add:  function #dt.ctor(tyVars, paramTypes) returns (DatatypeType);
 
         List<Bpl.Variable> argTypes = new List<Bpl.Variable>();
@@ -794,14 +792,13 @@ namespace Microsoft.Dafny {
           Bpl.Expr h;
           var hVar = BplBoundVar("$h", predef.HeapType, out h);
           Bpl.Expr conj = Bpl.Expr.True;
-          i = 0;
-          foreach (Formal arg in ctor.Formals) {
+          for (var i = 0; i < ctor.Formals.Count; i++) {
+            var arg = ctor.Formals[i];
             if (is_alloc) {
               conj = BplAnd(conj, MkIsAlloc(args[i], arg.Type, h));
             } else {
               conj = BplAnd(conj, MkIs(args[i], arg.Type));
             }
-            i++;
           }
           var c_params = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
           var c_ty = ClassTyCon((TopLevelDecl)dt, tyexprs);
@@ -837,8 +834,8 @@ namespace Microsoft.Dafny {
         }
 
         // Injectivity axioms for normal arguments
-        i = 0;
-        foreach (Formal arg in ctor.Formals) {
+        for (int i = 0; i < ctor.Formals.Count; i++) {
+          var arg = ctor.Formals[i];
           // function ##dt.ctor#i(DatatypeType) returns (Ti);
           var sf = ctor.Destructors[i];
           Contract.Assert(sf != null);
@@ -854,81 +851,83 @@ namespace Microsoft.Dafny {
           if (dt is IndDatatypeDecl) {
             var argType = arg.Type.NormalizeExpand();
             if (argType.IsDatatype || argType.IsTypeParameter) {
-              // for datatype:             axiom (forall params :: DtRank(params_i) < DtRank(#dt.ctor(params)));
-              // for type-parameter type:  axiom (forall params :: DtRank(Unbox(params_i)) < DtRank(#dt.ctor(params)));
+              // for datatype:             axiom (forall params :: {#dt.ctor(params)} DtRank(params_i) < DtRank(#dt.ctor(params)));
+              // for type-parameter type:  axiom (forall params :: {#dt.ctor(params)} BoxRank(params_i) < DtRank(#dt.ctor(params)));
               CreateBoundVariables(ctor.Formals, out bvs, out args);
               Bpl.Expr lhs = FunctionCall(ctor.tok, arg.Type.IsDatatype ? BuiltinFunction.DtRank : BuiltinFunction.BoxRank, null, args[i]);
               /* CHECK
               Bpl.Expr lhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null,
                 argType.IsDatatype ? args[i] : FunctionCall(ctor.tok, BuiltinFunction.Unbox, predef.DatatypeType, args[i]));
-              */
-              Bpl.Expr rhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
-              rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, rhs);
-              // TRIG (forall a#11#0#0: Box, a#11#1#0: DatatypeType :: BoxRank(a#11#0#0) < DtRank(#_module.List.Cons(a#11#0#0, a#11#1#0)))
-              var trigger = (Trigger)null; // FIXME new Bpl.Trigger(ctor.tok, true, new List<Bpl.Expr> { lhs, rhs }); // TRIGGERS: THIS IS BROKEN // NEW_TRIGGER 
-              q = new Bpl.ForallExpr(ctor.tok, bvs, trigger, Bpl.Expr.Lt(lhs, rhs)); // CLEMENT: Trigger not is use, because it breaks termination checks for match statements
+              */                           
+              Bpl.Expr ct = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
+              var rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, ct);
+              var trigger = BplTrigger(ct);
+              q = new Bpl.ForallExpr(ctor.tok, bvs, trigger, Bpl.Expr.Lt(lhs, rhs));
               sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Inductive rank"));
             } else if (argType is SeqType) {
-              // axiom (forall params, i: int :: 0 <= i && i < |arg| ==> DtRank(arg[i]) < DtRank(#dt.ctor(params)));
+              // axiom (forall params, i: int {#dt.ctor(params)} :: 0 <= i && i < |arg| ==> DtRank(arg[i]) < DtRank(#dt.ctor(params)));
               // that is:
-              // axiom (forall params, i: int :: 0 <= i && i < |arg| ==> DtRank(Unbox(Seq#Index(arg,i))) < DtRank(#dt.ctor(params)));
-              CreateBoundVariables(ctor.Formals, out bvs, out args);
-              Bpl.Variable iVar = new Bpl.BoundVariable(arg.tok, new Bpl.TypedIdent(arg.tok, "i", Bpl.Type.Int));
-              bvs.Add(iVar);
-              Bpl.IdentifierExpr ie = new Bpl.IdentifierExpr(arg.tok, iVar);
-              Bpl.Expr ante = Bpl.Expr.And(
-                Bpl.Expr.Le(Bpl.Expr.Literal(0), ie),
-                Bpl.Expr.Lt(ie, FunctionCall(arg.tok, BuiltinFunction.SeqLength, null, args[i])));
-              Bpl.Expr lhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null,
-                FunctionCall(arg.tok, BuiltinFunction.Unbox, predef.DatatypeType,
-                  FunctionCall(arg.tok, BuiltinFunction.SeqIndex, predef.DatatypeType, args[i], ie)));
-              Bpl.Expr rhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
-              rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, rhs);
-              q = new Bpl.ForallExpr(ctor.tok, bvs, new Trigger(lhs.tok, true, new List<Bpl.Expr> { lhs, rhs }), Bpl.Expr.Imp(ante, Bpl.Expr.Lt(lhs, rhs)));
-              sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q));
-              // axiom (forall params, SeqRank(arg) < DtRank(#dt.ctor(params)));
-              CreateBoundVariables(ctor.Formals, out bvs, out args);
-              lhs = FunctionCall(ctor.tok, BuiltinFunction.SeqRank, null, args[i]);
-              rhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
-              rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, rhs);
-              var trigger = new Trigger(lhs.tok, true, new List<Bpl.Expr> { lhs, rhs });
-              q = new Bpl.ForallExpr(ctor.tok, bvs, trigger, Bpl.Expr.Lt(lhs, rhs));
-              sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Inductive seq rank"));
+              // axiom (forall params, i: int {#dt.ctor(params)} :: 0 <= i && i < |arg| ==> DtRank(Unbox(Seq#Index(arg,i))) < DtRank(#dt.ctor(params)));
+              {
+                CreateBoundVariables(ctor.Formals, out bvs, out args);
+                Bpl.Variable iVar = new Bpl.BoundVariable(arg.tok, new Bpl.TypedIdent(arg.tok, "i", Bpl.Type.Int));
+                bvs.Add(iVar);
+                Bpl.IdentifierExpr ie = new Bpl.IdentifierExpr(arg.tok, iVar);
+                Bpl.Expr ante = Bpl.Expr.And(
+                  Bpl.Expr.Le(Bpl.Expr.Literal(0), ie),
+                  Bpl.Expr.Lt(ie, FunctionCall(arg.tok, BuiltinFunction.SeqLength, null, args[i])));
+                var seqIndex = FunctionCall(arg.tok, BuiltinFunction.SeqIndex, predef.DatatypeType, args[i], ie);
+                Bpl.Expr lhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null,
+                  FunctionCall(arg.tok, BuiltinFunction.Unbox, predef.DatatypeType, seqIndex));
+                var ct = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
+                var rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, ct);
+                q = new Bpl.ForallExpr(ctor.tok, bvs, new Trigger(lhs.tok, true, new List<Bpl.Expr> { seqIndex, ct }), Bpl.Expr.Imp(ante, Bpl.Expr.Lt(lhs, rhs)));
+                sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q));
+              }
+
+              // axiom (forall params {#dt.ctor(params)} :: SeqRank(arg) < DtRank(#dt.ctor(params)));
+              {
+                CreateBoundVariables(ctor.Formals, out bvs, out args);
+                var lhs = FunctionCall(ctor.tok, BuiltinFunction.SeqRank, null, args[i]);
+                var ct = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
+                var rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, ct);
+                var trigger = BplTrigger(ct);
+                q = new Bpl.ForallExpr(ctor.tok, bvs, trigger, Bpl.Expr.Lt(lhs, rhs));
+                sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Inductive seq rank"));
+              }
             } else if (argType is SetType) {
-              // axiom (forall params, d: Datatype :: arg[d] ==> DtRank(d) < DtRank(#dt.ctor(params)));
+              // axiom (forall params, d: Datatype {arg[d], #dt.ctor(params)}  :: arg[d] ==> DtRank(d) < DtRank(#dt.ctor(params)));
               // that is:
-              // axiom (forall params, d: Datatype :: arg[Box(d)] ==> DtRank(d) < DtRank(#dt.ctor(params)));
+              // axiom (forall params, d: Datatype {arg[Box(d)], #dt.ctor(params)} :: arg[Box(d)] ==> DtRank(d) < DtRank(#dt.ctor(params)));
               CreateBoundVariables(ctor.Formals, out bvs, out args);
               Bpl.Variable dVar = new Bpl.BoundVariable(arg.tok, new Bpl.TypedIdent(arg.tok, "d", predef.DatatypeType));
               bvs.Add(dVar);
               Bpl.IdentifierExpr ie = new Bpl.IdentifierExpr(arg.tok, dVar);
-              Bpl.Expr ante = Bpl.Expr.SelectTok(arg.tok, args[i], FunctionCall(arg.tok, BuiltinFunction.Box, null, ie));
+              Bpl.Expr inSet = Bpl.Expr.SelectTok(arg.tok, args[i], FunctionCall(arg.tok, BuiltinFunction.Box, null, ie));
               Bpl.Expr lhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, ie);
-              Bpl.Expr rhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
-              rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, rhs);
-              var trigger = new Bpl.Trigger(ctor.tok, true, new List<Bpl.Expr> { lhs, rhs });
-              q = new Bpl.ForallExpr(ctor.tok, bvs, trigger, Bpl.Expr.Imp(ante, Bpl.Expr.Lt(lhs, rhs)));
+              var ct = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
+              var rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, ct);
+              var trigger = new Bpl.Trigger(ctor.tok, true, new List<Bpl.Expr> { inSet, ct });
+              q = new Bpl.ForallExpr(ctor.tok, bvs, trigger, Bpl.Expr.Imp(inSet, Bpl.Expr.Lt(lhs, rhs)));
               sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Inductive set rank"));
             } else if (argType is MultiSetType) {
-              // axiom (forall params, d: Datatype :: 0 < arg[d] ==> DtRank(d) < DtRank(#dt.ctor(params)));
+              // axiom (forall params, d: Datatype {arg[d], #dt.ctor(params)} :: 0 < arg[d] ==> DtRank(d) < DtRank(#dt.ctor(params)));
               // that is:
-              // axiom (forall params, d: Datatype :: 0 < arg[Box(d)] ==> DtRank(d) < DtRank(#dt.ctor(params)));
+              // axiom (forall params, d: Datatype {arg[Box(d)], #dt.ctor(params)} :: 0 < arg[Box(d)] ==> DtRank(d) < DtRank(#dt.ctor(params)));
               CreateBoundVariables(ctor.Formals, out bvs, out args);
               Bpl.Variable dVar = new Bpl.BoundVariable(arg.tok, new Bpl.TypedIdent(arg.tok, "d", predef.DatatypeType));
               bvs.Add(dVar);
               Bpl.IdentifierExpr ie = new Bpl.IdentifierExpr(arg.tok, dVar);
-              Bpl.Expr ante = Bpl.Expr.Gt(Bpl.Expr.SelectTok(arg.tok, args[i], FunctionCall(arg.tok, BuiltinFunction.Box, null, ie)), Bpl.Expr.Literal(0));
+              var inMultiset = Bpl.Expr.SelectTok(arg.tok, args[i], FunctionCall(arg.tok, BuiltinFunction.Box, null, ie));
+              Bpl.Expr ante = Bpl.Expr.Gt(inMultiset, Bpl.Expr.Literal(0));
               Bpl.Expr lhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, ie);
-              Bpl.Expr rhs = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
-              rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, rhs);
-              // CLEMENT: Does the test suite cover this?
-              q = new Bpl.ForallExpr(ctor.tok, bvs, Bpl.Expr.Imp(ante, Bpl.Expr.Lt(lhs, rhs)));  // W_TRIGGER
+              var ct = FunctionCall(ctor.tok, ctor.FullName, predef.DatatypeType, args);
+              var rhs = FunctionCall(ctor.tok, BuiltinFunction.DtRank, null, ct);
+              var trigger = new Bpl.Trigger(ctor.tok, true, new List<Bpl.Expr> { inMultiset, ct });
+              q = new Bpl.ForallExpr(ctor.tok, bvs, trigger, Bpl.Expr.Imp(ante, Bpl.Expr.Lt(lhs, rhs)));
               sink.AddTopLevelDeclaration(new Bpl.Axiom(ctor.tok, q, "Inductive multiset rank"));
-              // CLEMENT: I don't understand what this case disjunction does here; I don't think it's covered by the test suite
             }
           }
-
-          i++;
         }
       }
 
diff --git a/Test/dafny0/ContainerRanks.dfy b/Test/dafny0/ContainerRanks.dfy
new file mode 100644
index 00000000..df35e214
--- /dev/null
+++ b/Test/dafny0/ContainerRanks.dfy
@@ -0,0 +1,33 @@
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+datatype Abc = End | Wrapper(seq<Abc>)
+
+lemma SeqRank0(a: Abc)
+  ensures a != Wrapper([a])
+{
+  assert [a][0] == a;  // TODO: one could consider strengthening axioms to eliminate the need for this assert
+                       // The reason we need the assert is to match the trigger in the rank axioms produced
+                       // for datatypes containing sequences.
+                       // See "is SeqType" case of AddDatatype in Translator.cs
+}
+
+lemma SeqRank1(s: seq<Abc>)
+  requires s != []
+  ensures s[0] != Wrapper(s)
+{
+}
+
+datatype Def = End | MultiWrapper(multiset<Def>)
+
+lemma MultisetRank(a: Def)
+  ensures a != MultiWrapper(multiset{a})
+{
+}
+
+datatype Ghi = End | SetWrapper(set<Ghi>)
+
+lemma SetRank(a: Ghi)
+  ensures a != SetWrapper({a})
+{
+}
diff --git a/Test/dafny0/ContainerRanks.dfy.expect b/Test/dafny0/ContainerRanks.dfy.expect
new file mode 100644
index 00000000..42fd56a5
--- /dev/null
+++ b/Test/dafny0/ContainerRanks.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 8 verified, 0 errors
-- 
cgit v1.2.3


From c45904b0dcab8ecdf94b031c47684e19708e9608 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Tue, 21 Jul 2015 19:27:25 -0700
Subject: Simplify some of the deduplication code in TriggerGenerator.cs

---
 Source/Dafny/TriggerGenerator.cs | 93 +++++++++++-----------------------------
 1 file changed, 25 insertions(+), 68 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/TriggerGenerator.cs b/Source/Dafny/TriggerGenerator.cs
index a777b4ae..cf677e0e 100644
--- a/Source/Dafny/TriggerGenerator.cs
+++ b/Source/Dafny/TriggerGenerator.cs
@@ -9,8 +9,7 @@ using System.Diagnostics.Contracts;
 using System.Text;
 using System.Diagnostics;
 
-//FIXME No LitInts in triggers
-//FIXME Generated triggers should be _triggers, and if a predicate is called with something that can't be a trigger head we shouldn't inline it (see .\Test\dafny2\SnapshotableTrees.dfy)
+//FIXME Generated triggers should be _triggers
 //FIXME: When scoring, do not consider old(x) to be higher than x.
 
 /* High level note: There are really two processes going on here. One is finding quantifiers; 
@@ -35,24 +34,6 @@ namespace Microsoft.Dafny {
     }
   }
 
-  class TriggerCandidateComparer : IEqualityComparer<TriggerCandidate> { //FIXME: There is a bunch of these comparers.
-    private static TriggerCandidateComparer singleton;
-    internal static TriggerCandidateComparer Instance {
-      get { return singleton == null ? (singleton = new TriggerCandidateComparer()) : singleton; }
-    }
-
-    private TriggerCandidateComparer() { }
-
-    public bool Equals(TriggerCandidate x, TriggerCandidate y) {
-      return x == null && y == null ||
-        x != null && y != null && x.Expr.ExpressionEq(y.Expr);
-    }
-
-    public int GetHashCode(TriggerCandidate obj) {
-      return 1; // FIXME: Force collisions. Use until we have a proper hashing strategy for expressions.
-    }
-  }
-
   class MultiTriggerCandidate {
     internal List<TriggerCandidate> Candidates;
     internal List<string> Tags;
@@ -63,9 +44,9 @@ namespace Microsoft.Dafny {
       get {
         if (potentialMatchingLoops == null) {
           //FIXME could be optimized by looking at the bindings instead of doing full equality
-          var candidates = Candidates.Distinct(TriggerCandidateComparer.Instance);
+          var candidates = Candidates.Deduplicate((x, y) => ExprExtensions.ExpressionEq(x.Expr, y.Expr));
           potentialMatchingLoops = candidates.SelectMany(candidate => candidate.MatchesInQuantifierBody)
-            .Distinct(ExprExtensions.TriggerMatchComparer.Instance).Where(tm => tm.CouldCauseLoops(candidates)).ToList();
+            .Deduplicate((x, y) => ExprExtensions.ExpressionEq(x.Expr, y.Expr)).Where(tm => tm.CouldCauseLoops(candidates)).ToList();
         }
         
         return potentialMatchingLoops;
@@ -103,7 +84,7 @@ namespace Microsoft.Dafny {
     internal bool IsTriggerKiller;
     internal ISet<IVariable> Variables;
     internal readonly List<TriggerCandidate> PrivateCandidates;
-    internal readonly List<TriggerCandidate> ExportedCandidates; //FIXME using a hashset is useless here
+    internal readonly List<TriggerCandidate> ExportedCandidates;
 
     internal TriggerAnnotation(bool IsTriggerKiller, IEnumerable<IVariable> Variables, 
                                IEnumerable<TriggerCandidate> AllCandidates, IEnumerable<TriggerCandidate> PrivateCandidates = null) {
@@ -214,6 +195,7 @@ namespace Microsoft.Dafny {
                  expr is LiteralExpr ||
                  expr is OldExpr ||
                  expr is ThisExpr ||
+                 expr is BoxingCastExpr ||
                  expr is DatatypeValue) {
         annotation = AnnotateOther(expr, false);
       } else {
@@ -352,7 +334,7 @@ namespace Microsoft.Dafny {
     }
 
     private static bool DefaultCandidateFilteringFunction(TriggerCandidate candidate, QuantifierExpr quantifier) {
-      //FIXME this will miss rewritten expressions (CleanupExpr)
+      //FIXME this will miss rewritten expressions (CleanupExpr). Should introduce an OriginalExpr to compare.
       candidate.MatchesInQuantifierBody = quantifier.SubexpressionsMatchingTrigger(candidate.Expr).ToList();
       return true;
     }
@@ -402,7 +384,7 @@ namespace Microsoft.Dafny {
         Contract.Requires(MultiCandidateScoringFunction != null);
         Contract.Requires(MultiCandidateSelectionFunction != null);
 
-        AllCandidates = annotation.PrivateCandidates.Distinct(TriggerCandidateComparer.Instance).ToList();
+        AllCandidates = annotation.PrivateCandidates.Deduplicate((x, y) => ExprExtensions.ExpressionEq(x.Expr, y.Expr));
         Partition(AllCandidates, 
           x => CandidateFilteringFunction(x, quantifier), out SelectedCandidates, out RejectedCandidates);
         Partition(AllNonEmptySubsets(SelectedCandidates).Select(s => new MultiTriggerCandidate(s)), 
@@ -487,12 +469,12 @@ namespace Microsoft.Dafny {
       if (multi_candidates.RejectedMultiCandidates.Any()) {
         var tooltip = JoinStringsWithHeader("Rejected: ", multi_candidates.RejectedMultiCandidates.Where(candidate => candidate.Tags != null)
           .Select(candidate => candidate.AsDafnyAttributeString(true, true)));
-        AdditionalInformationReporter(quantifier.tok, tooltip, quantifier.tok.val.Length); //CLEMENT Check this
+        AdditionalInformationReporter(quantifier.tok, tooltip, quantifier.tok.val.Length);
       }
 
       if (multi_candidates.FinalMultiCandidates.Any()) {
         var tooltip = JoinStringsWithHeader("Triggers: ", multi_candidates.FinalMultiCandidates.Select(multi_candidate => multi_candidate.AsDafnyAttributeString()));
-        AdditionalInformationReporter(quantifier.tok, tooltip, quantifier.tok.val.Length); //CLEMENT Check this
+        AdditionalInformationReporter(quantifier.tok, tooltip, quantifier.tok.val.Length);
       }
 
       string warning = multi_candidates.Warning();
@@ -502,10 +484,6 @@ namespace Microsoft.Dafny {
     }
 
     internal static bool IsTriggerKiller(Expression expr) {
-      // CLEMENT: This should be removed once trigger generation becomes the default
-      if (!DafnyOptions.O.AutoTriggers) {
-        return false;
-      }
       var annotation = new TriggerGenerator((x, y, z) => { }).Annotate(expr);
       return annotation.IsTriggerKiller;
     }
@@ -569,6 +547,20 @@ namespace Microsoft.Dafny {
     }
   }
 
+  internal static class DeduplicateExtension {
+    public static List<T> Deduplicate<T>(this IEnumerable<T> seq, Func<T, T, bool> eq) {
+      List<T> deduplicated = new List<T>();
+
+      foreach (var elem in seq) {
+        if (!deduplicated.Any(other => eq(elem, other))) {
+          deduplicated.Add(elem);
+        }
+      }
+
+      return deduplicated;
+    }
+  }
+
   static class ExprExtensions {
     static IEnumerable<Expression> AllSubExpressions(this Expression expr, bool strict = false) {
       foreach (var subexpr in expr.SubExpressions) {
@@ -604,41 +596,6 @@ namespace Microsoft.Dafny {
       }
     }
 
-    internal class EqExpressionComparer : IEqualityComparer<Expression> { //FIXME
-      private static EqExpressionComparer singleton;
-      internal static EqExpressionComparer Instance {
-        get { return singleton == null ? (singleton = new EqExpressionComparer()) : singleton; }
-      }
-
-      private EqExpressionComparer() { }
-
-      public bool Equals(Expression x, Expression y) {
-        return x == null && y == null ||
-               x != null && y != null && x.ExpressionEq(y);
-      }
-
-      public int GetHashCode(Expression obj) {
-        return 1;
-      }
-    }
-
-    internal class TriggerMatchComparer : IEqualityComparer<TriggerMatch> { //FIXME
-      private static TriggerMatchComparer singleton;
-      internal static TriggerMatchComparer Instance {
-        get { return singleton == null ? (singleton = new TriggerMatchComparer()) : singleton; }
-      }
-
-      private TriggerMatchComparer() { }
-
-      public bool Equals(TriggerMatch x, TriggerMatch y) {
-        return ExpressionEq(x.Expr, y.Expr);
-      }
-
-      public int GetHashCode(TriggerMatch obj) {
-        return 1;
-      }
-    }
-
     internal static bool ExpressionEq(this Expression expr1, Expression expr2) {
       expr1 = GetResolved(expr1);
       expr2 = GetResolved(expr2);
@@ -819,7 +776,7 @@ namespace Microsoft.Dafny {
         return ShallowEq((SeqSelectExpr)expr1, (SeqSelectExpr)expr2);
       } else if (expr1 is MemberSelectExpr && expr2 is MemberSelectExpr) {
         return ShallowEq((MemberSelectExpr)expr1, (MemberSelectExpr)expr2);
-      } else if (expr1 is MapDisplayExpr && expr2 is MapDisplayExpr) {
+      } else if (expr1 is MapDisplayExpr && expr2 is MapDisplayExpr) { //Note: MapDisplayExpr is not a DisplayExpression
         return ShallowEq((MapDisplayExpr)expr1, (MapDisplayExpr)expr2);
       } else if (expr1 is DisplayExpression && expr2 is DisplayExpression) {
         return ShallowEq((DisplayExpression)expr1, (DisplayExpression)expr2);
@@ -1030,7 +987,7 @@ namespace Microsoft.Dafny {
     private static bool ShallowEq(DisplayExpression expr1, DisplayExpression expr2) {
       if (expr1 is SeqDisplayExpr && expr2 is SeqDisplayExpr) {
         return ShallowEq((SeqDisplayExpr)expr1, (SeqDisplayExpr)expr2);
-      } else if (expr1 is MultiSetDisplayExpr && expr2 is MultiSetDisplayExpr) { //FIXME MultiSetDisplayExpr is not a DisplayExpression ??!
+      } else if (expr1 is MultiSetDisplayExpr && expr2 is MultiSetDisplayExpr) {
         return ShallowEq((MultiSetDisplayExpr)expr1, (MultiSetDisplayExpr)expr2);
       } else if (expr1 is SetDisplayExpr && expr2 is SetDisplayExpr) {
         return ShallowEq((SetDisplayExpr)expr1, (SetDisplayExpr)expr2);
-- 
cgit v1.2.3


From fb4915bc1b95d182b08a45c85d92046489ed1078 Mon Sep 17 00:00:00 2001
From: Michael Lowell Roberts <mirobert@microsoft.com>
Date: Wed, 22 Jul 2015 11:13:14 -0700
Subject: IronDafny related changes: - diabled error message related to ensures
 clauses requiring function bodies in the case of abstract modules. - fixed
 bug in similar error message related to bodyless methods in abstract modules.

---
 Source/Dafny/Dafny.atg | 16 +++++-----
 Source/Dafny/Parser.cs | 84 +++++++++++++++++++++++++-------------------------
 2 files changed, 50 insertions(+), 50 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index f30542d0..c4f038d4 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -573,7 +573,7 @@ SubModuleDecl<ModuleDefinition parent, out ModuleDecl submodule>
         | NewtypeDecl<module, out td>                  (. module.TopLevelDecls.Add(td); .)
         | OtherTypeDecl<module, out td>                (. module.TopLevelDecls.Add(td); .)
         | IteratorDecl<module, out iter>               (. module.TopLevelDecls.Add(iter); .)
-        | ClassMemberDecl<namedModuleDefaultClassMembers, false, !DafnyOptions.O.AllowGlobals, true>
+        | ClassMemberDecl<namedModuleDefaultClassMembers, false, !DafnyOptions.O.AllowGlobals, DafnyOptions.O.IronDafny && isAbstract>
         }
       "}"                                  (. module.BodyEndTok = t;
                                               module.TopLevelDecls.Add(new DefaultClassDecl(module, namedModuleDefaultClassMembers));
@@ -663,7 +663,7 @@ ClassDecl<ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c>
     .)
 	.
 
-ClassMemberDecl<.List<MemberDecl> mm, bool allowConstructors, bool moduleLevelDecl, bool permitAbstractDecl.>
+ClassMemberDecl<.List<MemberDecl> mm, bool allowConstructors, bool moduleLevelDecl, bool isWithinAbstractModule.>
 = (. Contract.Requires(cce.NonNullElements(mm));
      Method/*!*/ m;
      Function/*!*/ f;
@@ -687,7 +687,7 @@ ClassMemberDecl<.List<MemberDecl> mm, bool allowConstructors, bool moduleLevelDe
          mmod.IsStatic = false;
        }
     .)
-    FunctionDecl<mmod, out f>                   (. mm.Add(f); .)
+    FunctionDecl<mmod, isWithinAbstractModule, out f>                   (. mm.Add(f); .)
   | (. if (moduleLevelDecl && staticToken != null) {
          errors.Warning(staticToken, "module-level methods are always non-instance, so the 'static' keyword is not allowed here");
          mmod.IsStatic = false;
@@ -697,7 +697,7 @@ ClassMemberDecl<.List<MemberDecl> mm, bool allowConstructors, bool moduleLevelDe
          mmod.IsProtected = false;
        }
     .)
-    MethodDecl<mmod, allowConstructors, permitAbstractDecl, out m>  (. mm.Add(m); .)
+    MethodDecl<mmod, allowConstructors, isWithinAbstractModule, out m>  (. mm.Add(m); .)
   )
   .
 DatatypeDecl<ModuleDefinition/*!*/ module, out DatatypeDecl/*!*/ dt>
@@ -949,7 +949,7 @@ GenericParameters<.List<TypeParameter/*!*/>/*!*/ typeArgs.>
   ">"
   .
 /*------------------------------------------------------------------------*/
-MethodDecl<MemberModifiers mmod, bool allowConstructor, bool permitAbstractDecl, out Method/*!*/ m>
+MethodDecl<MemberModifiers mmod, bool allowConstructor, bool isWithinAbstractModule, out Method/*!*/ m>
 = (. Contract.Ensures(Contract.ValueAtReturn(out m) !=null);
      IToken/*!*/ id = Token.NoToken;
      bool hasName = false;  IToken keywordToken;
@@ -1030,7 +1030,7 @@ MethodDecl<MemberModifiers mmod, bool allowConstructor, bool permitAbstractDecl,
   [ BlockStmt<out body, out bodyStart, out bodyEnd>
   ]
   (.
-     if (!permitAbstractDecl && DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported") && !Attributes.Contains(attrs, "decl") && theVerifyThisFile) {
+     if (!isWithinAbstractModule && DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported") && !Attributes.Contains(attrs, "decl") && theVerifyThisFile) {
         SemErr(t, "a method with an ensures clause must have a body, unless given the :axiom attribute");
      }
 
@@ -1253,7 +1253,7 @@ GenericInstantiation<.List<Type/*!*/>/*!*/ gt.>
   ">"
   .
 /*------------------------------------------------------------------------*/
-FunctionDecl<MemberModifiers mmod, out Function/*!*/ f>
+FunctionDecl<MemberModifiers mmod, bool isWithinAbstractModule, out Function/*!*/ f>
 = (. Contract.Ensures(Contract.ValueAtReturn(out f)!=null);
      Attributes attrs = null;
      IToken/*!*/ id = Token.NoToken;  // to please compiler
@@ -1338,7 +1338,7 @@ FunctionDecl<MemberModifiers mmod, out Function/*!*/ f>
   { FunctionSpec<reqs, reads, ens, decreases> }
   [ FunctionBody<out body, out bodyStart, out bodyEnd>
   ]
-  (. if (DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported")) {
+  (. if (!isWithinAbstractModule && DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported")) {
         SemErr(t, "a function with an ensures clause must have a body, unless given the :axiom attribute");
      }
 
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index 76e0ebba..01438f68 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -74,8 +74,8 @@ public class Parser {
 	public const int _ellipsis = 58;
 	public const int maxT = 138;
 
-	const bool T = true;
-	const bool x = false;
+	const bool _T = true;
+	const bool _x = false;
 	const int minErrDist = 2;
 
 	public Scanner/*!*/ scanner;
@@ -684,7 +684,7 @@ bool IsType(ref IToken pt) {
 					break;
 				}
 				case 37: case 38: case 39: case 40: case 41: case 72: case 73: case 74: case 77: case 83: case 84: case 85: case 86: {
-					ClassMemberDecl(namedModuleDefaultClassMembers, false, !DafnyOptions.O.AllowGlobals, true);
+					ClassMemberDecl(namedModuleDefaultClassMembers, false, !DafnyOptions.O.AllowGlobals, DafnyOptions.O.IronDafny && isAbstract);
 					break;
 				}
 				}
@@ -982,7 +982,7 @@ bool IsType(ref IToken pt) {
 		
 	}
 
-	void ClassMemberDecl(List<MemberDecl> mm, bool allowConstructors, bool moduleLevelDecl, bool permitAbstractDecl) {
+	void ClassMemberDecl(List<MemberDecl> mm, bool allowConstructors, bool moduleLevelDecl, bool isWithinAbstractModule) {
 		Contract.Requires(cce.NonNullElements(mm));
 		Method/*!*/ m;
 		Function/*!*/ f;
@@ -1015,7 +1015,7 @@ bool IsType(ref IToken pt) {
 			 mmod.IsStatic = false;
 			}
 			
-			FunctionDecl(mmod, out f);
+			FunctionDecl(mmod, isWithinAbstractModule, out f);
 			mm.Add(f); 
 		} else if (StartOf(6)) {
 			if (moduleLevelDecl && staticToken != null) {
@@ -1027,7 +1027,7 @@ bool IsType(ref IToken pt) {
 			 mmod.IsProtected = false;
 			}
 			
-			MethodDecl(mmod, allowConstructors, permitAbstractDecl, out m);
+			MethodDecl(mmod, allowConstructors, isWithinAbstractModule, out m);
 			mm.Add(m); 
 		} else SynErr(151);
 	}
@@ -1131,7 +1131,7 @@ bool IsType(ref IToken pt) {
 		OldSemi();
 	}
 
-	void FunctionDecl(MemberModifiers mmod, out Function/*!*/ f) {
+	void FunctionDecl(MemberModifiers mmod, bool isWithinAbstractModule, out Function/*!*/ f) {
 		Contract.Ensures(Contract.ValueAtReturn(out f)!=null);
 		Attributes attrs = null;
 		IToken/*!*/ id = Token.NoToken;  // to please compiler
@@ -1257,7 +1257,7 @@ bool IsType(ref IToken pt) {
 		if (la.kind == 45) {
 			FunctionBody(out body, out bodyStart, out bodyEnd);
 		}
-		if (DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported")) {
+		if (!isWithinAbstractModule && DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported")) {
 		  SemErr(t, "a function with an ensures clause must have a body, unless given the :axiom attribute");
 		}
 		
@@ -1285,7 +1285,7 @@ bool IsType(ref IToken pt) {
 		
 	}
 
-	void MethodDecl(MemberModifiers mmod, bool allowConstructor, bool permitAbstractDecl, out Method/*!*/ m) {
+	void MethodDecl(MemberModifiers mmod, bool allowConstructor, bool isWithinAbstractModule, out Method/*!*/ m) {
 		Contract.Ensures(Contract.ValueAtReturn(out m) !=null);
 		IToken/*!*/ id = Token.NoToken;
 		bool hasName = false;  IToken keywordToken;
@@ -1405,7 +1405,7 @@ bool IsType(ref IToken pt) {
 		if (la.kind == 45) {
 			BlockStmt(out body, out bodyStart, out bodyEnd);
 		}
-		if (!permitAbstractDecl && DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported") && !Attributes.Contains(attrs, "decl") && theVerifyThisFile) {
+		if (!isWithinAbstractModule && DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported") && !Attributes.Contains(attrs, "decl") && theVerifyThisFile) {
 		  SemErr(t, "a method with an ensures clause must have a body, unless given the :axiom attribute");
 		}
 		
@@ -4389,38 +4389,38 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 	}
 
 	static readonly bool[,]/*!*/ set = {
-		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,T, x,x,T,T, T,x,x,T, T,x,x,T, T,x,T,T, T,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,T,x,T, T,x,x,T, T,T,x,x, T,x,x,T, T,T,T,T, T,T,x,T, T,x,x,T, x,x,T,T, T,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,x,x, T,x,x,x, x,T,x,T, T,T,T,T, T,T,T,T, T,x,x,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,T,T,x, x,T,x,x, x,x,x,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{x,T,x,x, x,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, x,x,T,x, x,x,x,T, x,x,x,x, x,x,x,x, T,T,x,x, T,x,T,x, x,T,x,T, T,T,T,T, T,T,T,T, T,x,x,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,T,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, T,x,x,T, T,T,T,T, T,x,x,x},
-		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,T,T,T, T,T,x,T, T,T,T,x, x,T,x,T, x,x,x,x, x,x,x,x, T,T,x,x, T,x,x,x, x,T,x,T, T,T,T,T, T,T,T,T, T,x,x,T, T,T,T,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{x,T,T,x, x,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,T,x,T, T,x,x,T, x,x,T,T, T,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,x,x,x},
-		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,T,T, x,x,x,x, x,x,T,x, T,T,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, T,x,x,T, T,T,T,T, T,x,x,x},
-		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,T,x,T, T,x,x,T, x,x,T,T, T,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, T,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,T,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, T,x,x,T, T,T,T,T, T,x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,T,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, T,x,x,T, T,T,T,T, T,x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,T,x,T, T,x,x,T, x,x,T,T, T,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,T, T,T,x,T, T,x,x,T, x,x,T,T, T,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,T,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{x,T,T,T, T,x,x,x, T,x,T,x, x,T,T,T, x,T,T,T, T,x,x,T, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,T, x,T,x,x, x,x,x,x, T,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,T,T,x, T,T,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,T, T,T,x,x, T,x,x,T, T,T,T,T, T,x,x,x},
-		{x,x,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,x,x,x},
-		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,x,x,T, x,x,x,x, x,x,T,T, T,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,x,x, x,x,x,x, x,x,T,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,T,x,T, T,x,x,T, x,x,T,T, T,T,T,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,T,T, T,x,x,x},
-		{x,x,x,x, x,x,x,x, x,x,x,x, x,T,T,x, x,T,T,x, x,x,x,x, x,x,x,x, x,x,T,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, T,x,x,x, x,T,x,x, x,x,x,x, x,x,x,x, x,x,x,T, x,x,x,x, x,x,T,x, T,T,x,T, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,x, x,x,x,T, T,T,x,x, x,x,x,x, x,x,x,x, x,x,x,x},
-		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, T,T,x,x, T,x,x,x, x,T,x,T, T,T,T,T, T,T,T,T, T,x,x,T, T,T,T,T, T,T,T,T, T,x,T,T, T,x,T,T, T,T,T,T, T,T,x,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,x,x, x,x,T,T, T,T,T,T, T,T,T,T, T,T,x,x},
-		{T,T,T,T, T,x,x,x, T,x,T,x, x,x,x,x, x,x,x,T, T,T,T,T, T,T,x,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,T,x, T,T,T,T, T,T,T,T, T,T,T,x, T,T,x,x, T,x,x,x, x,T,x,T, T,T,T,T, T,T,T,T, T,x,x,T, T,T,T,T, T,T,T,T, T,x,T,T, x,x,T,T, T,T,T,T, T,T,x,T, T,T,T,T, T,T,T,T, T,T,T,T, T,T,x,x, x,x,T,T, T,T,T,T, T,T,T,T, T,T,x,x}
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_T, _x,_x,_T,_T, _T,_x,_x,_T, _T,_x,_x,_T, _T,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_x, _x,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_T,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_x,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x}
 
 	};
 } // end Parser
-- 
cgit v1.2.3


From 1763ad8e4d6b631fe966b394ae2dbafa7d803627 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 23 Jul 2015 10:26:47 -0700
Subject: Fix: Visual studio did not show warnings.

To check if the fix works, try declaring a static top level function.
Initial work on this patch by Rustan
---
 Source/Dafny/Resolver.cs                |  4 ++--
 Source/DafnyExtension/DafnyDriver.cs    |  7 +++++++
 Source/DafnyExtension/ResolverTagger.cs | 32 +++++++++++++++++---------------
 3 files changed, 26 insertions(+), 17 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 26349ef5..44990d7d 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -51,7 +51,7 @@ namespace Microsoft.Dafny
       Error(e.tok, msg, args);
     }
 
-    private bool reportWarnings = true;
+    protected bool reportWarnings = true;
     /// <summary>
     /// Set whether or not to report warnings. Return the state of the previous behavior.
     /// </summary>
@@ -60,7 +60,7 @@ namespace Microsoft.Dafny
       reportWarnings = b;
       return old;
     }
-    public void Warning(IToken tok, string msg, params object[] args) {
+    public virtual void Warning(IToken tok, string msg, params object[] args) {
       Contract.Requires(tok != null);
       Contract.Requires(msg != null);
       if (reportWarnings) {
diff --git a/Source/DafnyExtension/DafnyDriver.cs b/Source/DafnyExtension/DafnyDriver.cs
index 7f39fe34..8300213c 100644
--- a/Source/DafnyExtension/DafnyDriver.cs
+++ b/Source/DafnyExtension/DafnyDriver.cs
@@ -182,6 +182,13 @@ namespace DafnyLanguage
         dd.RecordError(tok.filename, tok.line - 1, tok.col - 1, ErrorCategory.ResolveError, s);
         ErrorCount++;
       }
+
+      public override void Warning(IToken tok, string msg, params object[] args) {
+        if (reportWarnings) {
+          string s = string.Format(msg, args);
+          dd.RecordError(tok.filename, tok.line - 1, tok.col - 1, ErrorCategory.ResolveWarning, s);
+        }
+      }
     }
 
     #endregion
diff --git a/Source/DafnyExtension/ResolverTagger.cs b/Source/DafnyExtension/ResolverTagger.cs
index 1fdd3827..4237041f 100644
--- a/Source/DafnyExtension/ResolverTagger.cs
+++ b/Source/DafnyExtension/ResolverTagger.cs
@@ -68,26 +68,27 @@ namespace DafnyLanguage
     {
       Error = error;
     }
-    
-    private static string ConvertToErrorType(DafnyError err)
-    {
-      string ty;  // the COLORs below indicate what I see on my machine
-      switch (err.Category)
-      {
-        default:  // unexpected category
+
+    private static string ConvertToErrorType(DafnyError err) {
+      // the COLORs below indicate what I see on my machine
+      switch (err.Category) {
+        case ErrorCategory.ProcessError:
         case ErrorCategory.ParseError:
         case ErrorCategory.ParseWarning:
-          ty = "syntax error"; break;  // COLOR: red
+          return "syntax error";  // COLOR: red
         case ErrorCategory.ResolveError:
-          ty = "compiler error"; break;  // COLOR: blue
+          return "compiler error";  // COLOR: blue
+        case ErrorCategory.ResolveWarning:
+          return "compiler warning";  // COLOR: blue
+        case ErrorCategory.InternalError:
         case ErrorCategory.VerificationError:
-          ty = "error"; break;  // COLOR: red
+          return "error";  // COLOR: red
         case ErrorCategory.AuxInformation:
-          ty = "other error"; break;  // COLOR: purple red
-        case ErrorCategory.InternalError:
-          ty = "error"; break;  // COLOR: red
+          return "other error";  // COLOR: purple red
+        default:
+          Contract.Assert(false);
+          throw new InvalidOperationException();
       }
-      return ty;
     }
   }
 
@@ -412,6 +413,7 @@ namespace DafnyLanguage
         case ErrorCategory.InternalError:
           return TaskErrorCategory.Error;
         case ErrorCategory.ParseWarning:
+        case ErrorCategory.ResolveWarning:
           return TaskErrorCategory.Warning;
         case ErrorCategory.AuxInformation:
           return TaskErrorCategory.Message;
@@ -477,7 +479,7 @@ namespace DafnyLanguage
 
   public enum ErrorCategory
   {
-    ProcessError, ParseWarning, ParseError, ResolveError, VerificationError, AuxInformation, InternalError
+    ProcessError, ParseWarning, ParseError, ResolveWarning, ResolveError, VerificationError, AuxInformation, InternalError
   }
 
   public class DafnyError
-- 
cgit v1.2.3


From 3f886d1789d50400ffba2befdc2ae0e8d5c79cbe Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 23 Jul 2015 11:57:19 -0700
Subject: Fix: Unify column numbers in Dafny's errors

Dafny counts from 0, but Boogie counts from 1. Tokens are 1-based. Thus when we
print tokens, we need to decrement the column number. This was done for resolver
errors, but not for verification or parsing errors. In addition, parsing errors
were inconsistent with resolution errors case-wise.

Unfortunately, the fix affects the output of many tests.
---
 Source/Dafny/Parser.cs                             | 12 ++-
 Source/DafnyDriver/DafnyDriver.cs                  |  8 +-
 Test/dafny0/AdvancedLHS.dfy.expect                 |  2 +-
 Test/dafny0/Array.dfy.expect                       | 46 +++++-----
 Test/dafny0/AutoReq.dfy.expect                     | 38 ++++-----
 Test/dafny0/Backticks.dfy.expect                   |  4 +-
 Test/dafny0/BadFunction.dfy.expect                 |  2 +-
 Test/dafny0/Basics.dfy.expect                      | 36 ++++----
 Test/dafny0/Calculations.dfy.expect                | 12 +--
 Test/dafny0/Char.dfy.expect                        |  6 +-
 Test/dafny0/CoPrefix.dfy.expect                    | 30 +++----
 Test/dafny0/CoinductiveProofs.dfy.expect           | 42 +++++-----
 Test/dafny0/Comprehensions.dfy.expect              |  2 +-
 Test/dafny0/ComputationsLoop.dfy.expect            |  4 +-
 Test/dafny0/ComputationsLoop2.dfy.expect           |  6 +-
 Test/dafny0/ComputationsNeg.dfy.expect             | 14 ++--
 Test/dafny0/ControlStructures.dfy.expect           | 20 ++---
 Test/dafny0/Corecursion.dfy.expect                 | 16 ++--
 Test/dafny0/DTypes.dfy.expect                      | 24 +++---
 Test/dafny0/Datatypes.dfy.expect                   | 26 +++---
 Test/dafny0/Definedness.dfy.expect                 | 98 +++++++++++-----------
 Test/dafny0/DeterministicPick.dfy.expect           |  2 +-
 Test/dafny0/DiamondImports.dfy.expect              | 10 +--
 Test/dafny0/Fuel.dfy.expect                        | 50 +++++------
 Test/dafny0/FunctionSpecifications.dfy.expect      | 38 ++++-----
 Test/dafny0/IMaps.dfy.expect                       |  2 +-
 Test/dafny0/Include.dfy.expect                     | 10 +--
 Test/dafny0/Includee.dfy.expect                    | 10 +--
 Test/dafny0/IndexIntoUpdate.dfy.expect             |  2 +-
 Test/dafny0/InductivePredicates.dfy.expect         |  4 +-
 Test/dafny0/Inverses.dfy.expect                    |  8 +-
 Test/dafny0/Iterators.dfy.expect                   | 44 +++++-----
 Test/dafny0/LetExpr.dfy.expect                     | 18 ++--
 Test/dafny0/LhsDuplicates.dfy.expect               | 12 +--
 Test/dafny0/LoopModifies.dfy.expect                | 18 ++--
 Test/dafny0/Maps.dfy.expect                        |  4 +-
 Test/dafny0/ModifyStmt.dfy.expect                  | 22 ++---
 Test/dafny0/Modules0.dfy.expect                    |  4 +-
 Test/dafny0/Modules1.dfy.expect                    | 12 +--
 Test/dafny0/MultiDimArray.dfy.expect               |  4 +-
 Test/dafny0/MultiSets.dfy.expect                   | 14 ++--
 Test/dafny0/NatTypes.dfy.expect                    | 18 ++--
 Test/dafny0/Newtypes.dfy.expect                    | 26 +++---
 Test/dafny0/OpaqueFunctions.dfy.expect             | 52 ++++++------
 Test/dafny0/Parallel.dfy.expect                    | 20 ++---
 Test/dafny0/ParseErrors.dfy.expect                 | 32 +++----
 Test/dafny0/PredExpr.dfy.expect                    |  8 +-
 Test/dafny0/Predicates.dfy.expect                  | 26 +++---
 Test/dafny0/Protected.dfy.expect                   | 10 +--
 Test/dafny0/RankNeg.dfy.expect                     |  8 +-
 Test/dafny0/Reads.dfy.expect                       | 18 ++--
 Test/dafny0/RealCompare.dfy.expect                 | 10 +--
 Test/dafny0/RealTypes.dfy.expect                   | 10 +--
 Test/dafny0/Refinement.dfy.expect                  | 36 ++++----
 Test/dafny0/Skeletons.dfy.expect                   |  4 +-
 Test/dafny0/SmallTests.dfy.expect                  | 76 ++++++++---------
 Test/dafny0/SplitExpr.dfy.expect                   |  4 +-
 Test/dafny0/StatementExpressions.dfy.expect        | 10 +--
 Test/dafny0/Superposition.dfy.expect               | 12 +--
 Test/dafny0/Termination.dfy.expect                 | 16 ++--
 .../Trait/TraitUsingParentMembers.dfy.expect       |  2 +-
 Test/dafny0/Trait/TraitsDecreases.dfy.expect       | 22 ++---
 Test/dafny0/Tuples.dfy.expect                      |  4 +-
 Test/dafny0/TypeAntecedents.dfy.expect             |  8 +-
 Test/dafny0/TypeParameters.dfy.expect              | 30 +++----
 Test/dafny0/columns.dfy                            | 10 +++
 Test/dafny0/columns.dfy.expect                     | 18 ++++
 Test/dafny0/snapshots/Snapshots0.run.dfy.expect    |  2 +-
 Test/dafny0/snapshots/Snapshots1.run.dfy.expect    |  2 +-
 Test/dafny0/snapshots/Snapshots2.run.dfy.expect    |  2 +-
 Test/dafny0/snapshots/Snapshots3.run.dfy.expect    |  4 +-
 Test/dafny0/snapshots/Snapshots4.run.dfy.expect    |  4 +-
 Test/dafny0/snapshots/Snapshots6.run.dfy.expect    |  2 +-
 Test/dafny0/snapshots/Snapshots7.run.dfy.expect    |  2 +-
 Test/dafny1/MoreInduction.dfy.expect               | 16 ++--
 Test/dafny2/SnapshotableTrees.dfy.expect           |  4 +-
 Test/dafny4/BinarySearch.dfy.expect                |  2 +-
 Test/dafny4/Bug73.dfy.expect                       |  4 +-
 Test/dafny4/SoftwareFoundations-Basics.dfy.expect  |  2 +-
 Test/hofs/Apply.dfy.expect                         |  2 +-
 Test/hofs/Classes.dfy.expect                       |  4 +-
 Test/hofs/Field.dfy.expect                         |  8 +-
 Test/hofs/FnRef.dfy.expect                         |  8 +-
 Test/hofs/Frame.dfy.expect                         | 14 ++--
 Test/hofs/Lambda.dfy.expect                        |  2 +-
 Test/hofs/LambdaParsefail.dfy.expect               | 10 +--
 Test/hofs/LambdaParsefail2.dfy.expect              |  2 +-
 Test/hofs/Naked.dfy.expect                         | 24 +++---
 Test/hofs/OneShot.dfy.expect                       |  6 +-
 Test/hofs/ReadsReads.dfy.expect                    | 16 ++--
 Test/hofs/Simple.dfy.expect                        | 12 +--
 Test/hofs/Twice.dfy.expect                         |  4 +-
 Test/irondafny0/inheritreqs0.dfy.expect            |  4 +-
 Test/irondafny0/inheritreqs1.dfy.expect            |  4 +-
 Test/irondafny0/xrefine1.dfy.expect                |  4 +-
 95 files changed, 714 insertions(+), 682 deletions(-)
 create mode 100644 Test/dafny0/columns.dfy
 create mode 100644 Test/dafny0/columns.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index 01438f68..d50a4dd6 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -4429,8 +4429,8 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 public class Errors {
 	public int count = 0;                                    // number of errors detected
 	public System.IO.TextWriter/*!*/ errorStream = Console.Out;   // error messages go to this stream
-	public string errMsgFormat = "{0}({1},{2}): error: {3}"; // 0=filename, 1=line, 2=column, 3=text
-	public string warningMsgFormat = "{0}({1},{2}): warning: {3}"; // 0=filename, 1=line, 2=column, 3=text
+	public string errMsgFormat = "{0}({1},{2}): Error: {3}"; // 0=filename, 1=line, 2=column, 3=text
+	public string warningMsgFormat = "{0}({1},{2}): Warning: {3}"; // 0=filename, 1=line, 2=column, 3=text
 
 	public void SynErr(string filename, int line, int col, int n) {
 		SynErr(filename, line, col, GetSyntaxErrorString(n));
@@ -4438,7 +4438,7 @@ public class Errors {
 
 	public virtual void SynErr(string filename, int line, int col, string/*!*/ msg) {
 		Contract.Requires(msg != null);
-		errorStream.WriteLine(errMsgFormat, filename, line, col, msg);
+		errorStream.WriteLine(errMsgFormat, filename, line, col - 1, msg);
 		count++;
 	}
 
@@ -4701,7 +4701,7 @@ public class Errors {
 
 	public virtual void SemErr(string filename, int line, int col, string/*!*/ msg) {
 		Contract.Requires(msg != null);
-		errorStream.WriteLine(errMsgFormat, filename, line, col, msg);
+		errorStream.WriteLine(errMsgFormat, filename, line, col - 1, msg);
 		count++;
 	}
 
@@ -4713,7 +4713,7 @@ public class Errors {
 
 	public virtual void Warning(string filename, int line, int col, string msg) {
 		Contract.Requires(msg != null);
-		errorStream.WriteLine(warningMsgFormat, filename, line, col, msg);
+		errorStream.WriteLine(warningMsgFormat, filename, line, col - 1, msg);
 	}
 } // Errors
 
@@ -4721,6 +4721,4 @@ public class Errors {
 public class FatalError: Exception {
 	public FatalError(string m): base(m) {}
 }
-
-
 }
\ No newline at end of file
diff --git a/Source/DafnyDriver/DafnyDriver.cs b/Source/DafnyDriver/DafnyDriver.cs
index 9fdc9320..d22899ab 100644
--- a/Source/DafnyDriver/DafnyDriver.cs
+++ b/Source/DafnyDriver/DafnyDriver.cs
@@ -273,7 +273,13 @@ namespace Microsoft.Dafny
     {
       public override void ReportBplError(IToken tok, string message, bool error, TextWriter tw, string category = null)
       {
-        base.ReportBplError(tok, message, error, tw, category);
+        // Dafny has 0-indexed columns, but Boogie counts from 1
+        var realigned_tok = new Token(tok.line, tok.col - 1);
+        realigned_tok.kind = tok.kind;
+        realigned_tok.pos = tok.pos;
+        realigned_tok.val = tok.val;
+        realigned_tok.filename = tok.filename;
+        base.ReportBplError(realigned_tok, message, error, tw, category);
 
         if (tok is Dafny.NestedToken)
         {
diff --git a/Test/dafny0/AdvancedLHS.dfy.expect b/Test/dafny0/AdvancedLHS.dfy.expect
index cb817605..aab12cfc 100644
--- a/Test/dafny0/AdvancedLHS.dfy.expect
+++ b/Test/dafny0/AdvancedLHS.dfy.expect
@@ -1,4 +1,4 @@
-AdvancedLHS.dfy(34,23): Error: target object may be null
+AdvancedLHS.dfy(34,22): Error: target object may be null
 Execution trace:
     (0,0): anon0
     (0,0): anon15_Else
diff --git a/Test/dafny0/Array.dfy.expect b/Test/dafny0/Array.dfy.expect
index 59dcb4bf..40fb318d 100644
--- a/Test/dafny0/Array.dfy.expect
+++ b/Test/dafny0/Array.dfy.expect
@@ -1,16 +1,16 @@
-Array.dfy(13,8): Error: assignment may update an array element not in the enclosing context's modifies clause
+Array.dfy(13,7): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
     (0,0): anon2
     (0,0): anon6_Then
-Array.dfy(20,16): Error: target object may be null
+Array.dfy(20,15): Error: target object may be null
 Execution trace:
     (0,0): anon0
-Array.dfy(27,6): Error: index out of range
+Array.dfy(27,5): Error: index out of range
 Execution trace:
     (0,0): anon0
-Array.dfy(51,20): Error: assertion violation
+Array.dfy(51,19): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon12_Then
@@ -21,19 +21,19 @@ Execution trace:
     (0,0): anon16_Then
     (0,0): anon9
     (0,0): anon11
-Array.dfy(59,8): Error: assignment may update an array element not in the enclosing context's modifies clause
+Array.dfy(59,7): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
     (0,0): anon2
     (0,0): anon6_Then
-Array.dfy(66,8): Error: assignment may update an array element not in the enclosing context's modifies clause
+Array.dfy(66,7): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
     (0,0): anon2
     (0,0): anon6_Then
-Array.dfy(110,21): Error: upper bound below lower bound or above length of array
+Array.dfy(110,20): Error: upper bound below lower bound or above length of array
 Execution trace:
     (0,0): anon0
     (0,0): anon14_Else
@@ -41,7 +41,7 @@ Execution trace:
     (0,0): anon19_Then
     (0,0): anon20_Then
     (0,0): anon11
-Array.dfy(120,8): Error: insufficient reads clause to read the indicated range of array elements
+Array.dfy(120,7): Error: insufficient reads clause to read the indicated range of array elements
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Else
@@ -49,7 +49,7 @@ Execution trace:
     (0,0): anon12_Then
     (0,0): anon13_Then
     (0,0): anon9
-Array.dfy(122,8): Error: insufficient reads clause to read the indicated range of array elements
+Array.dfy(122,7): Error: insufficient reads clause to read the indicated range of array elements
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Else
@@ -57,7 +57,7 @@ Execution trace:
     (0,0): anon12_Then
     (0,0): anon13_Else
     (0,0): anon9
-Array.dfy(123,8): Error: insufficient reads clause to read the indicated range of array elements
+Array.dfy(123,7): Error: insufficient reads clause to read the indicated range of array elements
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Else
@@ -65,7 +65,7 @@ Execution trace:
     (0,0): anon12_Then
     (0,0): anon13_Else
     (0,0): anon9
-Array.dfy(124,8): Error: insufficient reads clause to read the indicated range of array elements
+Array.dfy(124,7): Error: insufficient reads clause to read the indicated range of array elements
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Else
@@ -73,45 +73,45 @@ Execution trace:
     (0,0): anon12_Then
     (0,0): anon13_Else
     (0,0): anon9
-Array.dfy(163,6): Error: insufficient reads clause to read array element
+Array.dfy(163,5): Error: insufficient reads clause to read array element
 Execution trace:
     (0,0): anon0
     (0,0): anon8_Else
     (0,0): anon9_Then
     (0,0): anon10_Then
     (0,0): anon7
-Array.dfy(171,6): Error: insufficient reads clause to read array element
+Array.dfy(171,5): Error: insufficient reads clause to read array element
 Execution trace:
     (0,0): anon0
     (0,0): anon8_Else
     (0,0): anon9_Then
     (0,0): anon10_Then
     (0,0): anon7
-Array.dfy(187,6): Error: assignment may update an array element not in the enclosing context's modifies clause
+Array.dfy(187,5): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
-Array.dfy(194,6): Error: assignment may update an array element not in the enclosing context's modifies clause
+Array.dfy(194,5): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
-Array.dfy(219,1): Error BP5003: A postcondition might not hold on this return path.
-Array.dfy(218,11): Related location: This is the postcondition that might not hold.
+Array.dfy(219,0): Error BP5003: A postcondition might not hold on this return path.
+Array.dfy(218,10): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-Array.dfy(243,1): Error BP5003: A postcondition might not hold on this return path.
-Array.dfy(242,11): Related location: This is the postcondition that might not hold.
+Array.dfy(243,0): Error BP5003: A postcondition might not hold on this return path.
+Array.dfy(242,10): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-Array.dfy(249,1): Error BP5003: A postcondition might not hold on this return path.
-Array.dfy(248,11): Related location: This is the postcondition that might not hold.
+Array.dfy(249,0): Error BP5003: A postcondition might not hold on this return path.
+Array.dfy(248,10): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-Array.dfy(264,10): Error: value assigned to a nat must be non-negative
+Array.dfy(264,9): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
     (0,0): anon2
     (0,0): anon6_Then
-Array.dfy(265,5): Error: value assigned to a nat must be non-negative
+Array.dfy(265,4): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
diff --git a/Test/dafny0/AutoReq.dfy.expect b/Test/dafny0/AutoReq.dfy.expect
index 8486716d..b4b34e14 100644
--- a/Test/dafny0/AutoReq.dfy.expect
+++ b/Test/dafny0/AutoReq.dfy.expect
@@ -1,43 +1,43 @@
-AutoReq.dfy(247,5): Error: possible violation of function precondition
-AutoReq.dfy(239,14): Related location
+AutoReq.dfy(247,4): Error: possible violation of function precondition
+AutoReq.dfy(239,13): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-AutoReq.dfy(13,3): Error: possible violation of function precondition
-AutoReq.dfy(5,14): Related location
+AutoReq.dfy(13,2): Error: possible violation of function precondition
+AutoReq.dfy(5,13): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-AutoReq.dfy(25,3): Error: possible violation of function precondition
-AutoReq.dfy(5,14): Related location
+AutoReq.dfy(25,2): Error: possible violation of function precondition
+AutoReq.dfy(5,13): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-AutoReq.dfy(38,12): Error: assertion violation
-AutoReq.dfy(31,13): Related location
-AutoReq.dfy(7,5): Related location
+AutoReq.dfy(38,11): Error: assertion violation
+AutoReq.dfy(31,12): Related location
+AutoReq.dfy(7,4): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Then
-AutoReq.dfy(38,12): Error: possible violation of function precondition
-AutoReq.dfy(5,14): Related location
+AutoReq.dfy(38,11): Error: possible violation of function precondition
+AutoReq.dfy(5,13): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Then
-AutoReq.dfy(40,12): Error: assertion violation
-AutoReq.dfy(31,27): Related location
-AutoReq.dfy(7,5): Related location
+AutoReq.dfy(40,11): Error: assertion violation
+AutoReq.dfy(31,26): Related location
+AutoReq.dfy(7,4): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Then
-AutoReq.dfy(40,12): Error: possible violation of function precondition
-AutoReq.dfy(5,14): Related location
+AutoReq.dfy(40,11): Error: possible violation of function precondition
+AutoReq.dfy(5,13): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Then
-AutoReq.dfy(45,12): Error: assertion violation
-AutoReq.dfy(31,13): Related location
-AutoReq.dfy(7,5): Related location
+AutoReq.dfy(45,11): Error: assertion violation
+AutoReq.dfy(31,12): Related location
+AutoReq.dfy(7,4): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon11_Then
diff --git a/Test/dafny0/Backticks.dfy.expect b/Test/dafny0/Backticks.dfy.expect
index 57761ab4..58977413 100644
--- a/Test/dafny0/Backticks.dfy.expect
+++ b/Test/dafny0/Backticks.dfy.expect
@@ -1,10 +1,10 @@
-Backticks.dfy(38,5): Error: insufficient reads clause to invoke function
+Backticks.dfy(38,4): Error: insufficient reads clause to invoke function
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Else
     (0,0): anon6
-Backticks.dfy(77,8): Error: call may violate context's modifies clause
+Backticks.dfy(77,7): Error: call may violate context's modifies clause
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
diff --git a/Test/dafny0/BadFunction.dfy.expect b/Test/dafny0/BadFunction.dfy.expect
index 9c4ae81d..1af2608d 100644
--- a/Test/dafny0/BadFunction.dfy.expect
+++ b/Test/dafny0/BadFunction.dfy.expect
@@ -1,4 +1,4 @@
-BadFunction.dfy(9,3): Error: failure to decrease termination measure
+BadFunction.dfy(9,2): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
diff --git a/Test/dafny0/Basics.dfy.expect b/Test/dafny0/Basics.dfy.expect
index f28df20a..65d5d101 100644
--- a/Test/dafny0/Basics.dfy.expect
+++ b/Test/dafny0/Basics.dfy.expect
@@ -1,8 +1,8 @@
-Basics.dfy(45,14): Error: assertion violation
+Basics.dfy(45,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Else
-Basics.dfy(69,42): Error: assertion violation
+Basics.dfy(69,41): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon13_Then
@@ -12,7 +12,7 @@ Execution trace:
     Basics.dfy(69,82): anon17_Else
     Basics.dfy(69,95): anon18_Else
     (0,0): anon12
-Basics.dfy(93,14): Error: assertion violation
+Basics.dfy(93,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     Basics.dfy(83,14): anon27_Else
@@ -27,7 +27,7 @@ Execution trace:
     Basics.dfy(91,13): anon34_Else
     (0,0): anon35_Then
     (0,0): anon15
-Basics.dfy(99,14): Error: assertion violation
+Basics.dfy(99,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     Basics.dfy(83,14): anon27_Else
@@ -42,7 +42,7 @@ Execution trace:
     Basics.dfy(97,19): anon40_Else
     (0,0): anon41_Then
     (0,0): anon26
-Basics.dfy(112,28): Error: target object may be null
+Basics.dfy(112,27): Error: target object may be null
 Execution trace:
     (0,0): anon0
     Basics.dfy(105,20): anon13_Else
@@ -52,7 +52,7 @@ Execution trace:
     Basics.dfy(107,24): anon15_Else
     (0,0): anon6
     (0,0): anon16_Then
-Basics.dfy(114,14): Error: target object may be null
+Basics.dfy(114,13): Error: target object may be null
 Execution trace:
     (0,0): anon0
     Basics.dfy(105,20): anon13_Else
@@ -62,11 +62,11 @@ Execution trace:
     Basics.dfy(107,24): anon15_Else
     (0,0): anon6
     (0,0): anon16_Else
-Basics.dfy(149,16): Error: assertion violation
+Basics.dfy(149,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Then
-Basics.dfy(168,10): Error: when left-hand sides 0 and 1 may refer to the same location, they must be assigned the same value
+Basics.dfy(168,9): Error: when left-hand sides 0 and 1 may refer to the same location, they must be assigned the same value
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Then
@@ -75,28 +75,28 @@ Execution trace:
     (0,0): anon6
     (0,0): anon12_Then
     (0,0): anon9
-Basics.dfy(182,10): Error: when left-hand sides 0 and 1 refer to the same location, they must be assigned the same value
+Basics.dfy(182,9): Error: when left-hand sides 0 and 1 refer to the same location, they must be assigned the same value
 Execution trace:
     (0,0): anon0
-Basics.dfy(194,19): Error: assertion violation
+Basics.dfy(194,18): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon11_Then
-Basics.dfy(196,10): Error: assignment may update an object not in the enclosing context's modifies clause
+Basics.dfy(196,9): Error: assignment may update an object not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
     (0,0): anon3
-Basics.dfy(196,10): Error: target object may be null
+Basics.dfy(196,9): Error: target object may be null
 Execution trace:
     (0,0): anon0
     (0,0): anon3
-Basics.dfy(201,12): Error: left-hand sides 0 and 1 may refer to the same location
+Basics.dfy(201,11): Error: left-hand sides 0 and 1 may refer to the same location
 Execution trace:
     (0,0): anon0
     (0,0): anon11_Then
     (0,0): anon3
     (0,0): anon12_Then
-Basics.dfy(212,15): Error: assertion violation
+Basics.dfy(212,14): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon11_Then
@@ -106,19 +106,19 @@ Execution trace:
     (0,0): anon13_Then
     (0,0): anon8
     (0,0): anon14_Then
-Basics.dfy(274,10): Error: when left-hand sides 0 and 1 refer to the same location, they must be assigned the same value
+Basics.dfy(274,9): Error: when left-hand sides 0 and 1 refer to the same location, they must be assigned the same value
 Execution trace:
     (0,0): anon0
-Basics.dfy(465,12): Error: assertion violation
+Basics.dfy(465,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Then
     (0,0): anon3
-Basics.dfy(476,19): Error: assertion violation
+Basics.dfy(476,18): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-Basics.dfy(478,12): Error: assertion violation
+Basics.dfy(478,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Then
diff --git a/Test/dafny0/Calculations.dfy.expect b/Test/dafny0/Calculations.dfy.expect
index 3427a5cb..d4559f53 100644
--- a/Test/dafny0/Calculations.dfy.expect
+++ b/Test/dafny0/Calculations.dfy.expect
@@ -1,24 +1,24 @@
-Calculations.dfy(7,6): Error: index out of range
+Calculations.dfy(7,5): Error: index out of range
 Execution trace:
     (0,0): anon0
     (0,0): anon24_Then
-Calculations.dfy(12,15): Error: index out of range
+Calculations.dfy(12,14): Error: index out of range
 Execution trace:
     (0,0): anon0
     (0,0): anon26_Then
-Calculations.dfy(12,19): Error: assertion violation
+Calculations.dfy(12,18): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon26_Then
-Calculations.dfy(56,12): Error: assertion violation
+Calculations.dfy(56,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
     Calculations.dfy(51,3): anon5_Else
-Calculations.dfy(79,15): Error: index out of range
+Calculations.dfy(79,14): Error: index out of range
 Execution trace:
     (0,0): anon0
     (0,0): anon12_Then
-Calculations.dfy(79,19): Error: assertion violation
+Calculations.dfy(79,18): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon12_Then
diff --git a/Test/dafny0/Char.dfy.expect b/Test/dafny0/Char.dfy.expect
index 55418934..874aaa65 100644
--- a/Test/dafny0/Char.dfy.expect
+++ b/Test/dafny0/Char.dfy.expect
@@ -1,14 +1,14 @@
-Char.dfy(48,21): Error: assertion violation
+Char.dfy(48,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Then
     (0,0): anon10_Then
-Char.dfy(52,21): Error: assertion violation
+Char.dfy(52,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Then
     (0,0): anon11_Else
-Char.dfy(63,17): Error: assertion violation
+Char.dfy(63,16): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Else
diff --git a/Test/dafny0/CoPrefix.dfy.expect b/Test/dafny0/CoPrefix.dfy.expect
index c92a09c1..a7295367 100644
--- a/Test/dafny0/CoPrefix.dfy.expect
+++ b/Test/dafny0/CoPrefix.dfy.expect
@@ -1,48 +1,48 @@
-CoPrefix.dfy(164,3): Error BP5003: A postcondition might not hold on this return path.
-CoPrefix.dfy(163,15): Related location: This is the postcondition that might not hold.
+CoPrefix.dfy(164,2): Error BP5003: A postcondition might not hold on this return path.
+CoPrefix.dfy(163,14): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Else
-CoPrefix.dfy(169,3): Error BP5003: A postcondition might not hold on this return path.
-CoPrefix.dfy(168,15): Related location: This is the postcondition that might not hold.
+CoPrefix.dfy(169,2): Error BP5003: A postcondition might not hold on this return path.
+CoPrefix.dfy(168,14): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Else
-CoPrefix.dfy(176,11): Error: cannot prove termination; try supplying a decreases clause
+CoPrefix.dfy(176,10): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-CoPrefix.dfy(63,57): Error: failure to decrease termination measure
+CoPrefix.dfy(63,56): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Then
     (0,0): anon8_Else
     (0,0): anon9_Then
-CoPrefix.dfy(76,56): Error: cannot prove termination; try supplying a decreases clause
+CoPrefix.dfy(76,55): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Then
     (0,0): anon8_Else
     (0,0): anon9_Then
-CoPrefix.dfy(114,1): Error BP5003: A postcondition might not hold on this return path.
-CoPrefix.dfy(113,11): Related location: This is the postcondition that might not hold.
-CoPrefix.dfy(101,17): Related location
+CoPrefix.dfy(114,0): Error BP5003: A postcondition might not hold on this return path.
+CoPrefix.dfy(113,10): Related location: This is the postcondition that might not hold.
+CoPrefix.dfy(101,16): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-CoPrefix.dfy(138,25): Error: assertion violation
+CoPrefix.dfy(138,24): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Then
     (0,0): anon10_Then
-CoPrefix.dfy(142,25): Error: assertion violation
-CoPrefix.dfy(117,23): Related location
+CoPrefix.dfy(142,24): Error: assertion violation
+CoPrefix.dfy(117,22): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Then
     (0,0): anon12_Then
-CoPrefix.dfy(151,1): Error BP5003: A postcondition might not hold on this return path.
-CoPrefix.dfy(150,11): Related location: This is the postcondition that might not hold.
+CoPrefix.dfy(151,0): Error BP5003: A postcondition might not hold on this return path.
+CoPrefix.dfy(150,10): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Else
diff --git a/Test/dafny0/CoinductiveProofs.dfy.expect b/Test/dafny0/CoinductiveProofs.dfy.expect
index 12ce2f01..2a5a2b0b 100644
--- a/Test/dafny0/CoinductiveProofs.dfy.expect
+++ b/Test/dafny0/CoinductiveProofs.dfy.expect
@@ -1,48 +1,48 @@
-CoinductiveProofs.dfy(29,12): Error: assertion violation
-CoinductiveProofs.dfy(13,17): Related location
+CoinductiveProofs.dfy(29,11): Error: assertion violation
+CoinductiveProofs.dfy(13,16): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
     (0,0): anon6_Then
-CoinductiveProofs.dfy(59,1): Error BP5003: A postcondition might not hold on this return path.
-CoinductiveProofs.dfy(58,11): Related location: This is the postcondition that might not hold.
-CoinductiveProofs.dfy(54,3): Related location
+CoinductiveProofs.dfy(59,0): Error BP5003: A postcondition might not hold on this return path.
+CoinductiveProofs.dfy(58,10): Related location: This is the postcondition that might not hold.
+CoinductiveProofs.dfy(54,2): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-CoinductiveProofs.dfy(74,12): Error: assertion violation
-CoinductiveProofs.dfy(54,3): Related location
+CoinductiveProofs.dfy(74,11): Error: assertion violation
+CoinductiveProofs.dfy(54,2): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
     (0,0): anon6_Then
-CoinductiveProofs.dfy(91,1): Error BP5003: A postcondition might not hold on this return path.
-CoinductiveProofs.dfy(90,11): Related location: This is the postcondition that might not hold.
-CoinductiveProofs.dfy(80,3): Related location
+CoinductiveProofs.dfy(91,0): Error BP5003: A postcondition might not hold on this return path.
+CoinductiveProofs.dfy(90,10): Related location: This is the postcondition that might not hold.
+CoinductiveProofs.dfy(80,2): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-CoinductiveProofs.dfy(100,12): Error: assertion violation
-CoinductiveProofs.dfy(80,3): Related location
+CoinductiveProofs.dfy(100,11): Error: assertion violation
+CoinductiveProofs.dfy(80,2): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
     (0,0): anon6_Then
-CoinductiveProofs.dfy(111,1): Error BP5003: A postcondition might not hold on this return path.
-CoinductiveProofs.dfy(110,11): Related location: This is the postcondition that might not hold.
-CoinductiveProofs.dfy(106,3): Related location
+CoinductiveProofs.dfy(111,0): Error BP5003: A postcondition might not hold on this return path.
+CoinductiveProofs.dfy(110,10): Related location: This is the postcondition that might not hold.
+CoinductiveProofs.dfy(106,2): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-CoinductiveProofs.dfy(150,1): Error BP5003: A postcondition might not hold on this return path.
-CoinductiveProofs.dfy(149,22): Related location: This is the postcondition that might not hold.
-CoinductiveProofs.dfy(4,24): Related location
+CoinductiveProofs.dfy(150,0): Error BP5003: A postcondition might not hold on this return path.
+CoinductiveProofs.dfy(149,21): Related location: This is the postcondition that might not hold.
+CoinductiveProofs.dfy(4,23): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-CoinductiveProofs.dfy(156,1): Error BP5003: A postcondition might not hold on this return path.
-CoinductiveProofs.dfy(155,22): Related location: This is the postcondition that might not hold.
-CoinductiveProofs.dfy(4,24): Related location
+CoinductiveProofs.dfy(156,0): Error BP5003: A postcondition might not hold on this return path.
+CoinductiveProofs.dfy(155,21): Related location: This is the postcondition that might not hold.
+CoinductiveProofs.dfy(4,23): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
diff --git a/Test/dafny0/Comprehensions.dfy.expect b/Test/dafny0/Comprehensions.dfy.expect
index 88873fd8..887a3249 100644
--- a/Test/dafny0/Comprehensions.dfy.expect
+++ b/Test/dafny0/Comprehensions.dfy.expect
@@ -1,4 +1,4 @@
-Comprehensions.dfy(12,14): Error: assertion violation
+Comprehensions.dfy(12,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Then
diff --git a/Test/dafny0/ComputationsLoop.dfy.expect b/Test/dafny0/ComputationsLoop.dfy.expect
index 91dc2af9..84674030 100644
--- a/Test/dafny0/ComputationsLoop.dfy.expect
+++ b/Test/dafny0/ComputationsLoop.dfy.expect
@@ -1,8 +1,8 @@
-ComputationsLoop.dfy(7,3): Error: failure to decrease termination measure
+ComputationsLoop.dfy(7,2): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-ComputationsLoop.dfy(12,26): Error: assertion violation
+ComputationsLoop.dfy(12,25): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/ComputationsLoop2.dfy.expect b/Test/dafny0/ComputationsLoop2.dfy.expect
index 816cbd31..48fc618f 100644
--- a/Test/dafny0/ComputationsLoop2.dfy.expect
+++ b/Test/dafny0/ComputationsLoop2.dfy.expect
@@ -1,12 +1,12 @@
-ComputationsLoop2.dfy(6,3): Error: cannot prove termination; try supplying a decreases clause
+ComputationsLoop2.dfy(6,2): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-ComputationsLoop2.dfy(11,3): Error: cannot prove termination; try supplying a decreases clause
+ComputationsLoop2.dfy(11,2): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-ComputationsLoop2.dfy(16,26): Error: assertion violation
+ComputationsLoop2.dfy(16,25): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/ComputationsNeg.dfy.expect b/Test/dafny0/ComputationsNeg.dfy.expect
index a6318087..598e9fa5 100644
--- a/Test/dafny0/ComputationsNeg.dfy.expect
+++ b/Test/dafny0/ComputationsNeg.dfy.expect
@@ -1,19 +1,19 @@
-ComputationsNeg.dfy(7,3): Error: failure to decrease termination measure
+ComputationsNeg.dfy(7,2): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-ComputationsNeg.dfy(11,1): Error BP5003: A postcondition might not hold on this return path.
-ComputationsNeg.dfy(10,17): Related location: This is the postcondition that might not hold.
+ComputationsNeg.dfy(11,0): Error BP5003: A postcondition might not hold on this return path.
+ComputationsNeg.dfy(10,16): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-ComputationsNeg.dfy(23,1): Error BP5003: A postcondition might not hold on this return path.
-ComputationsNeg.dfy(22,11): Related location: This is the postcondition that might not hold.
+ComputationsNeg.dfy(23,0): Error BP5003: A postcondition might not hold on this return path.
+ComputationsNeg.dfy(22,10): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-ComputationsNeg.dfy(36,13): Error: assertion violation
+ComputationsNeg.dfy(36,12): Error: assertion violation
 Execution trace:
     (0,0): anon0
-ComputationsNeg.dfy(45,13): Error: assertion violation
+ComputationsNeg.dfy(45,12): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/ControlStructures.dfy.expect b/Test/dafny0/ControlStructures.dfy.expect
index 3f4dce92..5638bcbc 100644
--- a/Test/dafny0/ControlStructures.dfy.expect
+++ b/Test/dafny0/ControlStructures.dfy.expect
@@ -1,29 +1,29 @@
-ControlStructures.dfy(8,3): Error: missing case in case statement: Purple
+ControlStructures.dfy(8,2): Error: missing case in case statement: Purple
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Else
     (0,0): anon7_Else
     (0,0): anon8_Then
-ControlStructures.dfy(8,3): Error: missing case in case statement: Blue
+ControlStructures.dfy(8,2): Error: missing case in case statement: Blue
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Else
     (0,0): anon7_Else
     (0,0): anon8_Else
     (0,0): anon9_Then
-ControlStructures.dfy(17,3): Error: missing case in case statement: Purple
+ControlStructures.dfy(17,2): Error: missing case in case statement: Purple
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Else
     (0,0): anon7_Else
     (0,0): anon8_Then
-ControlStructures.dfy(46,5): Error: missing case in case statement: Red
+ControlStructures.dfy(46,4): Error: missing case in case statement: Red
 Execution trace:
     (0,0): anon0
     (0,0): anon8_Then
     (0,0): anon9_Else
     (0,0): anon10_Then
-ControlStructures.dfy(54,3): Error: missing case in case statement: Red
+ControlStructures.dfy(54,2): Error: missing case in case statement: Red
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Else
@@ -31,11 +31,11 @@ Execution trace:
     (0,0): anon11_Else
     (0,0): anon12_Else
     (0,0): anon13_Then
-ControlStructures.dfy(75,3): Error: alternative cases fail to cover all possibilties
+ControlStructures.dfy(75,2): Error: alternative cases fail to cover all possibilties
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Else
-ControlStructures.dfy(218,18): Error: assertion violation
+ControlStructures.dfy(218,17): Error: assertion violation
 Execution trace:
     (0,0): anon0
     ControlStructures.dfy(197,3): anon59_LoopHead
@@ -51,7 +51,7 @@ Execution trace:
     (0,0): anon69_LoopBody
     ControlStructures.dfy(213,9): anon70_Else
     (0,0): anon71_Then
-ControlStructures.dfy(235,21): Error: assertion violation
+ControlStructures.dfy(235,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     ControlStructures.dfy(197,3): anon59_LoopHead
@@ -77,7 +77,7 @@ Execution trace:
     (0,0): anon38
     (0,0): anon83_Then
     (0,0): anon52
-ControlStructures.dfy(238,30): Error: assertion violation
+ControlStructures.dfy(238,29): Error: assertion violation
 Execution trace:
     (0,0): anon0
     ControlStructures.dfy(197,3): anon59_LoopHead
@@ -92,7 +92,7 @@ Execution trace:
     (0,0): anon84_Then
     (0,0): anon85_Then
     (0,0): anon56
-ControlStructures.dfy(241,17): Error: assertion violation
+ControlStructures.dfy(241,16): Error: assertion violation
 Execution trace:
     (0,0): anon0
     ControlStructures.dfy(197,3): anon59_LoopHead
diff --git a/Test/dafny0/Corecursion.dfy.expect b/Test/dafny0/Corecursion.dfy.expect
index 619a9c84..a6b3fdce 100644
--- a/Test/dafny0/Corecursion.dfy.expect
+++ b/Test/dafny0/Corecursion.dfy.expect
@@ -1,34 +1,34 @@
-Corecursion.dfy(17,13): Error: cannot prove termination; try supplying a decreases clause (note that only functions without side effects can be called co-recursively)
+Corecursion.dfy(17,12): Error: cannot prove termination; try supplying a decreases clause (note that only functions without side effects can be called co-recursively)
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-Corecursion.dfy(23,13): Error: cannot prove termination; try supplying a decreases clause (note that only functions without any ensures clause can be called co-recursively)
+Corecursion.dfy(23,12): Error: cannot prove termination; try supplying a decreases clause (note that only functions without any ensures clause can be called co-recursively)
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-Corecursion.dfy(58,5): Error: cannot prove termination; try supplying a decreases clause
+Corecursion.dfy(58,4): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-Corecursion.dfy(71,16): Error: cannot prove termination; try supplying a decreases clause (note that calls cannot be co-recursive in this context)
+Corecursion.dfy(71,15): Error: cannot prove termination; try supplying a decreases clause (note that calls cannot be co-recursive in this context)
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
-Corecursion.dfy(93,15): Error: cannot prove termination; try supplying a decreases clause (note that a call can be co-recursive only if all intra-cluster calls are in non-destructive contexts)
+Corecursion.dfy(93,14): Error: cannot prove termination; try supplying a decreases clause (note that a call can be co-recursive only if all intra-cluster calls are in non-destructive contexts)
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Then
-Corecursion.dfy(103,15): Error: cannot prove termination; try supplying a decreases clause (note that a call can be co-recursive only if all intra-cluster calls are in non-destructive contexts)
+Corecursion.dfy(103,14): Error: cannot prove termination; try supplying a decreases clause (note that a call can be co-recursive only if all intra-cluster calls are in non-destructive contexts)
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Then
-Corecursion.dfy(148,13): Error: failure to decrease termination measure (note that a call can be co-recursive only if all intra-cluster calls are in non-destructive contexts)
+Corecursion.dfy(148,12): Error: failure to decrease termination measure (note that a call can be co-recursive only if all intra-cluster calls are in non-destructive contexts)
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-Corecursion.dfy(161,13): Error: failure to decrease termination measure (note that a call can be co-recursive only if all intra-cluster calls are in non-destructive contexts)
+Corecursion.dfy(161,12): Error: failure to decrease termination measure (note that a call can be co-recursive only if all intra-cluster calls are in non-destructive contexts)
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
diff --git a/Test/dafny0/DTypes.dfy.expect b/Test/dafny0/DTypes.dfy.expect
index 9b4288e9..76088e9b 100644
--- a/Test/dafny0/DTypes.dfy.expect
+++ b/Test/dafny0/DTypes.dfy.expect
@@ -1,27 +1,27 @@
-DTypes.dfy(182,3): Error BP5003: A postcondition might not hold on this return path.
-DTypes.dfy(181,15): Related location: This is the postcondition that might not hold.
+DTypes.dfy(182,2): Error BP5003: A postcondition might not hold on this return path.
+DTypes.dfy(181,14): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-DTypes.dfy(18,14): Error: assertion violation
+DTypes.dfy(18,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
-DTypes.dfy(56,18): Error: assertion violation
+DTypes.dfy(56,17): Error: assertion violation
 Execution trace:
     (0,0): anon0
-DTypes.dfy(121,13): Error: assertion violation
-DTypes.dfy(93,30): Related location
+DTypes.dfy(121,12): Error: assertion violation
+DTypes.dfy(93,29): Related location
 Execution trace:
     (0,0): anon0
-DTypes.dfy(127,13): Error: assertion violation
-DTypes.dfy(93,20): Related location
+DTypes.dfy(127,12): Error: assertion violation
+DTypes.dfy(93,19): Related location
 Execution trace:
     (0,0): anon0
-DTypes.dfy(137,12): Error: assertion violation
-DTypes.dfy(132,6): Related location
-DTypes.dfy(93,20): Related location
+DTypes.dfy(137,11): Error: assertion violation
+DTypes.dfy(132,5): Related location
+DTypes.dfy(93,19): Related location
 Execution trace:
     (0,0): anon0
-DTypes.dfy(158,12): Error: assertion violation
+DTypes.dfy(158,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
diff --git a/Test/dafny0/Datatypes.dfy.expect b/Test/dafny0/Datatypes.dfy.expect
index 4c0b1e96..7147ca60 100644
--- a/Test/dafny0/Datatypes.dfy.expect
+++ b/Test/dafny0/Datatypes.dfy.expect
@@ -1,43 +1,43 @@
-Datatypes.dfy(297,10): Error BP5003: A postcondition might not hold on this return path.
-Datatypes.dfy(295,15): Related location: This is the postcondition that might not hold.
+Datatypes.dfy(297,9): Error BP5003: A postcondition might not hold on this return path.
+Datatypes.dfy(295,14): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon13_Then
     (0,0): anon14_Else
     (0,0): anon15_Then
     (0,0): anon6
-Datatypes.dfy(298,12): Error: missing case in case statement: Appendix
+Datatypes.dfy(298,11): Error: missing case in case statement: Appendix
 Execution trace:
     (0,0): anon0
     (0,0): anon13_Then
     (0,0): anon14_Else
     (0,0): anon15_Else
     (0,0): anon16_Then
-Datatypes.dfy(349,5): Error: missing case in case statement: Cons
+Datatypes.dfy(349,4): Error: missing case in case statement: Cons
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Then
-Datatypes.dfy(349,5): Error: missing case in case statement: Nil
+Datatypes.dfy(349,4): Error: missing case in case statement: Nil
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Else
     (0,0): anon9_Then
-Datatypes.dfy(356,8): Error: missing case in case statement: Cons
+Datatypes.dfy(356,7): Error: missing case in case statement: Cons
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Else
     (0,0): anon11_Then
     (0,0): anon12_Then
-Datatypes.dfy(356,8): Error: missing case in case statement: Nil
+Datatypes.dfy(356,7): Error: missing case in case statement: Nil
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Else
     (0,0): anon11_Then
     (0,0): anon12_Else
     (0,0): anon13_Then
-Datatypes.dfy(82,20): Error: assertion violation
+Datatypes.dfy(82,19): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon20_Else
@@ -47,23 +47,23 @@ Execution trace:
     (0,0): anon23_Then
     (0,0): anon24_Else
     (0,0): anon25_Then
-Datatypes.dfy(170,16): Error: assertion violation
+Datatypes.dfy(170,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Then
-Datatypes.dfy(172,16): Error: assertion violation
+Datatypes.dfy(172,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
     (0,0): anon5_Then
-Datatypes.dfy(201,13): Error: destructor 'Car' can only be applied to datatype values constructed by 'XCons'
+Datatypes.dfy(201,12): Error: destructor 'Car' can only be applied to datatype values constructed by 'XCons'
 Execution trace:
     (0,0): anon0
-Datatypes.dfy(204,17): Error: destructor 'Car' can only be applied to datatype values constructed by 'XCons'
+Datatypes.dfy(204,16): Error: destructor 'Car' can only be applied to datatype values constructed by 'XCons'
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Then
-Datatypes.dfy(225,17): Error: destructor 'c' can only be applied to datatype values constructed by 'T''
+Datatypes.dfy(225,16): Error: destructor 'c' can only be applied to datatype values constructed by 'T''
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
diff --git a/Test/dafny0/Definedness.dfy.expect b/Test/dafny0/Definedness.dfy.expect
index af5b62b9..b5b015ad 100644
--- a/Test/dafny0/Definedness.dfy.expect
+++ b/Test/dafny0/Definedness.dfy.expect
@@ -1,87 +1,87 @@
-Definedness.dfy(11,7): Error: possible division by zero
+Definedness.dfy(11,6): Error: possible division by zero
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-Definedness.dfy(18,16): Error: possible division by zero
+Definedness.dfy(18,15): Error: possible division by zero
 Execution trace:
     (0,0): anon0
-Definedness.dfy(27,16): Error: target object may be null
+Definedness.dfy(27,15): Error: target object may be null
 Execution trace:
     (0,0): anon0
-Definedness.dfy(28,21): Error: target object may be null
+Definedness.dfy(28,20): Error: target object may be null
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-Definedness.dfy(29,17): Error: possible division by zero
+Definedness.dfy(29,16): Error: possible division by zero
 Execution trace:
     (0,0): anon0
-Definedness.dfy(36,16): Error: target object may be null
+Definedness.dfy(36,15): Error: target object may be null
 Execution trace:
     (0,0): anon0
-Definedness.dfy(45,16): Error: target object may be null
+Definedness.dfy(45,15): Error: target object may be null
 Execution trace:
     (0,0): anon0
-Definedness.dfy(53,18): Error: target object may be null
+Definedness.dfy(53,17): Error: target object may be null
 Execution trace:
     (0,0): anon0
-Definedness.dfy(54,3): Error BP5003: A postcondition might not hold on this return path.
-Definedness.dfy(53,22): Related location: This is the postcondition that might not hold.
+Definedness.dfy(54,2): Error BP5003: A postcondition might not hold on this return path.
+Definedness.dfy(53,21): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-Definedness.dfy(60,18): Error: target object may be null
+Definedness.dfy(60,17): Error: target object may be null
 Execution trace:
     (0,0): anon0
-Definedness.dfy(61,3): Error BP5003: A postcondition might not hold on this return path.
-Definedness.dfy(60,22): Related location: This is the postcondition that might not hold.
+Definedness.dfy(61,2): Error BP5003: A postcondition might not hold on this return path.
+Definedness.dfy(60,21): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-Definedness.dfy(68,3): Error BP5003: A postcondition might not hold on this return path.
-Definedness.dfy(67,22): Related location: This is the postcondition that might not hold.
+Definedness.dfy(68,2): Error BP5003: A postcondition might not hold on this return path.
+Definedness.dfy(67,21): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-Definedness.dfy(88,7): Error: target object may be null
+Definedness.dfy(88,6): Error: target object may be null
 Execution trace:
     (0,0): anon0
-Definedness.dfy(89,5): Error: possible violation of function precondition
-Definedness.dfy(79,16): Related location
+Definedness.dfy(89,4): Error: possible violation of function precondition
+Definedness.dfy(79,15): Related location
 Execution trace:
     (0,0): anon0
-Definedness.dfy(89,10): Error: assignment may update an object not in the enclosing context's modifies clause
+Definedness.dfy(89,9): Error: assignment may update an object not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
-Definedness.dfy(89,10): Error: target object may be null
+Definedness.dfy(89,9): Error: target object may be null
 Execution trace:
     (0,0): anon0
-Definedness.dfy(90,10): Error: possible violation of function precondition
-Definedness.dfy(79,16): Related location
+Definedness.dfy(90,9): Error: possible violation of function precondition
+Definedness.dfy(79,15): Related location
 Execution trace:
     (0,0): anon0
-Definedness.dfy(95,14): Error: possible division by zero
+Definedness.dfy(95,13): Error: possible division by zero
 Execution trace:
     (0,0): anon0
-Definedness.dfy(95,23): Error: possible division by zero
+Definedness.dfy(95,22): Error: possible division by zero
 Execution trace:
     (0,0): anon0
-Definedness.dfy(96,15): Error: possible division by zero
+Definedness.dfy(96,14): Error: possible division by zero
 Execution trace:
     (0,0): anon0
-Definedness.dfy(101,12): Error: possible division by zero
+Definedness.dfy(101,11): Error: possible division by zero
 Execution trace:
     (0,0): anon0
-Definedness.dfy(108,15): Error: possible division by zero
+Definedness.dfy(108,14): Error: possible division by zero
 Execution trace:
     Definedness.dfy(108,5): anon7_LoopHead
     (0,0): anon7_LoopBody
     Definedness.dfy(108,5): anon8_Else
-Definedness.dfy(117,23): Error: possible violation of function precondition
-Definedness.dfy(79,16): Related location
+Definedness.dfy(117,22): Error: possible violation of function precondition
+Definedness.dfy(79,15): Related location
 Execution trace:
     (0,0): anon0
     Definedness.dfy(116,5): anon12_LoopHead
     (0,0): anon12_LoopBody
     (0,0): anon13_Then
-Definedness.dfy(123,17): Error: possible violation of function precondition
-Definedness.dfy(79,16): Related location
+Definedness.dfy(123,16): Error: possible violation of function precondition
+Definedness.dfy(79,15): Related location
 Execution trace:
     (0,0): anon0
     Definedness.dfy(116,5): anon12_LoopHead
@@ -91,30 +91,30 @@ Execution trace:
     Definedness.dfy(122,5): anon15_LoopHead
     (0,0): anon15_LoopBody
     (0,0): anon16_Then
-Definedness.dfy(133,17): Error: possible violation of function precondition
-Definedness.dfy(79,16): Related location
+Definedness.dfy(133,16): Error: possible violation of function precondition
+Definedness.dfy(79,15): Related location
 Execution trace:
     (0,0): anon0
     Definedness.dfy(132,5): anon6_LoopHead
     (0,0): anon6_LoopBody
     (0,0): anon7_Then
-Definedness.dfy(133,22): Error BP5004: This loop invariant might not hold on entry.
+Definedness.dfy(133,21): Error BP5004: This loop invariant might not hold on entry.
 Execution trace:
     (0,0): anon0
-Definedness.dfy(134,17): Error: possible violation of function precondition
-Definedness.dfy(79,16): Related location
+Definedness.dfy(134,16): Error: possible violation of function precondition
+Definedness.dfy(79,15): Related location
 Execution trace:
     (0,0): anon0
     Definedness.dfy(132,5): anon6_LoopHead
     (0,0): anon6_LoopBody
     (0,0): anon7_Then
-Definedness.dfy(143,15): Error: possible division by zero
+Definedness.dfy(143,14): Error: possible division by zero
 Execution trace:
     (0,0): anon0
     Definedness.dfy(143,5): anon8_LoopHead
     (0,0): anon8_LoopBody
     Definedness.dfy(143,5): anon9_Else
-Definedness.dfy(162,15): Error: possible division by zero
+Definedness.dfy(162,14): Error: possible division by zero
 Execution trace:
     (0,0): anon0
     Definedness.dfy(156,5): anon16_LoopHead
@@ -126,11 +126,11 @@ Execution trace:
     Definedness.dfy(162,5): anon20_LoopHead
     (0,0): anon20_LoopBody
     Definedness.dfy(162,5): anon21_Else
-Definedness.dfy(175,28): Error BP5004: This loop invariant might not hold on entry.
+Definedness.dfy(175,27): Error BP5004: This loop invariant might not hold on entry.
 Execution trace:
     (0,0): anon0
-Definedness.dfy(181,17): Error: possible violation of function precondition
-Definedness.dfy(79,16): Related location
+Definedness.dfy(181,16): Error: possible violation of function precondition
+Definedness.dfy(79,15): Related location
 Execution trace:
     (0,0): anon0
     Definedness.dfy(173,5): anon18_LoopHead
@@ -142,32 +142,32 @@ Execution trace:
     (0,0): anon22_Then
     (0,0): anon23_Then
     (0,0): anon11
-Definedness.dfy(196,19): Error: possible division by zero
+Definedness.dfy(196,18): Error: possible division by zero
 Execution trace:
     (0,0): anon0
     Definedness.dfy(194,5): anon6_LoopHead
     (0,0): anon6_LoopBody
     (0,0): anon7_Then
-Definedness.dfy(196,23): Error BP5004: This loop invariant might not hold on entry.
+Definedness.dfy(196,22): Error BP5004: This loop invariant might not hold on entry.
 Execution trace:
     (0,0): anon0
-Definedness.dfy(196,28): Error: possible division by zero
+Definedness.dfy(196,27): Error: possible division by zero
 Execution trace:
     (0,0): anon0
     Definedness.dfy(194,5): anon6_LoopHead
     (0,0): anon6_LoopBody
     (0,0): anon7_Then
-Definedness.dfy(215,10): Error BP5003: A postcondition might not hold on this return path.
-Definedness.dfy(217,46): Related location: This is the postcondition that might not hold.
+Definedness.dfy(215,9): Error BP5003: A postcondition might not hold on this return path.
+Definedness.dfy(217,45): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-Definedness.dfy(224,22): Error: target object may be null
+Definedness.dfy(224,21): Error: target object may be null
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Then
-Definedness.dfy(237,10): Error BP5003: A postcondition might not hold on this return path.
-Definedness.dfy(240,24): Related location: This is the postcondition that might not hold.
+Definedness.dfy(237,9): Error BP5003: A postcondition might not hold on this return path.
+Definedness.dfy(240,23): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
diff --git a/Test/dafny0/DeterministicPick.dfy.expect b/Test/dafny0/DeterministicPick.dfy.expect
index 0999294e..aef97ebd 100644
--- a/Test/dafny0/DeterministicPick.dfy.expect
+++ b/Test/dafny0/DeterministicPick.dfy.expect
@@ -1,4 +1,4 @@
-DeterministicPick.dfy(13,5): Error: to be compilable, the value of a let-such-that expression must be uniquely determined
+DeterministicPick.dfy(13,4): Error: to be compilable, the value of a let-such-that expression must be uniquely determined
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
diff --git a/Test/dafny0/DiamondImports.dfy.expect b/Test/dafny0/DiamondImports.dfy.expect
index e9e8c2b9..1acca075 100644
--- a/Test/dafny0/DiamondImports.dfy.expect
+++ b/Test/dafny0/DiamondImports.dfy.expect
@@ -1,12 +1,12 @@
-DiamondImports.dfy(34,16): Error: assertion violation
+DiamondImports.dfy(34,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
-DiamondImports.dfy(50,16): Error: assertion violation
+DiamondImports.dfy(50,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
     (0,0): anon2
-DiamondImports.dfy(101,16): Error: assertion violation
+DiamondImports.dfy(101,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Then
@@ -14,7 +14,7 @@ Execution trace:
     (0,0): anon8_Then
     (0,0): anon9_Then
     (0,0): anon6
-DiamondImports.dfy(120,16): Error: assertion violation
+DiamondImports.dfy(120,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Then
@@ -25,7 +25,7 @@ Execution trace:
     (0,0): anon6
     (0,0): anon12_Then
     (0,0): anon8
-DiamondImports.dfy(140,26): Error: assertion violation
+DiamondImports.dfy(140,25): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/Fuel.dfy.expect b/Test/dafny0/Fuel.dfy.expect
index 4c180a9c..90fe877d 100644
--- a/Test/dafny0/Fuel.dfy.expect
+++ b/Test/dafny0/Fuel.dfy.expect
@@ -1,94 +1,94 @@
-Fuel.dfy(17,23): Error: assertion violation
+Fuel.dfy(17,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Fuel.dfy(65,28): Error: assertion violation
+Fuel.dfy(65,27): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Else
-Fuel.dfy(69,28): Error: assertion violation
+Fuel.dfy(69,27): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Then
     (0,0): anon7_Then
-Fuel.dfy(92,23): Error: assertion violation
+Fuel.dfy(92,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Fuel.dfy(94,23): Error: assertion violation
+Fuel.dfy(94,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Fuel.dfy(120,23): Error: assertion violation
+Fuel.dfy(120,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Fuel.dfy(122,23): Error: assertion violation
+Fuel.dfy(122,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Fuel.dfy(129,39): Error: assertion violation
+Fuel.dfy(129,38): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Fuel.dfy(132,27): Error: assertion violation
+Fuel.dfy(132,26): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-Fuel.dfy(133,27): Error: assertion violation
+Fuel.dfy(133,26): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-Fuel.dfy(157,23): Error: assertion violation
+Fuel.dfy(157,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Else
     (0,0): anon9
-Fuel.dfy(200,56): Error: assertion violation
+Fuel.dfy(200,55): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Fuel.dfy(245,23): Error: assertion violation
+Fuel.dfy(245,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Fuel.dfy(247,23): Error: assertion violation
+Fuel.dfy(247,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Fuel.dfy(280,27): Error: assertion violation
+Fuel.dfy(280,26): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Then
-Fuel.dfy(335,27): Error: possible violation of function precondition
-Fuel.dfy(324,22): Related location
+Fuel.dfy(335,26): Error: possible violation of function precondition
+Fuel.dfy(324,21): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Then
-Fuel.dfy(335,50): Error: destructor 't' can only be applied to datatype values constructed by 'VTuple'
+Fuel.dfy(335,49): Error: destructor 't' can only be applied to datatype values constructed by 'VTuple'
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Then
-Fuel.dfy(335,51): Error: index out of range
+Fuel.dfy(335,50): Error: index out of range
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Then
-Fuel.dfy(336,39): Error: index out of range
+Fuel.dfy(336,38): Error: index out of range
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Then
-Fuel.dfy(336,43): Error: destructor 'u' can only be applied to datatype values constructed by 'VUint64'
+Fuel.dfy(336,42): Error: destructor 'u' can only be applied to datatype values constructed by 'VUint64'
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Then
-Fuel.dfy(346,43): Error: destructor 'u' can only be applied to datatype values constructed by 'VUint64'
+Fuel.dfy(346,42): Error: destructor 'u' can only be applied to datatype values constructed by 'VUint64'
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Then
-Fuel.dfy(397,23): Error: assertion violation
+Fuel.dfy(397,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Fuel.dfy(398,23): Error: assertion violation
+Fuel.dfy(398,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Fuel.dfy(407,39): Error: assertion violation
+Fuel.dfy(407,38): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/FunctionSpecifications.dfy.expect b/Test/dafny0/FunctionSpecifications.dfy.expect
index 9f76313a..078afaef 100644
--- a/Test/dafny0/FunctionSpecifications.dfy.expect
+++ b/Test/dafny0/FunctionSpecifications.dfy.expect
@@ -1,5 +1,5 @@
-FunctionSpecifications.dfy(29,10): Error BP5003: A postcondition might not hold on this return path.
-FunctionSpecifications.dfy(31,13): Related location: This is the postcondition that might not hold.
+FunctionSpecifications.dfy(29,9): Error BP5003: A postcondition might not hold on this return path.
+FunctionSpecifications.dfy(31,12): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Else
@@ -7,64 +7,64 @@ Execution trace:
     (0,0): anon12_Then
     (0,0): anon13_Else
     (0,0): anon9
-FunctionSpecifications.dfy(38,10): Error BP5003: A postcondition might not hold on this return path.
-FunctionSpecifications.dfy(40,24): Related location: This is the postcondition that might not hold.
+FunctionSpecifications.dfy(38,9): Error BP5003: A postcondition might not hold on this return path.
+FunctionSpecifications.dfy(40,23): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon15_Else
     (0,0): anon18_Else
     (0,0): anon19_Then
     (0,0): anon14
-FunctionSpecifications.dfy(53,11): Error: cannot prove termination; try supplying a decreases clause
+FunctionSpecifications.dfy(53,10): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon11_Then
     (0,0): anon5
-FunctionSpecifications.dfy(59,10): Error BP5003: A postcondition might not hold on this return path.
-FunctionSpecifications.dfy(60,22): Related location: This is the postcondition that might not hold.
+FunctionSpecifications.dfy(59,9): Error BP5003: A postcondition might not hold on this return path.
+FunctionSpecifications.dfy(60,21): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
-FunctionSpecifications.dfy(108,23): Error: assertion violation
+FunctionSpecifications.dfy(108,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
-FunctionSpecifications.dfy(111,23): Error: assertion violation
+FunctionSpecifications.dfy(111,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
-FunctionSpecifications.dfy(126,27): Error: assertion violation
+FunctionSpecifications.dfy(126,26): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-FunctionSpecifications.dfy(130,27): Error: assertion violation
+FunctionSpecifications.dfy(130,26): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Else
-FunctionSpecifications.dfy(158,3): Error: cannot prove termination; try supplying a decreases clause
+FunctionSpecifications.dfy(158,2): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-FunctionSpecifications.dfy(167,11): Error: cannot prove termination; try supplying a decreases clause
+FunctionSpecifications.dfy(167,10): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-FunctionSpecifications.dfy(135,20): Error BP5003: A postcondition might not hold on this return path.
-FunctionSpecifications.dfy(137,29): Related location: This is the postcondition that might not hold.
+FunctionSpecifications.dfy(135,19): Error BP5003: A postcondition might not hold on this return path.
+FunctionSpecifications.dfy(137,28): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-FunctionSpecifications.dfy(146,3): Error: failure to decrease termination measure
+FunctionSpecifications.dfy(146,2): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-FunctionSpecifications.dfy(153,3): Error: failure to decrease termination measure
+FunctionSpecifications.dfy(153,2): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-FunctionSpecifications.dfy(174,3): Error: cannot prove termination; try supplying a decreases clause
+FunctionSpecifications.dfy(174,2): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-FunctionSpecifications.dfy(171,20): Error: cannot prove termination; try supplying a decreases clause
+FunctionSpecifications.dfy(171,19): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/IMaps.dfy.expect b/Test/dafny0/IMaps.dfy.expect
index c2da9505..28ca8ca3 100644
--- a/Test/dafny0/IMaps.dfy.expect
+++ b/Test/dafny0/IMaps.dfy.expect
@@ -1,4 +1,4 @@
-IMaps.dfy(52,8): Error: element may not be in domain
+IMaps.dfy(52,7): Error: element may not be in domain
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
diff --git a/Test/dafny0/Include.dfy.expect b/Test/dafny0/Include.dfy.expect
index 0921cec9..d4543afe 100644
--- a/Test/dafny0/Include.dfy.expect
+++ b/Test/dafny0/Include.dfy.expect
@@ -1,13 +1,13 @@
-Include.dfy(19,19): Error BP5003: A postcondition might not hold on this return path.
-Includee.dfy(17,20): Related location: This is the postcondition that might not hold.
+Include.dfy(19,18): Error BP5003: A postcondition might not hold on this return path.
+Includee.dfy(17,19): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-Includee.dfy[Concrete](22,16): Error: assertion violation
+Includee.dfy[Concrete](22,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Include.dfy(27,7): Error BP5003: A postcondition might not hold on this return path.
-Includee.dfy[Concrete](20,15): Related location: This is the postcondition that might not hold.
+Include.dfy(27,6): Error BP5003: A postcondition might not hold on this return path.
+Includee.dfy[Concrete](20,14): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Then
diff --git a/Test/dafny0/Includee.dfy.expect b/Test/dafny0/Includee.dfy.expect
index e0f0689c..ce61e32a 100644
--- a/Test/dafny0/Includee.dfy.expect
+++ b/Test/dafny0/Includee.dfy.expect
@@ -1,12 +1,12 @@
-Includee.dfy(21,3): Error BP5003: A postcondition might not hold on this return path.
-Includee.dfy(20,15): Related location: This is the postcondition that might not hold.
+Includee.dfy(21,2): Error BP5003: A postcondition might not hold on this return path.
+Includee.dfy(20,14): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-Includee.dfy(24,18): Error: assertion violation
+Includee.dfy(24,17): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Includee.dfy(6,1): Error BP5003: A postcondition might not hold on this return path.
-Includee.dfy(5,13): Related location: This is the postcondition that might not hold.
+Includee.dfy(6,0): Error BP5003: A postcondition might not hold on this return path.
+Includee.dfy(5,12): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/IndexIntoUpdate.dfy.expect b/Test/dafny0/IndexIntoUpdate.dfy.expect
index 3423a20b..2db3aa0a 100644
--- a/Test/dafny0/IndexIntoUpdate.dfy.expect
+++ b/Test/dafny0/IndexIntoUpdate.dfy.expect
@@ -1,4 +1,4 @@
-IndexIntoUpdate.dfy(7,19): Error: assertion violation
+IndexIntoUpdate.dfy(7,18): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
diff --git a/Test/dafny0/InductivePredicates.dfy.expect b/Test/dafny0/InductivePredicates.dfy.expect
index b09b7903..ccf30643 100644
--- a/Test/dafny0/InductivePredicates.dfy.expect
+++ b/Test/dafny0/InductivePredicates.dfy.expect
@@ -1,8 +1,8 @@
-InductivePredicates.dfy(64,10): Error: assertion violation
+InductivePredicates.dfy(64,9): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-InductivePredicates.dfy(76,11): Error: assertion violation
+InductivePredicates.dfy(76,10): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/Inverses.dfy.expect b/Test/dafny0/Inverses.dfy.expect
index a04f21dc..29c67e5d 100644
--- a/Test/dafny0/Inverses.dfy.expect
+++ b/Test/dafny0/Inverses.dfy.expect
@@ -1,10 +1,10 @@
-Inverses.dfy(70,1): Error BP5003: A postcondition might not hold on this return path.
-Inverses.dfy(69,11): Related location: This is the postcondition that might not hold.
+Inverses.dfy(70,0): Error BP5003: A postcondition might not hold on this return path.
+Inverses.dfy(69,10): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Else
-Inverses.dfy(83,1): Error BP5003: A postcondition might not hold on this return path.
-Inverses.dfy(82,11): Related location: This is the postcondition that might not hold.
+Inverses.dfy(83,0): Error BP5003: A postcondition might not hold on this return path.
+Inverses.dfy(82,10): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Else
diff --git a/Test/dafny0/Iterators.dfy.expect b/Test/dafny0/Iterators.dfy.expect
index f0c6e400..d9129e3e 100644
--- a/Test/dafny0/Iterators.dfy.expect
+++ b/Test/dafny0/Iterators.dfy.expect
@@ -1,55 +1,55 @@
-Iterators.dfy(251,10): Error: failure to decrease termination measure
+Iterators.dfy(251,9): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Else
     (0,0): anon6_Else
-Iterators.dfy(274,10): Error: failure to decrease termination measure
+Iterators.dfy(274,9): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Else
     (0,0): anon6_Else
-Iterators.dfy(284,32): Error: failure to decrease termination measure
+Iterators.dfy(284,31): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
-Iterators.dfy(296,10): Error: cannot prove termination; try supplying a decreases clause
+Iterators.dfy(296,9): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Else
     (0,0): anon6_Else
-Iterators.dfy(317,10): Error: cannot prove termination; try supplying a decreases clause
+Iterators.dfy(317,9): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Else
     (0,0): anon6_Else
-Iterators.dfy(326,32): Error: cannot prove termination; try supplying a decreases clause
+Iterators.dfy(326,31): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-Iterators.dfy(343,10): Error: failure to decrease termination measure
+Iterators.dfy(343,9): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Else
     (0,0): anon6_Else
-Iterators.dfy(353,32): Error: cannot prove termination; try supplying a decreases clause
+Iterators.dfy(353,31): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
-Iterators.dfy(370,10): Error: failure to decrease termination measure
+Iterators.dfy(370,9): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Else
     (0,0): anon6_Else
-Iterators.dfy(103,22): Error: assertion violation
+Iterators.dfy(103,21): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Iterators.dfy(106,14): Error: assertion violation
+Iterators.dfy(106,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Then
     (0,0): anon3
-Iterators.dfy(177,28): Error: assertion violation
+Iterators.dfy(177,27): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon15_Then
-Iterators.dfy(208,7): Error: an assignment to _new is only allowed to shrink the set
+Iterators.dfy(208,6): Error: an assignment to _new is only allowed to shrink the set
 Execution trace:
     (0,0): anon0
     Iterators.dfy(197,3): anon16_LoopHead
@@ -57,7 +57,7 @@ Execution trace:
     Iterators.dfy(197,3): anon17_Else
     Iterators.dfy(197,3): anon19_Else
     (0,0): anon20_Then
-Iterators.dfy(212,21): Error: assertion violation
+Iterators.dfy(212,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     Iterators.dfy(197,3): anon16_LoopHead
@@ -65,8 +65,8 @@ Execution trace:
     Iterators.dfy(197,3): anon17_Else
     Iterators.dfy(197,3): anon19_Else
     (0,0): anon21_Then
-Iterators.dfy(40,22): Error BP5002: A precondition for this call might not hold.
-Iterators.dfy(4,10): Related location: This is the precondition that might not hold.
+Iterators.dfy(40,21): Error BP5002: A precondition for this call might not hold.
+Iterators.dfy(4,9): Related location: This is the precondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon35_Then
@@ -74,24 +74,24 @@ Execution trace:
     (0,0): anon36_Then
     (0,0): anon5
     (0,0): anon37_Then
-Iterators.dfy(89,14): Error: assertion violation
+Iterators.dfy(89,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Iterators.dfy(119,16): Error: assertion violation
+Iterators.dfy(119,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Else
-Iterators.dfy(150,16): Error: assertion violation
+Iterators.dfy(150,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-Iterators.dfy(155,24): Error BP5002: A precondition for this call might not hold.
-Iterators.dfy(125,10): Related location: This is the precondition that might not hold.
+Iterators.dfy(155,23): Error BP5002: A precondition for this call might not hold.
+Iterators.dfy(125,9): Related location: This is the precondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Then
     (0,0): anon3
-Iterators.dfy(234,21): Error: assertion violation
+Iterators.dfy(234,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     Iterators.dfy(225,3): anon14_LoopHead
diff --git a/Test/dafny0/LetExpr.dfy.expect b/Test/dafny0/LetExpr.dfy.expect
index 66dc2764..f0f51274 100644
--- a/Test/dafny0/LetExpr.dfy.expect
+++ b/Test/dafny0/LetExpr.dfy.expect
@@ -1,35 +1,35 @@
-LetExpr.dfy(109,23): Error: assertion violation
+LetExpr.dfy(109,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon11_Then
-LetExpr.dfy(9,12): Error: assertion violation
+LetExpr.dfy(9,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
-LetExpr.dfy(254,19): Error: value assigned to a nat must be non-negative
+LetExpr.dfy(254,18): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
-LetExpr.dfy(257,19): Error: value assigned to a nat must be non-negative
+LetExpr.dfy(257,18): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Then
-LetExpr.dfy(259,24): Error: value assigned to a nat must be non-negative
+LetExpr.dfy(259,23): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Else
-LetExpr.dfy(288,14): Error: RHS is not certain to look like the pattern 'Agnes'
+LetExpr.dfy(288,13): Error: RHS is not certain to look like the pattern 'Agnes'
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Else
-LetExpr.dfy(305,42): Error: value assigned to a nat must be non-negative
+LetExpr.dfy(305,41): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
-LetExpr.dfy(307,12): Error: assertion violation
+LetExpr.dfy(307,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
-LetExpr.dfy(317,12): Error: to be compilable, the value of a let-such-that expression must be uniquely determined
+LetExpr.dfy(317,11): Error: to be compilable, the value of a let-such-that expression must be uniquely determined
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Then
diff --git a/Test/dafny0/LhsDuplicates.dfy.expect b/Test/dafny0/LhsDuplicates.dfy.expect
index a864390f..d6689047 100644
--- a/Test/dafny0/LhsDuplicates.dfy.expect
+++ b/Test/dafny0/LhsDuplicates.dfy.expect
@@ -1,27 +1,27 @@
-LhsDuplicates.dfy(18,10): Error: left-hand sides for different forall-statement bound variables may refer to the same location
+LhsDuplicates.dfy(18,9): Error: left-hand sides for different forall-statement bound variables may refer to the same location
 Execution trace:
     (0,0): anon0
     (0,0): anon16_Else
     (0,0): anon18_Else
     (0,0): anon21_Then
     (0,0): anon13
-LhsDuplicates.dfy(34,12): Error: left-hand sides for different forall-statement bound variables may refer to the same location
+LhsDuplicates.dfy(34,11): Error: left-hand sides for different forall-statement bound variables may refer to the same location
 Execution trace:
     (0,0): anon0
     (0,0): anon16_Else
     (0,0): anon18_Else
     (0,0): anon21_Then
     (0,0): anon13
-LhsDuplicates.dfy(42,12): Error: when left-hand sides 1 and 3 refer to the same location, they must be assigned the same value
+LhsDuplicates.dfy(42,11): Error: when left-hand sides 1 and 3 refer to the same location, they must be assigned the same value
 Execution trace:
     (0,0): anon0
-LhsDuplicates.dfy(51,18): Error: when left-hand sides 0 and 2 refer to the same location, they must be assigned the same value
+LhsDuplicates.dfy(51,17): Error: when left-hand sides 0 and 2 refer to the same location, they must be assigned the same value
 Execution trace:
     (0,0): anon0
-LhsDuplicates.dfy(60,16): Error: when left-hand sides 1 and 2 may refer to the same location, they must be assigned the same value
+LhsDuplicates.dfy(60,15): Error: when left-hand sides 1 and 2 may refer to the same location, they must be assigned the same value
 Execution trace:
     (0,0): anon0
-LhsDuplicates.dfy(69,20): Error: when left-hand sides 1 and 2 refer to the same location, they must be assigned the same value
+LhsDuplicates.dfy(69,19): Error: when left-hand sides 1 and 2 refer to the same location, they must be assigned the same value
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/LoopModifies.dfy.expect b/Test/dafny0/LoopModifies.dfy.expect
index 682975fb..a7ded8a4 100644
--- a/Test/dafny0/LoopModifies.dfy.expect
+++ b/Test/dafny0/LoopModifies.dfy.expect
@@ -1,38 +1,38 @@
-LoopModifies.dfy(8,5): Error: assignment may update an array element not in the enclosing context's modifies clause
+LoopModifies.dfy(8,4): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
-LoopModifies.dfy(19,8): Error: assignment may update an array element not in the enclosing context's modifies clause
+LoopModifies.dfy(19,7): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
     LoopModifies.dfy(16,4): anon8_LoopHead
     (0,0): anon8_LoopBody
     LoopModifies.dfy(16,4): anon9_Else
     LoopModifies.dfy(16,4): anon11_Else
-LoopModifies.dfy(48,8): Error: assignment may update an array element not in the enclosing context's modifies clause
+LoopModifies.dfy(48,7): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
     LoopModifies.dfy(44,4): anon8_LoopHead
     (0,0): anon8_LoopBody
     LoopModifies.dfy(44,4): anon9_Else
     LoopModifies.dfy(44,4): anon11_Else
-LoopModifies.dfy(63,8): Error: assignment may update an array element not in the enclosing context's modifies clause
+LoopModifies.dfy(63,7): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
     LoopModifies.dfy(59,4): anon9_LoopHead
     (0,0): anon9_LoopBody
     LoopModifies.dfy(59,4): anon10_Else
     LoopModifies.dfy(59,4): anon12_Else
-LoopModifies.dfy(76,4): Error: loop modifies clause may violate context's modifies clause
+LoopModifies.dfy(76,3): Error: loop modifies clause may violate context's modifies clause
 Execution trace:
     (0,0): anon0
-LoopModifies.dfy(100,8): Error: assignment may update an array element not in the enclosing context's modifies clause
+LoopModifies.dfy(100,7): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
     LoopModifies.dfy(92,4): anon8_LoopHead
     (0,0): anon8_LoopBody
     LoopModifies.dfy(92,4): anon9_Else
     LoopModifies.dfy(92,4): anon11_Else
-LoopModifies.dfy(148,11): Error: assignment may update an array element not in the enclosing context's modifies clause
+LoopModifies.dfy(148,10): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
     LoopModifies.dfy(136,4): anon17_LoopHead
@@ -43,14 +43,14 @@ Execution trace:
     (0,0): anon21_LoopBody
     LoopModifies.dfy(141,7): anon22_Else
     LoopModifies.dfy(141,7): anon24_Else
-LoopModifies.dfy(199,10): Error: assignment may update an array element not in the enclosing context's modifies clause
+LoopModifies.dfy(199,9): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
     LoopModifies.dfy(195,4): anon8_LoopHead
     (0,0): anon8_LoopBody
     LoopModifies.dfy(195,4): anon9_Else
     LoopModifies.dfy(195,4): anon11_Else
-LoopModifies.dfy(287,13): Error: assignment may update an array element not in the enclosing context's modifies clause
+LoopModifies.dfy(287,12): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
     LoopModifies.dfy(275,4): anon16_LoopHead
diff --git a/Test/dafny0/Maps.dfy.expect b/Test/dafny0/Maps.dfy.expect
index f46549dd..8b4a6a36 100644
--- a/Test/dafny0/Maps.dfy.expect
+++ b/Test/dafny0/Maps.dfy.expect
@@ -1,7 +1,7 @@
-Maps.dfy(78,8): Error: element may not be in domain
+Maps.dfy(78,7): Error: element may not be in domain
 Execution trace:
     (0,0): anon0
-Maps.dfy(128,13): Error: assertion violation
+Maps.dfy(128,12): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/ModifyStmt.dfy.expect b/Test/dafny0/ModifyStmt.dfy.expect
index 4ea872e0..019453d1 100644
--- a/Test/dafny0/ModifyStmt.dfy.expect
+++ b/Test/dafny0/ModifyStmt.dfy.expect
@@ -1,19 +1,19 @@
-ModifyStmt.dfy(27,14): Error: assertion violation
+ModifyStmt.dfy(27,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
-ModifyStmt.dfy(42,5): Error: modify statement may violate context's modifies clause
+ModifyStmt.dfy(42,4): Error: modify statement may violate context's modifies clause
 Execution trace:
     (0,0): anon0
-ModifyStmt.dfy(48,5): Error: modify statement may violate context's modifies clause
+ModifyStmt.dfy(48,4): Error: modify statement may violate context's modifies clause
 Execution trace:
     (0,0): anon0
-ModifyStmt.dfy(61,5): Error: modify statement may violate context's modifies clause
+ModifyStmt.dfy(61,4): Error: modify statement may violate context's modifies clause
 Execution trace:
     (0,0): anon0
-ModifyStmt.dfy(70,14): Error: assertion violation
+ModifyStmt.dfy(70,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
-ModifyStmt.dfy(89,14): Error: assertion violation
+ModifyStmt.dfy(89,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Then
@@ -22,20 +22,20 @@ Execution trace:
     ModifyStmt.dfy(81,7): anon11_Else
     (0,0): anon12_Then
     (0,0): anon8
-ModifyStmt.dfy(99,14): Error: assertion violation
+ModifyStmt.dfy(99,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
-ModifyStmt.dfy(110,14): Error: assertion violation
+ModifyStmt.dfy(110,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
-ModifyStmt.dfy(122,16): Error: assertion violation
+ModifyStmt.dfy(122,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-ModifyStmt.dfy(134,7): Error: assignment may update an object not in the enclosing context's modifies clause
+ModifyStmt.dfy(134,6): Error: assignment may update an object not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
-ModifyStmt.dfy(172,15): Error: assertion violation
+ModifyStmt.dfy(172,14): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/Modules0.dfy.expect b/Test/dafny0/Modules0.dfy.expect
index c63ed937..e4b46cce 100644
--- a/Test/dafny0/Modules0.dfy.expect
+++ b/Test/dafny0/Modules0.dfy.expect
@@ -1,5 +1,5 @@
-Modules0.dfy(333,3): warning: module-level functions are always non-instance, so the 'static' keyword is not allowed here
-Modules0.dfy(335,3): warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Modules0.dfy(333,2): Warning: module-level functions are always non-instance, so the 'static' keyword is not allowed here
+Modules0.dfy(335,2): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 Modules0.dfy(8,8): Error: Duplicate name of top-level declaration: WazzupA
 Modules0.dfy(9,11): Error: Duplicate name of top-level declaration: WazzupA
 Modules0.dfy(10,7): Error: Duplicate name of top-level declaration: WazzupA
diff --git a/Test/dafny0/Modules1.dfy.expect b/Test/dafny0/Modules1.dfy.expect
index 342b5808..feddf46a 100644
--- a/Test/dafny0/Modules1.dfy.expect
+++ b/Test/dafny0/Modules1.dfy.expect
@@ -1,20 +1,20 @@
-Modules1.dfy(79,16): Error: assertion violation
+Modules1.dfy(79,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-Modules1.dfy(92,16): Error: assertion violation
+Modules1.dfy(92,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-Modules1.dfy(94,18): Error: assertion violation
+Modules1.dfy(94,17): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Else
-Modules1.dfy(56,9): Error: decreases expression must be bounded below by 0
-Modules1.dfy(54,13): Related location
+Modules1.dfy(56,8): Error: decreases expression must be bounded below by 0
+Modules1.dfy(54,12): Related location
 Execution trace:
     (0,0): anon0
-Modules1.dfy(62,9): Error: failure to decrease termination measure
+Modules1.dfy(62,8): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/MultiDimArray.dfy.expect b/Test/dafny0/MultiDimArray.dfy.expect
index 597ade30..f2bf74de 100644
--- a/Test/dafny0/MultiDimArray.dfy.expect
+++ b/Test/dafny0/MultiDimArray.dfy.expect
@@ -1,9 +1,9 @@
-MultiDimArray.dfy(56,21): Error: assertion violation
+MultiDimArray.dfy(56,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon11_Then
     (0,0): anon12_Then
-MultiDimArray.dfy(83,25): Error: assertion violation
+MultiDimArray.dfy(83,24): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
diff --git a/Test/dafny0/MultiSets.dfy.expect b/Test/dafny0/MultiSets.dfy.expect
index 30534b11..aed70bd2 100644
--- a/Test/dafny0/MultiSets.dfy.expect
+++ b/Test/dafny0/MultiSets.dfy.expect
@@ -1,24 +1,24 @@
-MultiSets.dfy(159,3): Error BP5003: A postcondition might not hold on this return path.
-MultiSets.dfy(158,15): Related location: This is the postcondition that might not hold.
+MultiSets.dfy(159,2): Error BP5003: A postcondition might not hold on this return path.
+MultiSets.dfy(158,14): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-MultiSets.dfy(165,3): Error BP5003: A postcondition might not hold on this return path.
-MultiSets.dfy(164,15): Related location: This is the postcondition that might not hold.
+MultiSets.dfy(165,2): Error BP5003: A postcondition might not hold on this return path.
+MultiSets.dfy(164,14): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-MultiSets.dfy(178,11): Error: new number of occurrences might be negative
+MultiSets.dfy(178,10): Error: new number of occurrences might be negative
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Then
     (0,0): anon3
-MultiSets.dfy(269,24): Error: assertion violation
+MultiSets.dfy(269,23): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon11_Then
     (0,0): anon3
     (0,0): anon12_Then
     (0,0): anon14_Else
-MultiSets.dfy(292,16): Error: assertion violation
+MultiSets.dfy(292,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon8_Then
diff --git a/Test/dafny0/NatTypes.dfy.expect b/Test/dafny0/NatTypes.dfy.expect
index 5af90253..2bc00e95 100644
--- a/Test/dafny0/NatTypes.dfy.expect
+++ b/Test/dafny0/NatTypes.dfy.expect
@@ -1,41 +1,41 @@
-NatTypes.dfy(35,12): Error: value assigned to a nat must be non-negative
+NatTypes.dfy(35,11): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
     NatTypes.dfy(23,5): anon10_LoopHead
     (0,0): anon10_LoopBody
     NatTypes.dfy(23,5): anon11_Else
     (0,0): anon12_Then
-NatTypes.dfy(10,5): Error: value assigned to a nat must be non-negative
+NatTypes.dfy(10,4): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
-NatTypes.dfy(43,14): Error: assertion violation
+NatTypes.dfy(43,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Then
-NatTypes.dfy(45,14): Error: assertion violation
+NatTypes.dfy(45,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Then
-NatTypes.dfy(62,16): Error: assertion violation
+NatTypes.dfy(62,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-NatTypes.dfy(76,16): Error: assertion violation
+NatTypes.dfy(76,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Else
     (0,0): anon6_Then
-NatTypes.dfy(94,22): Error: value assigned to a nat must be non-negative
+NatTypes.dfy(94,21): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-NatTypes.dfy(109,45): Error: value assigned to a nat must be non-negative
+NatTypes.dfy(109,44): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
     (0,0): anon8_Else
     (0,0): anon9_Else
     (0,0): anon10_Then
-NatTypes.dfy(132,35): Error: value assigned to a nat must be non-negative
+NatTypes.dfy(132,34): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Then
diff --git a/Test/dafny0/Newtypes.dfy.expect b/Test/dafny0/Newtypes.dfy.expect
index 8e6ff4c5..425ee9a9 100644
--- a/Test/dafny0/Newtypes.dfy.expect
+++ b/Test/dafny0/Newtypes.dfy.expect
@@ -1,54 +1,54 @@
-Newtypes.dfy(74,11): Error: cannot find witness that shows type is inhabited (sorry, for now, only tried 0)
+Newtypes.dfy(74,10): Error: cannot find witness that shows type is inhabited (sorry, for now, only tried 0)
 Execution trace:
     (0,0): anon0
-Newtypes.dfy(76,45): Error: possible division by zero
+Newtypes.dfy(76,44): Error: possible division by zero
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-Newtypes.dfy(87,14): Error: result of operation might violate newtype constraint
+Newtypes.dfy(87,13): Error: result of operation might violate newtype constraint
 Execution trace:
     (0,0): anon0
-Newtypes.dfy(95,12): Error: result of operation might violate newtype constraint
+Newtypes.dfy(95,11): Error: result of operation might violate newtype constraint
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-Newtypes.dfy(97,14): Error: result of operation might violate newtype constraint
+Newtypes.dfy(97,13): Error: result of operation might violate newtype constraint
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Else
-Newtypes.dfy(104,16): Error: result of operation might violate newtype constraint
+Newtypes.dfy(104,15): Error: result of operation might violate newtype constraint
 Execution trace:
     (0,0): anon0
-Newtypes.dfy(177,14): Error: result of operation might violate newtype constraint
+Newtypes.dfy(177,13): Error: result of operation might violate newtype constraint
 Execution trace:
     (0,0): anon0
-Newtypes.dfy(193,64): Error: index 0 out of range
+Newtypes.dfy(193,63): Error: index 0 out of range
 Execution trace:
     (0,0): anon0
     (0,0): anon32_Then
     (0,0): anon33_Then
     (0,0): anon16
-Newtypes.dfy(194,67): Error: index 1 out of range
+Newtypes.dfy(194,66): Error: index 1 out of range
 Execution trace:
     (0,0): anon0
     (0,0): anon34_Then
     (0,0): anon35_Then
     (0,0): anon19
-Newtypes.dfy(222,16): Error: new number of occurrences might be negative
+Newtypes.dfy(222,15): Error: new number of occurrences might be negative
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Then
-Newtypes.dfy(225,40): Error: result of operation might violate newtype constraint
+Newtypes.dfy(225,39): Error: result of operation might violate newtype constraint
 Execution trace:
     (0,0): anon0
     (0,0): anon8_Then
-Newtypes.dfy(237,19): Error: result of operation might violate newtype constraint
+Newtypes.dfy(237,18): Error: result of operation might violate newtype constraint
 Execution trace:
     (0,0): anon0
     Newtypes.dfy(236,5): anon9_LoopHead
     (0,0): anon9_LoopBody
     (0,0): anon10_Then
-Newtypes.dfy(277,19): Error: result of operation might violate newtype constraint
+Newtypes.dfy(277,18): Error: result of operation might violate newtype constraint
 Execution trace:
     (0,0): anon0
     Newtypes.dfy(276,5): anon9_LoopHead
diff --git a/Test/dafny0/OpaqueFunctions.dfy.expect b/Test/dafny0/OpaqueFunctions.dfy.expect
index 2fb1701f..e9f6e60c 100644
--- a/Test/dafny0/OpaqueFunctions.dfy.expect
+++ b/Test/dafny0/OpaqueFunctions.dfy.expect
@@ -1,86 +1,86 @@
-OpaqueFunctions.dfy(27,16): Error: assertion violation
+OpaqueFunctions.dfy(27,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
-OpaqueFunctions.dfy(52,8): Error BP5002: A precondition for this call might not hold.
-OpaqueFunctions.dfy(24,16): Related location: This is the precondition that might not hold.
+OpaqueFunctions.dfy(52,7): Error BP5002: A precondition for this call might not hold.
+OpaqueFunctions.dfy(24,15): Related location: This is the precondition that might not hold.
 Execution trace:
     (0,0): anon0
-OpaqueFunctions.dfy(58,20): Error: assertion violation
+OpaqueFunctions.dfy(58,19): Error: assertion violation
 Execution trace:
     (0,0): anon0
-OpaqueFunctions.dfy(60,21): Error: assertion violation
+OpaqueFunctions.dfy(60,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
-OpaqueFunctions.dfy(63,21): Error: assertion violation
+OpaqueFunctions.dfy(63,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Then
-OpaqueFunctions.dfy(66,21): Error: assertion violation
+OpaqueFunctions.dfy(66,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Else
-OpaqueFunctions.dfy(77,21): Error: assertion violation
+OpaqueFunctions.dfy(77,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-OpaqueFunctions.dfy(79,10): Error BP5002: A precondition for this call might not hold.
-OpaqueFunctions.dfy[A'](24,16): Related location: This is the precondition that might not hold.
+OpaqueFunctions.dfy(79,9): Error BP5002: A precondition for this call might not hold.
+OpaqueFunctions.dfy[A'](24,15): Related location: This is the precondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Else
-OpaqueFunctions.dfy(86,20): Error: assertion violation
+OpaqueFunctions.dfy(86,19): Error: assertion violation
 Execution trace:
     (0,0): anon0
-OpaqueFunctions.dfy(88,21): Error: assertion violation
+OpaqueFunctions.dfy(88,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
-OpaqueFunctions.dfy(91,21): Error: assertion violation
+OpaqueFunctions.dfy(91,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Then
-OpaqueFunctions.dfy(94,21): Error: assertion violation
+OpaqueFunctions.dfy(94,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Else
-OpaqueFunctions.dfy(105,21): Error: assertion violation
+OpaqueFunctions.dfy(105,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-OpaqueFunctions.dfy(107,10): Error BP5002: A precondition for this call might not hold.
-OpaqueFunctions.dfy[A'](24,16): Related location: This is the precondition that might not hold.
+OpaqueFunctions.dfy(107,9): Error BP5002: A precondition for this call might not hold.
+OpaqueFunctions.dfy[A'](24,15): Related location: This is the precondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Else
-OpaqueFunctions.dfy(114,20): Error: assertion violation
+OpaqueFunctions.dfy(114,19): Error: assertion violation
 Execution trace:
     (0,0): anon0
-OpaqueFunctions.dfy(116,21): Error: assertion violation
+OpaqueFunctions.dfy(116,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
-OpaqueFunctions.dfy(119,21): Error: assertion violation
+OpaqueFunctions.dfy(119,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Then
-OpaqueFunctions.dfy(122,21): Error: assertion violation
+OpaqueFunctions.dfy(122,20): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Else
-OpaqueFunctions.dfy(138,13): Error: assertion violation
+OpaqueFunctions.dfy(138,12): Error: assertion violation
 Execution trace:
     (0,0): anon0
-OpaqueFunctions.dfy(202,12): Error: assertion violation
+OpaqueFunctions.dfy(202,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
-OpaqueFunctions.dfy(218,12): Error: assertion violation
+OpaqueFunctions.dfy(218,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
-OpaqueFunctions.dfy(170,16): Error: assertion violation
+OpaqueFunctions.dfy(170,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
-OpaqueFunctions.dfy(185,20): Error: assertion violation
+OpaqueFunctions.dfy(185,19): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/Parallel.dfy.expect b/Test/dafny0/Parallel.dfy.expect
index db551bba..5d9b044f 100644
--- a/Test/dafny0/Parallel.dfy.expect
+++ b/Test/dafny0/Parallel.dfy.expect
@@ -1,9 +1,9 @@
-Parallel.dfy(297,22): Error: assertion violation
+Parallel.dfy(297,21): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-Parallel.dfy(34,10): Error BP5002: A precondition for this call might not hold.
-Parallel.dfy(60,14): Related location: This is the precondition that might not hold.
+Parallel.dfy(34,9): Error BP5002: A precondition for this call might not hold.
+Parallel.dfy(60,13): Related location: This is the precondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon29_Else
@@ -12,7 +12,7 @@ Execution trace:
     (0,0): anon34_Then
     (0,0): anon35_Then
     (0,0): anon14
-Parallel.dfy(38,5): Error: target object may be null
+Parallel.dfy(38,4): Error: target object may be null
 Execution trace:
     (0,0): anon0
     (0,0): anon29_Else
@@ -22,7 +22,7 @@ Execution trace:
     (0,0): anon37_Then
     (0,0): anon38_Then
     (0,0): anon20
-Parallel.dfy(42,18): Error: possible violation of postcondition of forall statement
+Parallel.dfy(42,17): Error: possible violation of postcondition of forall statement
 Execution trace:
     (0,0): anon0
     (0,0): anon29_Else
@@ -32,7 +32,7 @@ Execution trace:
     (0,0): anon39_Then
     (0,0): anon40_Then
     (0,0): anon26
-Parallel.dfy(47,19): Error: assertion violation
+Parallel.dfy(47,18): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon29_Else
@@ -41,24 +41,24 @@ Execution trace:
     (0,0): anon36_Else
     (0,0): anon39_Then
     (0,0): anon40_Then
-Parallel.dfy(93,19): Error: assertion violation
+Parallel.dfy(93,18): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Else
     (0,0): anon11_Then
-Parallel.dfy(99,20): Error: possible violation of postcondition of forall statement
+Parallel.dfy(99,19): Error: possible violation of postcondition of forall statement
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Else
     (0,0): anon11_Then
     (0,0): anon12_Then
-Parallel.dfy(122,12): Error: value assigned to a nat must be non-negative
+Parallel.dfy(122,11): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Then
     (0,0): anon7_Then
     (0,0): anon3
-Parallel.dfy(185,12): Error: left-hand sides for different forall-statement bound variables may refer to the same location
+Parallel.dfy(185,11): Error: left-hand sides for different forall-statement bound variables may refer to the same location
 Execution trace:
     (0,0): anon0
     (0,0): anon19_Then
diff --git a/Test/dafny0/ParseErrors.dfy.expect b/Test/dafny0/ParseErrors.dfy.expect
index 30898479..660ed926 100644
--- a/Test/dafny0/ParseErrors.dfy.expect
+++ b/Test/dafny0/ParseErrors.dfy.expect
@@ -1,17 +1,17 @@
-ParseErrors.dfy(7,19): error: a chain cannot have more than one != operator
-ParseErrors.dfy(9,37): error: this operator chain cannot continue with a descending operator
-ParseErrors.dfy(10,38): error: this operator chain cannot continue with an ascending operator
-ParseErrors.dfy(15,24): error: this operator chain cannot continue with a descending operator
-ParseErrors.dfy(18,18): error: this operator cannot be part of a chain
-ParseErrors.dfy(19,19): error: this operator cannot be part of a chain
-ParseErrors.dfy(20,18): error: this operator cannot be part of a chain
-ParseErrors.dfy(21,18): error: chaining not allowed from the previous operator
-ParseErrors.dfy(28,19): error: chaining not allowed from the previous operator
-ParseErrors.dfy(31,20): error: can only chain disjoint (!!) with itself.
-ParseErrors.dfy(58,8): error: the main operator of a calculation must be transitive
-ParseErrors.dfy(74,2): error: this operator cannot continue this calculation
-ParseErrors.dfy(75,2): error: this operator cannot continue this calculation
-ParseErrors.dfy(80,2): error: this operator cannot continue this calculation
-ParseErrors.dfy(81,2): error: this operator cannot continue this calculation
-ParseErrors.dfy(87,2): error: this operator cannot continue this calculation
+ParseErrors.dfy(7,18): Error: a chain cannot have more than one != operator
+ParseErrors.dfy(9,36): Error: this operator chain cannot continue with a descending operator
+ParseErrors.dfy(10,37): Error: this operator chain cannot continue with an ascending operator
+ParseErrors.dfy(15,23): Error: this operator chain cannot continue with a descending operator
+ParseErrors.dfy(18,17): Error: this operator cannot be part of a chain
+ParseErrors.dfy(19,18): Error: this operator cannot be part of a chain
+ParseErrors.dfy(20,17): Error: this operator cannot be part of a chain
+ParseErrors.dfy(21,17): Error: chaining not allowed from the previous operator
+ParseErrors.dfy(28,18): Error: chaining not allowed from the previous operator
+ParseErrors.dfy(31,19): Error: can only chain disjoint (!!) with itself.
+ParseErrors.dfy(58,7): Error: the main operator of a calculation must be transitive
+ParseErrors.dfy(74,1): Error: this operator cannot continue this calculation
+ParseErrors.dfy(75,1): Error: this operator cannot continue this calculation
+ParseErrors.dfy(80,1): Error: this operator cannot continue this calculation
+ParseErrors.dfy(81,1): Error: this operator cannot continue this calculation
+ParseErrors.dfy(87,1): Error: this operator cannot continue this calculation
 16 parse errors detected in ParseErrors.dfy
diff --git a/Test/dafny0/PredExpr.dfy.expect b/Test/dafny0/PredExpr.dfy.expect
index 18d5d73f..80f311cb 100644
--- a/Test/dafny0/PredExpr.dfy.expect
+++ b/Test/dafny0/PredExpr.dfy.expect
@@ -1,16 +1,16 @@
-PredExpr.dfy(7,12): Error: assertion violation
+PredExpr.dfy(7,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-PredExpr.dfy(39,15): Error: value assigned to a nat must be non-negative
+PredExpr.dfy(39,14): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Else
-PredExpr.dfy(52,17): Error: assertion violation
+PredExpr.dfy(52,16): Error: assertion violation
 Execution trace:
     (0,0): anon0
-PredExpr.dfy(77,14): Error: assertion violation
+PredExpr.dfy(77,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon8_Else
diff --git a/Test/dafny0/Predicates.dfy.expect b/Test/dafny0/Predicates.dfy.expect
index dac4eb3c..2d7ea6f1 100644
--- a/Test/dafny0/Predicates.dfy.expect
+++ b/Test/dafny0/Predicates.dfy.expect
@@ -1,26 +1,26 @@
-Predicates.dfy[B](21,5): Error BP5003: A postcondition might not hold on this return path.
-Predicates.dfy[B](20,15): Related location: This is the postcondition that might not hold.
-Predicates.dfy(31,9): Related location
+Predicates.dfy[B](21,4): Error BP5003: A postcondition might not hold on this return path.
+Predicates.dfy[B](20,14): Related location: This is the postcondition that might not hold.
+Predicates.dfy(31,8): Related location
 Execution trace:
     (0,0): anon0
-Predicates.dfy(88,16): Error: assertion violation
+Predicates.dfy(88,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Predicates.dfy(92,14): Error: assertion violation
+Predicates.dfy(92,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Predicates.dfy[Tricky_Full](126,5): Error BP5003: A postcondition might not hold on this return path.
-Predicates.dfy[Tricky_Full](125,15): Related location: This is the postcondition that might not hold.
-Predicates.dfy(136,7): Related location
-Predicates.dfy[Tricky_Full](116,9): Related location
+Predicates.dfy[Tricky_Full](126,4): Error BP5003: A postcondition might not hold on this return path.
+Predicates.dfy[Tricky_Full](125,14): Related location: This is the postcondition that might not hold.
+Predicates.dfy(136,6): Related location
+Predicates.dfy[Tricky_Full](116,8): Related location
 Execution trace:
     (0,0): anon0
-Predicates.dfy(164,5): Error BP5003: A postcondition might not hold on this return path.
-Predicates.dfy(163,15): Related location: This is the postcondition that might not hold.
+Predicates.dfy(164,4): Error BP5003: A postcondition might not hold on this return path.
+Predicates.dfy(163,14): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-Predicates.dfy[Q1](154,5): Error BP5003: A postcondition might not hold on this return path.
-Predicates.dfy[Q1](153,15): Related location: This is the postcondition that might not hold.
+Predicates.dfy[Q1](154,4): Error BP5003: A postcondition might not hold on this return path.
+Predicates.dfy[Q1](153,14): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/Protected.dfy.expect b/Test/dafny0/Protected.dfy.expect
index d50f2dd5..6796e847 100644
--- a/Test/dafny0/Protected.dfy.expect
+++ b/Test/dafny0/Protected.dfy.expect
@@ -1,20 +1,20 @@
-Protected.dfy(17,20): Error: assertion violation
+Protected.dfy(17,19): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Then
-Protected.dfy(31,18): Error: assertion violation
+Protected.dfy(31,17): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon12_Then
     (0,0): anon6
     (0,0): anon13_Else
-Protected.dfy(35,16): Error: assertion violation
+Protected.dfy(35,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Protected.dfy(48,20): Error: assertion violation
+Protected.dfy(48,19): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Protected.dfy(55,20): Error: assertion violation
+Protected.dfy(55,19): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/RankNeg.dfy.expect b/Test/dafny0/RankNeg.dfy.expect
index b2686b43..33cd4f1e 100644
--- a/Test/dafny0/RankNeg.dfy.expect
+++ b/Test/dafny0/RankNeg.dfy.expect
@@ -1,19 +1,19 @@
-RankNeg.dfy(10,26): Error: cannot prove termination; try supplying a decreases clause
+RankNeg.dfy(10,25): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Then
-RankNeg.dfy(15,28): Error: cannot prove termination; try supplying a decreases clause
+RankNeg.dfy(15,27): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Then
-RankNeg.dfy(22,31): Error: cannot prove termination; try supplying a decreases clause
+RankNeg.dfy(22,30): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Then
-RankNeg.dfy(32,25): Error: cannot prove termination; try supplying a decreases clause
+RankNeg.dfy(32,24): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
diff --git a/Test/dafny0/Reads.dfy.expect b/Test/dafny0/Reads.dfy.expect
index 1199797f..0ef90aec 100644
--- a/Test/dafny0/Reads.dfy.expect
+++ b/Test/dafny0/Reads.dfy.expect
@@ -1,32 +1,32 @@
-Reads.dfy(133,11): Error: insufficient reads clause to read field
+Reads.dfy(133,10): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
-Reads.dfy(9,30): Error: insufficient reads clause to read field
+Reads.dfy(9,29): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
-Reads.dfy(18,30): Error: insufficient reads clause to read field
+Reads.dfy(18,29): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
-Reads.dfy(28,50): Error: insufficient reads clause to read field
+Reads.dfy(28,49): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
-Reads.dfy(37,43): Error: insufficient reads clause to read field
+Reads.dfy(37,42): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Then
     (0,0): anon4
-Reads.dfy(51,30): Error: insufficient reads clause to read field
+Reads.dfy(51,29): Error: insufficient reads clause to read field
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Then
     (0,0): anon4
-Reads.dfy(117,36): Error: insufficient reads clause to invoke function
+Reads.dfy(117,35): Error: insufficient reads clause to invoke function
 Execution trace:
     (0,0): anon0
-Reads.dfy(117,36): Error: possible violation of function precondition
+Reads.dfy(117,35): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
-Reads.dfy(120,38): Error: insufficient reads clause to invoke function
+Reads.dfy(120,37): Error: insufficient reads clause to invoke function
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/RealCompare.dfy.expect b/Test/dafny0/RealCompare.dfy.expect
index 5b25fa25..48524bdf 100644
--- a/Test/dafny0/RealCompare.dfy.expect
+++ b/Test/dafny0/RealCompare.dfy.expect
@@ -1,19 +1,19 @@
-RealCompare.dfy(35,6): Error: failure to decrease termination measure
+RealCompare.dfy(35,5): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-RealCompare.dfy(50,4): Error: decreases expression must be bounded below by 0.0
-RealCompare.dfy(48,13): Related location
+RealCompare.dfy(50,3): Error: decreases expression must be bounded below by 0.0
+RealCompare.dfy(48,12): Related location
 Execution trace:
     (0,0): anon0
-RealCompare.dfy(141,12): Error: assertion violation
+RealCompare.dfy(141,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
     RealCompare.dfy(133,3): anon7_LoopHead
     (0,0): anon7_LoopBody
     RealCompare.dfy(133,3): anon8_Else
     (0,0): anon9_Then
-RealCompare.dfy(156,12): Error: assertion violation
+RealCompare.dfy(156,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
     RealCompare.dfy(147,3): anon9_LoopHead
diff --git a/Test/dafny0/RealTypes.dfy.expect b/Test/dafny0/RealTypes.dfy.expect
index 0d132948..0fce4634 100644
--- a/Test/dafny0/RealTypes.dfy.expect
+++ b/Test/dafny0/RealTypes.dfy.expect
@@ -1,22 +1,22 @@
-RealTypes.dfy(12,16): Error: the real-based number must be an integer (if you want truncation, apply .Trunc to the real-based number)
+RealTypes.dfy(12,15): Error: the real-based number must be an integer (if you want truncation, apply .Trunc to the real-based number)
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Then
-RealTypes.dfy(14,28): Error: assertion violation
+RealTypes.dfy(14,27): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Then
-RealTypes.dfy(21,12): Error: possible division by zero
+RealTypes.dfy(21,11): Error: possible division by zero
 Execution trace:
     (0,0): anon0
     RealTypes.dfy(20,23): anon3_Else
     (0,0): anon2
-RealTypes.dfy(21,20): Error: assertion violation
+RealTypes.dfy(21,19): Error: assertion violation
 Execution trace:
     (0,0): anon0
     RealTypes.dfy(20,23): anon3_Else
     (0,0): anon2
-RealTypes.dfy(29,12): Error: assertion violation
+RealTypes.dfy(29,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/Refinement.dfy.expect b/Test/dafny0/Refinement.dfy.expect
index d03b9412..339c86b4 100644
--- a/Test/dafny0/Refinement.dfy.expect
+++ b/Test/dafny0/Refinement.dfy.expect
@@ -1,40 +1,40 @@
-Refinement.dfy(15,5): Error BP5003: A postcondition might not hold on this return path.
-Refinement.dfy(14,17): Related location: This is the postcondition that might not hold.
+Refinement.dfy(15,4): Error BP5003: A postcondition might not hold on this return path.
+Refinement.dfy(14,16): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-Refinement.dfy[B](15,5): Error BP5003: A postcondition might not hold on this return path.
-Refinement.dfy(33,20): Related location: This is the postcondition that might not hold.
+Refinement.dfy[B](15,4): Error BP5003: A postcondition might not hold on this return path.
+Refinement.dfy(33,19): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-Refinement.dfy(69,16): Error: assertion violation
+Refinement.dfy(69,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Refinement.dfy(80,17): Error: assertion violation
+Refinement.dfy(80,16): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Refinement.dfy(99,12): Error BP5003: A postcondition might not hold on this return path.
-Refinement.dfy(78,15): Related location: This is the postcondition that might not hold.
+Refinement.dfy(99,11): Error BP5003: A postcondition might not hold on this return path.
+Refinement.dfy(78,14): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-Refinement.dfy(102,3): Error BP5003: A postcondition might not hold on this return path.
-Refinement.dfy(83,15): Related location: This is the postcondition that might not hold.
+Refinement.dfy(102,2): Error BP5003: A postcondition might not hold on this return path.
+Refinement.dfy(83,14): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-Refinement.dfy(189,5): Error BP5003: A postcondition might not hold on this return path.
-Refinement.dfy[IncorrectConcrete](121,15): Related location: This is the postcondition that might not hold.
-Refinement.dfy(186,9): Related location
+Refinement.dfy(189,4): Error BP5003: A postcondition might not hold on this return path.
+Refinement.dfy[IncorrectConcrete](121,14): Related location: This is the postcondition that might not hold.
+Refinement.dfy(186,8): Related location
 Execution trace:
     (0,0): anon0
-Refinement.dfy(193,5): Error BP5003: A postcondition might not hold on this return path.
-Refinement.dfy[IncorrectConcrete](129,15): Related location: This is the postcondition that might not hold.
-Refinement.dfy(186,9): Related location
+Refinement.dfy(193,4): Error BP5003: A postcondition might not hold on this return path.
+Refinement.dfy[IncorrectConcrete](129,14): Related location: This is the postcondition that might not hold.
+Refinement.dfy(186,8): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Then
     (0,0): anon3
-Refinement.dfy(199,7): Error: assertion violation
-Refinement.dfy[IncorrectConcrete](137,24): Related location
+Refinement.dfy(199,6): Error: assertion violation
+Refinement.dfy[IncorrectConcrete](137,23): Related location
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/Skeletons.dfy.expect b/Test/dafny0/Skeletons.dfy.expect
index 43b372c3..4b48bad0 100644
--- a/Test/dafny0/Skeletons.dfy.expect
+++ b/Test/dafny0/Skeletons.dfy.expect
@@ -1,5 +1,5 @@
-Skeletons.dfy(45,3): Error BP5003: A postcondition might not hold on this return path.
-Skeletons.dfy(44,15): Related location: This is the postcondition that might not hold.
+Skeletons.dfy(45,2): Error BP5003: A postcondition might not hold on this return path.
+Skeletons.dfy(44,14): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     Skeletons.dfy[C0](32,5): anon11_LoopHead
diff --git a/Test/dafny0/SmallTests.dfy.expect b/Test/dafny0/SmallTests.dfy.expect
index b0605d8e..eee0d4f1 100644
--- a/Test/dafny0/SmallTests.dfy.expect
+++ b/Test/dafny0/SmallTests.dfy.expect
@@ -1,41 +1,41 @@
-SmallTests.dfy(34,11): Error: index out of range
+SmallTests.dfy(34,10): Error: index out of range
 Execution trace:
     (0,0): anon0
-SmallTests.dfy(65,36): Error: possible division by zero
+SmallTests.dfy(65,35): Error: possible division by zero
 Execution trace:
     (0,0): anon0
     (0,0): anon13_Then
-SmallTests.dfy(66,51): Error: possible division by zero
+SmallTests.dfy(66,50): Error: possible division by zero
 Execution trace:
     (0,0): anon0
     (0,0): anon13_Else
     (0,0): anon14_Else
-SmallTests.dfy(67,22): Error: target object may be null
+SmallTests.dfy(67,21): Error: target object may be null
 Execution trace:
     (0,0): anon0
     (0,0): anon13_Then
     (0,0): anon14_Then
     (0,0): anon15_Then
-SmallTests.dfy(86,24): Error: target object may be null
+SmallTests.dfy(86,23): Error: target object may be null
 Execution trace:
     (0,0): anon0
     SmallTests.dfy(85,5): anon8_LoopHead
     (0,0): anon8_LoopBody
     (0,0): anon9_Then
-SmallTests.dfy(120,6): Error: call may violate context's modifies clause
+SmallTests.dfy(120,5): Error: call may violate context's modifies clause
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
     (0,0): anon3
-SmallTests.dfy(133,10): Error: call may violate context's modifies clause
+SmallTests.dfy(133,9): Error: call may violate context's modifies clause
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-SmallTests.dfy(135,10): Error: call may violate context's modifies clause
+SmallTests.dfy(135,9): Error: call may violate context's modifies clause
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Else
-SmallTests.dfy(175,9): Error: assignment may update an object field not in the enclosing context's modifies clause
+SmallTests.dfy(175,8): Error: assignment may update an object field not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
     (0,0): anon22_Else
@@ -44,23 +44,23 @@ Execution trace:
     (0,0): anon28_Then
     (0,0): anon29_Then
     (0,0): anon19
-SmallTests.dfy(199,14): Error: assertion violation
+SmallTests.dfy(199,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Then
-SmallTests.dfy(206,14): Error: assertion violation
+SmallTests.dfy(206,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Else
     (0,0): anon3
     (0,0): anon10_Then
-SmallTests.dfy(208,14): Error: assertion violation
+SmallTests.dfy(208,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Else
     (0,0): anon3
     (0,0): anon10_Else
-SmallTests.dfy(213,14): Error: assertion violation
+SmallTests.dfy(213,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Else
@@ -68,7 +68,7 @@ Execution trace:
     (0,0): anon10_Then
     (0,0): anon6
     (0,0): anon11_Then
-SmallTests.dfy(215,14): Error: assertion violation
+SmallTests.dfy(215,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Else
@@ -76,37 +76,37 @@ Execution trace:
     (0,0): anon10_Then
     (0,0): anon6
     (0,0): anon11_Else
-SmallTests.dfy(261,24): Error BP5002: A precondition for this call might not hold.
-SmallTests.dfy(239,30): Related location: This is the precondition that might not hold.
+SmallTests.dfy(261,23): Error BP5002: A precondition for this call might not hold.
+SmallTests.dfy(239,29): Related location: This is the precondition that might not hold.
 Execution trace:
     (0,0): anon0
     SmallTests.dfy(256,19): anon3_Else
     (0,0): anon2
-SmallTests.dfy(367,12): Error: assertion violation
+SmallTests.dfy(367,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
-SmallTests.dfy(377,12): Error: assertion violation
+SmallTests.dfy(377,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
-SmallTests.dfy(387,6): Error: cannot prove termination; try supplying a decreases clause
+SmallTests.dfy(387,5): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-SmallTests.dfy(692,14): Error: assertion violation
+SmallTests.dfy(692,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     SmallTests.dfy(689,5): anon7_LoopHead
     (0,0): anon7_LoopBody
     SmallTests.dfy(689,5): anon8_Else
     (0,0): anon9_Then
-SmallTests.dfy(713,14): Error: assertion violation
+SmallTests.dfy(713,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Then
     (0,0): anon8_Then
     (0,0): anon3
-SmallTests.dfy(296,3): Error BP5003: A postcondition might not hold on this return path.
-SmallTests.dfy(290,11): Related location: This is the postcondition that might not hold.
+SmallTests.dfy(296,2): Error BP5003: A postcondition might not hold on this return path.
+SmallTests.dfy(290,10): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon18_Else
@@ -114,29 +114,29 @@ Execution trace:
     (0,0): anon24_Then
     (0,0): anon15
     (0,0): anon25_Else
-SmallTests.dfy(338,12): Error: assertion violation
+SmallTests.dfy(338,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon8_Then
     (0,0): anon7
-SmallTests.dfy(345,10): Error: assertion violation
+SmallTests.dfy(345,9): Error: assertion violation
 Execution trace:
     (0,0): anon0
-SmallTests.dfy(355,4): Error: cannot prove termination; try supplying a decreases clause
+SmallTests.dfy(355,3): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-SmallTests.dfy(399,10): Error BP5003: A postcondition might not hold on this return path.
-SmallTests.dfy(402,41): Related location: This is the postcondition that might not hold.
+SmallTests.dfy(399,9): Error BP5003: A postcondition might not hold on this return path.
+SmallTests.dfy(402,40): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
-SmallTests.dfy(563,12): Error: assertion violation
+SmallTests.dfy(563,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
     (0,0): anon2
-SmallTests.dfy(577,20): Error: left-hand sides 0 and 1 may refer to the same location
+SmallTests.dfy(577,19): Error: left-hand sides 0 and 1 may refer to the same location
 Execution trace:
     (0,0): anon0
     (0,0): anon27_Then
@@ -148,7 +148,7 @@ Execution trace:
     (0,0): anon31_Then
     (0,0): anon32_Then
     (0,0): anon12
-SmallTests.dfy(579,15): Error: left-hand sides 1 and 2 may refer to the same location
+SmallTests.dfy(579,14): Error: left-hand sides 1 and 2 may refer to the same location
 Execution trace:
     (0,0): anon0
     (0,0): anon27_Then
@@ -163,16 +163,16 @@ Execution trace:
     (0,0): anon37_Then
     (0,0): anon22
     (0,0): anon38_Then
-SmallTests.dfy(586,25): Error: target object may be null
+SmallTests.dfy(586,24): Error: target object may be null
 Execution trace:
     (0,0): anon0
-SmallTests.dfy(599,10): Error: assertion violation
+SmallTests.dfy(599,9): Error: assertion violation
 Execution trace:
     (0,0): anon0
-SmallTests.dfy(623,5): Error: cannot establish the existence of LHS values that satisfy the such-that predicate
+SmallTests.dfy(623,4): Error: cannot establish the existence of LHS values that satisfy the such-that predicate
 Execution trace:
     (0,0): anon0
-SmallTests.dfy(646,23): Error: assertion violation
+SmallTests.dfy(646,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon8_Then
@@ -180,17 +180,17 @@ Execution trace:
     (0,0): anon4
     (0,0): anon10_Then
     (0,0): anon7
-SmallTests.dfy(660,10): Error: cannot establish the existence of LHS values that satisfy the such-that predicate
+SmallTests.dfy(660,9): Error: cannot establish the existence of LHS values that satisfy the such-that predicate
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
     (0,0): anon6_Then
     (0,0): anon3
-SmallTests.dfy(662,10): Error: cannot establish the existence of LHS values that satisfy the such-that predicate
+SmallTests.dfy(662,9): Error: cannot establish the existence of LHS values that satisfy the such-that predicate
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Else
-SmallTests.dfy(675,9): Error: cannot establish the existence of LHS values that satisfy the such-that predicate
+SmallTests.dfy(675,8): Error: cannot establish the existence of LHS values that satisfy the such-that predicate
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/SplitExpr.dfy.expect b/Test/dafny0/SplitExpr.dfy.expect
index b7ef524f..29dd6eda 100644
--- a/Test/dafny0/SplitExpr.dfy.expect
+++ b/Test/dafny0/SplitExpr.dfy.expect
@@ -1,5 +1,5 @@
-SplitExpr.dfy(92,15): Error: loop invariant violation
-SplitExpr.dfy(86,44): Related location
+SplitExpr.dfy(92,14): Error: loop invariant violation
+SplitExpr.dfy(86,43): Related location
 Execution trace:
     SplitExpr.dfy(91,3): anon7_LoopHead
 
diff --git a/Test/dafny0/StatementExpressions.dfy.expect b/Test/dafny0/StatementExpressions.dfy.expect
index 9de6a5d1..936a3954 100644
--- a/Test/dafny0/StatementExpressions.dfy.expect
+++ b/Test/dafny0/StatementExpressions.dfy.expect
@@ -1,22 +1,22 @@
-StatementExpressions.dfy(55,12): Error: cannot prove termination; try supplying a decreases clause
+StatementExpressions.dfy(55,11): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Then
     (0,0): anon8_Then
-StatementExpressions.dfy(59,14): Error: assertion violation
+StatementExpressions.dfy(59,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Then
     StatementExpressions.dfy(53,7): anon8_Else
-StatementExpressions.dfy(77,6): Error: possible division by zero
+StatementExpressions.dfy(77,5): Error: possible division by zero
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-StatementExpressions.dfy(88,5): Error: value assigned to a nat must be non-negative
+StatementExpressions.dfy(88,4): Error: value assigned to a nat must be non-negative
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-StatementExpressions.dfy(98,18): Error: cannot prove termination; try supplying a decreases clause
+StatementExpressions.dfy(98,17): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Then
diff --git a/Test/dafny0/Superposition.dfy.expect b/Test/dafny0/Superposition.dfy.expect
index 6497c712..04ec2f7d 100644
--- a/Test/dafny0/Superposition.dfy.expect
+++ b/Test/dafny0/Superposition.dfy.expect
@@ -10,16 +10,16 @@ Verifying CheckWellformed$$_0_M0.C.P ...
 
 Verifying CheckWellformed$$_0_M0.C.Q ...
   [5 proof obligations]  error
-Superposition.dfy(27,15): Error BP5003: A postcondition might not hold on this return path.
-Superposition.dfy(28,26): Related location: This is the postcondition that might not hold.
+Superposition.dfy(27,14): Error BP5003: A postcondition might not hold on this return path.
+Superposition.dfy(28,25): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
 
 Verifying CheckWellformed$$_0_M0.C.R ...
   [5 proof obligations]  error
-Superposition.dfy(33,15): Error BP5003: A postcondition might not hold on this return path.
-Superposition.dfy(34,26): Related location: This is the postcondition that might not hold.
+Superposition.dfy(33,14): Error BP5003: A postcondition might not hold on this return path.
+Superposition.dfy(34,25): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
@@ -32,8 +32,8 @@ Verifying Impl$$_1_M1.C.M ...
 
 Verifying CheckWellformed$$_1_M1.C.P ...
   [2 proof obligations]  error
-Superposition.dfy(50,25): Error BP5003: A postcondition might not hold on this return path.
-Superposition.dfy[M1](22,26): Related location: This is the postcondition that might not hold.
+Superposition.dfy(50,24): Error BP5003: A postcondition might not hold on this return path.
+Superposition.dfy[M1](22,25): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Else
diff --git a/Test/dafny0/Termination.dfy.expect b/Test/dafny0/Termination.dfy.expect
index 77a9e70e..69cb360d 100644
--- a/Test/dafny0/Termination.dfy.expect
+++ b/Test/dafny0/Termination.dfy.expect
@@ -1,20 +1,20 @@
-Termination.dfy[TerminationRefinement1](441,6): Error: failure to decrease termination measure
+Termination.dfy[TerminationRefinement1](441,5): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
-Termination.dfy(361,47): Error: failure to decrease termination measure
+Termination.dfy(361,46): Error: failure to decrease termination measure
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Else
     (0,0): anon10_Then
     (0,0): anon11_Else
-Termination.dfy(108,3): Error: cannot prove termination; try supplying a decreases clause for the loop
+Termination.dfy(108,2): Error: cannot prove termination; try supplying a decreases clause for the loop
 Execution trace:
     (0,0): anon0
     Termination.dfy(108,3): anon6_LoopHead
     (0,0): anon6_LoopBody
     Termination.dfy(108,3): anon7_Else
     Termination.dfy(108,3): anon8_Else
-Termination.dfy(116,3): Error: cannot prove termination; try supplying a decreases clause for the loop
+Termination.dfy(116,2): Error: cannot prove termination; try supplying a decreases clause for the loop
 Execution trace:
     (0,0): anon0
     Termination.dfy(116,3): anon8_LoopHead
@@ -23,7 +23,7 @@ Execution trace:
     (0,0): anon10_Then
     (0,0): anon5
     Termination.dfy(116,3): anon11_Else
-Termination.dfy(125,3): Error: decreases expression might not decrease
+Termination.dfy(125,2): Error: decreases expression might not decrease
 Execution trace:
     (0,0): anon0
     Termination.dfy(125,3): anon8_LoopHead
@@ -32,7 +32,7 @@ Execution trace:
     (0,0): anon10_Then
     (0,0): anon5
     Termination.dfy(125,3): anon11_Else
-Termination.dfy(126,17): Error: decreases expression must be bounded below by 0 at end of loop iteration
+Termination.dfy(126,16): Error: decreases expression must be bounded below by 0 at end of loop iteration
 Execution trace:
     (0,0): anon0
     Termination.dfy(125,3): anon8_LoopHead
@@ -41,13 +41,13 @@ Execution trace:
     (0,0): anon10_Then
     (0,0): anon5
     Termination.dfy(125,3): anon11_Else
-Termination.dfy(255,35): Error: cannot prove termination; try supplying a decreases clause
+Termination.dfy(255,34): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon8_Else
     (0,0): anon9_Else
     (0,0): anon10_Then
-Termination.dfy(296,3): Error: decreases expression might not decrease
+Termination.dfy(296,2): Error: decreases expression might not decrease
 Execution trace:
     Termination.dfy(296,3): anon9_LoopHead
     (0,0): anon9_LoopBody
diff --git a/Test/dafny0/Trait/TraitUsingParentMembers.dfy.expect b/Test/dafny0/Trait/TraitUsingParentMembers.dfy.expect
index 9960c1d9..1517dee4 100644
--- a/Test/dafny0/Trait/TraitUsingParentMembers.dfy.expect
+++ b/Test/dafny0/Trait/TraitUsingParentMembers.dfy.expect
@@ -1,4 +1,4 @@
-TraitUsingParentMembers.dfy(10,8): Error: assignment may update an array element not in the enclosing context's modifies clause
+TraitUsingParentMembers.dfy(10,7): Error: assignment may update an array element not in the enclosing context's modifies clause
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
diff --git a/Test/dafny0/Trait/TraitsDecreases.dfy.expect b/Test/dafny0/Trait/TraitsDecreases.dfy.expect
index 2607a0c6..7d646bd1 100644
--- a/Test/dafny0/Trait/TraitsDecreases.dfy.expect
+++ b/Test/dafny0/Trait/TraitsDecreases.dfy.expect
@@ -1,34 +1,34 @@
-TraitsDecreases.dfy(117,15): Error: predicate's decreases clause must be below or equal to that in the trait
+TraitsDecreases.dfy(117,14): Error: predicate's decreases clause must be below or equal to that in the trait
 Execution trace:
     (0,0): anon0
-TraitsDecreases.dfy(124,15): Error: predicate's decreases clause must be below or equal to that in the trait
+TraitsDecreases.dfy(124,14): Error: predicate's decreases clause must be below or equal to that in the trait
 Execution trace:
     (0,0): anon0
-TraitsDecreases.dfy(131,15): Error: predicate's decreases clause must be below or equal to that in the trait
+TraitsDecreases.dfy(131,14): Error: predicate's decreases clause must be below or equal to that in the trait
 Execution trace:
     (0,0): anon0
-TraitsDecreases.dfy(138,15): Error: predicate's decreases clause must be below or equal to that in the trait
+TraitsDecreases.dfy(138,14): Error: predicate's decreases clause must be below or equal to that in the trait
 Execution trace:
     (0,0): anon0
-TraitsDecreases.dfy(145,15): Error: predicate's decreases clause must be below or equal to that in the trait
+TraitsDecreases.dfy(145,14): Error: predicate's decreases clause must be below or equal to that in the trait
 Execution trace:
     (0,0): anon0
-TraitsDecreases.dfy(152,12): Error: method's decreases clause must be below or equal to that in the trait
+TraitsDecreases.dfy(152,11): Error: method's decreases clause must be below or equal to that in the trait
 Execution trace:
     (0,0): anon0
-TraitsDecreases.dfy(57,10): Error: method's decreases clause must be below or equal to that in the trait
+TraitsDecreases.dfy(57,9): Error: method's decreases clause must be below or equal to that in the trait
 Execution trace:
     (0,0): anon0
-TraitsDecreases.dfy(69,10): Error: method's decreases clause must be below or equal to that in the trait
+TraitsDecreases.dfy(69,9): Error: method's decreases clause must be below or equal to that in the trait
 Execution trace:
     (0,0): anon0
-TraitsDecreases.dfy(72,10): Error: method's decreases clause must be below or equal to that in the trait
+TraitsDecreases.dfy(72,9): Error: method's decreases clause must be below or equal to that in the trait
 Execution trace:
     (0,0): anon0
-TraitsDecreases.dfy(78,10): Error: method's decreases clause must be below or equal to that in the trait
+TraitsDecreases.dfy(78,9): Error: method's decreases clause must be below or equal to that in the trait
 Execution trace:
     (0,0): anon0
-TraitsDecreases.dfy(88,10): Error: method's decreases clause must be below or equal to that in the trait
+TraitsDecreases.dfy(88,9): Error: method's decreases clause must be below or equal to that in the trait
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/Tuples.dfy.expect b/Test/dafny0/Tuples.dfy.expect
index 13c706d3..9b5f3a83 100644
--- a/Test/dafny0/Tuples.dfy.expect
+++ b/Test/dafny0/Tuples.dfy.expect
@@ -1,7 +1,7 @@
-Tuples.dfy(22,19): Error: assertion violation
+Tuples.dfy(22,18): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Tuples.dfy(24,21): Error: possible division by zero
+Tuples.dfy(24,20): Error: possible division by zero
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/TypeAntecedents.dfy.expect b/Test/dafny0/TypeAntecedents.dfy.expect
index d6eb08e4..2e2f606d 100644
--- a/Test/dafny0/TypeAntecedents.dfy.expect
+++ b/Test/dafny0/TypeAntecedents.dfy.expect
@@ -1,8 +1,8 @@
-TypeAntecedents.dfy(35,13): Error: assertion violation
+TypeAntecedents.dfy(35,12): Error: assertion violation
 Execution trace:
     (0,0): anon0
-TypeAntecedents.dfy(58,1): Error BP5003: A postcondition might not hold on this return path.
-TypeAntecedents.dfy(57,15): Related location: This is the postcondition that might not hold.
+TypeAntecedents.dfy(58,0): Error BP5003: A postcondition might not hold on this return path.
+TypeAntecedents.dfy(57,14): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon25_Then
@@ -16,7 +16,7 @@ Execution trace:
     (0,0): anon34_Then
     (0,0): anon35_Then
     (0,0): anon24
-TypeAntecedents.dfy(66,16): Error: assertion violation
+TypeAntecedents.dfy(66,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon25_Else
diff --git a/Test/dafny0/TypeParameters.dfy.expect b/Test/dafny0/TypeParameters.dfy.expect
index 3d00e89a..aca0694d 100644
--- a/Test/dafny0/TypeParameters.dfy.expect
+++ b/Test/dafny0/TypeParameters.dfy.expect
@@ -1,43 +1,43 @@
-TypeParameters.dfy(47,22): Error: assertion violation
+TypeParameters.dfy(47,21): Error: assertion violation
 Execution trace:
     (0,0): anon0
-TypeParameters.dfy(69,27): Error: assertion violation
+TypeParameters.dfy(69,26): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
     (0,0): anon2
-TypeParameters.dfy(156,12): Error: assertion violation
-TypeParameters.dfy(156,28): Related location
+TypeParameters.dfy(156,11): Error: assertion violation
+TypeParameters.dfy(156,27): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon20_Then
     TypeParameters.dfy(156,32): anon21_Else
     (0,0): anon5
-TypeParameters.dfy(158,12): Error: assertion violation
-TypeParameters.dfy(158,33): Related location
+TypeParameters.dfy(158,11): Error: assertion violation
+TypeParameters.dfy(158,32): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon23_Then
     TypeParameters.dfy(158,37): anon24_Else
     (0,0): anon11
-TypeParameters.dfy(160,12): Error: assertion violation
-TypeParameters.dfy(160,20): Related location
+TypeParameters.dfy(160,11): Error: assertion violation
+TypeParameters.dfy(160,19): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon25_Then
-TypeParameters.dfy(162,12): Error: assertion violation
-TypeParameters.dfy(147,5): Related location
-TypeParameters.dfy(162,21): Related location
+TypeParameters.dfy(162,11): Error: assertion violation
+TypeParameters.dfy(147,4): Related location
+TypeParameters.dfy(162,20): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon26_Then
-TypeParameters.dfy(164,12): Error: assertion violation
-TypeParameters.dfy(149,8): Related location
+TypeParameters.dfy(164,11): Error: assertion violation
+TypeParameters.dfy(149,7): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon27_Then
-TypeParameters.dfy(178,15): Error BP5005: This loop invariant might not be maintained by the loop.
-TypeParameters.dfy(178,38): Related location
+TypeParameters.dfy(178,14): Error BP5005: This loop invariant might not be maintained by the loop.
+TypeParameters.dfy(178,37): Related location
 Execution trace:
     (0,0): anon0
     TypeParameters.dfy(171,3): anon16_LoopHead
diff --git a/Test/dafny0/columns.dfy b/Test/dafny0/columns.dfy
new file mode 100644
index 00000000..e36142be
--- /dev/null
+++ b/Test/dafny0/columns.dfy
@@ -0,0 +1,10 @@
+// RUN: %dafny "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// Dafny counts columns from 0, but Boogie from one, so for a while there were small bugs with that.
+
+static method A(x:int) requires x > 0 { // error os 's'
+  assert (forall y :: y > x ==> y > 100); // error on '('
+  assert x != 1; // error on '!'
+  assert x in {}; // error on 'i'
+}
diff --git a/Test/dafny0/columns.dfy.expect b/Test/dafny0/columns.dfy.expect
new file mode 100644
index 00000000..295ca351
--- /dev/null
+++ b/Test/dafny0/columns.dfy.expect
@@ -0,0 +1,18 @@
+columns.dfy(6,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+columns.dfy(7,9): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+    (0,0): anon3_Then
+    (0,0): anon2
+columns.dfy(8,11): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+    (0,0): anon3_Then
+    (0,0): anon2
+columns.dfy(9,11): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+    (0,0): anon3_Then
+    (0,0): anon2
+
+Dafny program verifier finished with 1 verified, 3 errors
diff --git a/Test/dafny0/snapshots/Snapshots0.run.dfy.expect b/Test/dafny0/snapshots/Snapshots0.run.dfy.expect
index 96c280d9..d32cd9bb 100644
--- a/Test/dafny0/snapshots/Snapshots0.run.dfy.expect
+++ b/Test/dafny0/snapshots/Snapshots0.run.dfy.expect
@@ -18,7 +18,7 @@ Processing command (at <unknown location>) a##cached##0 := a##cached##0 && ##ext
   >>> AssumeNegationOfAssumptionVariable
 Processing command (at Snapshots0.v1.dfy(4,10)) assert Lit(false);
   >>> MarkAsPartiallyVerified
-Snapshots0.v1.dfy(4,10): Error: assertion violation
+Snapshots0.v1.dfy(4,9): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/snapshots/Snapshots1.run.dfy.expect b/Test/dafny0/snapshots/Snapshots1.run.dfy.expect
index 878f9905..6d5e43f8 100644
--- a/Test/dafny0/snapshots/Snapshots1.run.dfy.expect
+++ b/Test/dafny0/snapshots/Snapshots1.run.dfy.expect
@@ -14,7 +14,7 @@ Processing command (at Snapshots1.v1.dfy(3,4)) assert (forall<alpha> $o: ref, $f
   >>> MarkAsFullyVerified
 Processing command (at Snapshots1.v1.dfy(4,10)) assert Lit(false);
   >>> DoNothingToAssert
-Snapshots1.v1.dfy(4,10): Error: assertion violation
+Snapshots1.v1.dfy(4,9): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/snapshots/Snapshots2.run.dfy.expect b/Test/dafny0/snapshots/Snapshots2.run.dfy.expect
index a6a9bc4c..ee2ceecd 100644
--- a/Test/dafny0/snapshots/Snapshots2.run.dfy.expect
+++ b/Test/dafny0/snapshots/Snapshots2.run.dfy.expect
@@ -26,7 +26,7 @@ Processing command (at Snapshots2.v1.dfy(3,4)) assert (forall<alpha> $o: ref, $f
   >>> MarkAsFullyVerified
 Processing command (at Snapshots2.v1.dfy(4,10)) assert Lit(false);
   >>> DoNothingToAssert
-Snapshots2.v1.dfy(4,10): Error: assertion violation
+Snapshots2.v1.dfy(4,9): Error: assertion violation
 Execution trace:
     (0,0): anon0
 Processing command (at Snapshots2.v1.dfy(11,11)) assert true;
diff --git a/Test/dafny0/snapshots/Snapshots3.run.dfy.expect b/Test/dafny0/snapshots/Snapshots3.run.dfy.expect
index 07e2d063..accacd90 100644
--- a/Test/dafny0/snapshots/Snapshots3.run.dfy.expect
+++ b/Test/dafny0/snapshots/Snapshots3.run.dfy.expect
@@ -1,6 +1,6 @@
 Processing command (at Snapshots3.v0.dfy(9,14)) assert Lit(0 != 0);
   >>> DoNothingToAssert
-Snapshots3.v0.dfy(9,14): Error: assertion violation
+Snapshots3.v0.dfy(9,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Else
@@ -10,7 +10,7 @@ Processing command (at Snapshots3.v1.dfy(5,12)) assert Lit(true);
   >>> DoNothingToAssert
 Processing command (at Snapshots3.v1.dfy(9,14)) assert Lit(0 != 0);
   >>> RecycleError
-Snapshots3.v0.dfy(9,14): Error: assertion violation
+Snapshots3.v0.dfy(9,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Else
diff --git a/Test/dafny0/snapshots/Snapshots4.run.dfy.expect b/Test/dafny0/snapshots/Snapshots4.run.dfy.expect
index fdc97775..d56eb9d0 100644
--- a/Test/dafny0/snapshots/Snapshots4.run.dfy.expect
+++ b/Test/dafny0/snapshots/Snapshots4.run.dfy.expect
@@ -8,11 +8,11 @@ Processing command (at Snapshots4.v1.dfy(9,14)) assert LitInt(0) == LitInt(0);
   >>> MarkAsFullyVerified
 Processing command (at Snapshots4.v1.dfy(10,14)) assert Lit(2 != 2);
   >>> DoNothingToAssert
-Snapshots4.v1.dfy(5,14): Error: assertion violation
+Snapshots4.v1.dfy(5,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-Snapshots4.v1.dfy(10,14): Error: assertion violation
+Snapshots4.v1.dfy(10,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Else
diff --git a/Test/dafny0/snapshots/Snapshots6.run.dfy.expect b/Test/dafny0/snapshots/Snapshots6.run.dfy.expect
index af440327..bef5a87d 100644
--- a/Test/dafny0/snapshots/Snapshots6.run.dfy.expect
+++ b/Test/dafny0/snapshots/Snapshots6.run.dfy.expect
@@ -4,7 +4,7 @@ Processing command (at Snapshots6.v0.dfy(20,14)) assert Lit(false);
 Dafny program verifier finished with 4 verified, 0 errors
 Processing command (at Snapshots6.v1.dfy(20,14)) assert Lit(false);
   >>> DoNothingToAssert
-Snapshots6.v1.dfy(20,14): Error: assertion violation
+Snapshots6.v1.dfy(20,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny0/snapshots/Snapshots7.run.dfy.expect b/Test/dafny0/snapshots/Snapshots7.run.dfy.expect
index 7c073a9a..b90a6034 100644
--- a/Test/dafny0/snapshots/Snapshots7.run.dfy.expect
+++ b/Test/dafny0/snapshots/Snapshots7.run.dfy.expect
@@ -24,7 +24,7 @@ Processing command (at <unknown location>) a##cached##0 := a##cached##0 && ##ext
   >>> AssumeNegationOfAssumptionVariable
 Processing command (at Snapshots7.v1.dfy(19,14)) assert Lit(false);
   >>> MarkAsPartiallyVerified
-Snapshots7.v1.dfy(19,14): Error: assertion violation
+Snapshots7.v1.dfy(19,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny1/MoreInduction.dfy.expect b/Test/dafny1/MoreInduction.dfy.expect
index c8785e56..5de0ace6 100644
--- a/Test/dafny1/MoreInduction.dfy.expect
+++ b/Test/dafny1/MoreInduction.dfy.expect
@@ -1,17 +1,17 @@
-MoreInduction.dfy(78,1): Error BP5003: A postcondition might not hold on this return path.
-MoreInduction.dfy(77,11): Related location: This is the postcondition that might not hold.
+MoreInduction.dfy(78,0): Error BP5003: A postcondition might not hold on this return path.
+MoreInduction.dfy(77,10): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-MoreInduction.dfy(83,1): Error BP5003: A postcondition might not hold on this return path.
-MoreInduction.dfy(82,21): Related location: This is the postcondition that might not hold.
+MoreInduction.dfy(83,0): Error BP5003: A postcondition might not hold on this return path.
+MoreInduction.dfy(82,20): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-MoreInduction.dfy(88,1): Error BP5003: A postcondition might not hold on this return path.
-MoreInduction.dfy(87,11): Related location: This is the postcondition that might not hold.
+MoreInduction.dfy(88,0): Error BP5003: A postcondition might not hold on this return path.
+MoreInduction.dfy(87,10): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
-MoreInduction.dfy(93,1): Error BP5003: A postcondition might not hold on this return path.
-MoreInduction.dfy(92,22): Related location: This is the postcondition that might not hold.
+MoreInduction.dfy(93,0): Error BP5003: A postcondition might not hold on this return path.
+MoreInduction.dfy(92,21): Related location: This is the postcondition that might not hold.
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/dafny2/SnapshotableTrees.dfy.expect b/Test/dafny2/SnapshotableTrees.dfy.expect
index 849b9e38..808fe0f9 100644
--- a/Test/dafny2/SnapshotableTrees.dfy.expect
+++ b/Test/dafny2/SnapshotableTrees.dfy.expect
@@ -1,5 +1,5 @@
-SnapshotableTrees.dfy(68,24): Error BP5002: A precondition for this call might not hold.
-SnapshotableTrees.dfy(648,16): Related location: This is the precondition that might not hold.
+SnapshotableTrees.dfy(68,23): Error BP5002: A precondition for this call might not hold.
+SnapshotableTrees.dfy(648,15): Related location: This is the precondition that might not hold.
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
diff --git a/Test/dafny4/BinarySearch.dfy.expect b/Test/dafny4/BinarySearch.dfy.expect
index 944f677a..a9f834b7 100644
--- a/Test/dafny4/BinarySearch.dfy.expect
+++ b/Test/dafny4/BinarySearch.dfy.expect
@@ -1,4 +1,4 @@
-BinarySearch.dfy(44,20): Error: result of operation might violate newtype constraint
+BinarySearch.dfy(44,19): Error: result of operation might violate newtype constraint
 Execution trace:
     (0,0): anon0
     BinarySearch.dfy(40,3): anon18_LoopHead
diff --git a/Test/dafny4/Bug73.dfy.expect b/Test/dafny4/Bug73.dfy.expect
index 6cf5c156..8beaa18c 100644
--- a/Test/dafny4/Bug73.dfy.expect
+++ b/Test/dafny4/Bug73.dfy.expect
@@ -1,9 +1,9 @@
-Bug73.dfy(7,14): Error: assertion violation
+Bug73.dfy(7,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     Bug73.dfy(7,19): anon3_Else
     (0,0): anon2
-Bug73.dfy(13,14): Error: assertion violation
+Bug73.dfy(13,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     Bug73.dfy(13,20): anon3_Else
diff --git a/Test/dafny4/SoftwareFoundations-Basics.dfy.expect b/Test/dafny4/SoftwareFoundations-Basics.dfy.expect
index 0f9eb8d0..f07b068f 100644
--- a/Test/dafny4/SoftwareFoundations-Basics.dfy.expect
+++ b/Test/dafny4/SoftwareFoundations-Basics.dfy.expect
@@ -1,4 +1,4 @@
-SoftwareFoundations-Basics.dfy(41,12): Error: assertion violation
+SoftwareFoundations-Basics.dfy(41,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/hofs/Apply.dfy.expect b/Test/hofs/Apply.dfy.expect
index 77d34c4c..0a923143 100644
--- a/Test/hofs/Apply.dfy.expect
+++ b/Test/hofs/Apply.dfy.expect
@@ -1,4 +1,4 @@
-Apply.dfy(27,16): Error: assertion violation
+Apply.dfy(27,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     Apply.dfy(26,27): anon15_Else
diff --git a/Test/hofs/Classes.dfy.expect b/Test/hofs/Classes.dfy.expect
index 1c9e31f0..a5b33522 100644
--- a/Test/hofs/Classes.dfy.expect
+++ b/Test/hofs/Classes.dfy.expect
@@ -1,7 +1,7 @@
-Classes.dfy(64,12): Error: assertion violation
+Classes.dfy(64,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Classes.dfy(40,6): Error: possible violation of function precondition
+Classes.dfy(40,5): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
diff --git a/Test/hofs/Field.dfy.expect b/Test/hofs/Field.dfy.expect
index 9f6998f5..0859d83c 100644
--- a/Test/hofs/Field.dfy.expect
+++ b/Test/hofs/Field.dfy.expect
@@ -1,13 +1,13 @@
-Field.dfy(12,12): Error: possible violation of function precondition
+Field.dfy(12,11): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
-Field.dfy(12,15): Error: assertion violation
+Field.dfy(12,14): Error: assertion violation
 Execution trace:
     (0,0): anon0
-Field.dfy(21,12): Error: possible violation of function precondition
+Field.dfy(21,11): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
-Field.dfy(21,14): Error: assertion violation
+Field.dfy(21,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/hofs/FnRef.dfy.expect b/Test/hofs/FnRef.dfy.expect
index 0f6f2aa9..e665c830 100644
--- a/Test/hofs/FnRef.dfy.expect
+++ b/Test/hofs/FnRef.dfy.expect
@@ -1,19 +1,19 @@
-FnRef.dfy(17,45): Error: possible violation of function precondition
+FnRef.dfy(17,44): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
     FnRef.dfy(15,12): anon5_Else
     (0,0): anon6_Then
-FnRef.dfy(32,8): Error: possible violation of function precondition
+FnRef.dfy(32,7): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
     FnRef.dfy(26,12): anon9_Else
     FnRef.dfy(28,8): anon10_Else
-FnRef.dfy(46,12): Error: assertion violation
+FnRef.dfy(46,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
     FnRef.dfy(43,12): anon7_Else
     (0,0): anon9_Then
-FnRef.dfy(65,14): Error: assertion violation
+FnRef.dfy(65,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     FnRef.dfy(56,12): anon8_Else
diff --git a/Test/hofs/Frame.dfy.expect b/Test/hofs/Frame.dfy.expect
index 0ee2eadb..9964deb4 100644
--- a/Test/hofs/Frame.dfy.expect
+++ b/Test/hofs/Frame.dfy.expect
@@ -1,35 +1,35 @@
-Frame.dfy(23,16): Error: assertion violation
+Frame.dfy(23,15): Error: assertion violation
 Execution trace:
     (0,0): anon0
     Frame.dfy(19,12): anon5_Else
     (0,0): anon6_Then
-Frame.dfy(37,14): Error: assertion violation
+Frame.dfy(37,13): Error: assertion violation
 Execution trace:
     (0,0): anon0
     Frame.dfy(33,12): anon3_Else
-Frame.dfy(63,23): Error: assertion violation
+Frame.dfy(63,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon13_Then
     Frame.dfy(55,12): anon14_Else
     (0,0): anon15_Then
     (0,0): anon5
-Frame.dfy(66,19): Error: insufficient reads clause to read array element
+Frame.dfy(66,18): Error: insufficient reads clause to read array element
 Execution trace:
     (0,0): anon0
     (0,0): anon16_Then
     (0,0): anon17_Then
-Frame.dfy(68,28): Error: insufficient reads clause to read array element
+Frame.dfy(68,27): Error: insufficient reads clause to read array element
 Execution trace:
     (0,0): anon0
     (0,0): anon16_Else
     (0,0): anon18_Then
-Frame.dfy(123,14): Error: possible violation of function precondition
+Frame.dfy(123,13): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
     (0,0): anon6_Else
-Frame.dfy(123,19): Error: assertion violation
+Frame.dfy(123,18): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
diff --git a/Test/hofs/Lambda.dfy.expect b/Test/hofs/Lambda.dfy.expect
index 4fe8275f..ab57fbe0 100644
--- a/Test/hofs/Lambda.dfy.expect
+++ b/Test/hofs/Lambda.dfy.expect
@@ -1,4 +1,4 @@
-Lambda.dfy(24,12): Error: assertion violation
+Lambda.dfy(24,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
     Lambda.dfy(6,24): anon31_Else
diff --git a/Test/hofs/LambdaParsefail.dfy.expect b/Test/hofs/LambdaParsefail.dfy.expect
index 11deb9b0..a72fc978 100644
--- a/Test/hofs/LambdaParsefail.dfy.expect
+++ b/Test/hofs/LambdaParsefail.dfy.expect
@@ -1,6 +1,6 @@
-LambdaParsefail.dfy(5,19): error: this symbol not expected in VarDeclStatement
-LambdaParsefail.dfy(6,19): error: this symbol not expected in VarDeclStatement
-LambdaParsefail.dfy(7,21): error: this symbol not expected in VarDeclStatement
-LambdaParsefail.dfy(8,15): error: cannot declare identifier beginning with underscore
-LambdaParsefail.dfy(9,17): error: this symbol not expected in VarDeclStatement
+LambdaParsefail.dfy(5,18): Error: this symbol not expected in VarDeclStatement
+LambdaParsefail.dfy(6,18): Error: this symbol not expected in VarDeclStatement
+LambdaParsefail.dfy(7,20): Error: this symbol not expected in VarDeclStatement
+LambdaParsefail.dfy(8,14): Error: cannot declare identifier beginning with underscore
+LambdaParsefail.dfy(9,16): Error: this symbol not expected in VarDeclStatement
 5 parse errors detected in LambdaParsefail.dfy
diff --git a/Test/hofs/LambdaParsefail2.dfy.expect b/Test/hofs/LambdaParsefail2.dfy.expect
index 0c9ecb83..1a6a65dc 100644
--- a/Test/hofs/LambdaParsefail2.dfy.expect
+++ b/Test/hofs/LambdaParsefail2.dfy.expect
@@ -1,2 +1,2 @@
-LambdaParsefail2.dfy(6,39): error: invalid LambdaArrow
+LambdaParsefail2.dfy(6,38): Error: invalid LambdaArrow
 1 parse errors detected in LambdaParsefail2.dfy
diff --git a/Test/hofs/Naked.dfy.expect b/Test/hofs/Naked.dfy.expect
index 514952a1..9794478d 100644
--- a/Test/hofs/Naked.dfy.expect
+++ b/Test/hofs/Naked.dfy.expect
@@ -1,45 +1,45 @@
-Naked.dfy(9,16): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
+Naked.dfy(9,15): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Else
     (0,0): anon10_Else
     (0,0): anon11_Then
-Naked.dfy(12,8): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
+Naked.dfy(12,7): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
     (0,0): anon9_Else
     (0,0): anon10_Else
     (0,0): anon11_Else
-Naked.dfy(17,53): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
+Naked.dfy(17,52): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
     (0,0): anon7_Else
     (0,0): anon8_Else
-Naked.dfy(22,13): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
+Naked.dfy(22,12): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
-Naked.dfy(26,14): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
+Naked.dfy(26,13): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
-Naked.dfy(30,45): Error: possible violation of function precondition
-Naked.dfy(32,14): Related location
+Naked.dfy(30,44): Error: possible violation of function precondition
+Naked.dfy(32,13): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-Naked.dfy(32,15): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
+Naked.dfy(32,14): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
-Naked.dfy(38,9): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
+Naked.dfy(38,8): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
-Naked.dfy(42,10): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
+Naked.dfy(42,9): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
-Naked.dfy(45,30): Error: cannot prove termination; try supplying a decreases clause
+Naked.dfy(45,29): Error: cannot prove termination; try supplying a decreases clause
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-Naked.dfy(48,11): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
+Naked.dfy(48,10): Error: cannot use naked function in recursive setting. Possible solution: eta expansion.
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/hofs/OneShot.dfy.expect b/Test/hofs/OneShot.dfy.expect
index 91b931b8..0b4a2bb8 100644
--- a/Test/hofs/OneShot.dfy.expect
+++ b/Test/hofs/OneShot.dfy.expect
@@ -1,16 +1,16 @@
-OneShot.dfy(20,12): Error: possible violation of function precondition
+OneShot.dfy(20,11): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
     OneShot.dfy(13,8): anon5_Else
     (0,0): anon6_Then
-OneShot.dfy(22,12): Error: assertion violation
+OneShot.dfy(22,11): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
     OneShot.dfy(13,8): anon5_Else
     (0,0): anon6_Else
-OneShot.dfy(22,13): Error: possible violation of function precondition
+OneShot.dfy(22,12): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
diff --git a/Test/hofs/ReadsReads.dfy.expect b/Test/hofs/ReadsReads.dfy.expect
index cd013630..0a374c44 100644
--- a/Test/hofs/ReadsReads.dfy.expect
+++ b/Test/hofs/ReadsReads.dfy.expect
@@ -1,33 +1,33 @@
-ReadsReads.dfy(31,7): Error: insufficient reads clause to invoke function
+ReadsReads.dfy(31,6): Error: insufficient reads clause to invoke function
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-ReadsReads.dfy(36,5): Error: insufficient reads clause to invoke function
+ReadsReads.dfy(36,4): Error: insufficient reads clause to invoke function
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-ReadsReads.dfy(47,12): Error: insufficient reads clause to invoke function
+ReadsReads.dfy(47,11): Error: insufficient reads clause to invoke function
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-ReadsReads.dfy(58,7): Error: insufficient reads clause to invoke function
+ReadsReads.dfy(58,6): Error: insufficient reads clause to invoke function
 Execution trace:
     (0,0): anon0
     (0,0): anon4_Else
-ReadsReads.dfy(87,50): Error: assertion violation
+ReadsReads.dfy(87,49): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon16_Then
-ReadsReads.dfy(89,29): Error: assertion violation
+ReadsReads.dfy(89,28): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon18_Then
-ReadsReads.dfy(99,37): Error: assertion violation
+ReadsReads.dfy(99,36): Error: assertion violation
 Execution trace:
     (0,0): anon0
     ReadsReads.dfy(96,14): anon15_Else
     (0,0): anon19_Then
-ReadsReads.dfy(101,29): Error: assertion violation
+ReadsReads.dfy(101,28): Error: assertion violation
 Execution trace:
     (0,0): anon0
     ReadsReads.dfy(96,14): anon15_Else
diff --git a/Test/hofs/Simple.dfy.expect b/Test/hofs/Simple.dfy.expect
index e2f16ef3..c0123c80 100644
--- a/Test/hofs/Simple.dfy.expect
+++ b/Test/hofs/Simple.dfy.expect
@@ -1,26 +1,26 @@
-Simple.dfy(14,10): Error: possible division by zero
+Simple.dfy(14,9): Error: possible division by zero
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Else
     (0,0): anon7_Then
-Simple.dfy(27,10): Error: possible division by zero
+Simple.dfy(27,9): Error: possible division by zero
 Execution trace:
     (0,0): anon0
     (0,0): anon6_Else
     (0,0): anon7_Then
-Simple.dfy(37,9): Error: possible violation of function precondition
+Simple.dfy(37,8): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
     Simple.dfy(35,13): anon5_Else
-Simple.dfy(49,9): Error: possible violation of function precondition
+Simple.dfy(49,8): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
     (0,0): anon2
-Simple.dfy(61,10): Error: possible violation of function precondition
+Simple.dfy(61,9): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
-Simple.dfy(73,10): Error: assertion violation
+Simple.dfy(73,9): Error: assertion violation
 Execution trace:
     (0,0): anon0
     Simple.dfy(72,38): anon5_Else
diff --git a/Test/hofs/Twice.dfy.expect b/Test/hofs/Twice.dfy.expect
index 2476b945..0ce2450c 100644
--- a/Test/hofs/Twice.dfy.expect
+++ b/Test/hofs/Twice.dfy.expect
@@ -1,8 +1,8 @@
-Twice.dfy(27,22): Error: assertion violation
+Twice.dfy(27,21): Error: assertion violation
 Execution trace:
     (0,0): anon0
     Twice.dfy(23,12): anon3_Else
-Twice.dfy(35,32): Error: possible violation of function precondition
+Twice.dfy(35,31): Error: possible violation of function precondition
 Execution trace:
     (0,0): anon0
     (0,0): anon10_Else
diff --git a/Test/irondafny0/inheritreqs0.dfy.expect b/Test/irondafny0/inheritreqs0.dfy.expect
index eaadc85a..44e33bc0 100644
--- a/Test/irondafny0/inheritreqs0.dfy.expect
+++ b/Test/irondafny0/inheritreqs0.dfy.expect
@@ -1,5 +1,5 @@
-inheritreqs0.dfy(19,14): Error BP5002: A precondition for this call might not hold.
-inheritreqs0.dfy[Impl](6,18): Related location: This is the precondition that might not hold.
+inheritreqs0.dfy(19,13): Error BP5002: A precondition for this call might not hold.
+inheritreqs0.dfy[Impl](6,17): Related location: This is the precondition that might not hold.
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/irondafny0/inheritreqs1.dfy.expect b/Test/irondafny0/inheritreqs1.dfy.expect
index 27c76fee..a07d179d 100644
--- a/Test/irondafny0/inheritreqs1.dfy.expect
+++ b/Test/irondafny0/inheritreqs1.dfy.expect
@@ -1,5 +1,5 @@
-inheritreqs1.dfy(20,14): Error BP5002: A precondition for this call might not hold.
-inheritreqs1.dfy(15,18): Related location: This is the precondition that might not hold.
+inheritreqs1.dfy(20,13): Error BP5002: A precondition for this call might not hold.
+inheritreqs1.dfy(15,17): Related location: This is the precondition that might not hold.
 Execution trace:
     (0,0): anon0
 
diff --git a/Test/irondafny0/xrefine1.dfy.expect b/Test/irondafny0/xrefine1.dfy.expect
index ae844fc8..ec946cda 100644
--- a/Test/irondafny0/xrefine1.dfy.expect
+++ b/Test/irondafny0/xrefine1.dfy.expect
@@ -1,5 +1,5 @@
-xrefine1.dfy(71,13): Error BP5002: A precondition for this call might not hold.
-xrefine1.dfy[MainImpl](49,29): Related location: This is the precondition that might not hold.
+xrefine1.dfy(71,12): Error BP5002: A precondition for this call might not hold.
+xrefine1.dfy[MainImpl](49,28): Related location: This is the precondition that might not hold.
 Execution trace:
     (0,0): anon0
 
-- 
cgit v1.2.3


From 31005fdf54359aad3f33a54228d61d82e10bc679 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 23 Jul 2015 11:35:01 -0700
Subject: Fix a bug with includes and /useBaseNameForFileName

If /useBasenameForFilename is specified, tokens just contain file names, which
is not enough to locate included files.

Solution based on Rustan's advice.
---
 Source/Dafny/Dafny.atg  | 16 ++++++++--------
 Source/Dafny/Parser.cs  | 16 ++++++++--------
 Source/Dafny/Scanner.cs |  9 +++++++--
 3 files changed, 23 insertions(+), 18 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index c4f038d4..8a3bdb0e 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -41,11 +41,11 @@ public static int Parse (string/*!*/ filename, ModuleDecl module, BuiltIns built
   string s;
   if (filename == "stdin.dfy") {
     s = Microsoft.Boogie.ParserHelper.Fill(System.Console.In, new List<string>());
-    return Parse(s, filename, module, builtIns, errors, verifyThisFile);
+    return Parse(s, filename, filename, module, builtIns, errors, verifyThisFile);
   } else {
     using (System.IO.StreamReader reader = new System.IO.StreamReader(filename)) {
       s = Microsoft.Boogie.ParserHelper.Fill(reader, new List<string>());
-      return Parse(s, DafnyOptions.Clo.UseBaseNameForFileName ? Path.GetFileName(filename) : filename, module, builtIns, errors, verifyThisFile);
+      return Parse(s, filename, DafnyOptions.Clo.UseBaseNameForFileName ? Path.GetFileName(filename) : filename, module, builtIns, errors, verifyThisFile);
     }
   }
 }
@@ -55,12 +55,12 @@ public static int Parse (string/*!*/ filename, ModuleDecl module, BuiltIns built
 /// Returns the number of parsing errors encountered.
 /// Note: first initialize the Scanner.
 ///</summary>
-public static int Parse (string/*!*/ s, string/*!*/ filename, ModuleDecl module, BuiltIns builtIns, bool verifyThisFile=true) {
+public static int Parse (string/*!*/ s, string/*!*/ fullFilename, string/*!*/ filename, ModuleDecl module, BuiltIns builtIns, bool verifyThisFile=true) {
   Contract.Requires(s != null);
   Contract.Requires(filename != null);
   Contract.Requires(module != null);
   Errors errors = new Errors();
-  return Parse(s, filename, module, builtIns, errors, verifyThisFile);
+  return Parse(s, fullFilename, filename, module, builtIns, errors, verifyThisFile);
 }
 ///<summary>
 /// Parses top-level things (modules, classes, datatypes, class members)
@@ -68,15 +68,15 @@ public static int Parse (string/*!*/ s, string/*!*/ filename, ModuleDecl module,
 /// Returns the number of parsing errors encountered.
 /// Note: first initialize the Scanner with the given Errors sink.
 ///</summary>
-public static int Parse (string/*!*/ s, string/*!*/ filename, ModuleDecl module, BuiltIns builtIns,
-                         Errors/*!*/ errors, bool verifyThisFile=true) {
+public static int Parse (string/*!*/ s, string/*!*/ fullFilename, string/*!*/ filename, ModuleDecl module,
+                         BuiltIns builtIns, Errors/*!*/ errors, bool verifyThisFile=true) {
   Contract.Requires(s != null);
   Contract.Requires(filename != null);
   Contract.Requires(module != null);
   Contract.Requires(errors != null);
   byte[]/*!*/ buffer = cce.NonNull( UTF8Encoding.Default.GetBytes(s));
   MemoryStream ms = new MemoryStream(buffer,false);
-  Scanner scanner = new Scanner(ms, errors, filename);
+  Scanner scanner = new Scanner(ms, errors, fullFilename, filename);
   Parser parser = new Parser(scanner, errors, module, builtIns, verifyThisFile);
   parser.Parse();
   return parser.errors.count;
@@ -506,7 +506,7 @@ Dafny
      Contract.Assert(defaultModule != null);
   .)
   { "include" stringToken               (. {
-                                             string parsedFile = t.filename;
+                                             string parsedFile = scanner.FullFilename;
                                              bool isVerbatimString;
                                              string includedFile = Util.RemoveParsedStringQuotes(t.val, out isVerbatimString);
                                              includedFile = Util.RemoveEscaping(includedFile, isVerbatimString);
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index d50a4dd6..dae1b95e 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -112,11 +112,11 @@ public static int Parse (string/*!*/ filename, ModuleDecl module, BuiltIns built
   string s;
   if (filename == "stdin.dfy") {
     s = Microsoft.Boogie.ParserHelper.Fill(System.Console.In, new List<string>());
-    return Parse(s, filename, module, builtIns, errors, verifyThisFile);
+    return Parse(s, filename, filename, module, builtIns, errors, verifyThisFile);
   } else {
     using (System.IO.StreamReader reader = new System.IO.StreamReader(filename)) {
       s = Microsoft.Boogie.ParserHelper.Fill(reader, new List<string>());
-      return Parse(s, DafnyOptions.Clo.UseBaseNameForFileName ? Path.GetFileName(filename) : filename, module, builtIns, errors, verifyThisFile);
+      return Parse(s, filename, DafnyOptions.Clo.UseBaseNameForFileName ? Path.GetFileName(filename) : filename, module, builtIns, errors, verifyThisFile);
     }
   }
 }
@@ -126,12 +126,12 @@ public static int Parse (string/*!*/ filename, ModuleDecl module, BuiltIns built
 /// Returns the number of parsing errors encountered.
 /// Note: first initialize the Scanner.
 ///</summary>
-public static int Parse (string/*!*/ s, string/*!*/ filename, ModuleDecl module, BuiltIns builtIns, bool verifyThisFile=true) {
+public static int Parse (string/*!*/ s, string/*!*/ fullFilename, string/*!*/ filename, ModuleDecl module, BuiltIns builtIns, bool verifyThisFile=true) {
   Contract.Requires(s != null);
   Contract.Requires(filename != null);
   Contract.Requires(module != null);
   Errors errors = new Errors();
-  return Parse(s, filename, module, builtIns, errors, verifyThisFile);
+  return Parse(s, fullFilename, filename, module, builtIns, errors, verifyThisFile);
 }
 ///<summary>
 /// Parses top-level things (modules, classes, datatypes, class members)
@@ -139,15 +139,15 @@ public static int Parse (string/*!*/ s, string/*!*/ filename, ModuleDecl module,
 /// Returns the number of parsing errors encountered.
 /// Note: first initialize the Scanner with the given Errors sink.
 ///</summary>
-public static int Parse (string/*!*/ s, string/*!*/ filename, ModuleDecl module, BuiltIns builtIns,
-                         Errors/*!*/ errors, bool verifyThisFile=true) {
+public static int Parse (string/*!*/ s, string/*!*/ fullFilename, string/*!*/ filename, ModuleDecl module,
+                         BuiltIns builtIns, Errors/*!*/ errors, bool verifyThisFile=true) {
   Contract.Requires(s != null);
   Contract.Requires(filename != null);
   Contract.Requires(module != null);
   Contract.Requires(errors != null);
   byte[]/*!*/ buffer = cce.NonNull( UTF8Encoding.Default.GetBytes(s));
   MemoryStream ms = new MemoryStream(buffer,false);
-  Scanner scanner = new Scanner(ms, errors, filename);
+  Scanner scanner = new Scanner(ms, errors, fullFilename, filename);
   Parser parser = new Parser(scanner, errors, module, builtIns, verifyThisFile);
   parser.Parse();
   return parser.errors.count;
@@ -536,7 +536,7 @@ bool IsType(ref IToken pt) {
 			Get();
 			Expect(20);
 			{
-			 string parsedFile = t.filename;
+			 string parsedFile = scanner.FullFilename;
 			 bool isVerbatimString;
 			 string includedFile = Util.RemoveParsedStringQuotes(t.val, out isVerbatimString);
 			 includedFile = Util.RemoveEscaping(includedFile, isVerbatimString);
diff --git a/Source/Dafny/Scanner.cs b/Source/Dafny/Scanner.cs
index 325a2f2c..a73f510d 100644
--- a/Source/Dafny/Scanner.cs
+++ b/Source/Dafny/Scanner.cs
@@ -224,6 +224,7 @@ public class Scanner {
 		Contract.Invariant(pt != null);
 		Contract.Invariant(tval != null);
 		Contract.Invariant(Filename != null);
+		Contract.Invariant(FullFilename != null);
 		Contract.Invariant(errorHandler != null);
 	}
 
@@ -258,6 +259,8 @@ public class Scanner {
 	private string/*!*/ Filename;
 	private Errors/*!*/ errorHandler;
 
+	internal string/*!*/ FullFilename { get; private set; }
+
 	static Scanner() {
 		start = new Hashtable(128);
 		for (int i = 63; i <= 63; ++i) start[i] = 1;
@@ -310,7 +313,7 @@ public class Scanner {
 	}
 
 //	[NotDelayed]
-	public Scanner (string/*!*/ fileName, Errors/*!*/ errorHandler, bool useBaseName = false) : base() {
+	public Scanner (string/*!*/ fullFilename, string/*!*/ fileName, Errors/*!*/ errorHandler, bool useBaseName = false) : base() {
 	  Contract.Requires(fileName != null);
 	  Contract.Requires(errorHandler != null);
 		this.errorHandler = errorHandler;
@@ -319,6 +322,7 @@ public class Scanner {
 		try {
 			Stream stream = new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read);
 			this._buffer = new Buffer(stream, false);
+			this.FullFilename = fullFilename;
 			Filename = useBaseName? GetBaseName(fileName): fileName;
 			Init();
 		} catch (IOException) {
@@ -327,7 +331,7 @@ public class Scanner {
 	}
 
 //	[NotDelayed]
-	public Scanner (Stream/*!*/ s, Errors/*!*/ errorHandler, string/*!*/ fileName, bool useBaseName = false) : base() {
+	public Scanner (Stream/*!*/ s, Errors/*!*/ errorHandler, string/*!*/ fullFilename, string/*!*/ fileName, bool useBaseName = false) : base() {
 	  Contract.Requires(s != null);
 	  Contract.Requires(errorHandler != null);
 	  Contract.Requires(fileName != null);
@@ -335,6 +339,7 @@ public class Scanner {
 		t = new Token(); // dummy because t is a non-null field
 		this._buffer = new Buffer(s, true);
 		this.errorHandler = errorHandler;
+		this.FullFilename = fullFilename;
 		this.Filename = useBaseName? GetBaseName(fileName) : fileName;
 		Init();
 	}
-- 
cgit v1.2.3


From 4bcc3e82425441b077ff53a9c2b2a8442ff8936f Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 23 Jul 2015 15:03:40 -0700
Subject: Fix: Read clauses should be checked before lit lifting

The function IgnoreFuel in UnfoldingPerformance.dfy used to be lit-wrapped. It
shouldn't be, because its reads clause is non-empty. This is not a soundness
bug, but fixing it improves performance in cases where a function call would be
incorrectly unrolled.

Test case written by Rustan.
---
 Source/Dafny/Translator.cs                  | 30 ++++++++------
 Test/dafny0/UnfoldingPerformance.dfy        | 61 +++++++++++++++++++++++++++++
 Test/dafny0/UnfoldingPerformance.dfy.expect | 11 ++++++
 3 files changed, 91 insertions(+), 11 deletions(-)
 create mode 100644 Test/dafny0/UnfoldingPerformance.dfy
 create mode 100644 Test/dafny0/UnfoldingPerformance.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index b2c688d9..05633742 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -10824,6 +10824,7 @@ namespace Microsoft.Dafny {
             s = translator.FunctionCall(expr.tok, BuiltinFunction.SeqBuild, predef.BoxType, s, elt);
           }
           if (isLit) {
+            // Lit-lifting: All elements are lit, so the sequence is Lit too
             s = MaybeLit(s, predef.BoxType);
           }
           return s;
@@ -11033,30 +11034,37 @@ namespace Microsoft.Dafny {
 
           var ty = translator.TrType(e.Type);
           var id = new Bpl.IdentifierExpr(e.tok, e.Function.FullSanitizedName, ty);
-          bool returnLit;
-          var args = FunctionInvocationArguments(e, layerArgument, out returnLit);
 
+          bool argsAreLit;
+          var args = FunctionInvocationArguments(e, layerArgument, out argsAreLit);
           Expr result = new Bpl.NAryExpr(e.tok, new Bpl.FunctionCall(id), args);
           result = translator.CondApplyUnbox(e.tok, result, e.Function.ResultType, e.Type);
-          if (returnLit && Translator.FunctionBodyIsAvailable(e.Function, translator.currentModule)) {
+          
+          bool callIsLit = argsAreLit 
+            && Translator.FunctionBodyIsAvailable(e.Function, translator.currentModule)
+            && !e.Function.Reads.Any(); // Function could depend on external values
+          if (callIsLit) {
             result = MaybeLit(result, ty);
           }
+
           return result;
         } else if (expr is DatatypeValue) {
           DatatypeValue dtv = (DatatypeValue)expr;
           Contract.Assert(dtv.Ctor != null);  // since dtv has been successfully resolved
           List<Bpl.Expr> args = new List<Bpl.Expr>();
-          bool isLit = true;
+
+          bool argsAreLit = true;
           for (int i = 0; i < dtv.Arguments.Count; i++) {
             Expression arg = dtv.Arguments[i];
             Type t = dtv.Ctor.Formals[i].Type;
             var bArg = TrExpr(arg);
-            isLit = isLit && translator.IsLit(bArg);
+            argsAreLit = argsAreLit && translator.IsLit(bArg);
             args.Add(translator.CondApplyBox(expr.tok, bArg, cce.NonNull(arg.Type), t));
           }
           Bpl.IdentifierExpr id = new Bpl.IdentifierExpr(dtv.tok, dtv.Ctor.FullName, predef.DatatypeType);
           Bpl.Expr ret = new Bpl.NAryExpr(dtv.tok, new Bpl.FunctionCall(id), args);
-          if (isLit) {
+          if (argsAreLit) {
+            // If all arguments are Lit, so is the whole expression
             ret = MaybeLit(ret, predef.DatatypeType);
           }
           return ret;
@@ -11806,11 +11814,11 @@ namespace Microsoft.Dafny {
       }
 
       public List<Expr> FunctionInvocationArguments(FunctionCallExpr e, Bpl.Expr layerArgument) {
-        bool returnLit;
-        return FunctionInvocationArguments(e, layerArgument, out returnLit);
+        bool dummy;
+        return FunctionInvocationArguments(e, layerArgument, out dummy);
       }
 
-      public List<Expr> FunctionInvocationArguments(FunctionCallExpr e, Bpl.Expr layerArgument, out bool returnLit) {
+      public List<Expr> FunctionInvocationArguments(FunctionCallExpr e, Bpl.Expr layerArgument, out bool argsAreLit) {
         Contract.Requires(e != null);
         Contract.Ensures(Contract.Result<List<Bpl.Expr>>() != null);
 
@@ -11829,12 +11837,12 @@ namespace Microsoft.Dafny {
         if (!e.Function.IsStatic) {
           args.Add(TrExpr(e.Receiver));
         }
-        returnLit = true;
+        argsAreLit = true;
         for (int i = 0; i < e.Args.Count; i++) {
           Expression ee = e.Args[i];
           Type t = e.Function.Formals[i].Type;
           Expr tr_ee = TrExpr(ee);
-          returnLit = returnLit && translator.IsLit(tr_ee);
+          argsAreLit = argsAreLit && translator.IsLit(tr_ee);
           args.Add(translator.CondApplyBox(e.tok, tr_ee, cce.NonNull(ee.Type), t));
         }
         return args;
diff --git a/Test/dafny0/UnfoldingPerformance.dfy b/Test/dafny0/UnfoldingPerformance.dfy
new file mode 100644
index 00000000..3eed689a
--- /dev/null
+++ b/Test/dafny0/UnfoldingPerformance.dfy
@@ -0,0 +1,61 @@
+// RUN: %dafny /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+class C {
+  var x: nat
+  function method IgnoreFuel(): nat
+    reads this
+  {
+    x
+  }
+}
+
+function method Fib(n: int): int
+{
+  if n < 2 then n else Fib(n-2) + Fib(n-1)
+}
+
+method Test0() {
+  var c := new C;
+  var f := Fib(c.IgnoreFuel());
+  // with the bug, the following wwould take a long time before it reports an error
+  // after the bug fix, this still fails, but quickly
+  assert 0 <= f;
+}
+
+method Test1() {
+  var c := new C;
+  var f := Fib(c.x);
+  // the following assert will also fail, but quickly
+  assert 0 <= f;
+}
+
+method Test2() {
+  var c := new C;
+  c.x := 10;
+  var f := Fib(c.IgnoreFuel());
+  assert 0 <= f;  // passes
+}
+
+method Test3() {
+  var c := new C;
+  c.x := 10;
+  var f := Fib(c.x);
+  assert 0 <= f;  // passes
+}
+
+method Test4() {
+  var c := new C;
+  c.x := 10;
+  var f := Fib(c.x - 2);
+  assert 0 <= f;  // fails
+}
+
+method Test5(x: int)
+  requires 9 <= x - 1 && x + 1 <= 11
+{
+  var c := new C;
+  c.x := x;
+  var f := Fib(c.x);
+  assert 0 <= f;  // succeeds?
+}
diff --git a/Test/dafny0/UnfoldingPerformance.dfy.expect b/Test/dafny0/UnfoldingPerformance.dfy.expect
new file mode 100644
index 00000000..220fecc5
--- /dev/null
+++ b/Test/dafny0/UnfoldingPerformance.dfy.expect
@@ -0,0 +1,11 @@
+UnfoldingPerformance.dfy(23,11): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+UnfoldingPerformance.dfy(30,11): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+UnfoldingPerformance.dfy(51,11): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+
+Dafny program verifier finished with 11 verified, 3 errors
-- 
cgit v1.2.3


From 8a26fae8810b3a0419df1704de2b23926b95e92e Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 24 Jul 2015 17:33:56 -0700
Subject: Update DafnyExtension to use the parser constructor introduced in
 d2e394fc4b93

---
 Source/DafnyExtension/DafnyDriver.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/DafnyExtension/DafnyDriver.cs b/Source/DafnyExtension/DafnyDriver.cs
index 8300213c..61328fbf 100644
--- a/Source/DafnyExtension/DafnyDriver.cs
+++ b/Source/DafnyExtension/DafnyDriver.cs
@@ -116,7 +116,7 @@ namespace DafnyLanguage
       Dafny.ModuleDecl module = new Dafny.LiteralModuleDecl(new Dafny.DefaultModuleDecl(), null);
       Dafny.BuiltIns builtIns = new Dafny.BuiltIns();
       Dafny.Errors parseErrors = new VSErrors(this);
-      int errorCount = Dafny.Parser.Parse(_snapshot.GetText(), _filename, module, builtIns, parseErrors);
+      int errorCount = Dafny.Parser.Parse(_snapshot.GetText(), _filename, _filename, module, builtIns, parseErrors);
       string errString = Dafny.Main.ParseIncludes(module, builtIns, new List<string>(), parseErrors);
       if (errorCount != 0 || errString != null)
         return false;
-- 
cgit v1.2.3


From 1ca106492d5680c29bfa83b34ff79f7ff8407db7 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Fri, 24 Jul 2015 20:49:43 -0700
Subject: Translate triggers with the same ExpressionTranslator as the body

Signed-off-by: Clement Pit--Claudel <clement.pitclaudel@live.com>
---
 Source/Dafny/Translator.cs | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 05633742..3821e5df 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -10623,7 +10623,7 @@ namespace Microsoft.Dafny {
       
       public ExpressionTranslator WithNoLits() {
         Contract.Ensures(Contract.Result<ExpressionTranslator>() != null);
-        return new ExpressionTranslator(translator, predef, HeapExpr, This, null, layerInterCluster, layerIntraCluster, modifiesFrame, true);
+        return new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, layerInterCluster, layerIntraCluster, modifiesFrame, true);
       }
 
       public ExpressionTranslator LimitedFunctions(Function applyLimited_CurrentFunction, Bpl.Expr layerArgument) {
@@ -13039,9 +13039,10 @@ namespace Microsoft.Dafny {
           typeAntecedent = etran.TrBoundVariables(e.BoundVars, bvars);
           foreach (var kase in caseProduct) {
             var ante = BplAnd(BplAnd(typeAntecedent, ih), kase);
-            var bdy = etran.LayerOffset(1).TrExpr(e.LogicalBody());
+            var etranBody = etran.LayerOffset(1);
+            var bdy = etranBody.TrExpr(e.LogicalBody());
             Bpl.Expr q;
-            var trig = TrTrigger(etran, e.Attributes, expr.tok);
+            var trig = TrTrigger(etranBody, e.Attributes, expr.tok);
             if (position) {
               q = new Bpl.ForallExpr(kase.tok, bvars, trig, Bpl.Expr.Imp(ante, bdy));
             } else {
-- 
cgit v1.2.3


From c69d99690d9a25c448455df2bc8afee276b7b64c Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Mon, 27 Jul 2015 11:25:10 -0700
Subject: Clean up error reporting.

There now is one main entry point for reporting errors, warnings, or
information. Next step is to make the VS extension use that.
---
 Source/Dafny/Parser.cs     | 21 +++++++--------------
 Source/Dafny/Resolver.cs   | 12 +++---------
 Source/Dafny/Translator.cs |  2 +-
 Source/Dafny/Util.cs       | 23 +++++++++++++++++++++++
 4 files changed, 34 insertions(+), 24 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index dae1b95e..53921bb1 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -4428,9 +4428,6 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 public class Errors {
 	public int count = 0;                                    // number of errors detected
-	public System.IO.TextWriter/*!*/ errorStream = Console.Out;   // error messages go to this stream
-	public string errMsgFormat = "{0}({1},{2}): Error: {3}"; // 0=filename, 1=line, 2=column, 3=text
-	public string warningMsgFormat = "{0}({1},{2}): Warning: {3}"; // 0=filename, 1=line, 2=column, 3=text
 
 	public void SynErr(string filename, int line, int col, int n) {
 		SynErr(filename, line, col, GetSyntaxErrorString(n));
@@ -4438,7 +4435,7 @@ public class Errors {
 
 	public virtual void SynErr(string filename, int line, int col, string/*!*/ msg) {
 		Contract.Requires(msg != null);
-		errorStream.WriteLine(errMsgFormat, filename, line, col - 1, msg);
+		Dafny.Util.ReportIssue("Error", filename, line, col, msg);
 		count++;
 	}
 
@@ -4693,27 +4690,23 @@ public class Errors {
 		return s;
 	}
 
-	public void SemErr(IToken/*!*/ tok, string/*!*/ msg) {  // semantic errors
+	public void SemErr(IToken/*!*/ tok, string/*!*/ msg) {	// semantic errors
 		Contract.Requires(tok != null);
 		Contract.Requires(msg != null);
-		SemErr(tok.filename, tok.line, tok.col, msg);
+		Dafny.Util.ReportIssue("Error", tok, msg);
+		count++;
 	}
 
 	public virtual void SemErr(string filename, int line, int col, string/*!*/ msg) {
 		Contract.Requires(msg != null);
-		errorStream.WriteLine(errMsgFormat, filename, line, col - 1, msg);
+		Dafny.Util.ReportIssue("Error", filename, line, col, msg);
 		count++;
 	}
 
-	public void Warning(IToken/*!*/ tok, string/*!*/ msg) {  // warnings
+	public void Warning(IToken/*!*/ tok, string/*!*/ msg) {	 // warnings
 		Contract.Requires(tok != null);
 		Contract.Requires(msg != null);
-		Warning(tok.filename, tok.line, tok.col, msg);
-	}
-
-	public virtual void Warning(string filename, int line, int col, string msg) {
-		Contract.Requires(msg != null);
-		errorStream.WriteLine(warningMsgFormat, filename, line, col - 1, msg);
+		Dafny.Util.ReportIssue("Warning", tok, msg);
 	}
 } // Errors
 
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 44990d7d..e3083133 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -24,9 +24,7 @@ namespace Microsoft.Dafny
       Contract.Requires(msg != null);
       ConsoleColor col = Console.ForegroundColor;
       Console.ForegroundColor = ConsoleColor.Red;
-      Console.WriteLine("{0}({1},{2}): Error: {3}",
-          DafnyOptions.Clo.UseBaseNameForFileName ? System.IO.Path.GetFileName(tok.filename) : tok.filename, tok.line, tok.col - 1,
-          string.Format(msg, args));
+      Dafny.Util.ReportIssue("Error", tok, msg, args);
       Console.ForegroundColor = col;
       ErrorCount++;
     }
@@ -66,9 +64,7 @@ namespace Microsoft.Dafny
       if (reportWarnings) {
         ConsoleColor col = Console.ForegroundColor;
         Console.ForegroundColor = ConsoleColor.Yellow;
-        Console.WriteLine("{0}({1},{2}): Warning: {3}",
-            DafnyOptions.Clo.UseBaseNameForFileName ? System.IO.Path.GetFileName(tok.filename) : tok.filename, tok.line, tok.col - 1,
-            string.Format(msg, args));
+        Dafny.Util.ReportIssue("Warning", tok, msg, args);
         Console.ForegroundColor = col;
       }
     }
@@ -281,9 +277,7 @@ namespace Microsoft.Dafny
     }
 
     public static void DefaultInformationReporter(AdditionalInformation info) {
-      Console.WriteLine("{0}({1},{2}): Info: {3}",
-                        DafnyOptions.Clo.UseBaseNameForFileName ? System.IO.Path.GetFileName(info.Token.filename) : info.Token.filename,
-                        info.Token.line, info.Token.col - 1, info.Text);
+      Dafny.Util.ReportIssue("Info", info.Token, info.Text);
     }
 
     public void ResolveProgram(Program prog) {
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 05633742..e2c45558 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -3609,7 +3609,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(tok != null);
       Contract.Ensures(Contract.Result<Bpl.Cmd>() != null);
       var col = tok.col + (isEndToken ? tok.val.Length : 0);
-      string description = string.Format("{0}({1},{2}){3}{4}", tok.filename, tok.line, col, additionalInfo == null ? "" : ": ", additionalInfo ?? "");
+      string description = Util.ReportIssueToString_Bare(additionalInfo == null ? "" : ": ", tok.filename, tok.line, tok.col, additionalInfo ?? "");
       QKeyValue kv = new QKeyValue(tok, "captureState", new List<object>() { description }, null);
       return new Bpl.AssumeCmd(tok, Bpl.Expr.True, kv);
     }
diff --git a/Source/Dafny/Util.cs b/Source/Dafny/Util.cs
index 63659696..6162d32c 100644
--- a/Source/Dafny/Util.cs
+++ b/Source/Dafny/Util.cs
@@ -67,6 +67,29 @@ namespace Microsoft.Dafny {
       return res;
     }
 
+    internal static void ReportIssue(string header, IToken tok, string msg, params object[] args) {
+      ReportIssue(header, tok, String.Format(msg, args));
+    }
+
+    internal static void ReportIssue(string header, IToken tok, string msg) {
+      ReportIssue(header, tok.filename, tok.line, tok.col, msg);
+    }
+
+    internal static void ReportIssue(string header, string filename, int line, int column, string msg) {
+      Console.WriteLine(ReportIssueToString(header, filename, line, column, msg));
+    }
+
+    internal static string ReportIssueToString(string header, string filename, int line, int column, string msg) {
+      Contract.Requires(header != null);
+      Contract.Requires(filename != null);
+      Contract.Requires(msg != null);
+      return ReportIssueToString_Bare(": " + header, filename, line, column, ": " + msg);
+    }
+
+    internal static string ReportIssueToString_Bare(string header, string filename, int line, int column, string msg) {
+      return String.Format("{0}({1},{2}){3}{4}", filename, line, column - 1, header, msg ?? "");
+    }
+
     /// <summary>
     /// Returns s but with all occurrences of '_' removed.
     /// </summary>
-- 
cgit v1.2.3


From b61088661bea206390f487ed813fd350a50eb084 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Mon, 27 Jul 2015 11:25:38 -0700
Subject: Small refactoring

---
 Source/Dafny/Util.cs | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Util.cs b/Source/Dafny/Util.cs
index 6162d32c..a0a7fe36 100644
--- a/Source/Dafny/Util.cs
+++ b/Source/Dafny/Util.cs
@@ -95,13 +95,7 @@ namespace Microsoft.Dafny {
     /// </summary>
     public static string RemoveUnderscores(string s) {
       Contract.Requires(s != null);
-      while (true) {
-        var j = s.IndexOf('_');
-        if (j == -1) {
-          return s;
-        }
-        s = s.Substring(0, j) + s.Substring(j + 1);
-      }
+      return s.Replace("_", "");
     }
 
     /// <summary>
-- 
cgit v1.2.3


From 8d1676a6d30e295d57e7e64fc58d103771459974 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Mon, 27 Jul 2015 11:28:39 -0700
Subject: Clarify the inlining warning.

---
 Source/Dafny/Translator.cs                | 8 ++------
 Test/dafny0/TriggerInPredicate.dfy.expect | 4 ++--
 2 files changed, 4 insertions(+), 8 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index e2c45558..83078fb5 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -12956,12 +12956,8 @@ namespace Microsoft.Dafny {
           } else {
             // Skip inlining, as it would cause arbitrary expressions to pop up in the trigger
             // CLEMENT: Report inlining issue in a VS plugin friendly way
-            var info = new AdditionalInformation {
-              Token = fexp.tok,
-              Length = fexp.tok.val.Length,
-              Text = "This call cannot be safely inlined.",
-            };
-            Resolver.DefaultInformationReporter(info);
+            //CLEMENT this should appear at the outmost call site, not at the innermost. See SnapshotableTrees.dfy
+            Dafny.Util.ReportIssue("Info", fexp.tok, "Some instances of this call cannot safely be inlined.");
           }
         }
 
diff --git a/Test/dafny0/TriggerInPredicate.dfy.expect b/Test/dafny0/TriggerInPredicate.dfy.expect
index 47b3bdf9..7f6e0268 100644
--- a/Test/dafny0/TriggerInPredicate.dfy.expect
+++ b/Test/dafny0/TriggerInPredicate.dfy.expect
@@ -1,4 +1,4 @@
-TriggerInPredicate.dfy(9,20): Info: This call cannot be safely inlined.
-TriggerInPredicate.dfy(9,20): Info: This call cannot be safely inlined.
+TriggerInPredicate.dfy(9,20): Info: Some instances of this call cannot safely be inlined.
+TriggerInPredicate.dfy(9,20): Info: Some instances of this call cannot safely be inlined.
 
 Dafny program verifier finished with 8 verified, 0 errors
-- 
cgit v1.2.3


From d5eb6e9e4c8e4f71e3bb48e0a40fc412e9a5e65e Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Mon, 27 Jul 2015 18:59:02 -0700
Subject: Updated parser generation to work with latest update in
 boogiepartners. Note that Coco.exe is now included in boogiepartners.

---
 Source/Dafny/Makefile  |  2 +-
 Source/Dafny/Parser.cs | 29 ++++++++++++++---------------
 2 files changed, 15 insertions(+), 16 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Makefile b/Source/Dafny/Makefile
index e8c0f5e0..68ab7a2d 100644
--- a/Source/Dafny/Makefile
+++ b/Source/Dafny/Makefile
@@ -4,7 +4,7 @@
 # from http://boogiepartners.codeplex.com/. Update the FRAME_DIR variable to
 # point to whatever directory you install that into.
 # ###############################################################################
-COCO_EXE_DIR = ..\..\..\boogie-partners\CocoRdownload
+COCO_EXE_DIR = ..\..\..\boogie-partners\CocoR\bin
 FRAME_DIR = ..\..\..\boogie-partners\CocoR\Modified
 COCO = $(COCO_EXE_DIR)\Coco.exe
 
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index dae1b95e..b4f45159 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -78,11 +78,11 @@ public class Parser {
 	const bool _x = false;
 	const int minErrDist = 2;
 
-	public Scanner/*!*/ scanner;
-	public Errors/*!*/  errors;
+	public Scanner scanner;
+	public Errors  errors;
 
-	public Token/*!*/ t;    // last recognized token
-	public Token/*!*/ la;   // lookahead token
+	public Token t;    // last recognized token
+	public Token la;   // lookahead token
 	int errDist = minErrDist;
 
 readonly Expression/*!*/ dummyExpr;
@@ -454,10 +454,10 @@ bool IsType(ref IToken pt) {
 /*--------------------------------------------------------------------------*/
 
 
-	public Parser(Scanner/*!*/ scanner, Errors/*!*/ errors) {
+	public Parser(Scanner scanner, Errors errors) {
 		this.scanner = scanner;
 		this.errors = errors;
-		Token/*!*/ tok = new Token();
+		Token tok = new Token();
 		tok.val = "";
 		this.la = tok;
 		this.t = new Token(); // just to satisfy its non-null constraint
@@ -468,13 +468,13 @@ bool IsType(ref IToken pt) {
 		errDist = 0;
 	}
 
-	public void SemErr (string/*!*/ msg) {
+	public void SemErr (string msg) {
 		Contract.Requires(msg != null);
 		if (errDist >= minErrDist) errors.SemErr(t, msg);
 		errDist = 0;
 	}
 
-	public void SemErr(IToken/*!*/ tok, string/*!*/ msg) {
+	public void SemErr(IToken tok, string msg) {
 	  Contract.Requires(tok != null);
 	  Contract.Requires(msg != null);
 	  errors.SemErr(tok, msg);
@@ -4385,10 +4385,9 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Dafny();
 		Expect(0);
 
-		Expect(0);
 	}
 
-	static readonly bool[,]/*!*/ set = {
+	static readonly bool[,] set = {
 		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_T, _x,_x,_T,_T, _T,_x,_x,_T, _T,_x,_x,_T, _T,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
 		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
 		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
@@ -4428,7 +4427,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 public class Errors {
 	public int count = 0;                                    // number of errors detected
-	public System.IO.TextWriter/*!*/ errorStream = Console.Out;   // error messages go to this stream
+	public System.IO.TextWriter errorStream = Console.Out;   // error messages go to this stream
 	public string errMsgFormat = "{0}({1},{2}): Error: {3}"; // 0=filename, 1=line, 2=column, 3=text
 	public string warningMsgFormat = "{0}({1},{2}): Warning: {3}"; // 0=filename, 1=line, 2=column, 3=text
 
@@ -4436,7 +4435,7 @@ public class Errors {
 		SynErr(filename, line, col, GetSyntaxErrorString(n));
 	}
 
-	public virtual void SynErr(string filename, int line, int col, string/*!*/ msg) {
+	public virtual void SynErr(string filename, int line, int col, string msg) {
 		Contract.Requires(msg != null);
 		errorStream.WriteLine(errMsgFormat, filename, line, col - 1, msg);
 		count++;
@@ -4693,19 +4692,19 @@ public class Errors {
 		return s;
 	}
 
-	public void SemErr(IToken/*!*/ tok, string/*!*/ msg) {  // semantic errors
+	public void SemErr(IToken tok, string msg) {  // semantic errors
 		Contract.Requires(tok != null);
 		Contract.Requires(msg != null);
 		SemErr(tok.filename, tok.line, tok.col, msg);
 	}
 
-	public virtual void SemErr(string filename, int line, int col, string/*!*/ msg) {
+	public virtual void SemErr(string filename, int line, int col, string msg) {
 		Contract.Requires(msg != null);
 		errorStream.WriteLine(errMsgFormat, filename, line, col - 1, msg);
 		count++;
 	}
 
-	public void Warning(IToken/*!*/ tok, string/*!*/ msg) {  // warnings
+	public void Warning(IToken tok, string msg) {  // warnings
 		Contract.Requires(tok != null);
 		Contract.Requires(msg != null);
 		Warning(tok.filename, tok.line, tok.col, msg);
-- 
cgit v1.2.3


From 13bb45d5350cb6b0ce6b731d6552780b0d147265 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Wed, 29 Jul 2015 16:55:49 -0700
Subject: Update the VS extension to use the error interface defined in
 576eac2e17ff

---
 Source/Dafny/Parser.cs               |  2 +-
 Source/Dafny/Util.cs                 | 10 +++++-----
 Source/DafnyExtension/DafnyDriver.cs |  4 ++--
 3 files changed, 8 insertions(+), 8 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index 86a185a4..fd6fb026 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -4702,7 +4702,7 @@ public class Errors {
 		count++;
 	}
 
-	public void Warning(IToken tok, string msg) {  // warnings
+	public virtual void Warning(IToken tok, string msg) {  // warnings
 		Contract.Requires(tok != null);
 		Contract.Requires(msg != null);
 		Dafny.Util.ReportIssue("Warning", tok, msg);
diff --git a/Source/Dafny/Util.cs b/Source/Dafny/Util.cs
index a0a7fe36..508d23c6 100644
--- a/Source/Dafny/Util.cs
+++ b/Source/Dafny/Util.cs
@@ -67,26 +67,26 @@ namespace Microsoft.Dafny {
       return res;
     }
 
-    internal static void ReportIssue(string header, IToken tok, string msg, params object[] args) {
+    public static void ReportIssue(string header, IToken tok, string msg, params object[] args) {
       ReportIssue(header, tok, String.Format(msg, args));
     }
 
-    internal static void ReportIssue(string header, IToken tok, string msg) {
+    public static void ReportIssue(string header, IToken tok, string msg) {
       ReportIssue(header, tok.filename, tok.line, tok.col, msg);
     }
 
-    internal static void ReportIssue(string header, string filename, int line, int column, string msg) {
+    public static void ReportIssue(string header, string filename, int line, int column, string msg) {
       Console.WriteLine(ReportIssueToString(header, filename, line, column, msg));
     }
 
-    internal static string ReportIssueToString(string header, string filename, int line, int column, string msg) {
+    public static string ReportIssueToString(string header, string filename, int line, int column, string msg) {
       Contract.Requires(header != null);
       Contract.Requires(filename != null);
       Contract.Requires(msg != null);
       return ReportIssueToString_Bare(": " + header, filename, line, column, ": " + msg);
     }
 
-    internal static string ReportIssueToString_Bare(string header, string filename, int line, int column, string msg) {
+    public static string ReportIssueToString_Bare(string header, string filename, int line, int column, string msg) {
       return String.Format("{0}({1},{2}){3}{4}", filename, line, column - 1, header, msg ?? "");
     }
 
diff --git a/Source/DafnyExtension/DafnyDriver.cs b/Source/DafnyExtension/DafnyDriver.cs
index 61328fbf..640ef67c 100644
--- a/Source/DafnyExtension/DafnyDriver.cs
+++ b/Source/DafnyExtension/DafnyDriver.cs
@@ -151,8 +151,8 @@ namespace DafnyLanguage
         dd.RecordError(filename, line - 1, col - 1, ErrorCategory.ResolveError, msg);
         count++;
       }
-      public override void Warning(string filename, int line, int col, string msg) {
-        dd.RecordError(filename, line - 1, col - 1, ErrorCategory.ParseWarning, msg);
+      public override void Warning(IToken tok, string msg) {
+        dd.RecordError(tok.filename, tok.line - 1, tok.col - 1, ErrorCategory.ParseWarning, msg);
       }
     }
 
-- 
cgit v1.2.3


From 7e7eb1a4177e03f6bb22411b7246db1d26f5ed27 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Wed, 29 Jul 2015 17:35:18 -0700
Subject: Fixed crash in resolution where, after reporting an error, the cases
 #type and #module were not handled

---
 Source/Dafny/Resolver.cs                |  4 ++++
 Test/dafny0/ResolutionErrors.dfy        | 24 ++++++++++++++++++++++++
 Test/dafny0/ResolutionErrors.dfy.expect | 16 +++++++++++++++-
 3 files changed, 43 insertions(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index e3083133..e977dbd5 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -4491,6 +4491,10 @@ namespace Microsoft.Dafny
           // something is wrong; either aa or bb wasn't properly resolved, or they don't unify
           return false;
         }
+      } else if (a is Resolver_IdentifierExpr.ResolverType_Type) {
+        return b is Resolver_IdentifierExpr.ResolverType_Type;
+      } else if (a is Resolver_IdentifierExpr.ResolverType_Module) {
+        return b is Resolver_IdentifierExpr.ResolverType_Module;
       } else {
         Contract.Assert(false); throw new cce.UnreachableException();  // unexpected type
       }
diff --git a/Test/dafny0/ResolutionErrors.dfy b/Test/dafny0/ResolutionErrors.dfy
index 8c910959..900c7459 100644
--- a/Test/dafny0/ResolutionErrors.dfy
+++ b/Test/dafny0/ResolutionErrors.dfy
@@ -1349,3 +1349,27 @@ module TupleEqualitySupport {
   datatype GoodRecord = GoodRecord(set<(int,int)>)
   datatype BadRecord = BadRecord(set<(int, int->bool)>)  // error: this tuple type does not support equality
 }
+
+// ------------------- non-type variable names -------------------
+
+module NonTypeVariableNames {
+  type X = int
+
+  module Y { }
+
+  method M(m: map<real,string>)
+  {
+    assert X == X;  // error (x2): type name used as variable
+    assert Y == Y;  // error (x2): module name used as variable
+    assert X in m;  // error (x2): type name used as variable
+    assert Y in m;  // error (x2): module name used as variable
+  }
+
+  method N(k: int)
+  {
+    assert k == X;  // error (x2): type name used as variable
+    assert k == Y;  // error (x2): module name used as variable
+    X := k;  // error: type name used as variable
+    Y := k;  // error: module name used as variable
+  }
+}
diff --git a/Test/dafny0/ResolutionErrors.dfy.expect b/Test/dafny0/ResolutionErrors.dfy.expect
index ae3e8cbf..481b47e0 100644
--- a/Test/dafny0/ResolutionErrors.dfy.expect
+++ b/Test/dafny0/ResolutionErrors.dfy.expect
@@ -90,6 +90,20 @@ ResolutionErrors.dfy(1329,15): Error: The name Inner ambiguously refers to a typ
 ResolutionErrors.dfy(1339,29): Error: ghost variables are allowed only in specification contexts
 ResolutionErrors.dfy(1341,49): Error: ghost variables are allowed only in specification contexts
 ResolutionErrors.dfy(1341,54): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(1362,11): Error: name of type (X) is used as a variable
+ResolutionErrors.dfy(1362,16): Error: name of type (X) is used as a variable
+ResolutionErrors.dfy(1363,11): Error: name of module (Y) is used as a variable
+ResolutionErrors.dfy(1363,16): Error: name of module (Y) is used as a variable
+ResolutionErrors.dfy(1364,11): Error: name of type (X) is used as a variable
+ResolutionErrors.dfy(1364,13): Error: second argument to "in" must be a set, multiset, or sequence with elements of type #type, or a map with domain #type (instead got map<real, string>)
+ResolutionErrors.dfy(1365,11): Error: name of module (Y) is used as a variable
+ResolutionErrors.dfy(1365,13): Error: second argument to "in" must be a set, multiset, or sequence with elements of type #module, or a map with domain #module (instead got map<real, string>)
+ResolutionErrors.dfy(1370,16): Error: name of type (X) is used as a variable
+ResolutionErrors.dfy(1370,13): Error: arguments must have the same type (got int and #type)
+ResolutionErrors.dfy(1371,16): Error: name of module (Y) is used as a variable
+ResolutionErrors.dfy(1371,13): Error: arguments must have the same type (got int and #module)
+ResolutionErrors.dfy(1372,4): Error: name of type (X) is used as a variable
+ResolutionErrors.dfy(1373,4): Error: name of module (Y) is used as a variable
 ResolutionErrors.dfy(432,2): Error: More than one anonymous constructor
 ResolutionErrors.dfy(50,13): Error: 'this' is not allowed in a 'static' context
 ResolutionErrors.dfy(87,14): Error: the name 'Benny' denotes a datatype constructor, but does not do so uniquely; add an explicit qualification (for example, 'Abc.Benny')
@@ -182,4 +196,4 @@ ResolutionErrors.dfy(1106,8): Error: new cannot be applied to a trait
 ResolutionErrors.dfy(1127,13): Error: first argument to / must be of numeric type (instead got set<bool>)
 ResolutionErrors.dfy(1134,18): Error: a call to a possibly non-terminating method is allowed only if the calling method is also declared (with 'decreases *') to be possibly non-terminating
 ResolutionErrors.dfy(1149,14): Error: a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating
-184 resolution/type errors detected in ResolutionErrors.dfy
+198 resolution/type errors detected in ResolutionErrors.dfy
-- 
cgit v1.2.3


From e93d4804f9d99150079728572c00a518af20a7c5 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 30 Jul 2015 12:04:16 -0700
Subject: Implement a Dafny server.

The Dafny server is a command line utility that allows non-.Net editors to take
advantage of Dafny's caching facilities, as used by the Dafny extension for
Visual Studio. The server is essentially a REPL, which produces output in the
same format as the Dafny CLI; clients thus do not need to understand the
internals of Dafny's caching. A typical editing session proceeds as follows:

* When a new Dafny file is opened, the editor starts a new instance of the
  Dafny server. The cache is blank at that point.
* The editor sends a copy of the buffer for initial verification. This takes
  some time, after which the server returns a list of errors.
* The user makes modifications; the editor periodically sends a new copy of
  the buffer's contents to the Dafny server, which quickly returns an updated
  list of errors.

The client-server protocol is sequential, uses JSON, and works over ASCII
pipes by base64-encoding queries. It defines one type of query, and two types
of responses:

Queries are of the following form:
   verify
   <base64 encoded JSON payload>
   [[DAFNY-CLIENT: EOM]]

Responses are of the following form:
   <list of errors and usual output, as produced by the Dafny CLI>
   [SUCCESS] [[DAFNY-SERVER: EOM]]
or
   <error message>
   [FAILURE] [[DAFNY-SERVER: EOM]]

The JSON payload is an array with 4 fields:
   * args:   An array of Dafny arguments, as passed to the Dafny CLI
   * source: A Dafny program, or the path to a Dafny source file.
   * sourceIsFile: A boolean indicating whether the 'source' argument is a
                   Dafny program or the path to one.
   * filename:     The name of the original source file, to be used in error
                   messages

For small files, embedding the Dafny source directly into a message is
convenient; for larger files, however, it is generally better for performance
to write the source snapshot to a separate file, and to pass that to Dafny
by setting the 'sourceIsFile' flag to true.
---
 Source/DafnyServer.sln                        |  20 ++
 Source/DafnyServer/App.config                 |   6 +
 Source/DafnyServer/DafnyServer.csproj         |  75 +++++++
 Source/DafnyServer/Properties/AssemblyInfo.cs |  36 ++++
 Source/DafnyServer/Server.cs                  | 269 ++++++++++++++++++++++++++
 5 files changed, 406 insertions(+)
 create mode 100644 Source/DafnyServer.sln
 create mode 100644 Source/DafnyServer/App.config
 create mode 100644 Source/DafnyServer/DafnyServer.csproj
 create mode 100644 Source/DafnyServer/Properties/AssemblyInfo.cs
 create mode 100644 Source/DafnyServer/Server.cs

(limited to 'Source')

diff --git a/Source/DafnyServer.sln b/Source/DafnyServer.sln
new file mode 100644
index 00000000..217b1c74
--- /dev/null
+++ b/Source/DafnyServer.sln
@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 2012
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DafnyServer", "DafnyServer\DafnyServer.csproj", "{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal
diff --git a/Source/DafnyServer/App.config b/Source/DafnyServer/App.config
new file mode 100644
index 00000000..fad249e4
--- /dev/null
+++ b/Source/DafnyServer/App.config
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<configuration>
+    <startup> 
+        <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
+    </startup>
+</configuration>
\ No newline at end of file
diff --git a/Source/DafnyServer/DafnyServer.csproj b/Source/DafnyServer/DafnyServer.csproj
new file mode 100644
index 00000000..0aac88b2
--- /dev/null
+++ b/Source/DafnyServer/DafnyServer.csproj
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}</ProjectGuid>
+    <OutputType>Exe</OutputType>
+    <AppDesignerFolder>Properties</AppDesignerFolder>
+    <RootNamespace>DafnyServer</RootNamespace>
+    <AssemblyName>DafnyServer</AssemblyName>
+    <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+    <FileAlignment>512</FileAlignment>
+    <StartupObject>Microsoft.Dafny.Server</StartupObject>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>..\..\Binaries\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>..\..\Binaries\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Core">
+      <HintPath>..\..\..\boogie\Binaries\Core.dll</HintPath>
+    </Reference>
+    <Reference Include="ExecutionEngine">
+      <HintPath>..\..\..\boogie\Binaries\ExecutionEngine.dll</HintPath>
+    </Reference>
+    <Reference Include="ParserHelper">
+      <HintPath>..\..\..\boogie\Binaries\ParserHelper.dll</HintPath>
+    </Reference>
+    <Reference Include="Provers.SMTLib">
+      <HintPath>..\..\..\boogie\Binaries\Provers.SMTLib.dll</HintPath>
+    </Reference>
+    <Reference Include="System" />
+    <Reference Include="System.Core" />
+    <Reference Include="System.Runtime.Serialization" />
+    <Reference Include="System.Xml.Linq" />
+    <Reference Include="Microsoft.CSharp" />
+    <Reference Include="DafnyPipeline">
+      <HintPath>..\..\Binaries\DafnyPipeline.dll</HintPath>
+    </Reference>
+    <Reference Include="System.Xml" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="Properties\AssemblyInfo.cs" />
+    <Compile Include="Server.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="App.config" />
+    <None Include="DafnyPrelude.bpl">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </None>
+  </ItemGroup>
+  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+  <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
+       Other similar extension points exist, see Microsoft.Common.targets.
+  <Target Name="BeforeBuild">
+  </Target>
+  <Target Name="AfterBuild">
+  </Target>
+  -->
+</Project>
diff --git a/Source/DafnyServer/Properties/AssemblyInfo.cs b/Source/DafnyServer/Properties/AssemblyInfo.cs
new file mode 100644
index 00000000..5b996543
--- /dev/null
+++ b/Source/DafnyServer/Properties/AssemblyInfo.cs
@@ -0,0 +1,36 @@
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+// General Information about an assembly is controlled through the following 
+// set of attributes. Change these attribute values to modify the information
+// associated with an assembly.
+[assembly: AssemblyTitle("Dafny Server")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyConfiguration("")]
+[assembly: AssemblyCompany("Microsoft Research")]
+[assembly: AssemblyProduct("Dafny Server")]
+[assembly: AssemblyCopyright("Copyright ©  2015")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyCulture("")]
+
+// Setting ComVisible to false makes the types in this assembly not visible 
+// to COM components.  If you need to access a type in this assembly from 
+// COM, set the ComVisible attribute to true on that type.
+[assembly: ComVisible(false)]
+
+// The following GUID is for the ID of the typelib if this project is exposed to COM
+[assembly: Guid("44d9c1c1-773b-47c1-b876-2de17e70152e")]
+
+// Version information for an assembly consists of the following four values:
+//
+//      Major Version
+//      Minor Version 
+//      Build Number
+//      Revision
+//
+// You can specify all the values or you can default the Build and Revision Numbers 
+// by using the '*' as shown below:
+// [assembly: AssemblyVersion("1.0.*")]
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
diff --git a/Source/DafnyServer/Server.cs b/Source/DafnyServer/Server.cs
new file mode 100644
index 00000000..36c28627
--- /dev/null
+++ b/Source/DafnyServer/Server.cs
@@ -0,0 +1,269 @@
+using System;
+using System.IO;
+using System.Text;
+using System.Collections.Generic;
+using System.Runtime.Serialization;
+using System.Runtime.Serialization.Json;
+
+using Dafny = Microsoft.Dafny;
+using Bpl = Microsoft.Boogie;
+using Microsoft.Boogie;
+
+namespace Microsoft.Dafny {
+  class Interaction {
+    internal static string SUCCESS = "SUCCESS";
+    internal static string FAILURE = "FAILURE";
+    internal static string SERVER_EOM_TAG = "[[DAFNY-SERVER: EOM]]";
+    internal static string CLIENT_EOM_TAG = "[[DAFNY-CLIENT: EOM]]";
+
+    internal static void EOM(string header, string msg) {
+      var trailer = (msg == null) ? "" : "\n";
+      Console.Write("{0}{1}[{2}] {3}\n", msg ?? "", trailer, header, SERVER_EOM_TAG);
+      Console.Out.Flush();
+    }
+
+    internal static void EOM(string header, Exception ex, string subHeader="") {
+      var aggregate = ex as AggregateException;
+      subHeader = String.IsNullOrEmpty(subHeader) ? "" : subHeader + " ";
+
+      if (aggregate == null) {
+        EOM(header, subHeader + ex.Message);
+      } else {
+        EOM(header, subHeader + aggregate.InnerExceptions.MapConcat(exn => exn.Message, ", "));
+      }
+    }
+  }
+
+  // FIXME: This should not be duplicated here
+  class DafnyConsolePrinter : ConsolePrinter {
+    public override void ReportBplError(IToken tok, string message, bool error, TextWriter tw, string category = null) {
+      // Dafny has 0-indexed columns, but Boogie counts from 1
+      var realigned_tok = new Token(tok.line, tok.col - 1);
+      realigned_tok.kind = tok.kind;
+      realigned_tok.pos = tok.pos;
+      realigned_tok.val = tok.val;
+      realigned_tok.filename = tok.filename;
+      base.ReportBplError(realigned_tok, message, error, tw, category);
+
+      if (tok is Dafny.NestedToken) {
+        var nt = (Dafny.NestedToken)tok;
+        ReportBplError(nt.Inner, "Related location", false, tw);
+      }
+    }
+  }
+
+  [Serializable]
+  class VerificationTask {
+    [DataMember]
+    string[] args = null;
+
+    [DataMember]
+    string filename = null;
+
+    [DataMember]
+    string source = null;
+
+    [DataMember]
+    bool sourceIsFile = false;
+
+    string ProgramSource { get { return sourceIsFile ? File.ReadAllText(source) : source; } }
+
+    internal static VerificationTask ReadTask(string b64_repr) {
+      try {
+        var json = Encoding.UTF8.GetString(System.Convert.FromBase64String(b64_repr));
+        using (MemoryStream ms = new MemoryStream(Encoding.Unicode.GetBytes(json))) {
+          DataContractJsonSerializer serializer = new DataContractJsonSerializer(typeof(VerificationTask));
+          return (VerificationTask)serializer.ReadObject(ms);
+        }
+      } catch (Exception ex) {
+        throw new ServerException("Deserialization failed: {0}.", ex.Message);
+      }
+    }
+
+    internal static void SelfTest() {
+      var task = new VerificationTask() { 
+        filename = "<none>", 
+        sourceIsFile = false, 
+        args = new string[] { },
+        source = "method selftest() { assert true; }"
+      };
+      try {
+        task.Run();
+        Interaction.EOM(Interaction.SUCCESS, null);
+      } catch (Exception ex) {
+        Interaction.EOM(Interaction.FAILURE, ex);
+      }
+    }
+
+    internal void Run() {
+      Server.ApplyArgs(args);
+      new DafnyHelper(filename, ProgramSource).Verify();
+    }
+  }
+
+  class ServerException : Exception {
+    internal ServerException(string message) : base(message) { }
+    internal ServerException(string message, params object[] args) : base(String.Format(message, args)) { }
+  }
+
+  class Server {
+    private bool running;
+
+    static void Main(string[] args) {
+      Server server = new Server();
+      if (args.Length > 0) {
+        if (args[0] == "selftest") {
+          VerificationTask.SelfTest();
+        } else {
+          Console.WriteLine("Not sure what to do with '{0}'", String.Join(" ", args));
+        }
+      } else {
+        server.Loop();
+      }
+    }
+
+    public Server() {
+      this.running = true;
+      Console.CancelKeyPress += this.CancelKeyPress;
+      ExecutionEngine.printer = new DafnyConsolePrinter();
+    }
+
+    internal static void ApplyArgs(string[] args) {
+      Dafny.DafnyOptions.Install(new Dafny.DafnyOptions());
+      if (CommandLineOptions.Clo.Parse(args)) {
+        // Dafny.DafnyOptions.O.ErrorTrace = 0; //FIXME
+        // Dafny.DafnyOptions.O.ModelViewFile = "-";
+        Dafny.DafnyOptions.O.ProverKillTime = 10;
+        Dafny.DafnyOptions.O.VcsCores = Math.Max(1, System.Environment.ProcessorCount - 1);
+        Dafny.DafnyOptions.O.VerifySnapshots = 2;
+      } else {
+        throw new ServerException("Invalid command line options");
+      }
+    }
+
+    void CancelKeyPress(object sender, ConsoleCancelEventArgs e) {
+      e.Cancel = true;
+      // FIXME TerminateProver and RunningProverFromCommandLine
+      // Cancel the current verification? TerminateProver() ? Or kill entirely?
+    }
+
+    static bool EndOfPayload(out string line) {
+      line = Console.ReadLine();
+      return line == null || line == Interaction.CLIENT_EOM_TAG;
+    }
+
+    static string ReadPayload() {
+      StringBuilder buffer = new StringBuilder();
+      string line = null;
+      while (!EndOfPayload(out line)) {
+        buffer.Append(line);
+      }
+      return buffer.ToString();
+    }
+
+    void Loop() {
+      for (int cycle = 0; running; cycle++) {
+        var line = Console.ReadLine() ?? "quit";
+        var command = line.Split();
+        Respond(command);
+      }
+    }
+
+    void Respond(string[] command) {
+      try {
+        if (command.Length ==  0) {
+          throw new ServerException("Empty command");
+        }
+
+        var verb = command[0];
+        if (verb == "verify") {
+          checkArgs(command, 0);
+          var payload = ReadPayload();
+          VerificationTask.ReadTask(payload).Run();
+        } else if (verb == "quit") {
+          checkArgs(command, 0);
+          Exit();
+        } else {
+          throw new ServerException("Unknown verb '{0}'", verb);
+        }
+
+        Interaction.EOM(Interaction.SUCCESS, "Verification completed successfully!");
+      } catch (ServerException ex) {
+        Interaction.EOM(Interaction.FAILURE, ex);
+      } catch (Exception ex) {
+        Interaction.EOM(Interaction.FAILURE, ex, "[FATAL]");
+        running = false;
+      }
+    }
+
+    void checkArgs(string[] command, int expectedLength) {
+      if (command.Length - 1 != expectedLength) {
+        throw new ServerException("Invalid argument count (got {0}, expected {1})", command.Length - 1, expectedLength);
+      }
+    }
+
+    void Exit() {
+      this.running = false;
+    }
+  }
+
+  class DafnyHelper {
+    private string fname;
+    private string source;
+
+    private Dafny.Errors errors;
+    private Dafny.Program dafnyProgram;
+    private Bpl.Program boogieProgram;
+
+    public DafnyHelper(string fname, string source) {
+      this.fname = fname;
+      this.source = source;
+      this.errors = new Dafny.Errors();
+    }
+
+    public bool Verify() {
+      return Parse() && Resolve() && Translate() && Boogie();
+    }
+
+    private bool Parse() {
+      Dafny.ModuleDecl module = new Dafny.LiteralModuleDecl(new Dafny.DefaultModuleDecl(), null);
+      Dafny.BuiltIns builtIns = new Dafny.BuiltIns();
+      var success = (Dafny.Parser.Parse(source, fname, fname, module, builtIns, errors) == 0 &&
+                     Dafny.Main.ParseIncludes(module, builtIns, new List<string>(), errors) == null);
+      if (success) {
+        dafnyProgram = new Dafny.Program(fname, module, builtIns);
+      }
+      return success;
+    }
+
+    private bool Resolve() {
+      var resolver = new Dafny.Resolver(dafnyProgram);
+      resolver.ResolveProgram(dafnyProgram);
+      return resolver.ErrorCount == 0;
+    }
+
+    private bool Translate() {
+      var translator = new Dafny.Translator() { InsertChecksums = true, UniqueIdPrefix = null }; //FIXME check if null is OK for UniqueIdPrefix
+      boogieProgram = translator.Translate(dafnyProgram); // FIXME how are translation errors reported?
+      return true;
+    }
+
+    // FIXME var boogieFilename = Path.Combine(Path.GetTempPath(), Path.ChangeExtension(Path.GetFileName(fname), "bpl"));
+    private bool Boogie() {
+      if (boogieProgram.Resolve() == 0 && boogieProgram.Typecheck() == 0) {
+        ExecutionEngine.EliminateDeadVariables(boogieProgram);
+        ExecutionEngine.CollectModSets(boogieProgram);
+        ExecutionEngine.CoalesceBlocks(boogieProgram);
+        ExecutionEngine.Inline(boogieProgram);
+
+        switch (ExecutionEngine.InferAndVerify(boogieProgram, new PipelineStatistics(), null, null, DateTime.UtcNow.Ticks.ToString())) { // FIXME check if null is ok for programId and error delegate
+          case PipelineOutcome.Done:
+          case PipelineOutcome.VerificationCompleted:
+            return true;
+        }
+      }
+
+      return false;
+    }
+  }
+}
\ No newline at end of file
-- 
cgit v1.2.3


From 48fed349a2fc592e7f015ecaa6cf98582446278f Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 30 Jul 2015 17:43:13 -0700
Subject: Fix an issue where the server would reverify the same file multiple
 times.

The confusing part here is that if one passes null as the ProgramId for two
consecutive calls to Boogie, then Boogie will return the same results twice,
regardless of what the second program was.
---
 Source/DafnyServer/Server.cs | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyServer/Server.cs b/Source/DafnyServer/Server.cs
index 36c28627..660188ba 100644
--- a/Source/DafnyServer/Server.cs
+++ b/Source/DafnyServer/Server.cs
@@ -114,6 +114,9 @@ namespace Microsoft.Dafny {
       if (args.Length > 0) {
         if (args[0] == "selftest") {
           VerificationTask.SelfTest();
+        } else if (File.Exists(args[0])) {
+          Console.SetIn(new StreamReader(args[0]));
+          server.Loop();
         } else {
           Console.WriteLine("Not sure what to do with '{0}'", String.Join(" ", args));
         }
@@ -248,15 +251,14 @@ namespace Microsoft.Dafny {
       return true;
     }
 
-    // FIXME var boogieFilename = Path.Combine(Path.GetTempPath(), Path.ChangeExtension(Path.GetFileName(fname), "bpl"));
     private bool Boogie() {
-      if (boogieProgram.Resolve() == 0 && boogieProgram.Typecheck() == 0) {
+      if (boogieProgram.Resolve() == 0 && boogieProgram.Typecheck() == 0) { //FIXME ResolveAndTypecheck?
         ExecutionEngine.EliminateDeadVariables(boogieProgram);
         ExecutionEngine.CollectModSets(boogieProgram);
         ExecutionEngine.CoalesceBlocks(boogieProgram);
         ExecutionEngine.Inline(boogieProgram);
 
-        switch (ExecutionEngine.InferAndVerify(boogieProgram, new PipelineStatistics(), null, null, DateTime.UtcNow.Ticks.ToString())) { // FIXME check if null is ok for programId and error delegate
+        switch (ExecutionEngine.InferAndVerify(boogieProgram, new PipelineStatistics(), "ServerProgram", null, DateTime.UtcNow.Ticks.ToString())) { // FIXME check if null is ok for error delegate
           case PipelineOutcome.Done:
           case PipelineOutcome.VerificationCompleted:
             return true;
-- 
cgit v1.2.3


From 990966db7dcea00045c5c104ded084348e8f7dde Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 31 Jul 2015 14:26:53 -0700
Subject: Split the server source into multiple files

---
 Source/DafnyServer/DafnyHelper.cs      |  87 ++++++++++++++
 Source/DafnyServer/DafnyServer.csproj  |   7 +-
 Source/DafnyServer/Server.cs           | 202 +++------------------------------
 Source/DafnyServer/Utilities.cs        |  60 ++++++++++
 Source/DafnyServer/VerificationTask.cs |  59 ++++++++++
 5 files changed, 227 insertions(+), 188 deletions(-)
 create mode 100644 Source/DafnyServer/DafnyHelper.cs
 create mode 100644 Source/DafnyServer/Utilities.cs
 create mode 100644 Source/DafnyServer/VerificationTask.cs

(limited to 'Source')

diff --git a/Source/DafnyServer/DafnyHelper.cs b/Source/DafnyServer/DafnyHelper.cs
new file mode 100644
index 00000000..10d98677
--- /dev/null
+++ b/Source/DafnyServer/DafnyHelper.cs
@@ -0,0 +1,87 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using Microsoft.Boogie;
+using Bpl = Microsoft.Boogie;
+
+namespace Microsoft.Dafny {
+  // FIXME: This should not be duplicated here
+  class DafnyConsolePrinter : ConsolePrinter {
+    public override void ReportBplError(IToken tok, string message, bool error, TextWriter tw, string category = null) {
+      // Dafny has 0-indexed columns, but Boogie counts from 1
+      var realigned_tok = new Token(tok.line, tok.col - 1);
+      realigned_tok.kind = tok.kind;
+      realigned_tok.pos = tok.pos;
+      realigned_tok.val = tok.val;
+      realigned_tok.filename = tok.filename;
+      base.ReportBplError(realigned_tok, message, error, tw, category);
+
+      if (tok is Dafny.NestedToken) {
+        var nt = (Dafny.NestedToken)tok;
+        ReportBplError(nt.Inner, "Related location", false, tw);
+      }
+    }
+  }
+
+  class DafnyHelper {
+    private string fname;
+    private string source;
+
+    private Dafny.Errors errors;
+    private Dafny.Program dafnyProgram;
+    private Bpl.Program boogieProgram;
+
+    public DafnyHelper(string fname, string source) {
+      this.fname = fname;
+      this.source = source;
+      this.errors = new Dafny.Errors();
+    }
+
+    public bool Verify() {
+      return Parse() && Resolve() && Translate() && Boogie();
+    }
+
+    private bool Parse() {
+      Dafny.ModuleDecl module = new Dafny.LiteralModuleDecl(new Dafny.DefaultModuleDecl(), null);
+      Dafny.BuiltIns builtIns = new Dafny.BuiltIns();
+      var success = (Dafny.Parser.Parse(source, fname, fname, module, builtIns, errors) == 0 &&
+                     Dafny.Main.ParseIncludes(module, builtIns, new List<string>(), errors) == null);
+      if (success) {
+        dafnyProgram = new Dafny.Program(fname, module, builtIns);
+      }
+      return success;
+    }
+
+    private bool Resolve() {
+      var resolver = new Dafny.Resolver(dafnyProgram);
+      resolver.ResolveProgram(dafnyProgram);
+      return resolver.ErrorCount == 0;
+    }
+
+    private bool Translate() {
+      var translator = new Dafny.Translator() { InsertChecksums = true, UniqueIdPrefix = null }; //FIXME check if null is OK for UniqueIdPrefix
+      boogieProgram = translator.Translate(dafnyProgram); // FIXME how are translation errors reported?
+      return true;
+    }
+
+    private bool Boogie() {
+      if (boogieProgram.Resolve() == 0 && boogieProgram.Typecheck() == 0) { //FIXME ResolveAndTypecheck?
+        ExecutionEngine.EliminateDeadVariables(boogieProgram);
+        ExecutionEngine.CollectModSets(boogieProgram);
+        ExecutionEngine.CoalesceBlocks(boogieProgram);
+        ExecutionEngine.Inline(boogieProgram);
+
+        switch (ExecutionEngine.InferAndVerify(boogieProgram, new PipelineStatistics(), "ServerProgram", null, DateTime.UtcNow.Ticks.ToString())) { // FIXME check if null is ok for error delegate
+          case PipelineOutcome.Done:
+          case PipelineOutcome.VerificationCompleted:
+            return true;
+        }
+      }
+
+      return false;
+    }
+  }
+}
diff --git a/Source/DafnyServer/DafnyServer.csproj b/Source/DafnyServer/DafnyServer.csproj
index 0aac88b2..3da33f16 100644
--- a/Source/DafnyServer/DafnyServer.csproj
+++ b/Source/DafnyServer/DafnyServer.csproj
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
   <PropertyGroup>
@@ -55,6 +55,9 @@
     <Reference Include="System.Xml" />
   </ItemGroup>
   <ItemGroup>
+    <Compile Include="DafnyHelper.cs" />
+    <Compile Include="Utilities.cs" />
+    <Compile Include="VerificationTask.cs" />
     <Compile Include="Properties\AssemblyInfo.cs" />
     <Compile Include="Server.cs" />
   </ItemGroup>
@@ -72,4 +75,4 @@
   <Target Name="AfterBuild">
   </Target>
   -->
-</Project>
+</Project>
\ No newline at end of file
diff --git a/Source/DafnyServer/Server.cs b/Source/DafnyServer/Server.cs
index 660188ba..c6f619d3 100644
--- a/Source/DafnyServer/Server.cs
+++ b/Source/DafnyServer/Server.cs
@@ -10,116 +10,21 @@ using Bpl = Microsoft.Boogie;
 using Microsoft.Boogie;
 
 namespace Microsoft.Dafny {
-  class Interaction {
-    internal static string SUCCESS = "SUCCESS";
-    internal static string FAILURE = "FAILURE";
-    internal static string SERVER_EOM_TAG = "[[DAFNY-SERVER: EOM]]";
-    internal static string CLIENT_EOM_TAG = "[[DAFNY-CLIENT: EOM]]";
-
-    internal static void EOM(string header, string msg) {
-      var trailer = (msg == null) ? "" : "\n";
-      Console.Write("{0}{1}[{2}] {3}\n", msg ?? "", trailer, header, SERVER_EOM_TAG);
-      Console.Out.Flush();
-    }
-
-    internal static void EOM(string header, Exception ex, string subHeader="") {
-      var aggregate = ex as AggregateException;
-      subHeader = String.IsNullOrEmpty(subHeader) ? "" : subHeader + " ";
-
-      if (aggregate == null) {
-        EOM(header, subHeader + ex.Message);
-      } else {
-        EOM(header, subHeader + aggregate.InnerExceptions.MapConcat(exn => exn.Message, ", "));
-      }
-    }
-  }
-
-  // FIXME: This should not be duplicated here
-  class DafnyConsolePrinter : ConsolePrinter {
-    public override void ReportBplError(IToken tok, string message, bool error, TextWriter tw, string category = null) {
-      // Dafny has 0-indexed columns, but Boogie counts from 1
-      var realigned_tok = new Token(tok.line, tok.col - 1);
-      realigned_tok.kind = tok.kind;
-      realigned_tok.pos = tok.pos;
-      realigned_tok.val = tok.val;
-      realigned_tok.filename = tok.filename;
-      base.ReportBplError(realigned_tok, message, error, tw, category);
-
-      if (tok is Dafny.NestedToken) {
-        var nt = (Dafny.NestedToken)tok;
-        ReportBplError(nt.Inner, "Related location", false, tw);
-      }
-    }
-  }
-
-  [Serializable]
-  class VerificationTask {
-    [DataMember]
-    string[] args = null;
-
-    [DataMember]
-    string filename = null;
-
-    [DataMember]
-    string source = null;
-
-    [DataMember]
-    bool sourceIsFile = false;
-
-    string ProgramSource { get { return sourceIsFile ? File.ReadAllText(source) : source; } }
-
-    internal static VerificationTask ReadTask(string b64_repr) {
-      try {
-        var json = Encoding.UTF8.GetString(System.Convert.FromBase64String(b64_repr));
-        using (MemoryStream ms = new MemoryStream(Encoding.Unicode.GetBytes(json))) {
-          DataContractJsonSerializer serializer = new DataContractJsonSerializer(typeof(VerificationTask));
-          return (VerificationTask)serializer.ReadObject(ms);
-        }
-      } catch (Exception ex) {
-        throw new ServerException("Deserialization failed: {0}.", ex.Message);
-      }
-    }
-
-    internal static void SelfTest() {
-      var task = new VerificationTask() { 
-        filename = "<none>", 
-        sourceIsFile = false, 
-        args = new string[] { },
-        source = "method selftest() { assert true; }"
-      };
-      try {
-        task.Run();
-        Interaction.EOM(Interaction.SUCCESS, null);
-      } catch (Exception ex) {
-        Interaction.EOM(Interaction.FAILURE, ex);
-      }
-    }
-
-    internal void Run() {
-      Server.ApplyArgs(args);
-      new DafnyHelper(filename, ProgramSource).Verify();
-    }
-  }
-
-  class ServerException : Exception {
-    internal ServerException(string message) : base(message) { }
-    internal ServerException(string message, params object[] args) : base(String.Format(message, args)) { }
-  }
-
   class Server {
     private bool running;
 
     static void Main(string[] args) {
       Server server = new Server();
-      if (args.Length > 0) {
-        if (args[0] == "selftest") {
-          VerificationTask.SelfTest();
-        } else if (File.Exists(args[0])) {
-          Console.SetIn(new StreamReader(args[0]));
-          server.Loop();
-        } else {
-          Console.WriteLine("Not sure what to do with '{0}'", String.Join(" ", args));
-        }
+
+      var hasArg = args.Length > 0;
+      var arg = hasArg ? args[0] : null;
+
+      if (hasArg && args[0] == "selftest") {
+        VerificationTask.SelfTest();
+      } else if (hasArg && File.Exists(arg)) {
+        Console.WriteLine("# Reading from {0}", arg);
+        Console.SetIn(new StreamReader(arg));
+        server.Loop();
       } else {
         server.Loop();
       }
@@ -131,19 +36,6 @@ namespace Microsoft.Dafny {
       ExecutionEngine.printer = new DafnyConsolePrinter();
     }
 
-    internal static void ApplyArgs(string[] args) {
-      Dafny.DafnyOptions.Install(new Dafny.DafnyOptions());
-      if (CommandLineOptions.Clo.Parse(args)) {
-        // Dafny.DafnyOptions.O.ErrorTrace = 0; //FIXME
-        // Dafny.DafnyOptions.O.ModelViewFile = "-";
-        Dafny.DafnyOptions.O.ProverKillTime = 10;
-        Dafny.DafnyOptions.O.VcsCores = Math.Max(1, System.Environment.ProcessorCount - 1);
-        Dafny.DafnyOptions.O.VerifySnapshots = 2;
-      } else {
-        throw new ServerException("Invalid command line options");
-      }
-    }
-
     void CancelKeyPress(object sender, ConsoleCancelEventArgs e) {
       e.Cancel = true;
       // FIXME TerminateProver and RunningProverFromCommandLine
@@ -167,8 +59,10 @@ namespace Microsoft.Dafny {
     void Loop() {
       for (int cycle = 0; running; cycle++) {
         var line = Console.ReadLine() ?? "quit";
-        var command = line.Split();
-        Respond(command);
+        if (line != String.Empty && !line.StartsWith("#")) {
+          var command = line.Split();
+          Respond(command);
+        }
       }
     }
 
@@ -180,11 +74,11 @@ namespace Microsoft.Dafny {
 
         var verb = command[0];
         if (verb == "verify") {
-          checkArgs(command, 0);
+          ServerUtils.checkArgs(command, 0);
           var payload = ReadPayload();
           VerificationTask.ReadTask(payload).Run();
         } else if (verb == "quit") {
-          checkArgs(command, 0);
+          ServerUtils.checkArgs(command, 0);
           Exit();
         } else {
           throw new ServerException("Unknown verb '{0}'", verb);
@@ -199,73 +93,9 @@ namespace Microsoft.Dafny {
       }
     }
 
-    void checkArgs(string[] command, int expectedLength) {
-      if (command.Length - 1 != expectedLength) {
-        throw new ServerException("Invalid argument count (got {0}, expected {1})", command.Length - 1, expectedLength);
-      }
-    }
-
     void Exit() {
       this.running = false;
     }
   }
 
-  class DafnyHelper {
-    private string fname;
-    private string source;
-
-    private Dafny.Errors errors;
-    private Dafny.Program dafnyProgram;
-    private Bpl.Program boogieProgram;
-
-    public DafnyHelper(string fname, string source) {
-      this.fname = fname;
-      this.source = source;
-      this.errors = new Dafny.Errors();
-    }
-
-    public bool Verify() {
-      return Parse() && Resolve() && Translate() && Boogie();
-    }
-
-    private bool Parse() {
-      Dafny.ModuleDecl module = new Dafny.LiteralModuleDecl(new Dafny.DefaultModuleDecl(), null);
-      Dafny.BuiltIns builtIns = new Dafny.BuiltIns();
-      var success = (Dafny.Parser.Parse(source, fname, fname, module, builtIns, errors) == 0 &&
-                     Dafny.Main.ParseIncludes(module, builtIns, new List<string>(), errors) == null);
-      if (success) {
-        dafnyProgram = new Dafny.Program(fname, module, builtIns);
-      }
-      return success;
-    }
-
-    private bool Resolve() {
-      var resolver = new Dafny.Resolver(dafnyProgram);
-      resolver.ResolveProgram(dafnyProgram);
-      return resolver.ErrorCount == 0;
-    }
-
-    private bool Translate() {
-      var translator = new Dafny.Translator() { InsertChecksums = true, UniqueIdPrefix = null }; //FIXME check if null is OK for UniqueIdPrefix
-      boogieProgram = translator.Translate(dafnyProgram); // FIXME how are translation errors reported?
-      return true;
-    }
-
-    private bool Boogie() {
-      if (boogieProgram.Resolve() == 0 && boogieProgram.Typecheck() == 0) { //FIXME ResolveAndTypecheck?
-        ExecutionEngine.EliminateDeadVariables(boogieProgram);
-        ExecutionEngine.CollectModSets(boogieProgram);
-        ExecutionEngine.CoalesceBlocks(boogieProgram);
-        ExecutionEngine.Inline(boogieProgram);
-
-        switch (ExecutionEngine.InferAndVerify(boogieProgram, new PipelineStatistics(), "ServerProgram", null, DateTime.UtcNow.Ticks.ToString())) { // FIXME check if null is ok for error delegate
-          case PipelineOutcome.Done:
-          case PipelineOutcome.VerificationCompleted:
-            return true;
-        }
-      }
-
-      return false;
-    }
-  }
 }
\ No newline at end of file
diff --git a/Source/DafnyServer/Utilities.cs b/Source/DafnyServer/Utilities.cs
new file mode 100644
index 00000000..8fb03b05
--- /dev/null
+++ b/Source/DafnyServer/Utilities.cs
@@ -0,0 +1,60 @@
+using System;
+using System.IO;
+using System.Text;
+using System.Collections.Generic;
+using System.Runtime.Serialization;
+using System.Runtime.Serialization.Json;
+using Microsoft.Boogie;
+
+namespace Microsoft.Dafny {
+  class Interaction {
+    internal static string SUCCESS = "SUCCESS";
+    internal static string FAILURE = "FAILURE";
+    internal static string SERVER_EOM_TAG = "[[DAFNY-SERVER: EOM]]";
+    internal static string CLIENT_EOM_TAG = "[[DAFNY-CLIENT: EOM]]";
+
+    internal static void EOM(string header, string msg) {
+      var trailer = (msg == null) ? "" : "\n";
+      Console.Write("{0}{1}[{2}] {3}\n", msg ?? "", trailer, header, SERVER_EOM_TAG);
+      Console.Out.Flush();
+    }
+
+    internal static void EOM(string header, Exception ex, string subHeader = "") {
+      var aggregate = ex as AggregateException;
+      subHeader = String.IsNullOrEmpty(subHeader) ? "" : subHeader + " ";
+
+      if (aggregate == null) {
+        EOM(header, subHeader + ex.Message);
+      } else {
+        EOM(header, subHeader + aggregate.InnerExceptions.MapConcat(exn => exn.Message, ", "));
+      }
+    }
+  }
+
+  class ServerException : Exception {
+    internal ServerException(string message) : base(message) { }
+    internal ServerException(string message, params object[] args) : base(String.Format(message, args)) { }
+  }
+
+  class ServerUtils {
+    internal static void checkArgs(string[] command, int expectedLength) {
+      if (command.Length - 1 != expectedLength) {
+        throw new ServerException("Invalid argument count (got {0}, expected {1})", command.Length - 1, expectedLength);
+      }
+    }
+
+    internal static void ApplyArgs(string[] args) {
+      Dafny.DafnyOptions.Install(new Dafny.DafnyOptions());
+
+      if (CommandLineOptions.Clo.Parse(args)) {
+        // Dafny.DafnyOptions.O.ErrorTrace = 0; //FIXME
+        // Dafny.DafnyOptions.O.ModelViewFile = "-";
+        Dafny.DafnyOptions.O.ProverKillTime = 10;
+        Dafny.DafnyOptions.O.VcsCores = Math.Max(1, System.Environment.ProcessorCount - 1);
+        Dafny.DafnyOptions.O.VerifySnapshots = 2;
+      } else {
+        throw new ServerException("Invalid command line options");
+      }
+    }
+  }
+}
diff --git a/Source/DafnyServer/VerificationTask.cs b/Source/DafnyServer/VerificationTask.cs
new file mode 100644
index 00000000..a00688b1
--- /dev/null
+++ b/Source/DafnyServer/VerificationTask.cs
@@ -0,0 +1,59 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Runtime.Serialization;
+using System.Runtime.Serialization.Json;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace Microsoft.Dafny {
+  [Serializable]
+  class VerificationTask {
+    [DataMember]
+    string[] args = null;
+
+    [DataMember]
+    string filename = null;
+
+    [DataMember]
+    string source = null;
+
+    [DataMember]
+    bool sourceIsFile = false;
+
+    string ProgramSource { get { return sourceIsFile ? File.ReadAllText(source) : source; } }
+
+    internal static VerificationTask ReadTask(string b64_repr) {
+      try {
+        var json = Encoding.UTF8.GetString(System.Convert.FromBase64String(b64_repr));
+        using (MemoryStream ms = new MemoryStream(Encoding.Unicode.GetBytes(json))) {
+          DataContractJsonSerializer serializer = new DataContractJsonSerializer(typeof(VerificationTask));
+          return (VerificationTask)serializer.ReadObject(ms);
+        }
+      } catch (Exception ex) {
+        throw new ServerException("Deserialization failed: {0}.", ex.Message);
+      }
+    }
+
+    internal static void SelfTest() {
+      var task = new VerificationTask() {
+        filename = "<none>",
+        sourceIsFile = false,
+        args = new string[] { },
+        source = "method selftest() { assert true; }"
+      };
+      try {
+        task.Run();
+        Interaction.EOM(Interaction.SUCCESS, null);
+      } catch (Exception ex) {
+        Interaction.EOM(Interaction.FAILURE, ex);
+      }
+    }
+
+    internal void Run() {
+      ServerUtils.ApplyArgs(args);
+      new DafnyHelper(filename, ProgramSource).Verify();
+    }
+  }
+}
-- 
cgit v1.2.3


From 65334f8f33c92a1e37376d6484d60ee45b55ca1d Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 31 Jul 2015 15:11:03 -0700
Subject: Add tests for the server

---
 Source/DafnyServer/Server.cs                 |   2 +-
 Test/lit.site.cfg                            |   8 +
 Test/runTests.py                             |  89 ++--
 Test/server/simple-session.transcript        | 637 +++++++++++++++++++++++++++
 Test/server/simple-session.transcript.expect | 299 +++++++++++++
 5 files changed, 1000 insertions(+), 35 deletions(-)
 create mode 100644 Test/server/simple-session.transcript
 create mode 100644 Test/server/simple-session.transcript.expect

(limited to 'Source')

diff --git a/Source/DafnyServer/Server.cs b/Source/DafnyServer/Server.cs
index c6f619d3..74cdd8c2 100644
--- a/Source/DafnyServer/Server.cs
+++ b/Source/DafnyServer/Server.cs
@@ -22,7 +22,7 @@ namespace Microsoft.Dafny {
       if (hasArg && args[0] == "selftest") {
         VerificationTask.SelfTest();
       } else if (hasArg && File.Exists(arg)) {
-        Console.WriteLine("# Reading from {0}", arg);
+        Console.WriteLine("# Reading from {0}", Path.GetFileName(arg));
         Console.SetIn(new StreamReader(arg));
         server.Loop();
       } else {
diff --git a/Test/lit.site.cfg b/Test/lit.site.cfg
index a960bdbc..c5718f86 100644
--- a/Test/lit.site.cfg
+++ b/Test/lit.site.cfg
@@ -79,14 +79,21 @@ lit_config.note('Repository root is {}'.format(repositoryRoot))
 
 binaryDir = os.path.join( repositoryRoot, 'Binaries')
 dafnyExecutable = os.path.join( binaryDir, 'Dafny.exe')
+serverExecutable = os.path.join( binaryDir, 'DafnyServer.exe')
 
 if not os.path.exists(dafnyExecutable):
     lit_config.fatal('Could not find Dafny.exe at {}'.format(dafnyExecutable))
 
+if not os.path.exists(serverExecutable):
+    lit_config.warning('Could not find DafnyServer.exe at {}'.format(serverExecutable))
+else:
+    config.suffixes.append('.transcript')
+
 dafnyExecutable = quotePath(dafnyExecutable)
 
 if os.name == 'posix':
     dafnyExecutable = 'mono ' + dafnyExecutable
+    serverExecutable = 'mono ' + serverExecutable
     if lit.util.which('mono') == None:
         lit_config.fatal('Cannot find mono. Make sure it is your PATH')
 
@@ -105,6 +112,7 @@ if len(dafnyParams) > 0:
 lit_config.note('Using Dafny: {}\n'.format(dafnyExecutable))
 
 config.substitutions.append( ('%dafny', dafnyExecutable) )
+config.substitutions.append( ('%server', serverExecutable) )
 
 # Sanity check: Check solver executable is available
 # FIXME: Should this check be removed entirely?
diff --git a/Test/runTests.py b/Test/runTests.py
index fc9c20e7..ebdb0655 100644
--- a/Test/runTests.py
+++ b/Test/runTests.py
@@ -38,6 +38,7 @@ class Defaults:
     DAFNY_BIN = os.path.realpath(os.path.join(os.path.dirname(__file__), "../Binaries/Dafny.exe"))
     COMPILER = [DAFNY_BIN]
     FLAGS = ["/useBaseNameForFileName", "/compile:1", "/nologo", "/timeLimit:300"]
+    EXTENSIONS = [".dfy", ".transcript"]
 
 class Colors:
     RED = '\033[91m'
@@ -103,7 +104,6 @@ class Test:
 
     def __init__(self, name, source_path, cmds, timeout, compiler_id = 0):
         self.name = name
-        self.dfy = None if self.name is None else (self.name + ".dfy")
         self.source_path = Test.uncygdrive(source_path)
         self.expect_path = Test.source_to_expect_path(self.source_path)
         self.source_directory, self.fname = os.path.split(self.source_path)
@@ -182,7 +182,7 @@ class Test:
                     debug(Debug.REPORT, "{} of {}".format(len(tests), len(results)), headers=status)
                     if status != TestStatus.PASSED:
                         for test in tests:
-                            debug(Debug.REPORT, "* " + test.dfy, headers=status, silentheaders=True)
+                            debug(Debug.REPORT, "* " + test.name, headers=status, silentheaders=True)
 
             debug(Debug.REPORT)
 
@@ -190,14 +190,14 @@ class Test:
             if failing:
                 with open("failing.lst", mode='w') as writer:
                     for t in failing:
-                        writer.write("{}\t{}\n".format(t.name, t.source_path))
+                        writer.write("{}\n".format(t.name))
                 debug(Debug.REPORT, "Some tests failed: use [runTests.py failing.lst] to rerun the failing tests")
 
             debug(Debug.REPORT, "Testing took {:.2f}s on {} thread(s)".format(results[0].suite_time, results[0].njobs))
 
 
     def run(self):
-        debug(Debug.DEBUG, "Starting {}".format(self.dfy))
+        debug(Debug.DEBUG, "Starting {}".format(self.name))
         os.makedirs(self.temp_directory, exist_ok=True)
         # os.chdir(self.source_directory)
 
@@ -227,7 +227,7 @@ class Test:
 
             stdout, stderr = stdout.strip(), stderr.strip()
             if stdout != b"" or stderr != b"":
-                debug(Debug.TRACE, "Writing the output of {} to {}".format(self.dfy, self.temp_output_path))
+                debug(Debug.TRACE, "Writing the output of {} to {}".format(self.name, self.temp_output_path))
                 with open(self.temp_output_path, mode='ab') as writer:
                     writer.write(stdout + stderr)
             if stderr != b"":
@@ -249,7 +249,7 @@ class Test:
 
         fstring = "[{:5.2f}s] {} ({}{})"
         progress = "{}/{}".format(tid, len(alltests))
-        message = fstring.format(self.duration, wrap_color(self.dfy, Colors.BRIGHT),
+        message = fstring.format(self.duration, wrap_color(self.name, Colors.BRIGHT),
                                  wrap_color(progress, Colors.BRIGHT), running)
 
         debug(Debug.INFO, message, headers=self.status)
@@ -275,7 +275,7 @@ def setup_parser():
     parser = argparse.ArgumentParser(description='Run the Dafny test suite.')
 
     parser.add_argument('path', type=str, action='store', nargs='+',
-                        help='Input files or folders. Folders are searched for .dfy files. Lists of files can also be specified by passing a .lst file (for an example of such a file, look at failing.lst after running failing tests.')
+                        help='Input files or folders. Folders are searched for test files. Lists of files can also be specified by passing a .lst file (for an example of such a file, look at failing.lst after running failing tests.')
 
     parser.add_argument('--compiler', type=str, action='append', default=None,
                         help='Dafny executable. Default: {}'.format(Defaults.DAFNY_BIN))
@@ -293,11 +293,14 @@ def setup_parser():
                         help='Excluded directories. {} are automatically added.'.format(Defaults.ALWAYS_EXCLUDED))
 
     parser.add_argument('--verbosity', action='store', type=int, default=1,
-                        help='Set verbosity level. 0: Minimal; 1: Some info; 2: More info.')
+                        help='Set verbosity level. 0: Minimal; 1: Some info; 2: More info; 3: Trace.')
 
     parser.add_argument('-v', action='store_const', default=1, dest="verbosity", const=2,
                         help='Short for --verbosity 2.')
 
+    parser.add_argument('-vv', action='store_const', default=1, dest="verbosity", const=3,
+                        help='Short for --verbosity 3.')
+
     parser.add_argument('--report', '-r', action='store', type=str, default=None,
                         help='Give an explicit name to the report file. Defaults to the current date and time.')
 
@@ -339,7 +342,7 @@ def run_one_internal(test, test_id, args, running):
             # ignore further work once you receive a kill signal
             KILLED = True
         except Exception as e:
-            debug(Debug.ERROR, "[{}] {}".format(test.dfy, e))
+            debug(Debug.ERROR, "[{}] {}".format(test.name, e))
             test.status = TestStatus.UNKNOWN
         finally:
             running.remove(test_id)
@@ -349,53 +352,71 @@ def run_one_internal(test, test_id, args, running):
 def run_one(args):
     return run_one_internal(*args)
 
-def read_one_test(name, fname, compiler_cmds, timeout):
+def get_server_path(compiler):
+    REGEXP = r"\bDafny.exe\b.*"
+    if re.search(REGEXP, compiler):
+        return re.sub(REGEXP, "DafnyServer.exe", compiler)
+    else:
+        return None
+
+def substitute_binaries(cmd, compiler):
+    cmd = cmd.replace("%dafny", compiler)
+    cmd = cmd.replace("%server", get_server_path(compiler))
+    return cmd
+
+def read_one_test(fname, compiler_cmds, timeout):
     for cid, compiler_cmd in enumerate(compiler_cmds):
         source_path = os.path.realpath(fname)
         with open(source_path, mode='r') as reader:
             cmds = []
             for line in reader:
                 line = line.strip()
-                match = re.match("^// *RUN: *(?!%diff)([^ ].*)$", line)
+                match = re.match("^[/# ]*RUN: *(?!%diff)([^ ].*)$", line)
                 if match:
-                    cmds.append(match.groups()[0].replace("%dafny", compiler_cmd))
+                    debug(Debug.TRACE, "Found RUN spec: {}".format(line))
+                    cmds.append(substitute_binaries(match.groups()[0], compiler_cmd))
                 else:
                     break
         if cmds:
-            yield Test(name, source_path, cmds, timeout, cid)
+            yield Test(fname, source_path, cmds, timeout, cid)
         else:
-            debug(Debug.INFO, "Test file {} has no RUN specification".format(fname))
+            debug(Debug.WARNING, "Test file {} has no RUN specification".format(fname))
 
 
-def find_one(name, fname, compiler_cmds, timeout, allow_lst=False):
-    name, ext = os.path.splitext(fname)
-    if ext == ".dfy":
+def find_one(fname, compiler_cmds, timeout):
+    _, ext = os.path.splitext(fname)
+    if ext in Defaults.EXTENSIONS:
         if os.path.exists(fname):
             debug(Debug.TRACE, "Found test file: {}".format(fname))
-            yield from read_one_test(name, fname, compiler_cmds, timeout)
+            yield from read_one_test(fname, compiler_cmds, timeout)
         else:
             debug(Debug.ERROR, "Test file {} not found".format(fname))
-    elif ext == ".lst" and allow_lst: #lst files are only read if explicitly listed on the CLI
-        debug(Debug.INFO, "Loading tests from {}".format(fname))
-        with open(fname) as reader:
-            for line in reader:
-                _name, _path = line.strip().split()
-                yield from find_one(_name, _path, compiler_cmds, timeout)
     else:
         debug(Debug.TRACE, "Ignoring {}".format(fname))
 
 
-def find_tests(paths, compiler_cmds, excluded, timeout):
+def expand_lsts(paths):
     for path in paths:
+        _, ext = os.path.splitext(path)
+        if ext == ".lst": #lst files are only read if explicitly listed on the CLI
+            debug(Debug.INFO, "Loading tests from {}".format(path))
+            with open(path) as reader:
+                for line in reader:
+                    _path = line.strip()
+                    yield _path
+        else:
+            yield path
+
+def find_tests(paths, compiler_cmds, excluded, timeout):
+    for path in expand_lsts(paths):
         if os.path.isdir(path):
             debug(Debug.TRACE, "Searching for tests in {}".format(path))
             for base, dirnames, fnames in os.walk(path):
                 dirnames[:] = [d for d in dirnames if d not in excluded]
                 for fname in fnames:
-                    yield from find_one(fname, os.path.join(base, fname), compiler_cmds, timeout)
+                    yield from find_one(os.path.join(base, fname), compiler_cmds, timeout)
         else:
-            yield from find_one(path, path, compiler_cmds, timeout, True)
-
+            yield from find_one(path, compiler_cmds, timeout)
 
 def run_tests(args):
     if args.compiler is None:
@@ -404,12 +425,15 @@ def run_tests(args):
         args.base_flags = Defaults.FLAGS
 
     for compiler in args.compiler:
+        server = get_server_path(compiler)
         if not os.path.exists(compiler):
             debug(Debug.ERROR, "Compiler not found: {}".format(compiler))
             return
+        if not os.path.exists(server):
+            debug(Debug.WARNING, "Server not found")
 
     tests = list(find_tests(args.path, [compiler + ' ' + " ".join(args.base_flags + args.flags)
-                                         for compiler in args.compiler],
+                                        for compiler in args.compiler],
                             args.exclude + Defaults.ALWAYS_EXCLUDED, args.timeout))
     tests.sort(key=operator.attrgetter("name"))
 
@@ -447,10 +471,7 @@ def run_tests(args):
 
 
 def diff(paths, accept, difftool):
-    for path in paths:
-        if not path.endswith(".dfy"):
-            path += ".dfy"
-
+    for path in expand_lsts(paths):
         if not os.path.exists(path):
             debug(Debug.ERROR, "Not found: {}".format(path))
         else:
@@ -470,7 +491,7 @@ def compare_results(globs, time_all):
     from glob import glob
     paths = [path for g in globs for path in glob(g)]
     reports = {path: Test.load_report(path) for path in paths}
-    resultsets = {path: {test.dfy: (test.status, test.duration) for test in report}
+    resultsets = {path: {test.name: (test.status, test.duration) for test in report}
                   for path, report in reports.items()}
 
     all_tests = set(name for resultset in resultsets.values() for name in resultset.keys())
diff --git a/Test/server/simple-session.transcript b/Test/server/simple-session.transcript
new file mode 100644
index 00000000..26539267
--- /dev/null
+++ b/Test/server/simple-session.transcript
@@ -0,0 +1,637 @@
+# RUN: %server "%s" > "%t"
+# RUN: %diff "%s.expect" "%t"
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xuICBhc3NlcnQgZmFsc2U7XG59XG4iLCJz
+b3VyY2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xuICBhc3NlcnQgZmFsc2U7XG4gfVxuIiwi
+c291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xuICBhc3NlcnQgZmFsc2U7XG59XG4iLCJz
+b3VyY2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xuICBhc3NlcnQgZmFsc2U7XG59XG4iLCJz
+b3VyY2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG4iLCJzb3VyY2VJc0ZpbGUiOmZh
+bHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5tZXRob2QgTScoKSB7Iiwic291
+cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5tZXRob2QgTScoKSB7XG4gICIs
+InNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5tZXRob2QgTScoKSB7XG59Iiwi
+c291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5tZXRob2QgTScoKSB7XG5cbn0i
+LCJzb3VyY2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5tZXRob2QgTScoKSB7XG4gIFxu
+fSIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5tZXRob2QgTScoKSB7XG4gIHhc
+bn0iLCJzb3VyY2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5tZXRob2QgTScoKSB7XG4gIFxu
+fSIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5tZXRob2QgTScoKSB7XG4gIHZh
+clxufSIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5tZXRob2QgTScoKSB7XG4gIHZh
+ciB4IDo9IDE7XG59Iiwic291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5tZXRob2QgTScoKSB7XG4gIHZh
+ciB4IDo9IDE7XG4gIFxufSIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5tZXRob2QgTScoKSB7XG4gIHZh
+ciB4IDo9IDE7XG4gIHZhciB5LCB6IDo9IDI7XG59Iiwic291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5tZXRob2QgTScoKSB7XG4gIHZh
+ciB4IDo9IDE7XG4gIHZhciB5LCB6IDo9IDI7XG4gIFxufSIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5tZXRob2QgTScoKSB7XG4gIHZh
+ciB4IDo9IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIFxufSIsInNvdXJjZUlzRmlsZSI6ZmFs
+c2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKCkg
+e1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAyLCAzO1xuICBcbn0iLCJzb3VyY2VJc0Zp
+bGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKCkg
+e1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAyLCAzO1xuICBcbn0iLCJzb3VyY2VJc0Zp
+bGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcblxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAyLCAzO1xuICBcbn0iLCJz
+b3VyY2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcblxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAyLCAzO1xuICBcbn0iLCJz
+b3VyY2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgXG57XG4gIHZhciB4IDo9IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIFxufSIs
+InNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxXG57XG4gIHZhciB4IDo9IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIFxu
+fSIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxXG57XG4gIHZhciB4IDo9IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIFxu
+fSIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgXG59Iiwic291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzXG59Iiwic291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvclxufSIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JyA6OiBcbn0iLCJzb3VyY2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JyA6OiBpbnQsIHgnICogeCcgPiAwO1xufSIsInNvdXJj
+ZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JyA6OiBpbnQsIHgnICogeCcgPiAwO1xufSIsInNvdXJj
+ZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4J2ludCwgeCcgKiB4JyA+IDA7XG59Iiwic291cmNlSXNG
+aWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50LCB4JyAqIHgnID4gMDtcbn0iLCJzb3VyY2VJ
+c0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6ICwgeCcgKiB4JyA+IDA7XG59Iiwic291
+cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPiAwO1xufSIsInNvdXJj
+ZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbn0iLCJzb3Vy
+Y2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgXG59Iiwi
+c291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzXG59
+Iiwic291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn0iLCJzb3VyY2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuIiwic291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn0iLCJz
+b3VyY2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn0iLCJz
+b3VyY2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cbiIs
+InNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNJyh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59Iiwic291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNJyh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59Iiwic291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNJyh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG4iLCJzb3VyY2VJc0ZpbGUiOmZhbHNl
+fQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNJyh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTScodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiB4JyA+PSAwO1xuICBhc3NlcnQg
+eCAqIHggPiAwO1xufSIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0odDogbmF0KVxuICByZXF1aXJlcyB0
+ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAyLCAzO1xuICBhc3NlcnQgZm9y
+YWxsIHgnOiBpbnQgOjogeCcgKiB4JyA+PSAwO1xuICBhc3NlcnQgeCAqIHggPiAwO1xufVxuXG5z
+dGF0aWMgbWV0aG9kIE0odDogbmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAx
+O1xuICB2YXIgeSwgeiA6PSAyLCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiB4
+JyA+PSAwO1xuICBhc3NlcnQgeCAqIHggPiAwO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0odDogbmF0
+KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAyLCAz
+O1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiB4JyA+PSAwO1xuICBhc3NlcnQgeCAq
+IHggPiAwO1xufSIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiB4JyA+PSAwO1xuICBhc3NlcnQg
+eCAqIHggPiAwO1xufSIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiB4JyA+PSAwO1xuICBhc3NlcnQg
+eCAqIHggPiAwO1xufVxuIiwic291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiAtIHgnID49IDA7XG4gIGFzc2Vy
+dCB4ICogeCA+IDA7XG59XG4iLCJzb3VyY2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiAtIHgnICAwO1xuICBhc3NlcnQg
+eCAqIHggPiAwO1xufVxuIiwic291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiAtIHgnIDwgMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cbiIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiAtIHgnIDw9IDA7XG4gIGFzc2Vy
+dCB4ICogeCA+IDA7XG59XG4iLCJzb3VyY2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiAtIHgnIDw9IDA7XG4gIFxuICBh
+c3NlcnQgeCAqIHggPiAwO1xufVxuIiwic291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiAtIHgnIDw9IDA7XG4gIGFzc1xu
+ICBhc3NlcnQgeCAqIHggPiAwO1xufVxuIiwic291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiAtIHgnIDw9IDA7XG4gIGFzc2Vy
+XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG4iLCJzb3VyY2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiAtIHgnIDw9IDA7XG4gIGFzc1xu
+ICBhc3NlcnQgeCAqIHggPiAwO1xufVxuIiwic291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiAtIHgnIDw9IDA7XG4gIGFzc3Vt
+ZSB5IDwgMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cbiIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiAtIHgnIDw9IDA7XG4gIGFzc3Vt
+ZSB5IDwgMDtcbiAgYXNzZXJ0IDtcbn1cbiIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiAtIHgnIDw9IDA7XG4gIGFzc3Vt
+ZSB5IDwgMDtcbiAgYXNzZXJ0IDtcbn1cbiIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiAtIHgnIDw9IDA7XG4gIGFzc3Vt
+ZSB5IDwgMDtcbiAgYXNzZXJ0IGZhbDtcbn1cbiIsInNvdXJjZUlzRmlsZSI6ZmFsc2V9
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiAtIHgnIDw9IDA7XG4gIGFzc3Vt
+ZSB5IDwgMDtcbiAgYXNzZXJ0IGZhbHNlO1xufVxuIiwic291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xufVxuXG5zdGF0aWMgbWV0aG9kIE0nKHQ6
+IG5hdClcbiAgcmVxdWlyZXMgdCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0g
+MiwgMztcbiAgYXNzZXJ0IGZvcmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0
+IHggKiB4ID4gMDtcbn1cblxuXG5zdGF0aWMgbWV0aG9kIE0wKHQ6IG5hdClcbiAgcmVxdWlyZXMg
+dCA+IDBcbntcbiAgdmFyIHggOj0gMTtcbiAgdmFyIHksIHogOj0gMiwgMztcbiAgYXNzZXJ0IGZv
+cmFsbCB4JzogaW50IDo6IHgnICogeCcgPj0gMDtcbiAgYXNzZXJ0IHggKiB4ID4gMDtcbn1cblxu
+c3RhdGljIG1ldGhvZCBNMSh0OiBuYXQpXG4gIHJlcXVpcmVzIHQgPiAwXG57XG4gIHZhciB4IDo9
+IDE7XG4gIHZhciB5LCB6IDo9IDIsIDM7XG4gIGFzc2VydCBmb3JhbGwgeCc6IGludCA6OiB4JyAq
+IHgnID49IDA7XG4gIGFzc2VydCB4ICogeCA+IDA7XG59XG5cbnN0YXRpYyBtZXRob2QgTTIodDog
+bmF0KVxuICByZXF1aXJlcyB0ID4gMFxue1xuICB2YXIgeCA6PSAxO1xuICB2YXIgeSwgeiA6PSAy
+LCAzO1xuICBhc3NlcnQgZm9yYWxsIHgnOiBpbnQgOjogeCcgKiAtIHgnIDw9IDA7XG4gIGFzc3Vt
+ZSB5IDwgMDtcbiAgYXNzZXJ0IGZhbHNlO1xufVxuIiwic291cmNlSXNGaWxlIjpmYWxzZX0=
+[[DAFNY-CLIENT: EOM]]
diff --git a/Test/server/simple-session.transcript.expect b/Test/server/simple-session.transcript.expect
new file mode 100644
index 00000000..89c3351d
--- /dev/null
+++ b/Test/server/simple-session.transcript.expect
@@ -0,0 +1,299 @@
+# Reading from simple-session.transcript
+transcript(3,9): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(3,9): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(3,9): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(3,9): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,13): Error: rbrace expected
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(6,2): Error: rbrace expected
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(7,0): Error: invalid UpdateStmt
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(7,0): Error: ident expected
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(7,11): Error: the number of left-hand sides (2) and right-hand sides (1) must match for a multi-assignment
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(7,11): Error: the number of left-hand sides (2) and right-hand sides (1) must match for a multi-assignment
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(6,2): Error: EOF expected
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(6,2): Error: EOF expected
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(11,0): Error: invalid UpdateStmt
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(11,0): Error: semi expected
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(11,0): Error: invalid UnaryExpression
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,25): Error: openparen expected
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,25): Error: openparen expected
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,26): Error: invalid QSep
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,28): Error: invalid QSep
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,27): Error: invalid UnaryExpression
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,9): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(12,0): Error: invalid UpdateStmt
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,14): Error: Duplicate member name: M'
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,14): Error: Duplicate member name: M'
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,14): Error: Duplicate member name: M'
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,14): Error: Duplicate member name: M'
+transcript(24,14): Error: Duplicate member name: M'
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,14): Error: Duplicate member name: M'
+transcript(24,14): Error: Duplicate member name: M'
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,14): Error: Duplicate member name: M'
+transcript(24,14): Error: Duplicate member name: M'
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,14): Error: Duplicate member name: M'
+transcript(24,14): Error: Duplicate member name: M'
+transcript(33,14): Error: Duplicate member name: M'
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,14): Error: Duplicate member name: M
+transcript(33,14): Error: Duplicate member name: M
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(38,9): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(38,38): Error: semi expected
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(38,9): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(40,2): Error: invalid UpdateStmt
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(40,2): Error: invalid UpdateStmt
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(40,2): Error: invalid UpdateStmt
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(40,9): Error: invalid AssertStmt
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(40,9): Error: invalid AssertStmt
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(40,9): Error: unresolved identifier: fal
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
-- 
cgit v1.2.3


From a8953bef9bebfaa4afb56a914060360c7453e8b8 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Fri, 31 Jul 2015 16:43:34 -0700
Subject: Allow forall statements in refinements

---
 Source/Dafny/RefinementTransformer.cs   |  3 ---
 Test/dafny0/RefinementErrors.dfy        | 37 +++++++++++++++++++++++++++++++++
 Test/dafny0/RefinementErrors.dfy.expect |  3 ++-
 3 files changed, 39 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/RefinementTransformer.cs b/Source/Dafny/RefinementTransformer.cs
index 2d32f78a..f430933b 100644
--- a/Source/Dafny/RefinementTransformer.cs
+++ b/Source/Dafny/RefinementTransformer.cs
@@ -1532,9 +1532,6 @@ namespace Microsoft.Dafny
         });
       } else if (s is CallStmt) {
         reporter.Error(s.Tok, "cannot have call statement");
-      } else if (s is ForallStmt) {
-        if (((ForallStmt)s).Kind == ForallStmt.ParBodyKind.Assign) // allow Proof and Call (as neither touch any existing state)
-          reporter.Error(s.Tok, "cannot have forall statement");
       } else {
         if (s is WhileStmt || s is AlternativeLoopStmt) {
           loopLevels++;
diff --git a/Test/dafny0/RefinementErrors.dfy b/Test/dafny0/RefinementErrors.dfy
index 121b33aa..8d60a8e4 100644
--- a/Test/dafny0/RefinementErrors.dfy
+++ b/Test/dafny0/RefinementErrors.dfy
@@ -59,3 +59,40 @@ module BB refines B {
     { 10 }
   }
 }
+
+module Forall0 {
+  class C {
+    var a: int
+    method M()
+      modifies this
+    {
+    }
+    lemma Lemma(x: int)
+    {
+    }
+  }
+}
+module Forall1 refines Forall0 {
+  class C {
+    var b: int
+    method M...
+    {
+      forall x { Lemma(x); }  // allowed
+      var s := {4};
+      forall x | x in s ensures x == 4 { }  // allowed
+      forall x {  // allowed
+        calc {
+          x in s;
+        ==
+          x == 4;
+        }
+      }
+      forall c | c in {this} {
+        c.b := 17;  // allowed
+      }
+      forall c | c in {this} {
+        c.a := 17;  // error: not allowed to update previously defined field
+      }
+    }
+  }
+}
diff --git a/Test/dafny0/RefinementErrors.dfy.expect b/Test/dafny0/RefinementErrors.dfy.expect
index 40cdb081..bac6612d 100644
--- a/Test/dafny0/RefinementErrors.dfy.expect
+++ b/Test/dafny0/RefinementErrors.dfy.expect
@@ -9,4 +9,5 @@ RefinementErrors.dfy(38,13): Error: type parameters are not allowed to be rename
 RefinementErrors.dfy(39,23): Error: the type of parameter 'z' is different from the type of the same parameter in the corresponding function in the module it refines ('seq<C>' instead of 'set<C>')
 RefinementErrors.dfy(40,9): Error: there is a difference in name of parameter 3 ('k' versus 'b') of function F compared to corresponding function in the module it refines
 RefinementErrors.dfy(57,20): Error: a function can be changed into a function method in a refining module only if the function has not yet been given a body: G
-11 resolution/type errors detected in RefinementErrors.dfy
+RefinementErrors.dfy(94,10): Error: refinement method cannot assign to a field defined in parent module ('a')
+12 resolution/type errors detected in RefinementErrors.dfy
-- 
cgit v1.2.3


From 6eeaf689c0ae81bf9df46f975b014b2b9e465f0a Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 31 Jul 2015 16:45:02 -0700
Subject: Add a Linux z3 binary to the repo, and use that or z3.exe based on
 the OS

---
 Binaries/z3                  | Bin 0 -> 16438468 bytes
 Source/Dafny/DafnyOptions.cs |  10 ++++++++++
 2 files changed, 10 insertions(+)
 create mode 100644 Binaries/z3

(limited to 'Source')

diff --git a/Binaries/z3 b/Binaries/z3
new file mode 100644
index 00000000..7c60feb4
Binary files /dev/null and b/Binaries/z3 differ
diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index 8972c490..66cf639f 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -11,6 +11,7 @@ namespace Microsoft.Dafny
   {
     public DafnyOptions()
       : base("Dafny", "Dafny program verifier") {
+        SetZ3ExecutableName();
     }
 
     public override string VersionNumber {
@@ -255,6 +256,15 @@ namespace Microsoft.Dafny
       // TODO: provide attribute help here
     }
 
+    private void SetZ3ExecutableName() {
+      var platform = (int)System.Environment.OSVersion.Platform;
+      var isLinux = platform == 4 || platform ==  128; // http://www.mono-project.com/docs/faq/technical/
+
+      //TODO should we also vendor an OSX build?
+      var binDir = System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location);
+      Z3ExecutablePath = System.IO.Path.Combine(binDir, isLinux ? "z3" : "z3.exe");
+    }
+
     public override void Usage() {
       Console.WriteLine(@"  ---- Dafny options ---------------------------------------------------------
 
-- 
cgit v1.2.3


From d023b0e19f7bf886801a3a059511b8449d8ab223 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Fri, 31 Jul 2015 16:58:36 -0700
Subject: Bug fix: check that assign-such-that constraint is of type boolean

---
 Source/Dafny/Resolver.cs                |  3 +++
 Test/dafny0/ResolutionErrors.dfy        | 15 +++++++++++++++
 Test/dafny0/ResolutionErrors.dfy.expect |  6 +++++-
 3 files changed, 23 insertions(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index e977dbd5..a58d6e6c 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -6100,6 +6100,9 @@ namespace Microsoft.Dafny
       s.IsGhost = s.Lhss.TrueForAll(AssignStmt.LhsIsToGhost);
       var ec = ErrorCount;
       ResolveExpression(s.Expr, new ResolveOpts(codeContext, true, specContextOnly));
+      if (!UnifyTypes(s.Expr.Type, Type.Bool)) {
+        Error(s.Expr, "type of RHS of assign-such-that statement must be boolean (got {0})", s.Expr.Type);
+      }
       if (ec == ErrorCount && !s.IsGhost && s.AssumeToken == null && !specContextOnly) {
         CheckIsNonGhost(s.Expr);
 
diff --git a/Test/dafny0/ResolutionErrors.dfy b/Test/dafny0/ResolutionErrors.dfy
index 900c7459..1354e533 100644
--- a/Test/dafny0/ResolutionErrors.dfy
+++ b/Test/dafny0/ResolutionErrors.dfy
@@ -1373,3 +1373,18 @@ module NonTypeVariableNames {
     Y := k;  // error: module name used as variable
   }
 }
+
+// ------------------- assign-such-that and let-such-that -------------------
+
+module SuchThat {
+  method M() {
+    var x: int;
+    x :| 5 + 7;  // error: constraint should be boolean
+    x :| x;  // error: constraint should be boolean
+    var y :| 4;  // error: constraint should be boolean
+  }
+  function F(): int {
+    var w :| 6 + 8;  // error: constraint should be boolean
+    w
+  }
+}
diff --git a/Test/dafny0/ResolutionErrors.dfy.expect b/Test/dafny0/ResolutionErrors.dfy.expect
index 481b47e0..b5c93ac1 100644
--- a/Test/dafny0/ResolutionErrors.dfy.expect
+++ b/Test/dafny0/ResolutionErrors.dfy.expect
@@ -104,6 +104,10 @@ ResolutionErrors.dfy(1371,16): Error: name of module (Y) is used as a variable
 ResolutionErrors.dfy(1371,13): Error: arguments must have the same type (got int and #module)
 ResolutionErrors.dfy(1372,4): Error: name of type (X) is used as a variable
 ResolutionErrors.dfy(1373,4): Error: name of module (Y) is used as a variable
+ResolutionErrors.dfy(1382,11): Error: type of RHS of assign-such-that statement must be boolean (got int)
+ResolutionErrors.dfy(1383,9): Error: type of RHS of assign-such-that statement must be boolean (got int)
+ResolutionErrors.dfy(1384,13): Error: type of RHS of assign-such-that statement must be boolean (got int)
+ResolutionErrors.dfy(1387,15): Error: type of RHS of let-such-that expression must be boolean (got int)
 ResolutionErrors.dfy(432,2): Error: More than one anonymous constructor
 ResolutionErrors.dfy(50,13): Error: 'this' is not allowed in a 'static' context
 ResolutionErrors.dfy(87,14): Error: the name 'Benny' denotes a datatype constructor, but does not do so uniquely; add an explicit qualification (for example, 'Abc.Benny')
@@ -196,4 +200,4 @@ ResolutionErrors.dfy(1106,8): Error: new cannot be applied to a trait
 ResolutionErrors.dfy(1127,13): Error: first argument to / must be of numeric type (instead got set<bool>)
 ResolutionErrors.dfy(1134,18): Error: a call to a possibly non-terminating method is allowed only if the calling method is also declared (with 'decreases *') to be possibly non-terminating
 ResolutionErrors.dfy(1149,14): Error: a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating
-198 resolution/type errors detected in ResolutionErrors.dfy
+202 resolution/type errors detected in ResolutionErrors.dfy
-- 
cgit v1.2.3


From 3243c7ac086991a801f6bca711387d36fc601999 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Fri, 31 Jul 2015 17:22:52 -0700
Subject: Add path to DafnyPrelude.bpl from DafnyServer project

---
 Source/DafnyServer/DafnyServer.csproj | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyServer/DafnyServer.csproj b/Source/DafnyServer/DafnyServer.csproj
index 3da33f16..a173f810 100644
--- a/Source/DafnyServer/DafnyServer.csproj
+++ b/Source/DafnyServer/DafnyServer.csproj
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
   <PropertyGroup>
@@ -63,7 +63,7 @@
   </ItemGroup>
   <ItemGroup>
     <None Include="App.config" />
-    <None Include="DafnyPrelude.bpl">
+    <None Include="..\..\Binaries\DafnyPrelude.bpl">
       <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
     </None>
   </ItemGroup>
@@ -75,4 +75,4 @@
   <Target Name="AfterBuild">
   </Target>
   -->
-</Project>
\ No newline at end of file
+</Project>
-- 
cgit v1.2.3


From 0579ef0552cf496b7c7b2246586b91b5bb42d406 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 31 Jul 2015 17:55:23 -0700
Subject: Integrate the DafnyServer project into the main Dafny solution

---
 Source/Dafny.sln                      | 17 +++++++++++++++++
 Source/DafnyServer.sln                | 20 --------------------
 Source/DafnyServer/DafnyServer.csproj |  3 ---
 3 files changed, 17 insertions(+), 23 deletions(-)
 delete mode 100644 Source/DafnyServer.sln

(limited to 'Source')

diff --git a/Source/Dafny.sln b/Source/Dafny.sln
index e7ba8026..570922fa 100644
--- a/Source/Dafny.sln
+++ b/Source/Dafny.sln
@@ -5,6 +5,8 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DafnyDriver", "DafnyDriver\
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DafnyPipeline", "Dafny\DafnyPipeline.csproj", "{FE44674A-1633-4917-99F4-57635E6FA740}"
 EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DafnyServer", "DafnyServer\DafnyServer.csproj", "{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Checked|.NET = Checked|.NET
@@ -52,6 +54,21 @@ Global
 		{FE44674A-1633-4917-99F4-57635E6FA740}.Release|Any CPU.Build.0 = Release|Any CPU
 		{FE44674A-1633-4917-99F4-57635E6FA740}.Release|Mixed Platforms.ActiveCfg = Release|Any CPU
 		{FE44674A-1633-4917-99F4-57635E6FA740}.Release|Mixed Platforms.Build.0 = Release|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Checked|.NET.ActiveCfg = Release|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Checked|Any CPU.ActiveCfg = Release|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Checked|Any CPU.Build.0 = Release|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Checked|Mixed Platforms.ActiveCfg = Release|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Checked|Mixed Platforms.Build.0 = Release|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Debug|.NET.ActiveCfg = Debug|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Debug|Mixed Platforms.ActiveCfg = Debug|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Debug|Mixed Platforms.Build.0 = Debug|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Release|.NET.ActiveCfg = Release|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Release|Any CPU.Build.0 = Release|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Release|Mixed Platforms.ActiveCfg = Release|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Release|Mixed Platforms.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
diff --git a/Source/DafnyServer.sln b/Source/DafnyServer.sln
deleted file mode 100644
index 217b1c74..00000000
--- a/Source/DafnyServer.sln
+++ /dev/null
@@ -1,20 +0,0 @@
-
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 2012
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DafnyServer", "DafnyServer\DafnyServer.csproj", "{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		Debug|Any CPU = Debug|Any CPU
-		Release|Any CPU = Release|Any CPU
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Release|Any CPU.Build.0 = Release|Any CPU
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-EndGlobal
diff --git a/Source/DafnyServer/DafnyServer.csproj b/Source/DafnyServer/DafnyServer.csproj
index 3da33f16..d1171d69 100644
--- a/Source/DafnyServer/DafnyServer.csproj
+++ b/Source/DafnyServer/DafnyServer.csproj
@@ -63,9 +63,6 @@
   </ItemGroup>
   <ItemGroup>
     <None Include="App.config" />
-    <None Include="DafnyPrelude.bpl">
-      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
-    </None>
   </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
-- 
cgit v1.2.3


From d86d8e6d41394166370bdaee4b02fa1ce6886f42 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 31 Jul 2015 19:09:55 -0700
Subject: Fix an issue with column numbers in the VS extension

The error came from the fact that Dafny now consistently used 0-based indexing.
Boogie gets its traces from text that's inserted by Dafny in the Boogie file, so
there's no need to apply an extra offset in the VS extension.
---
 Source/DafnyExtension/ResolverTagger.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/DafnyExtension/ResolverTagger.cs b/Source/DafnyExtension/ResolverTagger.cs
index 4237041f..6eaec5a6 100644
--- a/Source/DafnyExtension/ResolverTagger.cs
+++ b/Source/DafnyExtension/ResolverTagger.cs
@@ -529,7 +529,7 @@ namespace DafnyLanguage
              else
              {
                var line = Math.Max(0, int.Parse(match.Groups[1].Value) - 1);
-               var column = Math.Max(0, int.Parse(match.Groups[2].Value) - 1);
+               var column = Math.Max(0, int.Parse(match.Groups[2].Value));
                var sLine = Snapshot.GetLineFromLineNumber(line);
                Contract.Assert(column <= sLine.Length);
                var sLength = Math.Max(0, Math.Min(sLine.Length - column, 0));
-- 
cgit v1.2.3


From c978cd18f8dfba5bfac92af792041c5b4756de5a Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 31 Jul 2015 19:10:14 -0700
Subject: Tiny refactoring in the extension's driver

---
 Source/DafnyExtension/DafnyDriver.cs | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyExtension/DafnyDriver.cs b/Source/DafnyExtension/DafnyDriver.cs
index 640ef67c..50d8c2e3 100644
--- a/Source/DafnyExtension/DafnyDriver.cs
+++ b/Source/DafnyExtension/DafnyDriver.cs
@@ -134,7 +134,7 @@ namespace DafnyLanguage
 
     void RecordError(string filename, int line, int col, ErrorCategory cat, string msg, bool isRecycled = false)
     {
-      _errors.Add(new DafnyError(filename, line, col, cat, msg, _snapshot, isRecycled, null, System.IO.Path.GetFullPath(this._filename) == filename));
+      _errors.Add(new DafnyError(filename, line - 1, col - 1, cat, msg, _snapshot, isRecycled, null, System.IO.Path.GetFullPath(this._filename) == filename));
     }
 
     class VSErrors : Dafny.Errors
@@ -144,15 +144,15 @@ namespace DafnyLanguage
         this.dd = dd;
       }
       public override void SynErr(string filename, int line, int col, string msg) {
-        dd.RecordError(filename, line - 1, col - 1, ErrorCategory.ParseError, msg);
+        dd.RecordError(filename, line, col, ErrorCategory.ParseError, msg);
         count++;
       }
       public override void SemErr(string filename, int line, int col, string msg) {
-        dd.RecordError(filename, line - 1, col - 1, ErrorCategory.ResolveError, msg);
+        dd.RecordError(filename, line, col, ErrorCategory.ResolveError, msg);
         count++;
       }
       public override void Warning(IToken tok, string msg) {
-        dd.RecordError(tok.filename, tok.line - 1, tok.col - 1, ErrorCategory.ParseWarning, msg);
+        dd.RecordError(tok.filename, tok.line, tok.col, ErrorCategory.ParseWarning, msg);
       }
     }
 
@@ -179,14 +179,14 @@ namespace DafnyLanguage
 
       public override void Error(Bpl.IToken tok, string msg, params object[] args) {
         string s = string.Format(msg, args);
-        dd.RecordError(tok.filename, tok.line - 1, tok.col - 1, ErrorCategory.ResolveError, s);
+        dd.RecordError(tok.filename, tok.line, tok.col, ErrorCategory.ResolveError, s);
         ErrorCount++;
       }
 
       public override void Warning(IToken tok, string msg, params object[] args) {
         if (reportWarnings) {
           string s = string.Format(msg, args);
-          dd.RecordError(tok.filename, tok.line - 1, tok.col - 1, ErrorCategory.ResolveWarning, s);
+          dd.RecordError(tok.filename, tok.line, tok.col, ErrorCategory.ResolveWarning, s);
         }
       }
     }
-- 
cgit v1.2.3


From 2a921fb2a765d91bba47901144845b0102edbcbb Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Mon, 10 Aug 2015 18:06:04 -0700
Subject: Added routine OneAttributeToString to pretty printer

---
 Source/Dafny/DafnyAst.cs | 10 ++++++++++
 Source/Dafny/Printer.cs  | 25 ++++++++++++++++++-------
 2 files changed, 28 insertions(+), 7 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 8d68e3e2..f66f40a1 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -5761,6 +5761,16 @@ namespace Microsoft.Dafny {
       Contract.Requires(name != null);
       Name = name;
     }
+    /// <summary>
+    /// Constructs a resolved IdentifierExpr.
+    /// </summary>
+    public IdentifierExpr(IVariable v)
+      : base(v.Tok) {
+      Contract.Requires(v != null);
+      Name = v.Name;
+      Var = v;
+      Type = v.Type;
+    }
   }
 
   /// <summary>
diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index 1c7508eb..1fa90e41 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -109,6 +109,15 @@ namespace Microsoft.Dafny {
       }
     }
 
+    public static string OneAttributeToString(Attributes a) {
+      Contract.Requires(a != null);
+      using (var wr = new System.IO.StringWriter()) {
+        var pr = new Printer(wr);
+        pr.PrintOneAttribute(a);
+        return ToStringWithoutNewline(wr);
+      }
+    }
+
     public static string ToStringWithoutNewline(System.IO.StringWriter wr) {
       Contract.Requires(wr != null);
       var sb = wr.GetStringBuilder();
@@ -429,14 +438,16 @@ namespace Microsoft.Dafny {
     public void PrintAttributes(Attributes a) {
       if (a != null) {
         PrintAttributes(a.Prev);
-
-        wr.Write(" {{:{0}", a.Name);
-        if (a.Args != null)
-        {
-          PrintAttributeArgs(a.Args, false);
-        }
-        wr.Write("}");
+        PrintOneAttribute(a);
+      }
+    }
+    public void PrintOneAttribute(Attributes a) {
+      Contract.Requires(a != null);
+      wr.Write(" {{:{0}", a.Name);
+      if (a.Args != null) {
+        PrintAttributeArgs(a.Args, false);
       }
+      wr.Write("}");
     }
 
     public void PrintAttributeArgs(List<Expression> args, bool isFollowedBySemicolon) {
-- 
cgit v1.2.3


From 3bf4b44b821dca5017017e99502f263e636d5e84 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Tue, 11 Aug 2015 19:07:42 -0700
Subject: Moved discovery of induction variables into a Rewriter. Generate
 warnings for malformed :induction arguments. Removed the functionality that
 allowed induction on 'this'.

---
 Source/Dafny/DafnyOptions.cs |   2 +-
 Source/Dafny/Printer.cs      |   8 +-
 Source/Dafny/Resolver.cs     |   1 +
 Source/Dafny/Rewriter.cs     | 343 ++++++++++++++++++++++++++++-
 Source/Dafny/Translator.cs   | 513 ++++++++++---------------------------------
 5 files changed, 466 insertions(+), 401 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index 66cf639f..2eea5717 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -312,7 +312,7 @@ namespace Microsoft.Dafny
                 2 - apply induction as requested (by attributes) and also
                     for heuristically chosen quantifiers
                 3 (default) - apply induction as requested, and for
-                    heuristically chosen quantifiers and ghost methods
+                    heuristically chosen quantifiers and lemmas
   /inductionHeuristic:<n>
                 0 - least discriminating induction heuristic (that is, lean
                     toward applying induction more often)
diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index 1fa90e41..7a93a140 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -109,11 +109,11 @@ namespace Microsoft.Dafny {
       }
     }
 
-    public static string OneAttributeToString(Attributes a) {
+    public static string OneAttributeToString(Attributes a, string nameSubstitution = null) {
       Contract.Requires(a != null);
       using (var wr = new System.IO.StringWriter()) {
         var pr = new Printer(wr);
-        pr.PrintOneAttribute(a);
+        pr.PrintOneAttribute(a, nameSubstitution);
         return ToStringWithoutNewline(wr);
       }
     }
@@ -441,9 +441,9 @@ namespace Microsoft.Dafny {
         PrintOneAttribute(a);
       }
     }
-    public void PrintOneAttribute(Attributes a) {
+    public void PrintOneAttribute(Attributes a, string nameSubstitution = null) {
       Contract.Requires(a != null);
-      wr.Write(" {{:{0}", a.Name);
+      wr.Write(" {{:{0}", nameSubstitution ?? a.Name);
       if (a.Args != null) {
         PrintAttributeArgs(a.Args, false);
       }
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index a58d6e6c..75d171ac 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -322,6 +322,7 @@ namespace Microsoft.Dafny
       if (DafnyOptions.O.AutoTriggers) {
         rewriters.Add(new TriggersRewriter(this));
       }
+      rewriters.Add(new InductionRewriter(this));
 
       systemNameInfo = RegisterTopLevelDecls(prog.BuiltIns.SystemModule, false);
       prog.CompileModules.Add(prog.BuiltIns.SystemModule);
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 4223fb7f..ffd808c5 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -1266,6 +1266,347 @@ namespace Microsoft.Dafny
       return new AutoGeneratedToken(tok);
     }
   }
-}
 
+  // ===========================================================================================
+
+  public class InductionRewriter : IRewriter
+  {
+    Resolver Resolver;
+    internal InductionRewriter(Resolver resolver) {
+      Contract.Requires(resolver != null);
+      this.Resolver = resolver;
+    }
+    public void PreResolve(ModuleDefinition m) {
+    }
+    public void PostResolve(ModuleDefinition m) {
+    }
+    public void PostCyclicityResolve(ModuleDefinition m) {
+      if (DafnyOptions.O.Induction == 0) {
+        // Don't bother inferring :induction attributes.  This will also have the effect of not warning about malformed :induction attributes
+      } else {
+        foreach (var decl in m.TopLevelDecls) {
+          if (decl is ClassDecl) {
+            var cl = (ClassDecl)decl;
+            foreach (var member in cl.Members) {
+              if (member is FixpointLemma) {
+                var method = (FixpointLemma)member;
+                ProcessMethodExpressions(method);
+                ComputeLemmaInduction(method.PrefixLemma);
+                ProcessMethodExpressions(method.PrefixLemma);
+              } else if (member is Method) {
+                var method = (Method)member;
+                ComputeLemmaInduction(method);
+                ProcessMethodExpressions(method);
+              } else if (member is FixpointPredicate) {
+                var function = (FixpointPredicate)member;
+                ProcessFunctionExpressions(function);
+                ProcessFunctionExpressions(function.PrefixPredicate);
+              } else if (member is Function) {
+                var function = (Function)member;
+                ProcessFunctionExpressions(function);
+              }
+            }
+          } else if (decl is NewtypeDecl) {
+            var nt = (NewtypeDecl)decl;
+            if (nt.Constraint != null) {
+              var visitor = new Induction_Visitor(this);
+              visitor.Visit(nt.Constraint);
+            }
+          }
+        }
+      }
+    }
+    void ProcessMethodExpressions(Method method) {
+      Contract.Requires(method != null);
+      var visitor = new Induction_Visitor(this);
+      method.Req.ForEach(mfe => visitor.Visit(mfe.E));
+      method.Ens.ForEach(mfe => visitor.Visit(mfe.E));
+      if (method.Body != null) {
+        visitor.Visit(method.Body);
+      }
+    }
+    void ProcessFunctionExpressions(Function function) {
+      Contract.Requires(function != null);
+      var visitor = new Induction_Visitor(this);
+      function.Req.ForEach(visitor.Visit);
+      function.Ens.ForEach(visitor.Visit);
+      if (function.Body != null) {
+        visitor.Visit(function.Body);
+      }
+    }
+    void ComputeLemmaInduction(Method method) {
+      Contract.Requires(method != null);
+      if (method.IsGhost && method.Mod.Expressions.Count == 0 && method.Outs.Count == 0 && !(method is FixpointLemma)) {
+        var posts = new List<Expression>();
+        method.Ens.ForEach(mfe => posts.Add(mfe.E));
+        ComputeInductionVariables(method.tok, method.Ins, posts, ref method.Attributes);
+      }
+    }
+    void ComputeInductionVariables<VarType>(IToken tok, List<VarType> boundVars, List<Expression> searchExprs, ref Attributes attributes) where VarType : class, IVariable {
+      Contract.Requires(tok != null);
+      Contract.Requires(boundVars != null);
+      Contract.Requires(searchExprs != null);
+      Contract.Requires(DafnyOptions.O.Induction != 0);
+      bool forLemma = boundVars is List<Formal>;
+
+      var args = Attributes.FindExpressions(attributes, "induction");  // we only look at the first one we find, since it overrides any other ones
+      if (args == null) {
+        if (DafnyOptions.O.Induction < 2) {
+          // No explicit induction variables and we're asked not to infer anything, so we're done
+          return;
+        } else if (DafnyOptions.O.Induction == 2 && forLemma) {
+          // We're asked to infer induction variables only for quantifiers, not for lemmas
+          return;
+        }
+        // GO INFER below (only select boundVars)
+      } else if (args.Count == 0) {
+        // {:induction} is treated the same as {:induction true}, which says to automatically infer induction variables
+        // GO INFER below (all boundVars)
+      } else if (args.Count == 1 && args[0] is LiteralExpr && ((LiteralExpr)args[0]).Value is bool) {
+        // {:induction false} or {:induction true}
+        if (!(bool)((LiteralExpr)args[0]).Value) {
+          // we're told not to infer anything
+          return;
+        }
+        // GO INFER below (all boundVars)
+      } else {
+        // Here, we're expecting the arguments to {:induction args} to be a sublist of "boundVars".
+        var goodArguments = new List<Expression>();
+        var i = 0;
+        foreach (var arg in args) {
+          var ie = arg.Resolved as IdentifierExpr;
+          if (ie != null) {
+            var j = boundVars.FindIndex(i, v => v == ie.Var);
+            if (i <= j) {
+              goodArguments.Add(ie);
+              i = j;
+              continue;
+            }
+            if (0 <= boundVars.FindIndex(v => v == ie.Var)) {
+              Resolver.Warning(arg.tok, "{0}s given as :induction arguments must be given in the same order as in the {1}; ignoring attribute",
+                forLemma ? "lemma parameter" : "bound variable", forLemma ? "lemma" : "quantifier");
+              return;
+            }
+          }
+          Resolver.Warning(arg.tok, "invalid :induction attribute argument; expected {0}{1}; ignoring attribute",
+            i == 0 ? "'false' or 'true' or " : "",
+            forLemma ? "lemma parameter" : "bound variable");
+          return;
+        }
+        // The argument list was legal, so let's use it for the _induction attribute
+        attributes = new Attributes("_induction", goodArguments, attributes);
+        return;
+      }
+
+      // Okay, here we go, coming up with good induction setting for the given situation
+      var inductionVariables = new List<Expression>();
+      foreach (IVariable n in boundVars) {
+        if (!n.Type.IsTypeParameter && (args != null || searchExprs.Exists(expr => VarOccursInArgumentToRecursiveFunction(expr, n)))) {
+          inductionVariables.Add(new IdentifierExpr(n));
+        }
+      }
+      if (inductionVariables.Count != 0) {
+        // We found something usable, so let's record that in an attribute
+        attributes = new Attributes("_induction", inductionVariables, attributes);
+        // And since we're inferring something, let's also report that in a hover text.
+        var s = Printer.OneAttributeToString(attributes, "induction");
+        Resolver.ReportAdditionalInformation(tok, s, s.Length);
+      }
+    }
+    class Induction_Visitor : BottomUpVisitor
+    {
+      readonly InductionRewriter IndRewriter;
+      public Induction_Visitor(InductionRewriter inductionRewriter) {
+        Contract.Requires(inductionRewriter != null);
+        IndRewriter = inductionRewriter;
+      }
+      protected override void VisitOneExpr(Expression expr) {
+        var q = expr as QuantifierExpr;
+        if (q != null) {
+          IndRewriter.ComputeInductionVariables(q.tok, q.BoundVars, new List<Expression>() { q.LogicalBody() }, ref q.Attributes);
+        }
+      }
+      void VisitInductionStmt(Statement stmt) {
+        Contract.Requires(stmt != null);
+        // visit a selection of subexpressions
+        if (stmt is AssertStmt) {
+          var s = (AssertStmt)stmt;
+          Visit(s.Expr);
+        }
+        // recursively visit all substatements
+        foreach (var s in stmt.SubStatements) {
+          VisitInductionStmt(s);
+        }
+      }
+    }
+
+    /// <summary>
+    /// Returns 'true' iff by looking at 'expr' the Induction Heuristic determines that induction should be applied to 'n'.
+    /// More precisely:
+    ///   DafnyInductionHeuristic      Return 'true'
+    ///   -----------------------      -------------
+    ///        0                       always
+    ///        1    if 'n' occurs as   any subexpression (of 'expr')
+    ///        2    if 'n' occurs as   any subexpression of          any index argument of an array/sequence select expression or any                       argument to a recursive function
+    ///        3    if 'n' occurs as   a prominent subexpression of  any index argument of an array/sequence select expression or any                       argument to a recursive function
+    ///        4    if 'n' occurs as   any subexpression of                                                                       any                       argument to a recursive function
+    ///        5    if 'n' occurs as   a prominent subexpression of                                                               any                       argument to a recursive function
+    ///        6    if 'n' occurs as   a prominent subexpression of                                                               any decreases-influencing argument to a recursive function
+    /// Parameter 'n' is allowed to be a ThisSurrogate.
+    /// </summary>
+    public static bool VarOccursInArgumentToRecursiveFunction(Expression expr, IVariable n) {
+      switch (DafnyOptions.O.InductionHeuristic) {
+        case 0: return true;
+        case 1: return Translator.ContainsFreeVariable(expr, false, n);
+        default: return VarOccursInArgumentToRecursiveFunction(expr, n, false);
+      }
+    }
+
+    /// <summary>
+    /// Worker routine for VarOccursInArgumentToRecursiveFunction(expr,n), where the additional parameter 'exprIsProminent' says whether or
+    /// not 'expr' has prominent status in its context.
+    /// DafnyInductionHeuristic cases 0 and 1 are assumed to be handled elsewhere (i.e., a precondition of this method is DafnyInductionHeuristic is at least 2).
+    /// Parameter 'n' is allowed to be a ThisSurrogate.
+    /// </summary>
+    static bool VarOccursInArgumentToRecursiveFunction(Expression expr, IVariable n, bool exprIsProminent) {
+      Contract.Requires(expr != null);
+      Contract.Requires(n != null);
+
+      // The following variable is what gets passed down to recursive calls if the subexpression does not itself acquire prominent status.
+      var subExprIsProminent = DafnyOptions.O.InductionHeuristic == 2 || DafnyOptions.O.InductionHeuristic == 4 ? /*once prominent, always prominent*/exprIsProminent : /*reset the prominent status*/false;
+
+      if (expr is ThisExpr) {
+        return exprIsProminent && n is ThisSurrogate;
+      } else if (expr is IdentifierExpr) {
+        var e = (IdentifierExpr)expr;
+        return exprIsProminent && e.Var == n;
+      } else if (expr is SeqSelectExpr) {
+        var e = (SeqSelectExpr)expr;
+        var q = DafnyOptions.O.InductionHeuristic < 4 || subExprIsProminent;
+        return VarOccursInArgumentToRecursiveFunction(e.Seq, n, subExprIsProminent) ||  // this subexpression does not acquire "prominent" status
+          (e.E0 != null && VarOccursInArgumentToRecursiveFunction(e.E0, n, q)) ||  // this one does (unless arrays/sequences are excluded)
+          (e.E1 != null && VarOccursInArgumentToRecursiveFunction(e.E1, n, q));    // ditto
+      } else if (expr is MultiSelectExpr) {
+        var e = (MultiSelectExpr)expr;
+        var q = DafnyOptions.O.InductionHeuristic < 4 || subExprIsProminent;
+        return VarOccursInArgumentToRecursiveFunction(e.Array, n, subExprIsProminent) ||
+          e.Indices.Exists(exp => VarOccursInArgumentToRecursiveFunction(exp, n, q));
+      } else if (expr is FunctionCallExpr) {
+        var e = (FunctionCallExpr)expr;
+        // For recursive functions:  arguments are "prominent"
+        // For non-recursive function:  arguments are "prominent" if the call is
+        var rec = e.Function.IsRecursive && e.CoCall != FunctionCallExpr.CoCallResolution.Yes;
+        var decr = e.Function.Decreases.Expressions;
+        bool variantArgument;
+        if (DafnyOptions.O.InductionHeuristic < 6) {
+          variantArgument = rec;
+        } else {
+          // The receiver is considered to be "variant" if the function is recursive and the receiver participates
+          // in the effective decreases clause of the function.  The receiver participates if it's a free variable
+          // of a term in the explicit decreases clause.
+          variantArgument = rec && decr.Exists(ee => Translator.ContainsFreeVariable(ee, true, null));
+        }
+        if (VarOccursInArgumentToRecursiveFunction(e.Receiver, n, variantArgument || subExprIsProminent)) {
+          return true;
+        }
+        Contract.Assert(e.Function.Formals.Count == e.Args.Count);
+        for (int i = 0; i < e.Function.Formals.Count; i++) {
+          var f = e.Function.Formals[i];
+          var exp = e.Args[i];
+          if (DafnyOptions.O.InductionHeuristic < 6) {
+            variantArgument = rec;
+          } else if (rec) {
+            // The argument position is considered to be "variant" if the function is recursive and...
+            // ... it has something to do with why the callee is well-founded, which happens when...
+            if (f is ImplicitFormal) {
+              // ... it is the argument is the implicit _k parameter, which is always first in the effective decreases clause of a prefix lemma, or
+              variantArgument = true;
+            } else if (decr.Exists(ee => Translator.ContainsFreeVariable(ee, false, f))) {
+              // ... it participates in the effective decreases clause of the function, which happens when it is
+              // a free variable of a term in the explicit decreases clause, or
+              variantArgument = true;
+            } else {
+              // ... the callee is a prefix predicate.
+              variantArgument = true;
+            }
+          }
+          if (VarOccursInArgumentToRecursiveFunction(exp, n, variantArgument || subExprIsProminent)) {
+            return true;
+          }
+        }
+        return false;
+      } else if (expr is TernaryExpr) {
+        var e = (TernaryExpr)expr;
+        switch (e.Op) {
+          case TernaryExpr.Opcode.PrefixEqOp:
+          case TernaryExpr.Opcode.PrefixNeqOp:
+            return VarOccursInArgumentToRecursiveFunction(e.E0, n, true) ||
+              VarOccursInArgumentToRecursiveFunction(e.E1, n, subExprIsProminent) ||
+              VarOccursInArgumentToRecursiveFunction(e.E2, n, subExprIsProminent);
+          default:
+            Contract.Assert(false); throw new cce.UnreachableException();  // unexpected ternary expression
+        }
+      } else if (expr is DatatypeValue) {
+        var e = (DatatypeValue)expr;
+        var q = n.Type.IsDatatype ? exprIsProminent : subExprIsProminent;  // prominent status continues, if we're looking for a variable whose type is a datatype
+        return e.Arguments.Exists(exp => VarOccursInArgumentToRecursiveFunction(exp, n, q));
+      } else if (expr is UnaryExpr) {
+        var e = (UnaryExpr)expr;
+        // both Not and SeqLength preserve prominence
+        return VarOccursInArgumentToRecursiveFunction(e.E, n, exprIsProminent);
+      } else if (expr is BinaryExpr) {
+        var e = (BinaryExpr)expr;
+        bool q;
+        switch (e.ResolvedOp) {
+          case BinaryExpr.ResolvedOpcode.Add:
+          case BinaryExpr.ResolvedOpcode.Sub:
+          case BinaryExpr.ResolvedOpcode.Mul:
+          case BinaryExpr.ResolvedOpcode.Div:
+          case BinaryExpr.ResolvedOpcode.Mod:
+          case BinaryExpr.ResolvedOpcode.Union:
+          case BinaryExpr.ResolvedOpcode.Intersection:
+          case BinaryExpr.ResolvedOpcode.SetDifference:
+          case BinaryExpr.ResolvedOpcode.Concat:
+            // these operators preserve prominence
+            q = exprIsProminent;
+            break;
+          default:
+            // whereas all other binary operators do not
+            q = subExprIsProminent;
+            break;
+        }
+        return VarOccursInArgumentToRecursiveFunction(e.E0, n, q) ||
+          VarOccursInArgumentToRecursiveFunction(e.E1, n, q);
+      } else if (expr is StmtExpr) {
+        var e = (StmtExpr)expr;
+        // ignore the statement
+        return VarOccursInArgumentToRecursiveFunction(e.E, n);
+
+      } else if (expr is ITEExpr) {
+        var e = (ITEExpr)expr;
+        return VarOccursInArgumentToRecursiveFunction(e.Test, n, subExprIsProminent) ||  // test is not "prominent"
+          VarOccursInArgumentToRecursiveFunction(e.Thn, n, exprIsProminent) ||  // but the two branches are
+          VarOccursInArgumentToRecursiveFunction(e.Els, n, exprIsProminent);
+      } else if (expr is OldExpr ||
+                 expr is ConcreteSyntaxExpression ||
+                 expr is BoxingCastExpr ||
+                 expr is UnboxingCastExpr) {
+        foreach (var exp in expr.SubExpressions) {
+          if (VarOccursInArgumentToRecursiveFunction(exp, n, exprIsProminent)) {  // maintain prominence
+            return true;
+          }
+        }
+        return false;
+      } else {
+        // in all other cases, reset the prominence status and recurse on the subexpressions
+        foreach (var exp in expr.SubExpressions) {
+          if (VarOccursInArgumentToRecursiveFunction(exp, n, subExprIsProminent)) {
+            return true;
+          }
+        }
+        return false;
+      }
+    }
+  }
+}
 
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index b8c4b8ec..cdfb1a32 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -2756,126 +2756,117 @@ namespace Microsoft.Dafny {
 
       Bpl.StmtList stmts;
       if (!wellformednessProc) {
-        if (3 <= DafnyOptions.O.Induction && m.IsGhost && m.Mod.Expressions.Count == 0 && m.Outs.Count == 0 && !(m is FixpointLemma)) {
-          var posts = new List<Expression>();
-          m.Ens.ForEach(mfe => posts.Add(mfe.E));
-          var allIns = new List<Formal>();
-          if (!m.IsStatic) {
-            allIns.Add(new ThisSurrogate(m.tok, Resolver.GetThisType(m.tok, (ClassDecl)m.EnclosingClass)));
-          }
-          allIns.AddRange(m.Ins);
-          var inductionVars = ApplyInduction(allIns, m.Attributes, posts, delegate(System.IO.TextWriter wr) { wr.Write(m.FullName); });
-          if (inductionVars.Count != 0) {
-            // Let the parameters be this,x,y of the method M and suppose ApplyInduction returns this,y.
-            // Also, let Pre be the precondition and VF be the decreases clause.
-            // Then, insert into the method body what amounts to:
-            //     assume case-analysis-on-parameter[[ y' ]];
-            //     forall (this', y' | Pre(this', x, y') && VF(this', x, y') << VF(this, x, y)) {
-            //       this'.M(x, y');
-            //     }
-            // Generate bound variables for the forall statement, and a substitution for the Pre and VF
-
-            // assume case-analysis-on-parameter[[ y' ]];
-            foreach (var inFormal in m.Ins) {
-              var dt = inFormal.Type.AsDatatype;
-              if (dt != null) {
-                var funcID = new Bpl.FunctionCall(new Bpl.IdentifierExpr(inFormal.tok, "$IsA#" + dt.FullSanitizedName, Bpl.Type.Bool));
-                var f = new Bpl.IdentifierExpr(inFormal.tok, inFormal.AssignUniqueName(m.IdGenerator), TrType(inFormal.Type));
-                builder.Add(new Bpl.AssumeCmd(inFormal.tok, new Bpl.NAryExpr(inFormal.tok, funcID, new List<Bpl.Expr> { f })));
-              }
-            }
-
-            var parBoundVars = new List<BoundVar>();
-            Expression receiverReplacement = null;
-            var substMap = new Dictionary<IVariable, Expression>();
-            foreach (var iv in inductionVars) {
-              BoundVar bv;
-              IdentifierExpr ie;
-              CloneVariableAsBoundVar(iv.tok, iv, "$ih#" + iv.Name, out bv, out ie);
-              parBoundVars.Add(bv);
-              if (iv is ThisSurrogate) {
-                Contract.Assert(receiverReplacement == null && substMap.Count == 0);  // the receiver comes first, if at all
-                receiverReplacement = ie;
-              } else {
-                substMap.Add(iv, ie);
-              }
+        var inductionVars = ApplyInduction(m.Ins, m.Attributes);
+        if (inductionVars.Count != 0) {
+          // Let the parameters be this,x,y of the method M and suppose ApplyInduction returns y.
+          // Also, let Pre be the precondition and VF be the decreases clause.
+          // Then, insert into the method body what amounts to:
+          //     assume case-analysis-on-parameter[[ y' ]];
+          //     forall (y' | Pre(this, x, y') && VF(this, x, y') << VF(this, x, y)) {
+          //       this.M(x, y');
+          //     }
+          // Generate bound variables for the forall statement, and a substitution for the Pre and VF
+
+          // assume case-analysis-on-parameter[[ y' ]];
+          foreach (var inFormal in m.Ins) {
+            var dt = inFormal.Type.AsDatatype;
+            if (dt != null) {
+              var funcID = new Bpl.FunctionCall(new Bpl.IdentifierExpr(inFormal.tok, "$IsA#" + dt.FullSanitizedName, Bpl.Type.Bool));
+              var f = new Bpl.IdentifierExpr(inFormal.tok, inFormal.AssignUniqueName(m.IdGenerator), TrType(inFormal.Type));
+              builder.Add(new Bpl.AssumeCmd(inFormal.tok, new Bpl.NAryExpr(inFormal.tok, funcID, new List<Bpl.Expr> { f })));
+            }
+          }
+
+          var parBoundVars = new List<BoundVar>();
+          Expression receiverReplacement = null;
+          var substMap = new Dictionary<IVariable, Expression>();
+          foreach (var iv in inductionVars) {
+            BoundVar bv;
+            IdentifierExpr ie;
+            CloneVariableAsBoundVar(iv.tok, iv, "$ih#" + iv.Name, out bv, out ie);
+            parBoundVars.Add(bv);
+            if (iv is ThisSurrogate) {
+              Contract.Assert(receiverReplacement == null && substMap.Count == 0);  // the receiver comes first, if at all
+              receiverReplacement = ie;
+            } else {
+              substMap.Add(iv, ie);
             }
+          }
 
 
-            // Generate a CallStmt for the recursive call
-            Expression recursiveCallReceiver;
-            if (receiverReplacement != null) {
-              recursiveCallReceiver = receiverReplacement;
-            } else if (m.IsStatic) {
-              recursiveCallReceiver = new StaticReceiverExpr(m.tok, (ClassDecl)m.EnclosingClass, true);  // this also resolves it
+          // Generate a CallStmt for the recursive call
+          Expression recursiveCallReceiver;
+          if (receiverReplacement != null) {
+            recursiveCallReceiver = receiverReplacement;
+          } else if (m.IsStatic) {
+            recursiveCallReceiver = new StaticReceiverExpr(m.tok, (ClassDecl)m.EnclosingClass, true);  // this also resolves it
+          } else {
+            recursiveCallReceiver = new ImplicitThisExpr(m.tok);
+            recursiveCallReceiver.Type = Resolver.GetThisType(m.tok, (ClassDecl)m.EnclosingClass);  // resolve here
+          }
+          var recursiveCallArgs = new List<Expression>();
+          foreach (var inFormal in m.Ins) {
+            Expression inE;
+            if (substMap.TryGetValue(inFormal, out inE)) {
+              recursiveCallArgs.Add(inE);
             } else {
-              recursiveCallReceiver = new ImplicitThisExpr(m.tok);
-              recursiveCallReceiver.Type = Resolver.GetThisType(m.tok, (ClassDecl)m.EnclosingClass);  // resolve here
-            }
-            var recursiveCallArgs = new List<Expression>();
-            foreach (var inFormal in m.Ins) {
-              Expression inE;
-              if (substMap.TryGetValue(inFormal, out inE)) {
-                recursiveCallArgs.Add(inE);
-              } else {
-                var ie = new IdentifierExpr(inFormal.tok, inFormal.Name);
-                ie.Var = inFormal;  // resolve here
-                ie.Type = inFormal.Type;  // resolve here
-                recursiveCallArgs.Add(ie);
-              }
-            }
-            var methodSel = new MemberSelectExpr(m.tok, recursiveCallReceiver, m.Name);
-            methodSel.Member = m;  // resolve here
-            methodSel.TypeApplication = new List<Type>();
-            methodSel.TypeApplication.AddRange(recursiveCallReceiver.Type.TypeArgs);
-            m.TypeArgs.ForEach(tp => methodSel.TypeApplication.Add(new UserDefinedType(tp)));
-            methodSel.Type = new InferredTypeProxy();  // this is the last step in resolving 'methodSel'
-            var recursiveCall = new CallStmt(m.tok, m.tok, new List<Expression>(), methodSel, recursiveCallArgs);
-            recursiveCall.IsGhost = m.IsGhost;  // resolve here
-
-            Expression parRange = new LiteralExpr(m.tok, true);
-            parRange.Type = Type.Bool;  // resolve here
-            if (receiverReplacement != null) {
-              // add "this' != null" to the range
-              var nil = new LiteralExpr(receiverReplacement.tok);
-              nil.Type = receiverReplacement.Type;  // resolve here
-              var neqNull = new BinaryExpr(receiverReplacement.tok, BinaryExpr.Opcode.Neq, receiverReplacement, nil);
-              neqNull.ResolvedOp = BinaryExpr.ResolvedOpcode.NeqCommon;  // resolve here
-              neqNull.Type = Type.Bool;  // resolve here
-              parRange = Expression.CreateAnd(parRange, neqNull);
-            }
-            foreach (var pre in m.Req) {
-              if (!pre.IsFree) {
-                parRange = Expression.CreateAnd(parRange, Substitute(pre.E, receiverReplacement, substMap));
-              }
-            }
-            // construct an expression (generator) for:  VF' << VF
-            ExpressionConverter decrCheck = delegate(Dictionary<IVariable, Expression> decrSubstMap, ExpressionTranslator exprTran) {
-              var decrToks = new List<IToken>();
-              var decrTypes = new List<Type>();
-              var decrCallee = new List<Expr>();
-              var decrCaller = new List<Expr>();
-              foreach (var ee in m.Decreases.Expressions) {
-                decrToks.Add(ee.tok);
-                decrTypes.Add(ee.Type.NormalizeExpand());
-                decrCaller.Add(exprTran.TrExpr(ee));
-                Expression es = Substitute(ee, receiverReplacement, substMap);
-                es = Substitute(es, null, decrSubstMap);
-                decrCallee.Add(exprTran.TrExpr(es));
-              }
-              return DecreasesCheck(decrToks, decrTypes, decrTypes, decrCallee, decrCaller, null, null, false, true);
-            };
+              var ie = new IdentifierExpr(inFormal.tok, inFormal.Name);
+              ie.Var = inFormal;  // resolve here
+              ie.Type = inFormal.Type;  // resolve here
+              recursiveCallArgs.Add(ie);
+            }
+          }
+          var methodSel = new MemberSelectExpr(m.tok, recursiveCallReceiver, m.Name);
+          methodSel.Member = m;  // resolve here
+          methodSel.TypeApplication = new List<Type>();
+          methodSel.TypeApplication.AddRange(recursiveCallReceiver.Type.TypeArgs);
+          m.TypeArgs.ForEach(tp => methodSel.TypeApplication.Add(new UserDefinedType(tp)));
+          methodSel.Type = new InferredTypeProxy();  // this is the last step in resolving 'methodSel'
+          var recursiveCall = new CallStmt(m.tok, m.tok, new List<Expression>(), methodSel, recursiveCallArgs);
+          recursiveCall.IsGhost = m.IsGhost;  // resolve here
+
+          Expression parRange = new LiteralExpr(m.tok, true);
+          parRange.Type = Type.Bool;  // resolve here
+          if (receiverReplacement != null) {
+            // add "this' != null" to the range
+            var nil = new LiteralExpr(receiverReplacement.tok);
+            nil.Type = receiverReplacement.Type;  // resolve here
+            var neqNull = new BinaryExpr(receiverReplacement.tok, BinaryExpr.Opcode.Neq, receiverReplacement, nil);
+            neqNull.ResolvedOp = BinaryExpr.ResolvedOpcode.NeqCommon;  // resolve here
+            neqNull.Type = Type.Bool;  // resolve here
+            parRange = Expression.CreateAnd(parRange, neqNull);
+          }
+          foreach (var pre in m.Req) {
+            if (!pre.IsFree) {
+              parRange = Expression.CreateAnd(parRange, Substitute(pre.E, receiverReplacement, substMap));
+            }
+          }
+          // construct an expression (generator) for:  VF' << VF
+          ExpressionConverter decrCheck = delegate(Dictionary<IVariable, Expression> decrSubstMap, ExpressionTranslator exprTran) {
+            var decrToks = new List<IToken>();
+            var decrTypes = new List<Type>();
+            var decrCallee = new List<Expr>();
+            var decrCaller = new List<Expr>();
+            foreach (var ee in m.Decreases.Expressions) {
+              decrToks.Add(ee.tok);
+              decrTypes.Add(ee.Type.NormalizeExpand());
+              decrCaller.Add(exprTran.TrExpr(ee));
+              Expression es = Substitute(ee, receiverReplacement, substMap);
+              es = Substitute(es, null, decrSubstMap);
+              decrCallee.Add(exprTran.TrExpr(es));
+            }
+            return DecreasesCheck(decrToks, decrTypes, decrTypes, decrCallee, decrCaller, null, null, false, true);
+          };
 
 #if VERIFY_CORRECTNESS_OF_TRANSLATION_FORALL_STATEMENT_RANGE
-            var definedness = new Bpl.StmtListBuilder();
-            var exporter = new Bpl.StmtListBuilder();
-            TrForallStmtCall(m.tok, parBoundVars, parRange, decrCheck, recursiveCall, definedness, exporter, localVariables, etran);
-            // All done, so put the two pieces together
-            builder.Add(new Bpl.IfCmd(m.tok, null, definedness.Collect(m.tok), null, exporter.Collect(m.tok)));
+          var definedness = new Bpl.StmtListBuilder();
+          var exporter = new Bpl.StmtListBuilder();
+          TrForallStmtCall(m.tok, parBoundVars, parRange, decrCheck, recursiveCall, definedness, exporter, localVariables, etran);
+          // All done, so put the two pieces together
+          builder.Add(new Bpl.IfCmd(m.tok, null, definedness.Collect(m.tok), null, exporter.Collect(m.tok)));
 #else
-            TrForallStmtCall(m.tok, parBoundVars, parRange, decrCheck, recursiveCall, null, builder, localVariables, etran);
+          TrForallStmtCall(m.tok, parBoundVars, parRange, decrCheck, recursiveCall, null, builder, localVariables, etran);
 #endif
-          }
         }
         // translate the body of the method
         Contract.Assert(m.Body != null);  // follows from method precondition and the if guard
@@ -12965,8 +12956,8 @@ namespace Microsoft.Dafny {
           /* NB: only for type arg less quantifiers for now: */
              && ((QuantifierExpr)expr).TypeArgs.Count == 0) {
         var e = (QuantifierExpr)expr;
-        var inductionVariables = ApplyInduction(e);
-        if (apply_induction && 2 <= DafnyOptions.O.Induction && inductionVariables.Count != 0) {
+        var inductionVariables = ApplyInduction(e.BoundVars, e.Attributes);
+        if (apply_induction && inductionVariables.Count != 0) {
           // From the given quantifier (forall n :: P(n)), generate the seemingly weaker proof obligation
           //   (forall n :: (forall k :: k < n ==> P(k)) ==> P(n))
           // For an existential (exists n :: P(n)), it is
@@ -13165,297 +13156,29 @@ namespace Microsoft.Dafny {
       return RefinementToken.IsInherited(expr.tok, currentModule) && (codeContext == null || !codeContext.MustReverify) && RefinementTransformer.ContainsChange(expr, currentModule);
     }
 
-    List<BoundVar> ApplyInduction(QuantifierExpr e) {
-      Contract.Requires(e.TypeArgs.Count == 0);
-      return ApplyInduction(e.BoundVars, e.Attributes, new List<Expression>() { e.LogicalBody() },
-        delegate(System.IO.TextWriter wr) { new Printer(wr).PrintExpression(e, true); });
-    }
-
-    delegate void TracePrinter(System.IO.TextWriter wr);
-
     /// <summary>
     /// Return a subset of "boundVars" (in the order giving in "boundVars") to which to apply induction to,
-    /// according to :induction attributes in "attributes" and heuristically interesting subexpressions of
-    /// "searchExprs".
+    /// according to :_induction attribute in "attributes".
     /// </summary>
-    List<VarType> ApplyInduction<VarType>(List<VarType> boundVars, Attributes attributes, List<Expression> searchExprs, TracePrinter tracePrinter) where VarType : class, IVariable
+    List<VarType> ApplyInduction<VarType>(List<VarType> boundVars, Attributes attributes) where VarType : class, IVariable
     {
       Contract.Requires(boundVars != null);
-      Contract.Requires(searchExprs != null);
-      Contract.Requires(tracePrinter != null);
       Contract.Ensures(Contract.Result<List<VarType>>() != null);
 
-      if (DafnyOptions.O.Induction == 0) {
+      var args = Attributes.FindExpressions(attributes, "_induction");
+      if (args == null) {
         return new List<VarType>();  // don't apply induction
       }
 
-      foreach (var a in attributes.AsEnumerable()) {
-        if (a.Name == "induction") {
-          // Here are the supported forms of the :induction attribute.
-          //    :induction           -- apply induction to all bound variables
-          //    :induction false     -- suppress induction, that is, don't apply it to any bound variable
-          //    :induction L       where L is a list consisting entirely of bound variables:
-          //                         -- apply induction to the specified bound variables
-          //    :induction X       where X is anything else
-          //                         -- treat the same as {:induction}, that is, apply induction to all
-          //                            bound variables
-
-          // Handle {:induction false}
-          if (a.Args.Count == 1) {
-            var arg = a.Args[0] as LiteralExpr;
-            if (arg != null && arg.Value is bool && !(bool)arg.Value) {
-              if (CommandLineOptions.Clo.Trace) {
-                Console.Write("Suppressing automatic induction for: ");
-                tracePrinter(Console.Out);
-                Console.WriteLine();
-              }
-              return new List<VarType>();
-            }
-          }
-
-          // Handle {:induction L}
-          if (a.Args.Count != 0) {
-            // check that all attribute arguments refer to bound variables; otherwise, go to default_form
-            var argsAsVars = new List<VarType>();
-            foreach (var arg in a.Args) {
-              var theArg = arg.Resolved;
-              if (theArg is ThisExpr) {
-                foreach (var bv in boundVars) {
-                  if (bv is ThisSurrogate) {
-                    argsAsVars.Add(bv);
-                    goto TRY_NEXT_ATTRIBUTE_ARGUMENT;
-                  }
-                }
-              } else if (theArg is IdentifierExpr) {
-                var id = (IdentifierExpr)theArg;
-                var bv = id.Var as VarType;
-                if (bv != null && boundVars.Contains(bv)) {
-                  argsAsVars.Add(bv);
-                  goto TRY_NEXT_ATTRIBUTE_ARGUMENT;
-                }
-              }
-              // the attribute argument was not one of the possible induction variables
-              goto USE_DEFAULT_FORM;
-            TRY_NEXT_ATTRIBUTE_ARGUMENT:
-              ;
-            }
-            // so, all attribute arguments are variables; add them to L in the order of the bound variables (not necessarily the order in the attribute)
-            var L = new List<VarType>();
-            foreach (var bv in boundVars) {
-              if (argsAsVars.Contains(bv)) {
-                L.Add(bv);
-              }
-            }
-            if (CommandLineOptions.Clo.Trace) {
-              string sep = "Applying requested induction on ";
-              foreach (var bv in L) {
-                Console.Write("{0}{1}", sep, bv.Name);
-                sep = ", ";
-              }
-              Console.Write(" of: ");
-              tracePrinter(Console.Out);
-              Console.WriteLine();
-            }
-            return L;
-          USE_DEFAULT_FORM: ;
-          }
-
-          // We have the {:induction} case, or something to be treated in the same way
-          if (CommandLineOptions.Clo.Trace) {
-            Console.Write("Applying requested induction on all bound variables of: ");
-            tracePrinter(Console.Out);
-            Console.WriteLine();
-          }
-          return boundVars;
-        }
-      }
-
-      if (DafnyOptions.O.Induction < 2) {
-        return new List<VarType>();  // don't apply induction
-      }
-
-      // consider automatically applying induction
-      var inductionVariables = new List<VarType>();
-      foreach (var n in boundVars) {
-        if (!n.Type.IsTypeParameter && searchExprs.Exists(expr => VarOccursInArgumentToRecursiveFunction(expr, n))) {
-          if (CommandLineOptions.Clo.Trace) {
-            Console.Write("Applying automatic induction on variable '{0}' of: ", n.Name);
-            tracePrinter(Console.Out);
-            Console.WriteLine();
-          }
-          inductionVariables.Add(n);
-        }
-      }
-
-      return inductionVariables;
-    }
-
-    /// <summary>
-    /// Returns 'true' iff by looking at 'expr' the Induction Heuristic determines that induction should be applied to 'n'.
-    /// More precisely:
-    ///   DafnyInductionHeuristic      Return 'true'
-    ///   -----------------------      -------------
-    ///        0                       always
-    ///        1    if 'n' occurs as   any subexpression (of 'expr')
-    ///        2    if 'n' occurs as   any subexpression of          any index argument of an array/sequence select expression or any                       argument to a recursive function
-    ///        3    if 'n' occurs as   a prominent subexpression of  any index argument of an array/sequence select expression or any                       argument to a recursive function
-    ///        4    if 'n' occurs as   any subexpression of                                                                       any                       argument to a recursive function
-    ///        5    if 'n' occurs as   a prominent subexpression of                                                               any                       argument to a recursive function
-    ///        6    if 'n' occurs as   a prominent subexpression of                                                               any decreases-influencing argument to a recursive function
-    /// Parameter 'n' is allowed to be a ThisSurrogate.
-    /// </summary>
-    bool VarOccursInArgumentToRecursiveFunction(Expression expr, IVariable n) {
-      switch (DafnyOptions.O.InductionHeuristic) {
-        case 0: return true;
-        case 1: return ContainsFreeVariable(expr, false, n);
-        default: return VarOccursInArgumentToRecursiveFunction(expr, n, false);
-      }
-    }
-
-    /// <summary>
-    /// Worker routine for VarOccursInArgumentToRecursiveFunction(expr,n), where the additional parameter 'exprIsProminent' says whether or
-    /// not 'expr' has prominent status in its context.
-    /// DafnyInductionHeuristic cases 0 and 1 are assumed to be handled elsewhere (i.e., a precondition of this method is DafnyInductionHeuristic is at least 2).
-    /// Parameter 'n' is allowed to be a ThisSurrogate.
-    /// </summary>
-    bool VarOccursInArgumentToRecursiveFunction(Expression expr, IVariable n, bool exprIsProminent) {
-      Contract.Requires(expr != null);
-      Contract.Requires(n != null);
-
-      // The following variable is what gets passed down to recursive calls if the subexpression does not itself acquire prominent status.
-      var subExprIsProminent = DafnyOptions.O.InductionHeuristic == 2 || DafnyOptions.O.InductionHeuristic == 4 ? /*once prominent, always prominent*/exprIsProminent : /*reset the prominent status*/false;
-
-      if (expr is ThisExpr) {
-        return exprIsProminent && n is ThisSurrogate;
-      } else if (expr is IdentifierExpr) {
-        var e = (IdentifierExpr)expr;
-        return exprIsProminent && e.Var == n;
-      } else if (expr is SeqSelectExpr) {
-        var e = (SeqSelectExpr)expr;
-        var q = DafnyOptions.O.InductionHeuristic < 4 || subExprIsProminent;
-        return VarOccursInArgumentToRecursiveFunction(e.Seq, n, subExprIsProminent) ||  // this subexpression does not acquire "prominent" status
-          (e.E0 != null && VarOccursInArgumentToRecursiveFunction(e.E0, n, q)) ||  // this one does (unless arrays/sequences are excluded)
-          (e.E1 != null && VarOccursInArgumentToRecursiveFunction(e.E1, n, q));    // ditto
-      } else if (expr is MultiSelectExpr) {
-        var e = (MultiSelectExpr)expr;
-        var q = DafnyOptions.O.InductionHeuristic < 4 || subExprIsProminent;
-        return VarOccursInArgumentToRecursiveFunction(e.Array, n, subExprIsProminent) ||
-          e.Indices.Exists(exp => VarOccursInArgumentToRecursiveFunction(exp, n, q));
-      } else if (expr is FunctionCallExpr) {
-        var e = (FunctionCallExpr)expr;
-        // For recursive functions:  arguments are "prominent"
-        // For non-recursive function:  arguments are "prominent" if the call is
-        var rec = e.Function.IsRecursive && e.CoCall != FunctionCallExpr.CoCallResolution.Yes;
-        var decr = e.Function.Decreases.Expressions;
-        bool variantArgument;
-        if (DafnyOptions.O.InductionHeuristic < 6) {
-          variantArgument = rec;
-        } else {
-          // The receiver is considered to be "variant" if the function is recursive and the receiver participates
-          // in the effective decreases clause of the function.  The receiver participates if it's a free variable
-          // of a term in the explicit decreases clause.
-          variantArgument = rec && decr.Exists(ee => ContainsFreeVariable(ee, true, null));
-        }
-        if (VarOccursInArgumentToRecursiveFunction(e.Receiver, n, variantArgument || subExprIsProminent)) {
-          return true;
-        }
-        Contract.Assert(e.Function.Formals.Count == e.Args.Count);
-        for (int i = 0; i < e.Function.Formals.Count; i++) {
-          var f = e.Function.Formals[i];
-          var exp = e.Args[i];
-          if (DafnyOptions.O.InductionHeuristic < 6) {
-            variantArgument = rec;
-          } else if (rec) {
-            // The argument position is considered to be "variant" if the function is recursive and...
-            // ... it has something to do with why the callee is well-founded, which happens when...
-            if (f is ImplicitFormal) {
-              // ... it is the argument is the implicit _k parameter, which is always first in the effective decreases clause of a prefix lemma, or
-              variantArgument = true;
-            } else if (decr.Exists(ee => ContainsFreeVariable(ee, false, f))) {
-              // ... it participates in the effective decreases clause of the function, which happens when it is
-              // a free variable of a term in the explicit decreases clause, or
-              variantArgument = true;
-            } else {
-              // ... the callee is a prefix predicate.
-              variantArgument = true;
-            }
-          }
-          if (VarOccursInArgumentToRecursiveFunction(exp, n, variantArgument || subExprIsProminent)) {
-            return true;
-          }
-        }
-        return false;
-      } else if (expr is TernaryExpr) {
-        var e = (TernaryExpr)expr;
-        switch (e.Op) {
-          case TernaryExpr.Opcode.PrefixEqOp:
-          case TernaryExpr.Opcode.PrefixNeqOp:
-            return VarOccursInArgumentToRecursiveFunction(e.E0, n, true) ||
-              VarOccursInArgumentToRecursiveFunction(e.E1, n, subExprIsProminent) ||
-              VarOccursInArgumentToRecursiveFunction(e.E2, n, subExprIsProminent);
-          default:
-            Contract.Assert(false); throw new cce.UnreachableException();  // unexpected ternary expression
-        }
-      } else if (expr is DatatypeValue) {
-        var e = (DatatypeValue)expr;
-        var q = n.Type.IsDatatype ? exprIsProminent : subExprIsProminent;  // prominent status continues, if we're looking for a variable whose type is a datatype
-        return e.Arguments.Exists(exp => VarOccursInArgumentToRecursiveFunction(exp, n, q));
-      } else if (expr is UnaryExpr) {
-        var e = (UnaryExpr)expr;
-        // both Not and SeqLength preserve prominence
-        return VarOccursInArgumentToRecursiveFunction(e.E, n, exprIsProminent);
-      } else if (expr is BinaryExpr) {
-        var e = (BinaryExpr)expr;
-        bool q;
-        switch (e.ResolvedOp) {
-          case BinaryExpr.ResolvedOpcode.Add:
-          case BinaryExpr.ResolvedOpcode.Sub:
-          case BinaryExpr.ResolvedOpcode.Mul:
-          case BinaryExpr.ResolvedOpcode.Div:
-          case BinaryExpr.ResolvedOpcode.Mod:
-          case BinaryExpr.ResolvedOpcode.Union:
-          case BinaryExpr.ResolvedOpcode.Intersection:
-          case BinaryExpr.ResolvedOpcode.SetDifference:
-          case BinaryExpr.ResolvedOpcode.Concat:
-            // these operators preserve prominence
-            q = exprIsProminent;
-            break;
-          default:
-            // whereas all other binary operators do not
-            q = subExprIsProminent;
-            break;
-        }
-        return VarOccursInArgumentToRecursiveFunction(e.E0, n, q) ||
-          VarOccursInArgumentToRecursiveFunction(e.E1, n, q);
-      } else if (expr is StmtExpr) {
-        var e = (StmtExpr)expr;
-        // ignore the statement
-        return VarOccursInArgumentToRecursiveFunction(e.E, n);
-
-      } else if (expr is ITEExpr) {
-        var e = (ITEExpr)expr;
-        return VarOccursInArgumentToRecursiveFunction(e.Test, n, subExprIsProminent) ||  // test is not "prominent"
-          VarOccursInArgumentToRecursiveFunction(e.Thn, n, exprIsProminent) ||  // but the two branches are
-          VarOccursInArgumentToRecursiveFunction(e.Els, n, exprIsProminent);
-      } else if (expr is OldExpr ||
-                 expr is ConcreteSyntaxExpression ||
-                 expr is BoxingCastExpr ||
-                 expr is UnboxingCastExpr) {
-        foreach (var exp in expr.SubExpressions) {
-          if (VarOccursInArgumentToRecursiveFunction(exp, n, exprIsProminent)) {  // maintain prominence
-            return true;
-          }
-        }
-        return false;
-      } else {
-        // in all other cases, reset the prominence status and recurse on the subexpressions
-        foreach (var exp in expr.SubExpressions) {
-          if (VarOccursInArgumentToRecursiveFunction(exp, n, subExprIsProminent)) {
-            return true;
-          }
-        }
-        return false;
+      var argsAsVars = new List<VarType>();
+      foreach (var arg in args) {
+        // We expect each "arg" to be an IdentifierExpr among "boundVars"
+        var id = (IdentifierExpr)arg;
+        var bv = (VarType)id.Var;
+        Contract.Assume(boundVars.Contains(bv));
+        argsAsVars.Add(bv);
       }
+      return argsAsVars;
     }
 
     IEnumerable<Bpl.Expr> InductionCases(Type ty, Bpl.Expr expr, ExpressionTranslator etran) {
@@ -13502,7 +13225,7 @@ namespace Microsoft.Dafny {
     /// Parameter 'v' is allowed to be a ThisSurrogate, in which case the method return true iff 'this'
     /// occurs in 'expr'.
     /// </summary>
-    static bool ContainsFreeVariable(Expression expr, bool lookForReceiver, IVariable v) {
+    public static bool ContainsFreeVariable(Expression expr, bool lookForReceiver, IVariable v) {
       Contract.Requires(expr != null);
       Contract.Requires(lookForReceiver || v != null);
 
-- 
cgit v1.2.3


From 34cb773ec61c32479c8d189b23e000af956cc28e Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Tue, 11 Aug 2015 19:12:43 -0700
Subject: Removed the unused type ThisSurrogate

---
 Source/Dafny/DafnyAst.cs   | 13 -------------
 Source/Dafny/Rewriter.cs   |  4 +---
 Source/Dafny/Translator.cs | 27 +++++----------------------
 3 files changed, 6 insertions(+), 38 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index f66f40a1..fe6ebfc1 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -2964,19 +2964,6 @@ namespace Microsoft.Dafny {
     }
   }
 
-  /// <summary>
-  /// A "ThisSurrogate" is used during translation time to make the treatment of the receiver more similar to
-  /// the treatment of other in-parameters.
-  /// </summary>
-  public class ThisSurrogate : Formal
-  {
-    public ThisSurrogate(IToken tok, Type type)
-      : base(tok, "this", type, true, false) {
-      Contract.Requires(tok != null);
-      Contract.Requires(type != null);
-    }
-  }
-
   public class BoundVar : NonglobalVariable {
     public override bool IsMutable {
       get {
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index ffd808c5..7ab7dd36 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -1475,9 +1475,7 @@ namespace Microsoft.Dafny
       // The following variable is what gets passed down to recursive calls if the subexpression does not itself acquire prominent status.
       var subExprIsProminent = DafnyOptions.O.InductionHeuristic == 2 || DafnyOptions.O.InductionHeuristic == 4 ? /*once prominent, always prominent*/exprIsProminent : /*reset the prominent status*/false;
 
-      if (expr is ThisExpr) {
-        return exprIsProminent && n is ThisSurrogate;
-      } else if (expr is IdentifierExpr) {
+      if (expr is IdentifierExpr) {
         var e = (IdentifierExpr)expr;
         return exprIsProminent && e.Var == n;
       } else if (expr is SeqSelectExpr) {
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index cdfb1a32..59d93347 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -2778,27 +2778,19 @@ namespace Microsoft.Dafny {
           }
 
           var parBoundVars = new List<BoundVar>();
-          Expression receiverReplacement = null;
           var substMap = new Dictionary<IVariable, Expression>();
           foreach (var iv in inductionVars) {
             BoundVar bv;
             IdentifierExpr ie;
             CloneVariableAsBoundVar(iv.tok, iv, "$ih#" + iv.Name, out bv, out ie);
             parBoundVars.Add(bv);
-            if (iv is ThisSurrogate) {
-              Contract.Assert(receiverReplacement == null && substMap.Count == 0);  // the receiver comes first, if at all
-              receiverReplacement = ie;
-            } else {
-              substMap.Add(iv, ie);
-            }
+            substMap.Add(iv, ie);
           }
 
 
           // Generate a CallStmt for the recursive call
           Expression recursiveCallReceiver;
-          if (receiverReplacement != null) {
-            recursiveCallReceiver = receiverReplacement;
-          } else if (m.IsStatic) {
+          if (m.IsStatic) {
             recursiveCallReceiver = new StaticReceiverExpr(m.tok, (ClassDecl)m.EnclosingClass, true);  // this also resolves it
           } else {
             recursiveCallReceiver = new ImplicitThisExpr(m.tok);
@@ -2827,18 +2819,9 @@ namespace Microsoft.Dafny {
 
           Expression parRange = new LiteralExpr(m.tok, true);
           parRange.Type = Type.Bool;  // resolve here
-          if (receiverReplacement != null) {
-            // add "this' != null" to the range
-            var nil = new LiteralExpr(receiverReplacement.tok);
-            nil.Type = receiverReplacement.Type;  // resolve here
-            var neqNull = new BinaryExpr(receiverReplacement.tok, BinaryExpr.Opcode.Neq, receiverReplacement, nil);
-            neqNull.ResolvedOp = BinaryExpr.ResolvedOpcode.NeqCommon;  // resolve here
-            neqNull.Type = Type.Bool;  // resolve here
-            parRange = Expression.CreateAnd(parRange, neqNull);
-          }
           foreach (var pre in m.Req) {
             if (!pre.IsFree) {
-              parRange = Expression.CreateAnd(parRange, Substitute(pre.E, receiverReplacement, substMap));
+              parRange = Expression.CreateAnd(parRange, Substitute(pre.E, null, substMap));
             }
           }
           // construct an expression (generator) for:  VF' << VF
@@ -2851,7 +2834,7 @@ namespace Microsoft.Dafny {
               decrToks.Add(ee.tok);
               decrTypes.Add(ee.Type.NormalizeExpand());
               decrCaller.Add(exprTran.TrExpr(ee));
-              Expression es = Substitute(ee, receiverReplacement, substMap);
+              Expression es = Substitute(ee, null, substMap);
               es = Substitute(es, null, decrSubstMap);
               decrCallee.Add(exprTran.TrExpr(es));
             }
@@ -13230,7 +13213,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(lookForReceiver || v != null);
 
       if (expr is ThisExpr) {
-        return lookForReceiver || v is ThisSurrogate;
+        return lookForReceiver;
       } else if (expr is IdentifierExpr) {
         IdentifierExpr e = (IdentifierExpr)expr;
         return e.Var == v;
-- 
cgit v1.2.3


From 4325b50ed7732bdd2b7b7455bd290f385d0f5383 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Tue, 11 Aug 2015 19:26:35 -0700
Subject: Disallow user-defined attributes that begin with an underscore

---
 Source/Dafny/Cloner.cs  | 3 +++
 Source/Dafny/Dafny.atg  | 4 ++--
 Source/Dafny/Parser.cs  | 6 +++---
 Source/Dafny/Printer.cs | 6 ++++--
 4 files changed, 12 insertions(+), 7 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index f959b537..5f5a9a6e 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -228,6 +228,9 @@ namespace Microsoft.Dafny
     public Attributes CloneAttributes(Attributes attrs) {
       if (attrs == null) {
         return null;
+      } else if (attrs.Name.StartsWith("_")) {
+        // skip this attribute, since it would have been produced during resolution
+        return CloneAttributes(attrs.Prev);
       } else {
         return new Attributes(attrs.Name, attrs.Args.ConvertAll(CloneExpr), CloneAttributes(attrs.Prev));
       }
diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index 8a3bdb0e..b945632d 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -2915,10 +2915,10 @@ Expressions<.List<Expression> args.>
   .
 /*------------------------------------------------------------------------*/
 Attribute<ref Attributes attrs>
-= (. string name;
+= (. IToken x; string name;
      var args = new List<Expression>();
   .)
-  "{" ":" ident                            (. name = t.val; .)
+  "{" ":" NoUSIdent<out x>                          (. name = x.val; .)
   [ Expressions<args> ]
   "}"
   (. attrs = new Attributes(name, args, attrs); .)
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index fd6fb026..7e4b2339 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -1033,13 +1033,13 @@ bool IsType(ref IToken pt) {
 	}
 
 	void Attribute(ref Attributes attrs) {
-		string name;
+		IToken x; string name;
 		var args = new List<Expression>();
 		
 		Expect(45);
 		Expect(21);
-		Expect(1);
-		name = t.val; 
+		NoUSIdent(out x);
+		name = x.val; 
 		if (StartOf(7)) {
 			Expressions(args);
 		}
diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index 7a93a140..6081f2c6 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -443,11 +443,13 @@ namespace Microsoft.Dafny {
     }
     public void PrintOneAttribute(Attributes a, string nameSubstitution = null) {
       Contract.Requires(a != null);
-      wr.Write(" {{:{0}", nameSubstitution ?? a.Name);
+      var name = nameSubstitution ?? a.Name;
+      var usAttribute = name.StartsWith("_");
+      wr.Write(" {1}{{:{0}", name, usAttribute ? "/*" : "");
       if (a.Args != null) {
         PrintAttributeArgs(a.Args, false);
       }
-      wr.Write("}");
+      wr.Write("}}{0}", usAttribute ? "*/" : "");
     }
 
     public void PrintAttributeArgs(List<Expression> args, bool isFollowedBySemicolon) {
-- 
cgit v1.2.3


From 41d16e5a28b4eab7fb56f04c76759f8e24678b74 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Tue, 11 Aug 2015 23:08:17 -0700
Subject: Bug fixes and improvements in pretty printing

---
 Source/Dafny/Cloner.cs           |  2 +-
 Source/Dafny/Compiler.cs         |  8 +-----
 Source/Dafny/Printer.cs          | 16 +++++++----
 Source/Dafny/Resolver.cs         | 61 ++++++++++++----------------------------
 Source/Dafny/Rewriter.cs         |  8 +++---
 Source/Dafny/TriggerGenerator.cs | 10 +++----
 6 files changed, 39 insertions(+), 66 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index 5f5a9a6e..0a5ca245 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -720,7 +720,7 @@ namespace Microsoft.Dafny
     {
       Contract.Requires(tok != null);
       Contract.Requires(s != null);
-      resolver.ReportAdditionalInformation(tok, s + suffix, s.Length);
+      resolver.ReportAdditionalInformation(tok, s + suffix);
     }
   }
 
diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 4fdd34f6..f02f7861 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -1201,13 +1201,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(cce.NonNullElements(targs));
       Contract.Ensures(Contract.Result<string>() != null);
 
-      string s = "";
-      string sep = "";
-      foreach (TypeParameter tp in targs) {
-        s += sep + "@" + tp.CompileName;
-        sep = ",";
-      }
-      return s;
+      return Util.Comma(targs, tp => "@" + tp.CompileName);
     }
 
     string DefaultValue(Type type)
diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index 6081f2c6..1f63d769 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -1443,7 +1443,7 @@ namespace Microsoft.Dafny {
         bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
         if (parensNeeded) { wr.Write("("); }
-        PrintExpr(e.Seq, 0x00, false, false, !parensNeeded && isFollowedBySemicolon, indent);  // BOGUS: fix me
+        PrintExpr(e.Seq, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent);
         wr.Write("[");
         if (e.SelectOne) {
           Contract.Assert( e.E0 != null);
@@ -1467,7 +1467,7 @@ namespace Microsoft.Dafny {
         bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
         if (parensNeeded) { wr.Write("("); }
-        PrintExpr(e.Array, 0x00, false, false, !parensNeeded && isFollowedBySemicolon, indent);  // BOGUS: fix me
+        PrintExpr(e.Array, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent);
         string prefix = "[";
         foreach (Expression idx in e.Indices) {
           Contract.Assert(idx != null);
@@ -1491,7 +1491,7 @@ namespace Microsoft.Dafny {
           bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
           if (parensNeeded) { wr.Write("("); }
-          PrintExpr(e.Seq, 00, false, false, !parensNeeded && isFollowedBySemicolon, indent);  // BOGUS: fix me
+          PrintExpr(e.Seq, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent);
           wr.Write("[");
           PrintExpression(e.Index, false);
           wr.Write(" := ");
@@ -1804,9 +1804,12 @@ namespace Microsoft.Dafny {
 
       } else if (expr is LambdaExpr) {
         var e = (LambdaExpr)expr;
-        wr.Write("(");
-        wr.Write(Util.Comma(e.BoundVars, bv => bv.DisplayName + ":" + bv.Type));
-        wr.Write(")");
+        bool parensNeeded = !isRightmost;
+        if (parensNeeded) { wr.Write("("); }
+        var skipSignatureParens = e.BoundVars.Count == 1 && e.BoundVars[0].Type is InferredTypeProxy;
+        if (!skipSignatureParens) { wr.Write("("); }
+        wr.Write(Util.Comma(", ", e.BoundVars, bv => bv.DisplayName + (bv.Type is InferredTypeProxy ? "" : ": " + bv.Type)));
+        if (!skipSignatureParens) { wr.Write(")"); }
         if (e.Range != null) {
           wr.Write(" requires ");
           PrintExpression(e.Range, false);
@@ -1817,6 +1820,7 @@ namespace Microsoft.Dafny {
         }
         wr.Write(e.OneShot ? " -> " : " => ");
         PrintExpression(e.Body, isFollowedBySemicolon);
+        if (parensNeeded) { wr.Write(")"); }
 
       } else if (expr is WildcardExpr) {
         wr.Write("*");
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 75d171ac..2da365a9 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -101,13 +101,11 @@ namespace Microsoft.Dafny
 
     public Action<AdditionalInformation> AdditionalInformationReporter;
 
-    internal void ReportAdditionalInformation(IToken token, string text, int length)
-    {
+    internal void ReportAdditionalInformation(IToken token, string text) {
       Contract.Requires(token != null);
       Contract.Requires(text != null);
-      Contract.Requires(0 <= length); //FIXME: KRML: This should (probably) be the length of the token
       if (AdditionalInformationReporter != null) {
-        AdditionalInformationReporter(new AdditionalInformation { Token = token, Text = text, Length = length });
+        AdditionalInformationReporter(new AdditionalInformation { Token = token, Text = text, Length = token.val.Length });
       }
     }
 
@@ -494,7 +492,7 @@ namespace Microsoft.Dafny
       }
       foreach (var module in prog.Modules) {
         foreach (var iter in ModuleDefinition.AllIteratorDecls(module.TopLevelDecls)) {
-          ReportAdditionalInformation(iter.tok, Printer.IteratorClassToString(iter), iter.Name.Length);
+          ReportAdditionalInformation(iter.tok, Printer.IteratorClassToString(iter));
         }
       }
       // fill in other additional information
@@ -563,17 +561,10 @@ namespace Microsoft.Dafny
               showIt = ((Method)m).IsRecursive;
             }
             if (showIt) {
-              s += "decreases ";
-              if (m.Decreases.Expressions.Count != 0) {
-                string sep = "";
-                foreach (var d in m.Decreases.Expressions) {
-                  s += sep + Printer.ExprToString(d);
-                  sep = ", ";
-                }
-              }
+              s += "decreases " + Util.Comma(", ", m.Decreases.Expressions, Printer.ExprToString);
               // Note, in the following line, we use the location information for "clbl", not "m".  These
               // are the same, except in the case where "clbl" is a CoLemma and "m" is a prefix lemma.
-              ReportAdditionalInformation(clbl.Tok, s, clbl.Tok.val.Length);
+              ReportAdditionalInformation(clbl.Tok, s);
             }
           }
         }
@@ -1626,7 +1617,7 @@ namespace Microsoft.Dafny
                   "Hint: try writing a newtype constraint of the form 'i:int | lowerBound <= i < upperBound && (...any additional constraints...)'");
               }
               if (dd.NativeType != null && stringNativeType == null) {
-                ReportAdditionalInformation(dd.tok, "{:nativeType \"" + dd.NativeType.Name + "\"}", dd.tok.val.Length);
+                ReportAdditionalInformation(dd.tok, "{:nativeType \"" + dd.NativeType.Name + "\"}");
               }
             }
           }
@@ -1735,7 +1726,7 @@ namespace Microsoft.Dafny
               foreach (var c in coCandidates) {
                 c.CandidateCall.CoCall = FunctionCallExpr.CoCallResolution.Yes;
                 c.EnclosingCoConstructor.IsCoCall = true;
-                ReportAdditionalInformation(c.CandidateCall.tok, "co-recursive call", c.CandidateCall.Name.Length);
+                ReportAdditionalInformation(c.CandidateCall.tok, "co-recursive call");
               }
               // Finally, fill in the CoClusterTarget field
               // Start by setting all the CoClusterTarget fields to CoRecursiveTargetAllTheWay.
@@ -2002,10 +1993,10 @@ namespace Microsoft.Dafny
         Contract.Requires(args != null);
         Error(expr.tok, msg, args);
       }
-      protected void ReportAdditionalInformation(IToken tok, string text, int length)
+      protected void ReportAdditionalInformation(IToken tok, string text)
       {
         Contract.Requires(tok != null);
-        resolver.ReportAdditionalInformation(tok, text, length);
+        resolver.ReportAdditionalInformation(tok, text);
       }
     }
     #endregion Visitors
@@ -2041,7 +2032,7 @@ namespace Microsoft.Dafny
                 m.IsTailRecursive = true;
                 if (tailCall != null) {
                   // this means there was at least one recursive call
-                  ReportAdditionalInformation(m.tok, "tail recursive", m.Name.Length);
+                  ReportAdditionalInformation(m.tok, "tail recursive");
                 }
               }
             }
@@ -2607,7 +2598,7 @@ namespace Microsoft.Dafny
               Error(e, msg);
             } else {
               e.CoCall = FunctionCallExpr.CoCallResolution.Yes;
-              ReportAdditionalInformation(e.tok, e.Function.Name + "#[_k - 1]", e.Function.Name.Length);
+              ReportAdditionalInformation(e.tok, e.Function.Name + "#[_k - 1]");
             }
           }
           // do the sub-parts with cp := Neither
@@ -3011,7 +3002,7 @@ namespace Microsoft.Dafny
             var substituter = new Translator.AlphaConverting_Substituter(cs.Receiver, argsSubstMap, new Dictionary<TypeParameter, Type>(), new Translator());
             foreach (var ens in cs.Method.Ens) {
               var p = substituter.Substitute(ens.E);  // substitute the call's actuals for the method's formals
-              resolver.ReportAdditionalInformation(s.Tok, "ensures " + Printer.ExprToString(p) + ";", s.Tok.val.Length);
+              resolver.ReportAdditionalInformation(s.Tok, "ensures " + Printer.ExprToString(p));
             }
           }
         }
@@ -5217,16 +5208,8 @@ namespace Microsoft.Dafny
           ResolveStatement(s.Body, bodyMustBeSpecOnly, codeContext);
           loopStack.RemoveAt(loopStack.Count - 1);  // pop
         } else {
-          string text = "havoc {";
-          if (fvs.Count != 0) {
-            string sep = "";
-            foreach (var fv in fvs) {
-              text += sep + fv.Name;
-              sep = ", ";
-            }
-          }
-          text += "};";  // always terminate with a semi-colon
-          ReportAdditionalInformation(s.Tok, text, s.Tok.val.Length);
+          string text = "havoc {" + Util.Comma(", ", fvs, fv => fv.Name) + "};";  // always terminate with a semi-colon
+          ReportAdditionalInformation(s.Tok, text);
         }
 
       } else if (stmt is AlternativeLoopStmt) {
@@ -5324,7 +5307,7 @@ namespace Microsoft.Dafny
               // add the conclusion of the calc as a free postcondition
               var result = ((CalcStmt)s0).Result;
               s.Ens.Add(new MaybeFreeExpression(result, true));
-              ReportAdditionalInformation(s.Tok, "ensures " + Printer.ExprToString(result) + ";", s.Tok.val.Length);
+              ReportAdditionalInformation(s.Tok, "ensures " + Printer.ExprToString(result));
             } else {
               s.Kind = ForallStmt.ParBodyKind.Proof;
               if (s.Body is BlockStmt && ((BlockStmt)s.Body).Body.Count == 0) {
@@ -5930,16 +5913,8 @@ namespace Microsoft.Dafny
         loopStmt.InferredDecreases = true;
       }
       if (loopStmt.InferredDecreases) {
-        string s = "decreases ";
-        if (theDecreases.Count != 0) {
-          string sep = "";
-          foreach (var d in theDecreases) {
-            s += sep + Printer.ExprToString(d);
-            sep = ", ";
-          }
-        }
-        s += ";";  // always terminate with a semi-colon, even in the case of an empty decreases clause
-        ReportAdditionalInformation(loopStmt.Tok, s, loopStmt.Tok.val.Length);
+        string s = "decreases " + Util.Comma(", ", theDecreases, Printer.ExprToString);
+        ReportAdditionalInformation(loopStmt.Tok, s);
       }
     }
     private void ResolveConcreteUpdateStmt(ConcreteUpdateStatement s, bool specContextOnly, ICodeContext codeContext) {
@@ -10486,7 +10461,7 @@ namespace Microsoft.Dafny
             // this call is disqualified from being a co-call, because it has a postcondition
             // (a postcondition could be allowed, as long as it does not get to be used with
             // co-recursive calls, because that could be unsound; for example, consider
-            // "ensures false;")
+            // "ensures false")
             if (!dealsWithCodatatypes) {
               e.CoCall = FunctionCallExpr.CoCallResolution.No;
             } else {
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 7ab7dd36..4ac709f6 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -839,7 +839,7 @@ namespace Microsoft.Dafny
       }
 
       if (!tip.Equals("")) {
-        resolver.ReportAdditionalInformation(f.tok, tip, f.tok.val.Length);
+        resolver.ReportAdditionalInformation(f.tok, tip);
         if (DafnyOptions.O.AutoReqPrintFile != null) {
           using (System.IO.TextWriter writer = new System.IO.StreamWriter(DafnyOptions.O.AutoReqPrintFile, true)) {
             writer.WriteLine(f.Name);
@@ -866,7 +866,7 @@ namespace Microsoft.Dafny
       }
 
       if (!tip.Equals("")) {
-        resolver.ReportAdditionalInformation(method.tok, tip, method.tok.val.Length);
+        resolver.ReportAdditionalInformation(method.tok, tip);
         if (DafnyOptions.O.AutoReqPrintFile != null) {
           using (System.IO.TextWriter writer = new System.IO.StreamWriter(DafnyOptions.O.AutoReqPrintFile, true)) {
             writer.WriteLine(method.Name);
@@ -1061,7 +1061,7 @@ namespace Microsoft.Dafny
             Expression allReqsSatisfied = andify(e.Term.tok, auto_reqs);
             Expression allReqsSatisfiedAndTerm = Expression.CreateAnd(allReqsSatisfied, e.Term);
             e.UpdateTerm(allReqsSatisfiedAndTerm);
-            resolver.ReportAdditionalInformation(e.tok, "autoreq added (" + Printer.ExtendedExprToString(allReqsSatisfied) + ") &&", e.tok.val.Length);
+            resolver.ReportAdditionalInformation(e.tok, "autoreq added (" + Printer.ExtendedExprToString(allReqsSatisfied) + ") &&");
         }
       } else if (expr is SetComprehension) {
         var e = (SetComprehension)expr;
@@ -1410,7 +1410,7 @@ namespace Microsoft.Dafny
         attributes = new Attributes("_induction", inductionVariables, attributes);
         // And since we're inferring something, let's also report that in a hover text.
         var s = Printer.OneAttributeToString(attributes, "induction");
-        Resolver.ReportAdditionalInformation(tok, s, s.Length);
+        Resolver.ReportAdditionalInformation(tok, s);
       }
     }
     class Induction_Visitor : BottomUpVisitor
diff --git a/Source/Dafny/TriggerGenerator.cs b/Source/Dafny/TriggerGenerator.cs
index cf677e0e..067336a3 100644
--- a/Source/Dafny/TriggerGenerator.cs
+++ b/Source/Dafny/TriggerGenerator.cs
@@ -126,9 +126,9 @@ namespace Microsoft.Dafny {
     List<QuantifierExpr> quantifiers;
     Dictionary<Expression, TriggerAnnotation> annotations;
 
-    Action<IToken, string, int> AdditionalInformationReporter;
+    Action<IToken, string> AdditionalInformationReporter;
 
-    private TriggerGenerator(Action<IToken, string, int> additionalInformationReporter) {
+    private TriggerGenerator(Action<IToken, string> additionalInformationReporter) {
       Contract.Requires(additionalInformationReporter != null);
       this.quantifiers = new List<QuantifierExpr>();
       this.annotations = new Dictionary<Expression, TriggerAnnotation>();
@@ -469,12 +469,12 @@ namespace Microsoft.Dafny {
       if (multi_candidates.RejectedMultiCandidates.Any()) {
         var tooltip = JoinStringsWithHeader("Rejected: ", multi_candidates.RejectedMultiCandidates.Where(candidate => candidate.Tags != null)
           .Select(candidate => candidate.AsDafnyAttributeString(true, true)));
-        AdditionalInformationReporter(quantifier.tok, tooltip, quantifier.tok.val.Length);
+        AdditionalInformationReporter(quantifier.tok, tooltip);
       }
 
       if (multi_candidates.FinalMultiCandidates.Any()) {
         var tooltip = JoinStringsWithHeader("Triggers: ", multi_candidates.FinalMultiCandidates.Select(multi_candidate => multi_candidate.AsDafnyAttributeString()));
-        AdditionalInformationReporter(quantifier.tok, tooltip, quantifier.tok.val.Length);
+        AdditionalInformationReporter(quantifier.tok, tooltip);
       }
 
       string warning = multi_candidates.Warning();
@@ -484,7 +484,7 @@ namespace Microsoft.Dafny {
     }
 
     internal static bool IsTriggerKiller(Expression expr) {
-      var annotation = new TriggerGenerator((x, y, z) => { }).Annotate(expr);
+      var annotation = new TriggerGenerator((x, y) => { }).Annotate(expr);
       return annotation.IsTriggerKiller;
     }
 
-- 
cgit v1.2.3


From 7f57e6de24fdd2e61dd1f9cd053e850f53b83c0f Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Wed, 12 Aug 2015 11:52:42 -0700
Subject: Add a few utility methods to the visitors

---
 Source/Dafny/DafnyAst.cs | 31 ++++++++++++++++++++++++++++---
 1 file changed, 28 insertions(+), 3 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 8d68e3e2..66b91ac2 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -6764,13 +6764,14 @@ namespace Microsoft.Dafny {
   }
 
   public abstract class QuantifierExpr : ComprehensionExpr, TypeParameter.ParentType {
+    private readonly int UniqueId;
     public List<TypeParameter> TypeArgs;
     private static int currentQuantId = -1;
-    static int FreshQuantId()
-    {
+
+    static int FreshQuantId() {
       return System.Threading.Interlocked.Increment(ref currentQuantId);
     }
-    private readonly int UniqueId;
+    
     public string FullName {
       get {
         return "q$" + UniqueId;
@@ -7615,6 +7616,18 @@ namespace Microsoft.Dafny {
       stmt.SubStatements.Iter(Visit);
       VisitOneStmt(stmt);
     }
+    public void Visit(IEnumerable<Expression> exprs) {
+      exprs.Iter(Visit);
+    }
+    public void Visit(IEnumerable<Statement> stmts) {
+      stmts.Iter(Visit);
+    }
+    public void Visit(MaybeFreeExpression expr) {
+      Visit(expr.E);
+    }
+    public void Visit(IEnumerable<MaybeFreeExpression> exprs) {
+      exprs.Iter(Visit);
+    }
     protected virtual void VisitOneExpr(Expression expr) {
       Contract.Requires(expr != null);
       // by default, do nothing
@@ -7646,6 +7659,18 @@ namespace Microsoft.Dafny {
         stmt.SubStatements.Iter(s => Visit(s, st));
       }
     }
+    public void Visit(IEnumerable<Expression> exprs, State st) {
+      exprs.Iter(e => Visit(e, st));
+    }
+    public void Visit(IEnumerable<Statement> stmts, State st) {
+      stmts.Iter(e => Visit(e, st));
+    }
+    public void Visit(MaybeFreeExpression expr, State st) {
+      Visit(expr.E, st);
+    }
+    public void Visit(IEnumerable<MaybeFreeExpression> exprs, State st) {
+      exprs.Iter(e => Visit(e, st));
+    }
     /// <summary>
     /// Visit one expression proper.  This method is invoked before it is invoked on the
     /// sub-parts (sub-expressions and sub-statements).  A return value of "true" says to
-- 
cgit v1.2.3


From f28fa68497352ffb57ab2846da4cc1c1aeaf1968 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Wed, 12 Aug 2015 22:44:50 -0700
Subject: Change the induction heuristic for lemmas to also look in
 precondition for clues about which parameters to include. As a result,
 improved many test cases (see, e.g., dafny4/NipkowKlein-chapter7.dfy!) and
 beautified some others.

---
 Source/Dafny/Printer.cs                    |   3 +-
 Source/Dafny/Rewriter.cs                   |  23 +++--
 Test/VerifyThis2015/Problem1.dfy           |   8 --
 Test/dafny0/InductivePredicates.dfy        |  41 ++++----
 Test/dafny0/InductivePredicates.dfy.expect |   6 +-
 Test/dafny0/Parallel.dfy                   | 146 ++++++++++++++---------------
 Test/dafny3/Filter.dfy                     |  16 ++--
 Test/dafny3/GenericSort.dfy                |  56 +++++------
 Test/dafny3/InfiniteTrees.dfy              |  44 +++------
 Test/dafny4/ACL2-extractor.dfy             |   8 +-
 Test/dafny4/KozenSilva.dfy                 |  80 ++++++++--------
 Test/dafny4/KozenSilva.dfy.expect          |   2 +-
 Test/dafny4/NipkowKlein-chapter7.dfy       |  46 +--------
 Test/dafny4/NumberRepresentations.dfy      |  13 ++-
 Test/vstte2012/Tree.dfy                    |  32 +++----
 15 files changed, 236 insertions(+), 288 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index 1f63d769..6a6a76ba 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -438,6 +438,7 @@ namespace Microsoft.Dafny {
     public void PrintAttributes(Attributes a) {
       if (a != null) {
         PrintAttributes(a.Prev);
+        wr.Write(" ");
         PrintOneAttribute(a);
       }
     }
@@ -445,7 +446,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(a != null);
       var name = nameSubstitution ?? a.Name;
       var usAttribute = name.StartsWith("_");
-      wr.Write(" {1}{{:{0}", name, usAttribute ? "/*" : "");
+      wr.Write("{1}{{:{0}", name, usAttribute ? "/*" : "");
       if (a.Args != null) {
         PrintAttributeArgs(a.Args, false);
       }
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 4ac709f6..f107a819 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -1336,25 +1336,25 @@ namespace Microsoft.Dafny
     }
     void ComputeLemmaInduction(Method method) {
       Contract.Requires(method != null);
-      if (method.IsGhost && method.Mod.Expressions.Count == 0 && method.Outs.Count == 0 && !(method is FixpointLemma)) {
-        var posts = new List<Expression>();
-        method.Ens.ForEach(mfe => posts.Add(mfe.E));
-        ComputeInductionVariables(method.tok, method.Ins, posts, ref method.Attributes);
+      if (method.Body != null && method.IsGhost && method.Mod.Expressions.Count == 0 && method.Outs.Count == 0 && !(method is FixpointLemma)) {
+        var specs = new List<Expression>();
+        method.Req.ForEach(mfe => specs.Add(mfe.E));
+        method.Ens.ForEach(mfe => specs.Add(mfe.E));
+        ComputeInductionVariables(method.tok, method.Ins, specs, method, ref method.Attributes);
       }
     }
-    void ComputeInductionVariables<VarType>(IToken tok, List<VarType> boundVars, List<Expression> searchExprs, ref Attributes attributes) where VarType : class, IVariable {
+    void ComputeInductionVariables<VarType>(IToken tok, List<VarType> boundVars, List<Expression> searchExprs, Method lemma, ref Attributes attributes) where VarType : class, IVariable {
       Contract.Requires(tok != null);
       Contract.Requires(boundVars != null);
       Contract.Requires(searchExprs != null);
       Contract.Requires(DafnyOptions.O.Induction != 0);
-      bool forLemma = boundVars is List<Formal>;
 
       var args = Attributes.FindExpressions(attributes, "induction");  // we only look at the first one we find, since it overrides any other ones
       if (args == null) {
         if (DafnyOptions.O.Induction < 2) {
           // No explicit induction variables and we're asked not to infer anything, so we're done
           return;
-        } else if (DafnyOptions.O.Induction == 2 && forLemma) {
+        } else if (DafnyOptions.O.Induction == 2 && lemma != null) {
           // We're asked to infer induction variables only for quantifiers, not for lemmas
           return;
         }
@@ -1384,13 +1384,13 @@ namespace Microsoft.Dafny
             }
             if (0 <= boundVars.FindIndex(v => v == ie.Var)) {
               Resolver.Warning(arg.tok, "{0}s given as :induction arguments must be given in the same order as in the {1}; ignoring attribute",
-                forLemma ? "lemma parameter" : "bound variable", forLemma ? "lemma" : "quantifier");
+                lemma != null ? "lemma parameter" : "bound variable", lemma != null ? "lemma" : "quantifier");
               return;
             }
           }
           Resolver.Warning(arg.tok, "invalid :induction attribute argument; expected {0}{1}; ignoring attribute",
             i == 0 ? "'false' or 'true' or " : "",
-            forLemma ? "lemma parameter" : "bound variable");
+            lemma != null ? "lemma parameter" : "bound variable");
           return;
         }
         // The argument list was legal, so let's use it for the _induction attribute
@@ -1410,6 +1410,9 @@ namespace Microsoft.Dafny
         attributes = new Attributes("_induction", inductionVariables, attributes);
         // And since we're inferring something, let's also report that in a hover text.
         var s = Printer.OneAttributeToString(attributes, "induction");
+        if (lemma is PrefixLemma) {
+          s = lemma.Name + " " + s;
+        }
         Resolver.ReportAdditionalInformation(tok, s);
       }
     }
@@ -1423,7 +1426,7 @@ namespace Microsoft.Dafny
       protected override void VisitOneExpr(Expression expr) {
         var q = expr as QuantifierExpr;
         if (q != null) {
-          IndRewriter.ComputeInductionVariables(q.tok, q.BoundVars, new List<Expression>() { q.LogicalBody() }, ref q.Attributes);
+          IndRewriter.ComputeInductionVariables(q.tok, q.BoundVars, new List<Expression>() { q.LogicalBody() }, null, ref q.Attributes);
         }
       }
       void VisitInductionStmt(Statement stmt) {
diff --git a/Test/VerifyThis2015/Problem1.dfy b/Test/VerifyThis2015/Problem1.dfy
index 2e8a5243..67eeba07 100644
--- a/Test/VerifyThis2015/Problem1.dfy
+++ b/Test/VerifyThis2015/Problem1.dfy
@@ -161,18 +161,13 @@ lemma Same2<T>(pat: seq<T>, a: seq<T>)
   ensures IRP_Alt(pat, a)
 {
   if pat == [] {
-    assert pat <= a;
   } else if a != [] && pat[0] == a[0] {
-    assert IsRelaxedPrefixAux(pat[1..], a[1..], 1);
-    Same2(pat[1..], a[1..]);
     if pat[1..] <= a[1..] {
-      assert pat <= a;
     } else {
       var k :| 0 <= k < |pat[1..]| && pat[1..][..k] + pat[1..][k+1..] <= a[1..];
       assert 0 <= k+1 < |pat| && pat[..k+1] + pat[k+2..] <= a;
     }
   } else {
-    assert IsRelaxedPrefixAux(pat[1..], a, 0);
     Same2_Prefix(pat[1..], a);
     assert pat[1..] <= a;
     assert 0 <= 0 < |pat| && pat[..0] + pat[0+1..] <= a;
@@ -182,7 +177,4 @@ lemma Same2_Prefix<T>(pat: seq<T>, a: seq<T>)
   requires IsRelaxedPrefixAux(pat, a, 0)
   ensures pat <= a
 {
-  if pat != [] {
-    Same2_Prefix(pat[1..], a[1..]);
-  }
 }
diff --git a/Test/dafny0/InductivePredicates.dfy b/Test/dafny0/InductivePredicates.dfy
index 424118e7..8d05af11 100644
--- a/Test/dafny0/InductivePredicates.dfy
+++ b/Test/dafny0/InductivePredicates.dfy
@@ -18,7 +18,7 @@ lemma M(x: natinf)
 }
 
 // yay!  my first proof involving an inductive predicate :)
-lemma M'(k: nat, x: natinf)
+lemma {:induction false} M'(k: nat, x: natinf)
   requires Even#[k](x)
   ensures x.N? && x.n % 2 == 0
 {
@@ -32,8 +32,14 @@ lemma M'(k: nat, x: natinf)
   }
 }
 
+lemma M'_auto(k: nat, x: natinf)
+  requires Even#[k](x)
+  ensures x.N? && x.n % 2 == 0
+{
+}
+
 // Here is the same proof as in M / M', but packaged into a single "inductive lemma":
-inductive lemma IL(x: natinf)
+inductive lemma {:induction false} IL(x: natinf)
   requires Even(x)
   ensures x.N? && x.n % 2 == 0
 {
@@ -45,7 +51,7 @@ inductive lemma IL(x: natinf)
   }
 }
 
-inductive lemma IL_EvenBetter(x: natinf)
+inductive lemma {:induction false} IL_EvenBetter(x: natinf)
   requires Even(x)
   ensures x.N? && x.n % 2 == 0
 {
@@ -57,6 +63,12 @@ inductive lemma IL_EvenBetter(x: natinf)
   }
 }
 
+inductive lemma IL_Best(x: natinf)
+  requires Even(x)
+  ensures x.N? && x.n % 2 == 0
+{
+}
+
 inductive lemma IL_Bad(x: natinf)
   requires Even(x)
   ensures x.N? && x.n % 2 == 0
@@ -107,7 +119,7 @@ module Alt {
   {
     match x
     case N(n) => N(n+1)
-   case Inf => Inf
+    case Inf => Inf
   }
 
   inductive predicate Even(x: natinf)
@@ -116,7 +128,7 @@ module Alt {
     exists y :: x == S(S(y)) && Even(y)
   }
 
-  inductive lemma MyLemma_NotSoNice(x: natinf)
+  inductive lemma {:induction false} MyLemma_NotSoNice(x: natinf)
     requires Even(x)
     ensures x.N? && x.n % 2 == 0
   {
@@ -130,7 +142,7 @@ module Alt {
     }
   }
 
-  inductive lemma MyLemma_NiceButNotFast(x: natinf)
+  inductive lemma {:induction false} MyLemma_NiceButNotFast(x: natinf)
     requires Even(x)
     ensures x.N? && x.n % 2 == 0
   {
@@ -143,7 +155,13 @@ module Alt {
         assert x.n == y.n + 2;
     }
   }
-
+  
+  inductive lemma MyLemma_RealNice_AndFastToo(x: natinf)
+    requires Even(x)
+    ensures x.N? && x.n % 2 == 0
+  {
+  }
+  
   lemma InfNotEven()
     ensures !Even(Inf)
   {
@@ -156,15 +174,6 @@ module Alt {
     requires Even(Inf)
     ensures false
   {
-    var x := Inf;
-    if {
-      case x.N? && x.n == 0 =>
-        assert false;  // this case is absurd
-      case exists y :: x == S(S(y)) && Even(y) =>
-        var y :| x == S(S(y)) && Even(y);
-        assert y == Inf;
-        InfNotEven_Aux();
-    }
   }
 
   lemma NextEven(x: natinf)
diff --git a/Test/dafny0/InductivePredicates.dfy.expect b/Test/dafny0/InductivePredicates.dfy.expect
index ccf30643..48beade5 100644
--- a/Test/dafny0/InductivePredicates.dfy.expect
+++ b/Test/dafny0/InductivePredicates.dfy.expect
@@ -1,9 +1,9 @@
-InductivePredicates.dfy(64,9): Error: assertion violation
+InductivePredicates.dfy(76,9): Error: assertion violation
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-InductivePredicates.dfy(76,10): Error: assertion violation
+InductivePredicates.dfy(88,10): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
-Dafny program verifier finished with 29 verified, 2 errors
+Dafny program verifier finished with 35 verified, 2 errors
diff --git a/Test/dafny0/Parallel.dfy b/Test/dafny0/Parallel.dfy
index 030eb350..e0d6491b 100644
--- a/Test/dafny0/Parallel.dfy
+++ b/Test/dafny0/Parallel.dfy
@@ -2,13 +2,13 @@
 // RUN: %diff "%s.expect" "%t"
 
 class C {
-  var data: int;
-  var n: nat;
-  var st: set<object>;
+  var data: int
+  var n: nat
+  var st: set<object>
 
   ghost method CLemma(k: int)
-    requires k != -23;
-    ensures data < k;  // magic, isn't it (or bogus, some would say)
+    requires k != -23
+    ensures data < k  // magic, isn't it (or bogus, some would say)
 }
 
 // This method more or less just tests the syntax, resolution, and basic verification
@@ -19,31 +19,31 @@ method ParallelStatement_Resolve(
     S: set<int>,
     clx: C, cly: C, clk: int
   )
-  requires a != null && null !in spine;
-  modifies a, spine;
+  requires a != null && null !in spine
+  modifies a, spine
 {
-  forall (i: int | 0 <= i < a.Length && i % 2 == 0) {
+  forall i | 0 <= i < a.Length && i % 2 == 0 {
     a[i] := a[(i + 1) % a.Length] + 3;
   }
 
-  forall (o | o in spine) {
+  forall o | o in spine {
     o.st := o.st + Repr;
   }
 
-  forall (x, y | x in S && 0 <= y+x < 100) {
+  forall x, y | x in S && 0 <= y+x < 100 {
     Lemma(clx, x, y);  // error: precondition does not hold (clx may be null)
   }
 
-  forall (x, y | x in S && 0 <= y+x < 100) {
+  forall x, y | x in S && 0 <= y+x < 100 {
     cly.CLemma(x + y);  // error: receiver might be null
   }
 
-  forall (p | 0 <= p)
-    ensures F(p) <= Sum(p) + p - 1;  // error (no connection is known between F and Sum)
+  forall p | 0 <= p
+    ensures F(p) <= Sum(p) + p - 1  // error (no connection is known between F and Sum)
   {
     assert 0 <= G(p);
     ghost var t;
-    if (p % 2 == 0) {
+    if p % 2 == 0 {
       assert G(p) == F(p+2);  // error (there's nothing that gives any relation between F and G)
       t := p+p;
     } else {
@@ -56,11 +56,11 @@ method ParallelStatement_Resolve(
   }
 }
 
-ghost method Lemma(c: C, x: int, y: int)
-  requires c != null;
-  ensures c.data <= x+y;
-ghost method PowerLemma(x: int, y: int)
-  ensures Pred(x, y);
+lemma Lemma(c: C, x: int, y: int)
+  requires c != null
+  ensures c.data <= x+y
+lemma PowerLemma(x: int, y: int)
+  ensures Pred(x, y)
 
 function F(x: int): int
 function G(x: int): nat
@@ -71,54 +71,54 @@ function Pred(x: int, y: int): bool
 // ---------------------------------------------------------------------
 
 method M0(S: set<C>)
-  requires null !in S;
-  modifies S;
-  ensures forall o :: o in S ==> o.data == 85;
-  ensures forall o :: o != null && o !in S ==> o.data == old(o.data);
+  requires null !in S
+  modifies S
+  ensures forall o :: o in S ==> o.data == 85
+  ensures forall o :: o != null && o !in S ==> o.data == old(o.data)
 {
-  forall (s | s in S) {
+  forall s | s in S {
     s.data := 85;
   }
 }
 
 method M1(S: set<C>, x: C)
-  requires null !in S && x in S;
+  requires null !in S && x in S
 {
-  forall (s | s in S)
-    ensures s.data < 100;
+  forall s | s in S
+    ensures s.data < 100
   {
     assume s.data == 85;
   }
-  if (*) {
+  if * {
     assert x.data == 85;  // error (cannot be inferred from forall ensures clause)
   } else {
     assert x.data < 120;
   }
 
-  forall (s | s in S)
-    ensures s.data < 70;  // error
+  forall s | s in S
+    ensures s.data < 70  // error
   {
     assume s.data == 85;
   }
 }
 
 method M2() returns (a: array<int>)
-  ensures a != null;
-  ensures forall i,j :: 0 <= i < a.Length/2 <= j < a.Length ==> a[i] < a[j];
+  ensures a != null
+  ensures forall i,j :: 0 <= i < a.Length/2 <= j < a.Length ==> a[i] < a[j]
 {
   a := new int[250];
-  forall (i: nat | i < 125) {
+  forall i: nat | i < 125 {
     a[i] := 423;
   }
-  forall (i | 125 <= i < 250) {
+  forall i | 125 <= i < 250 {
     a[i] := 300 + i;
   }
 }
 
 method M4(S: set<C>, k: int)
-  modifies S;
+  modifies S
 {
-  forall (s | s in S && s != null) {
+  forall s | s in S && s != null {
     s.n := k;  // error: k might be negative
   }
 }
@@ -127,25 +127,25 @@ method M5()
 {
   if {
   case true =>
-    forall (x | 0 <= x < 100) {
+    forall x | 0 <= x < 100 {
       PowerLemma(x, x);
     }
     assert Pred(34, 34);
 
   case true =>
-    forall (x,y | 0 <= x < 100 && y == x+1) {
+    forall x,y | 0 <= x < 100 && y == x+1 {
       PowerLemma(x, y);
     }
     assert Pred(34, 35);
 
   case true =>
-    forall (x,y | 0 <= x < y < 100) {
+    forall x,y | 0 <= x < y < 100 {
       PowerLemma(x, y);
     }
     assert Pred(34, 35);
 
   case true =>
-    forall (x | x in set k | 0 <= k < 100) {
+    forall x | x in set k | 0 <= k < 100 {
       PowerLemma(x, x);
     }
     assert Pred(34, 34);
@@ -155,22 +155,22 @@ method M5()
 method Main()
 {
   var a := new int[180];
-  forall (i | 0 <= i < 180) {
+  forall i | 0 <= i < 180 {
     a[i] := 2*i + 100;
   }
   var sq := [0, 0, 0, 2, 2, 2, 5, 5, 5];
-  forall (i | 0 <= i < |sq|) {
+  forall i | 0 <= i < |sq| {
     a[20+i] := sq[i];
   }
-  forall (t | t in sq) {
+  forall t | t in sq {
     a[t] := 1000;
   }
-  forall (t,u | t in sq && t < 4 && 10 <= u < 10+t) {
+  forall t,u | t in sq && t < 4 && 10 <= u < 10+t {
     a[u] := 6000 + t;
   }
   var k := 0;
-  while (k < 180) {
-    if (k != 0) { print ", "; }
+  while k < 180 {
+    if k != 0 { print ", "; }
     print a[k];
     k := k + 1;
   }
@@ -180,50 +180,50 @@ method Main()
 method DuplicateUpdate() {
   var a := new int[180];
   var sq := [0, 0, 0, 2, 2, 2, 5, 5, 5];
-  if (*) {
-    forall (t,u | t in sq && 10 <= u < 10+t) {
+  if * {
+    forall t,u | t in sq && 10 <= u < 10+t {
       a[u] := 6000 + t;  // error: a[10] (and a[11]) are assigned more than once
     }
   } else {
-    forall (t,u | t in sq && t < 4 && 10 <= u < 10+t) {
+    forall t,u | t in sq && t < 4 && 10 <= u < 10+t {
       a[u] := 6000 + t;  // with the 't < 4' conjunct in the line above, this is fine
     }
   }
 }
 
-ghost method DontDoMuch(x: int)
+lemma DontDoMuch(x: int)
 {
 }
 
 method OmittedRange() {
-  forall (x: int) { }  // a type is still needed for the bound variable
-  forall (x) {
+  forall x: int { }  // a type is still needed for the bound variable
+  forall x {
     DontDoMuch(x);
   }
 }
 
 // ----------------------- two-state postconditions ---------------------------------
 
-class TwoState_C { ghost var data: int; }
+class TwoState_C { ghost var data: int }
 
 // It is not possible to achieve this postcondition in a ghost method, because ghost
 // contexts are not allowed to allocate state.  Callers of this ghost method will know
 // that the postcondition is tantamount to 'false'.
 ghost method TwoState0(y: int)
-  ensures exists o: TwoState_C :: o != null && fresh(o);
+  ensures exists o: TwoState_C :: o != null && fresh(o)
 
 method TwoState_Main0() {
-  forall (x) { TwoState0(x); }
+  forall x { TwoState0(x); }
   assert false;  // no prob, because the postcondition of TwoState0 implies false
 }
 
 method X_Legit(c: TwoState_C)
-  requires c != null;
-  modifies c;
+  requires c != null
+  modifies c
 {
   c.data := c.data + 1;
-  forall (x | c.data <= x)
-    ensures old(c.data) < x;  // note that the 'old' refers to the method's initial state
+  forall x | c.data <= x
+    ensures old(c.data) < x  // note that the 'old' refers to the method's initial state
   {
   }
 }
@@ -235,8 +235,8 @@ method X_Legit(c: TwoState_C)
 // method, not the beginning of the 'forall' statement.
 method TwoState_Main2()
 {
-  forall (x: int)
-    ensures exists o: TwoState_C :: o != null && fresh(o);
+  forall x: int
+    ensures exists o: TwoState_C :: o != null && fresh(o)
   {
     TwoState0(x);
   }
@@ -251,8 +251,8 @@ method TwoState_Main2()
 // statement's effect on the heap is not optimized away.
 method TwoState_Main3()
 {
-  forall (x: int)
-    ensures exists o: TwoState_C :: o != null && fresh(o);
+  forall x: int
+    ensures exists o: TwoState_C :: o != null && fresh(o)
   {
     assume false;  // (there's no other way to achieve this forall-statement postcondition)
   }
@@ -262,11 +262,11 @@ method TwoState_Main3()
 // ------- empty forall statement -----------------------------------------
 
 class EmptyForallStatement {
-  var emptyPar: int;
+  var emptyPar: int
 
   method Empty_Parallel0()
-    modifies this;
-    ensures emptyPar == 8;
+    modifies this
+    ensures emptyPar == 8
   {
     forall () {
       this.emptyPar := 8;
@@ -274,11 +274,11 @@ class EmptyForallStatement {
   }
 
   function EmptyPar_P(x: int): bool
-  ghost method EmptyPar_Lemma(x: int)
-    ensures EmptyPar_P(x);
+  lemma EmptyPar_Lemma(x: int)
+    ensures EmptyPar_P(x)
 
   method Empty_Parallel1()
-    ensures EmptyPar_P(8);
+    ensures EmptyPar_P(8)
   {
     forall {
       EmptyPar_Lemma(8);
@@ -288,7 +288,7 @@ class EmptyForallStatement {
   method Empty_Parallel2()
   {
     forall
-      ensures exists k :: EmptyPar_P(k);
+      ensures exists k :: EmptyPar_P(k)
     {
       var y := 8;
       assume EmptyPar_P(y);
@@ -312,9 +312,9 @@ predicate ThProperty(step: nat, t: Nat, r: nat)
   case Succ(o) => step>0 && exists ro:nat :: ThProperty(step-1, o, ro)
 }
 
-ghost method Th(step: nat, t: Nat, r: nat)
-  requires t.Succ? && ThProperty(step, t, r);
+lemma Th(step: nat, t: Nat, r: nat)
+  requires t.Succ? && ThProperty(step, t, r)
   // the next line follows from the precondition and the definition of ThProperty
-  ensures exists ro:nat :: ThProperty(step-1, t.tail, ro);
+  ensures exists ro:nat :: ThProperty(step-1, t.tail, ro)
 {
 }
diff --git a/Test/dafny3/Filter.dfy b/Test/dafny3/Filter.dfy
index 24c8e94e..6e67de26 100644
--- a/Test/dafny3/Filter.dfy
+++ b/Test/dafny3/Filter.dfy
@@ -35,7 +35,7 @@ lemma Lemma_TailSubStreamK(s: Stream, u: Stream, k: nat)  // this lemma could ha
 {
   if k != 0 {
     Lemma_InTail(s.head, u);
-    Lemma_TailSubStreamK(s.tail, u, k-1);
+    //Lemma_TailSubStreamK(s.tail, u, k-1);
   }
 }
 lemma Lemma_InSubStream<T>(x: T, s: Stream<T>, u: Stream<T>)
@@ -193,10 +193,10 @@ lemma FS_Ping<T>(s: Stream<T>, h: PredicateHandle, x: T)
 }
 
 lemma FS_Pong<T>(s: Stream<T>, h: PredicateHandle, x: T, k: nat)
-  requires AlwaysAnother(s, h) && In(x, s) && P(x, h);
-  requires Tail(s, k).head == x;
-  ensures In(x, Filter(s, h));
-  decreases k;
+  requires AlwaysAnother(s, h) && In(x, s) && P(x, h)
+  requires Tail(s, k).head == x
+  ensures In(x, Filter(s, h))
+  decreases k
 {
   var fs := Filter(s, h);
   if s.head == x {
@@ -205,14 +205,14 @@ lemma FS_Pong<T>(s: Stream<T>, h: PredicateHandle, x: T, k: nat)
     assert fs == Cons(s.head, Filter(s.tail, h));  // reminder of where we are
     calc {
       true;
-    ==  { FS_Pong(s.tail, h, x, k-1); }
+    //==  { FS_Pong(s.tail, h, x, k-1); }
       In(x, Filter(s.tail, h));
     ==> { assert fs.head != x;  Lemma_InTail(x, fs); }
       In(x, fs);
     }
   } else {
-    assert fs == Filter(s.tail, h);  // reminder of where we are
-    FS_Pong(s.tail, h, x, k-1);
+    //assert fs == Filter(s.tail, h);  // reminder of where we are
+    //FS_Pong(s.tail, h, x, k-1);
   }
 }
 
diff --git a/Test/dafny3/GenericSort.dfy b/Test/dafny3/GenericSort.dfy
index 7ea038be..6bd06965 100644
--- a/Test/dafny3/GenericSort.dfy
+++ b/Test/dafny3/GenericSort.dfy
@@ -7,25 +7,25 @@ abstract module TotalOrder {
   // Three properties of total orders.  Here, they are given as unproved
   // lemmas, that is, as axioms.
   lemma Antisymmetry(a: T, b: T)
-    requires Leq(a, b) && Leq(b, a);
-    ensures a == b;
+    requires Leq(a, b) && Leq(b, a)
+    ensures a == b
   lemma Transitivity(a: T, b: T, c: T)
-    requires Leq(a, b) && Leq(b, c);
-    ensures Leq(a, c);
+    requires Leq(a, b) && Leq(b, c)
+    ensures Leq(a, c)
   lemma Totality(a: T, b: T)
-    ensures Leq(a, b) || Leq(b, a);
+    ensures Leq(a, b) || Leq(b, a)
 }
 
 abstract module Sort {
   import O as TotalOrder  // let O denote some module that has the members of TotalOrder
 
   predicate Sorted(a: array<O.T>, low: int, high: int)
-    requires a != null && 0 <= low <= high <= a.Length;
-    reads a;
+    requires a != null && 0 <= low <= high <= a.Length
+    reads a
     // The body of the predicate is hidden outside the module, but the postcondition is
     // "exported" (that is, visible, known) outside the module.  Here, we choose the
     // export the following property:
-    ensures Sorted(a, low, high) ==> forall i, j :: low <= i < j < high ==> O.Leq(a[i], a[j]);
+    ensures Sorted(a, low, high) ==> forall i, j :: low <= i < j < high ==> O.Leq(a[i], a[j])
   {
     forall i, j :: low <= i < j < high ==> O.Leq(a[i], a[j])
   }
@@ -33,18 +33,18 @@ abstract module Sort {
   // In the insertion sort routine below, it's more convenient to keep track of only that
   // neighboring elements of the array are sorted...
   predicate NeighborSorted(a: array<O.T>, low: int, high: int)
-    requires a != null && 0 <= low <= high <= a.Length;
-    reads a;
+    requires a != null && 0 <= low <= high <= a.Length
+    reads a
   {
     forall i :: low < i < high ==> O.Leq(a[i-1], a[i])
   }
   // ...but we show that property to imply all pairs to be sorted.  The proof of this
   // lemma uses the transitivity property.
   lemma NeighborSorted_implies_Sorted(a: array<O.T>, low: int, high: int)
-    requires a != null && 0 <= low <= high <= a.Length;
-    requires NeighborSorted(a, low, high);
-    ensures Sorted(a, low, high);
-    decreases high - low;
+    requires a != null && 0 <= low <= high <= a.Length
+    requires NeighborSorted(a, low, high)
+    ensures Sorted(a, low, high)
+    decreases high - low
   {
     if low != high {
       NeighborSorted_implies_Sorted(a, low+1, high);
@@ -57,25 +57,25 @@ abstract module Sort {
 
   // Standard insertion sort method
   method InsertionSort(a: array<O.T>)
-    requires a != null;
-    modifies a;
-    ensures Sorted(a, 0, a.Length);
-    ensures multiset(a[..]) == old(multiset(a[..]));
+    requires a != null
+    modifies a
+    ensures Sorted(a, 0, a.Length)
+    ensures multiset(a[..]) == old(multiset(a[..]))
   {
     if a.Length == 0 { return; }
     var i := 1;
     while i < a.Length
-      invariant 0 < i <= a.Length;
-      invariant NeighborSorted(a, 0, i);
-      invariant multiset(a[..]) == old(multiset(a[..]));
+      invariant 0 < i <= a.Length
+      invariant NeighborSorted(a, 0, i)
+      invariant multiset(a[..]) == old(multiset(a[..]))
     {
       var j := i;
       while 0 < j && !O.Leq(a[j-1], a[j])
-        invariant 0 <= j <= i;
-        invariant NeighborSorted(a, 0, j);
-        invariant NeighborSorted(a, j, i+1);
-        invariant 0 < j < i ==> O.Leq(a[j-1], a[j+1]);
-        invariant multiset(a[..]) == old(multiset(a[..]));
+        invariant 0 <= j <= i
+        invariant NeighborSorted(a, 0, j)
+        invariant NeighborSorted(a, j, i+1)
+        invariant 0 < j < i ==> O.Leq(a[j-1], a[j+1])
+        invariant multiset(a[..]) == old(multiset(a[..]))
       {
         // The proof of correctness uses the totality property here.
         // It implies that if two elements are not previously in
@@ -97,7 +97,7 @@ module IntOrder refines TotalOrder {
   datatype T = Int(i: int)
   // Define the ordering on these integers
   predicate method Leq ...
-    ensures Leq(a, b) ==> a.i <= b.i;
+    ensures Leq(a, b) ==> a.i <= b.i
   {
     a.i <= b.i
   }
@@ -156,7 +156,7 @@ module intOrder refines TotalOrder {
   type T = int
   // Define the ordering on these integers
   predicate method Leq ...
-    ensures Leq(a, b) ==> a <= b;
+    ensures Leq(a, b) ==> a <= b
   {
     a <= b
   }
diff --git a/Test/dafny3/InfiniteTrees.dfy b/Test/dafny3/InfiniteTrees.dfy
index 516a9e4e..85f73bc3 100644
--- a/Test/dafny3/InfiniteTrees.dfy
+++ b/Test/dafny3/InfiniteTrees.dfy
@@ -286,7 +286,7 @@ lemma Theorem1_Lemma(t: Tree, n: nat, p: Stream<int>)
         LowerThan(ch, n);
       ==>  // def. LowerThan
         LowerThan(ch.head.children, n-1);
-      ==>  { Theorem1_Lemma(ch.head, n-1, tail); }
+      ==>  //{ Theorem1_Lemma(ch.head, n-1, tail); }
         !IsNeverEndingStream(tail);
       ==>  // def. IsNeverEndingStream
         !IsNeverEndingStream(p);
@@ -374,30 +374,30 @@ lemma Proposition3b()
   }
 }
 lemma Proposition3b_Lemma(t: Tree, h: nat, p: Stream<int>)
-  requires LowerThan(t.children, h) && ValidPath(t, p);
-  ensures !IsNeverEndingStream(p);
-  decreases h;
+  requires LowerThan(t.children, h) && ValidPath(t, p)
+  ensures !IsNeverEndingStream(p)
+  decreases h
 {
   match p {
     case Nil =>
     case Cons(index, tail) =>
       // From the definition of ValidPath(t, p), we get the following:
       var ch := Tail(t.children, index);
-      assert ch.Cons? && ValidPath(ch.head, tail);
+      // assert ch.Cons? && ValidPath(ch.head, tail);
       // From the definition of LowerThan(t.children, h), we get the following:
       match t.children {
         case Nil =>
           ValidPath_Lemma(p);
           assert false;  // absurd case
         case Cons(_, _) =>
-          assert 1 <= h;
+          // assert 1 <= h;
           LowerThan_Lemma(t.children, index, h);
-          assert LowerThan(ch, h);
+          // assert LowerThan(ch, h);
       }
       // Putting these together, by ch.Cons? and the definition of LowerThan(ch, h), we get:
-      assert LowerThan(ch.head.children, h-1);
+      // assert LowerThan(ch.head.children, h-1);
       // And now we can invoke the induction hypothesis:
-      Proposition3b_Lemma(ch.head, h-1, tail);
+      // Proposition3b_Lemma(ch.head, h-1, tail);
   }
 }
 
@@ -627,30 +627,10 @@ colemma Path_Lemma2'(p: Stream<int>)
   }
 }
 colemma Path_Lemma2''(p: Stream<int>, n: nat, tail: Stream<int>)
-  requires IsNeverEndingStream(p) && p.tail == tail;
-  ensures InfinitePath'(S2N'(n, tail));
+  requires IsNeverEndingStream(p) && p.tail == tail
+  ensures InfinitePath'(S2N'(n, tail))
 {
-  if n <= 0 {
-    calc {
-      InfinitePath'#[_k](S2N'(n, tail));
-      // def. S2N'
-      InfinitePath'#[_k](Zero(S2N(tail)));
-      // def. InfinitePath'
-      InfinitePath#[_k-1](S2N(tail));
-      { Path_Lemma2'(tail); }
-      true;
-    }
-  } else {
-    calc {
-      InfinitePath'#[_k](S2N'(n, tail));
-      // def. S2N'
-      InfinitePath'#[_k](Succ(S2N'(n-1, tail)));
-      // def. InfinitePath'
-      InfinitePath'#[_k-1](S2N'(n-1, tail));
-      { Path_Lemma2''(p, n-1, tail); }
-      true;
-    }
-  }
+  Path_Lemma2'(tail);
 }
 lemma Path_Lemma3(r: CoOption<Number>)
   ensures InfinitePath(r) ==> IsNeverEndingStream(N2S(r));
diff --git a/Test/dafny4/ACL2-extractor.dfy b/Test/dafny4/ACL2-extractor.dfy
index 8fe98531..bd2c9d83 100644
--- a/Test/dafny4/ACL2-extractor.dfy
+++ b/Test/dafny4/ACL2-extractor.dfy
@@ -116,9 +116,9 @@ lemma RevLength(xs: List)
 // you can prove two lists equal by proving their elements equal
 
 lemma EqualElementsMakeEqualLists(xs: List, ys: List)
-  requires length(xs) == length(ys);
-  requires forall i :: 0 <= i < length(xs) ==> nth(i, xs) == nth(i, ys);
-  ensures xs == ys;
+  requires length(xs) == length(ys)
+  requires forall i :: 0 <= i < length(xs) ==> nth(i, xs) == nth(i, ys)
+  ensures xs == ys
 {
   match xs {
     case Nil =>
@@ -132,7 +132,7 @@ lemma EqualElementsMakeEqualLists(xs: List, ys: List)
           nth(i+1, xs) == nth(i+1, ys);
         }
       }
-      EqualElementsMakeEqualLists(xs.tail, ys.tail);
+      // EqualElementsMakeEqualLists(xs.tail, ys.tail);
   }
 }
 
diff --git a/Test/dafny4/KozenSilva.dfy b/Test/dafny4/KozenSilva.dfy
index af0cdc71..ef49b10f 100644
--- a/Test/dafny4/KozenSilva.dfy
+++ b/Test/dafny4/KozenSilva.dfy
@@ -25,8 +25,8 @@ copredicate LexLess(s: Stream<int>, t: Stream<int>)
 
 // A co-lemma is used to establish the truth of a co-predicate.
 colemma Theorem1_LexLess_Is_Transitive(s: Stream<int>, t: Stream<int>, u: Stream<int>)
-  requires LexLess(s, t) && LexLess(t, u);
-  ensures LexLess(s, u);
+  requires LexLess(s, t) && LexLess(t, u)
+  ensures LexLess(s, u)
 {
   // Here is the proof, which is actually a body of code.  It lends itself to a
   // simple, intuitive co-inductive reading.  For a theorem this simple, this simple
@@ -38,6 +38,14 @@ colemma Theorem1_LexLess_Is_Transitive(s: Stream<int>, t: Stream<int>, u: Stream
   }
 }
 
+// Actually, Dafny can do the proof of the previous lemma completely automatically.  Here it is:
+colemma Theorem1_LexLess_Is_Transitive_Automatic(s: Stream<int>, t: Stream<int>, u: Stream<int>)
+  requires LexLess(s, t) && LexLess(t, u)
+  ensures LexLess(s, u)
+{
+  // no manual proof needed, so the body of the co-lemma is empty
+}
+
 // The following predicate captures the (inductively defined) negation of (the
 // co-inductively defined) LexLess above.
 predicate NotLexLess(s: Stream<int>, t: Stream<int>)
@@ -51,7 +59,7 @@ predicate NotLexLess'(k: nat, s: Stream<int>, t: Stream<int>)
 }
 
 lemma EquivalenceTheorem(s: Stream<int>, t: Stream<int>)
-  ensures LexLess(s, t) <==> !NotLexLess(s, t);
+  ensures LexLess(s, t) <==> !NotLexLess(s, t)
 {
   if !NotLexLess(s, t) {
     EquivalenceTheorem0(s, t);
@@ -61,8 +69,8 @@ lemma EquivalenceTheorem(s: Stream<int>, t: Stream<int>)
   }
 }
 colemma EquivalenceTheorem0(s: Stream<int>, t: Stream<int>)
-  requires !NotLexLess(s, t);
-  ensures LexLess(s, t);
+  requires !NotLexLess(s, t)
+  ensures LexLess(s, t)
 {
   // Here, more needs to be said about the way Dafny handles co-lemmas.
   // The way a co-lemma establishes a co-predicate is to prove, by induction,
@@ -74,14 +82,14 @@ colemma EquivalenceTheorem0(s: Stream<int>, t: Stream<int>)
 // indicates a finite unrolling of a co-inductive predicate.  In particular,
 // LexLess#[k] refers to k unrollings of LexLess.
 lemma EquivalenceTheorem0_Lemma(k: nat, s: Stream<int>, t: Stream<int>)
-  requires !NotLexLess'(k, s, t);
-  ensures LexLess#[k](s, t);
+  requires !NotLexLess'(k, s, t)
+  ensures LexLess#[k](s, t)
 {
   // This simple inductive proof is done completely automatically by Dafny.
 }
 lemma EquivalenceTheorem1(s: Stream<int>, t: Stream<int>)
-  requires LexLess(s, t);
-  ensures !NotLexLess(s, t);
+  requires LexLess(s, t)
+  ensures !NotLexLess(s, t)
 {
   // The forall statement in Dafny is used, here, as universal introduction:
   // what EquivalenceTheorem1_Lemma establishes for one k, the forall
@@ -91,22 +99,22 @@ lemma EquivalenceTheorem1(s: Stream<int>, t: Stream<int>)
   }
 }
 lemma EquivalenceTheorem1_Lemma(k: nat, s: Stream<int>, t: Stream<int>)
-  requires LexLess(s, t);
-  ensures !NotLexLess'(k, s, t);
+  requires LexLess(s, t)
+  ensures !NotLexLess'(k, s, t)
 {
 }
 
 lemma Theorem1_Alt(s: Stream<int>, t: Stream<int>, u: Stream<int>)
-  requires NotLexLess(s, u);
-  ensures NotLexLess(s, t) || NotLexLess(t, u);
+  requires NotLexLess(s, u)
+  ensures NotLexLess(s, t) || NotLexLess(t, u)
 {
   forall k: nat | NotLexLess'(k, s, u) {
     Theorem1_Alt_Lemma(k, s, t, u);
   }
 }
 lemma Theorem1_Alt_Lemma(k: nat, s: Stream<int>, t: Stream<int>, u: Stream<int>)
-  requires NotLexLess'(k, s, u);
-  ensures NotLexLess'(k, s, t) || NotLexLess'(k, t, u);
+  requires NotLexLess'(k, s, u)
+  ensures NotLexLess'(k, s, t) || NotLexLess'(k, t, u)
 {
 }
 
@@ -116,8 +124,8 @@ function PointwiseAdd(s: Stream<int>, t: Stream<int>): Stream<int>
 }
 
 colemma Theorem2_Pointwise_Addition_Is_Monotone(s: Stream<int>, t: Stream<int>, u: Stream<int>, v: Stream<int>)
-  requires LexLess(s, t) && LexLess(u, v);
-  ensures LexLess(PointwiseAdd(s, u), PointwiseAdd(t, v));
+  requires LexLess(s, t) && LexLess(u, v)
+  ensures LexLess(PointwiseAdd(s, u), PointwiseAdd(t, v))
 {
   // The co-lemma will establish the co-inductive predicate by establishing
   // all finite unrollings thereof.  Each finite unrolling is proved by
@@ -148,15 +156,9 @@ copredicate Subtype(a: RecType, b: RecType)
 }
 
 colemma Theorem3_Subtype_Is_Transitive(a: RecType, b: RecType, c: RecType)
-  requires Subtype(a, b) && Subtype(b, c);
-  ensures Subtype(a, c);
-{
-  if a == Bottom || c == Top {
-    // done
-  } else {
-    Theorem3_Subtype_Is_Transitive(c.dom, b.dom, a.dom);
-    Theorem3_Subtype_Is_Transitive(a.ran, b.ran, c.ran);
-  }
+  requires Subtype(a, b) && Subtype(b, c)
+  ensures Subtype(a, c)
+{
 }
 
 // --------------------------------------------------------------------------
@@ -184,16 +186,16 @@ copredicate ValBelow(u: Val, v: Val)
 }
 
 colemma Theorem4a_ClEnvBelow_Is_Transitive(c: ClEnv, d: ClEnv, e: ClEnv)
-  requires ClEnvBelow(c, d) && ClEnvBelow(d, e);
-  ensures ClEnvBelow(c, e);
+  requires ClEnvBelow(c, d) && ClEnvBelow(d, e)
+  ensures ClEnvBelow(c, e)
 {
   forall y | y in c.m {
     Theorem4b_ValBelow_Is_Transitive#[_k-1](c.m[y], d.m[y], e.m[y]);
   }
 }
 colemma Theorem4b_ValBelow_Is_Transitive(u: Val, v: Val, w: Val)
-  requires ValBelow(u, v) && ValBelow(v, w);
-  ensures ValBelow(u, w);
+  requires ValBelow(u, v) && ValBelow(v, w)
+  ensures ValBelow(u, w)
 {
   if u.ValCl? {
     Theorem4a_ClEnvBelow_Is_Transitive(u.cl.env, v.cl.env, w.cl.env);
@@ -209,7 +211,7 @@ predicate IsCapsule(cap: Capsule)
 }
 
 function ClosureConversion(cap: Capsule): Cl
-  requires IsCapsule(cap);
+  requires IsCapsule(cap)
 {
   Closure(cap.e.abs, ClosureConvertedMap(cap.s))
   // In the Kozen and Silva paper, there are more conditions, having to do with free variables,
@@ -229,8 +231,8 @@ predicate CapsuleEnvironmentBelow(s: map<Var, ConstOrAbs>, t: map<Var, ConstOrAb
 }
 
 colemma Theorem5_ClosureConversion_Is_Monotone(s: map<Var, ConstOrAbs>, t: map<Var, ConstOrAbs>)
-  requires CapsuleEnvironmentBelow(s, t);
-  ensures ClEnvBelow(ClosureConvertedMap(s), ClosureConvertedMap(t));
+  requires CapsuleEnvironmentBelow(s, t)
+  ensures ClEnvBelow(ClosureConvertedMap(s), ClosureConvertedMap(t))
 {
 }
 
@@ -251,8 +253,8 @@ copredicate Bisim(s: Stream, t: Stream)
 }
 
 colemma Theorem6_Bisim_Is_Symmetric(s: Stream, t: Stream)
-  requires Bisim(s, t);
-  ensures Bisim(t, s);
+  requires Bisim(s, t)
+  ensures Bisim(t, s)
 {
   // proof is automatic
 }
@@ -270,8 +272,8 @@ function merge(s: Stream, t: Stream): Stream
 // In general, the termination argument needs to be supplied explicitly in terms
 // of a metric, rank, variant function, or whatever you want to call it--a
 // "decreases" clause in Dafny.  Dafny provides some help in making up "decreases"
-// clauses, and in this case it automatically adds "decreases 0;" to SplitLeft
-// and "decreases 1;" to SplitRight.  With these "decreases" clauses, the
+// clauses, and in this case it automatically adds "decreases 0" to SplitLeft
+// and "decreases 1" to SplitRight.  With these "decreases" clauses, the
 // termination check of SplitRight's call to SplitLeft will simply be "0 < 1",
 // which is trivial to check.
 function SplitLeft(s: Stream): Stream
@@ -284,7 +286,7 @@ function SplitRight(s: Stream): Stream
 }
 
 colemma Theorem7_Merge_Is_Left_Inverse_Of_Split_Bisim(s: Stream)
-  ensures Bisim(merge(SplitLeft(s), SplitRight(s)), s);
+  ensures Bisim(merge(SplitLeft(s), SplitRight(s)), s)
 {
   var LHS := merge(SplitLeft(s), SplitRight(s));
   // The construct that follows is a "calc" statement.  It gives a way to write an
@@ -318,7 +320,7 @@ colemma Theorem7_Merge_Is_Left_Inverse_Of_Split_Bisim(s: Stream)
 }
 
 colemma Theorem7_Merge_Is_Left_Inverse_Of_Split_Equal(s: Stream)
-  ensures merge(SplitLeft(s), SplitRight(s)) == s;
+  ensures merge(SplitLeft(s), SplitRight(s)) == s
 {
   // The proof of this co-lemma is actually done completely automatically (so the
   // body of this co-lemma can be empty).  However, just to show what the calculations
diff --git a/Test/dafny4/KozenSilva.dfy.expect b/Test/dafny4/KozenSilva.dfy.expect
index c6c90498..90432af3 100644
--- a/Test/dafny4/KozenSilva.dfy.expect
+++ b/Test/dafny4/KozenSilva.dfy.expect
@@ -1,2 +1,2 @@
 
-Dafny program verifier finished with 47 verified, 0 errors
+Dafny program verifier finished with 49 verified, 0 errors
diff --git a/Test/dafny4/NipkowKlein-chapter7.dfy b/Test/dafny4/NipkowKlein-chapter7.dfy
index 7db31cbd..e694fc4b 100644
--- a/Test/dafny4/NipkowKlein-chapter7.dfy
+++ b/Test/dafny4/NipkowKlein-chapter7.dfy
@@ -112,13 +112,6 @@ inductive lemma lemma_7_6(b: bexp, c: com, c': com, s: state, t: state)
   requires big_step(While(b, c), s, t) && equiv_c(c, c')
   ensures big_step(While(b, c'), s, t)
 {
-  if !bval(b, s) {
-    // trivial
-  } else {
-    var s' :| big_step#[_k-1](c, s, s') && big_step#[_k-1](While(b, c), s', t);
-    lemma_7_6(b, c, c', s', t);  // induction hypothesis
-    assert big_step(While(b, c'), s', t);
-  }
 }
 
 // equiv_c is an equivalence relation
@@ -139,27 +132,7 @@ inductive lemma IMP_is_deterministic(c: com, s: state, t: state, t': state)
   requires big_step(c, s, t) && big_step(c, s, t')
   ensures t == t'
 {
-  match c
-  case SKIP =>
-    // trivial
-  case Assign(x, a) =>
-    // trivial
-  case Seq(c0, c1) =>
-    var s' :| big_step#[_k-1](c0, s, s') && big_step#[_k-1](c1, s', t);
-    var s'' :| big_step#[_k-1](c0, s, s'') && big_step#[_k-1](c1, s'', t');
-    IMP_is_deterministic(c0, s, s', s'');
-    IMP_is_deterministic(c1, s', t, t');
-  case If(b, thn, els) =>
-    IMP_is_deterministic(if bval(b, s) then thn else els, s, t, t');
-  case While(b, body) =>
-    if !bval(b, s) {
-      // trivial
-    } else {
-      var s' :| big_step#[_k-1](body, s, s') && big_step#[_k-1](While(b, body), s', t);
-      var s'' :| big_step#[_k-1](body, s, s'') && big_step#[_k-1](While(b, body), s'', t');
-      IMP_is_deterministic(body, s, s', s'');
-      IMP_is_deterministic(While(b, body), s', t, t');
-    }
+  // Dafny totally rocks!
 }
 
 // ----- Small-step semantics -----
@@ -214,12 +187,6 @@ inductive lemma star_transitive_aux(c0: com, s0: state, c1: com, s1: state, c2:
   requires small_step_star(c0, s0, c1, s1)
   ensures small_step_star(c1, s1, c2, s2) ==> small_step_star(c0, s0, c2, s2)
 {
-  if c0 == c1 && s0 == s1 {
-  } else {
-    var c', s' :|
-      small_step(c0, s0, c', s') && small_step_star#[_k-1](c', s', c1, s1);
-      star_transitive_aux(c', s', c1, s1, c2, s2);
-  }
 }
 
 // The big-step semantics can be simulated by some number of small steps
@@ -240,15 +207,14 @@ inductive lemma BigStep_implies_SmallStepStar(c: com, s: state, t: state)
       small_step_star(Seq(c0, c1), s, Seq(SKIP, c1), s') && small_step_star(Seq(SKIP, c1), s', SKIP, t);
       { lemma_7_13(c0, s, SKIP, s', c1); }
       small_step_star(c0, s, SKIP, s') && small_step_star(Seq(SKIP, c1), s', SKIP, t);
-      { BigStep_implies_SmallStepStar(c0, s, s'); }
+      //{ BigStep_implies_SmallStepStar(c0, s, s'); }
       small_step_star(Seq(SKIP, c1), s', SKIP, t);
       { assert small_step(Seq(SKIP, c1), s', c1, s'); }
       small_step_star(c1, s', SKIP, t);
-      { BigStep_implies_SmallStepStar(c1, s', t); }
+      //{ BigStep_implies_SmallStepStar(c1, s', t); }
       true;
     }
   case If(b, thn, els) =>
-    BigStep_implies_SmallStepStar(if bval(b, s) then thn else els, s, t);
   case While(b, body) =>
     if !bval(b, s) && s == t {
       calc <== {
@@ -271,11 +237,11 @@ inductive lemma BigStep_implies_SmallStepStar(c: com, s: state, t: state)
         small_step_star(Seq(body, While(b, body)), s, Seq(SKIP, While(b, body)), s') && small_step_star(Seq(SKIP, While(b, body)), s', SKIP, t);
         { lemma_7_13(body, s, SKIP, s', While(b, body)); }
         small_step_star(body, s, SKIP, s') && small_step_star(Seq(SKIP, While(b, body)), s', SKIP, t);
-        { BigStep_implies_SmallStepStar(body, s, s'); }
+        //{ BigStep_implies_SmallStepStar(body, s, s'); }
         small_step_star(Seq(SKIP, While(b, body)), s', SKIP, t);
         { assert small_step(Seq(SKIP, While(b, body)), s', While(b, body), s'); }
         small_step_star(While(b, body), s', SKIP, t);
-        { BigStep_implies_SmallStepStar(While(b, body), s', t); }
+        //{ BigStep_implies_SmallStepStar(While(b, body), s', t); }
         true;
       }
     }
@@ -299,7 +265,6 @@ inductive lemma SmallStepStar_implies_BigStep(c: com, s: state, t: state)
   if c == SKIP && s == t {
   } else {
     var c', s' :| small_step(c, s, c', s') && small_step_star#[_k-1](c', s', SKIP, t);
-    SmallStepStar_implies_BigStep(c', s', t);
     SmallStep_plus_BigStep(c, s, c', s', t);
   }
 }
@@ -316,7 +281,6 @@ inductive lemma SmallStep_plus_BigStep(c: com, s: state, c': com, s': state, t:
       var c0' :| c' == Seq(c0', c1) && small_step(c0, s, c0', s');
       if big_step(c', s', t) {
         var s'' :| big_step(c0', s', s'') && big_step(c1, s'', t);
-        SmallStep_plus_BigStep(c0, s, c0', s', s'');
       }
     }
   case If(b, thn, els) =>
diff --git a/Test/dafny4/NumberRepresentations.dfy b/Test/dafny4/NumberRepresentations.dfy
index 3dba6325..0d6cffa1 100644
--- a/Test/dafny4/NumberRepresentations.dfy
+++ b/Test/dafny4/NumberRepresentations.dfy
@@ -234,17 +234,16 @@ lemma UniqueRepresentation(a: seq<int>, b: seq<int>, lowDigit: int, base: nat)
 }
 
 lemma ZeroIsUnique(a: seq<int>, lowDigit: int, base: nat)
-  requires 2 <= base && lowDigit <= 0 < lowDigit + base;
-  requires a == trim(a);
-  requires IsSkewNumber(a, lowDigit, base);
-  requires eval(a, base) == 0;
-  ensures a == [];
+  requires 2 <= base && lowDigit <= 0 < lowDigit + base
+  requires a == trim(a)
+  requires IsSkewNumber(a, lowDigit, base)
+  requires eval(a, base) == 0
+  ensures a == []
 {
   if a != [] {
-    assert eval(a, base) == a[0] + base * eval(a[1..], base);
     if eval(a[1..], base) == 0 {
       TrimProperty(a);
-      ZeroIsUnique(a[1..], lowDigit, base);
+      // ZeroIsUnique(a[1..], lowDigit, base);
     }
     assert false;
   }
diff --git a/Test/vstte2012/Tree.dfy b/Test/vstte2012/Tree.dfy
index a346aac5..662024e4 100644
--- a/Test/vstte2012/Tree.dfy
+++ b/Test/vstte2012/Tree.dfy
@@ -22,9 +22,9 @@ datatype Result = Fail | Res(t: Tree, sOut: seq<int>)
 // The postconditions state properties that are needed
 // in the completeness proof.
 function toList(d: int, t: Tree): seq<int>
-  ensures toList(d, t) != [] && toList(d, t)[0] >= d;
-  ensures (toList(d, t)[0] == d) == (t == Leaf);
-  decreases t;
+  ensures toList(d, t) != [] && toList(d, t)[0] >= d
+  ensures (toList(d, t)[0] == d) == (t == Leaf)
+  decreases t
 {
   match t
   case Leaf => [d]
@@ -43,10 +43,10 @@ function toList(d: int, t: Tree): seq<int>
 function method build_rec(d: int, s: seq<int>): Result
   ensures build_rec(d, s).Res? ==>
             |build_rec(d, s).sOut| < |s| &&
-            build_rec(d, s).sOut == s[|s|-|build_rec(d, s).sOut|..];
+            build_rec(d, s).sOut == s[|s|-|build_rec(d, s).sOut|..]
   ensures build_rec(d, s).Res? ==>
-            toList(d,build_rec(d, s).t) == s[..|s|-|build_rec(d, s).sOut|];
-  decreases |s|, (if s==[] then 0 else s[0]-d);
+            toList(d,build_rec(d, s).t) == s[..|s|-|build_rec(d, s).sOut|]
+  decreases |s|, (if s==[] then 0 else s[0]-d)
 {
   if s==[] || s[0] < d then
     Fail
@@ -68,7 +68,7 @@ function method build_rec(d: int, s: seq<int>): Result
 // sequence yields exactly the input sequence.
 // Completeness is proved as a lemma, see below.
 function method build(s: seq<int>): Result
-  ensures build(s).Res? ==> toList(0,build(s).t) == s;
+  ensures build(s).Res? ==> toList(0,build(s).t) == s
 {
   var r := build_rec(0, s);
   if r.Res? && r.sOut == [] then r else Fail
@@ -86,16 +86,14 @@ function method build(s: seq<int>): Result
 // correctly (encoded by calls to this lemma).
 lemma lemma0(t: Tree, d: int, s: seq<int>)
   ensures build_rec(d, toList(d, t) + s).Res? &&
-          build_rec(d, toList(d, t) + s).sOut == s;
+          build_rec(d, toList(d, t) + s).sOut == s
 {
   match(t) {
   case Leaf =>
     assert toList(d, t) == [d];
   case Node(l, r) =>
     assert toList(d, t) + s == toList(d+1, l) + (toList(d+1, r) + s);
-
-    lemma0(l, d+1, toList(d+1, r) + s);  // apply the induction hypothesis
-    lemma0(r, d+1, s);  // apply the induction hypothesis
+    // the rest follows from (two invocations of) the (automatically applied) induction hypothesis
   }
 }
 
@@ -107,8 +105,8 @@ lemma lemma0(t: Tree, d: int, s: seq<int>)
 // the following two lemmas replace these arguments
 // by quantified variables.
 lemma lemma1(t: Tree, s:seq<int>)
-  requires s == toList(0, t) + [];
-  ensures  build(s).Res?;
+  requires s == toList(0, t) + []
+  ensures build(s).Res?
 {
   lemma0(t, 0, []);
 }
@@ -117,7 +115,7 @@ lemma lemma1(t: Tree, s:seq<int>)
 // This lemma introduces the existential quantifier in the completeness
 // property.
 lemma lemma2(s: seq<int>)
-  ensures (exists t: Tree :: toList(0,t) == s) ==> build(s).Res?;
+  ensures (exists t: Tree :: toList(0,t) == s) ==> build(s).Res?
 {
   forall t | toList(0,t) == s {
     lemma1(t, s);
@@ -131,7 +129,7 @@ lemma lemma2(s: seq<int>)
 // The body of the method converts the argument of lemma2
 // into a universally quantified variable.
 lemma completeness()
-  ensures forall s: seq<int> :: ((exists t: Tree :: toList(0,t) == s) ==> build(s).Res?);
+  ensures forall s: seq<int> :: ((exists t: Tree :: toList(0,t) == s) ==> build(s).Res?)
 {
   forall s {
     lemma2(s);
@@ -145,7 +143,7 @@ lemma completeness()
 // unfold the necessary definitions.
 method harness0()
   ensures build([1,3,3,2]).Res? &&
-          build([1,3,3,2]).t == Node(Leaf, Node(Node(Leaf, Leaf), Leaf));
+          build([1,3,3,2]).t == Node(Leaf, Node(Node(Leaf, Leaf), Leaf))
 {
 }
 
@@ -155,6 +153,6 @@ method harness0()
 // assertions are required by the verifier to
 // unfold the necessary definitions.
 method harness1()
-  ensures build([1,3,2,2]).Fail?;
+  ensures build([1,3,2,2]).Fail?
 {
 }
-- 
cgit v1.2.3


From 593cbcd63017c6a5fe4d50dda34a50637824dfd9 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 13 Aug 2015 10:39:04 -0700
Subject: Add a UniqueIdPrefix in the server and bump up the prover kill time

---
 Source/DafnyServer/DafnyHelper.cs | 2 +-
 Source/DafnyServer/Utilities.cs   | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyServer/DafnyHelper.cs b/Source/DafnyServer/DafnyHelper.cs
index 10d98677..f32d0e38 100644
--- a/Source/DafnyServer/DafnyHelper.cs
+++ b/Source/DafnyServer/DafnyHelper.cs
@@ -62,7 +62,7 @@ namespace Microsoft.Dafny {
     }
 
     private bool Translate() {
-      var translator = new Dafny.Translator() { InsertChecksums = true, UniqueIdPrefix = null }; //FIXME check if null is OK for UniqueIdPrefix
+      var translator = new Dafny.Translator() { InsertChecksums = true, UniqueIdPrefix = fname };
       boogieProgram = translator.Translate(dafnyProgram); // FIXME how are translation errors reported?
       return true;
     }
diff --git a/Source/DafnyServer/Utilities.cs b/Source/DafnyServer/Utilities.cs
index 8fb03b05..20fe0578 100644
--- a/Source/DafnyServer/Utilities.cs
+++ b/Source/DafnyServer/Utilities.cs
@@ -49,9 +49,10 @@ namespace Microsoft.Dafny {
       if (CommandLineOptions.Clo.Parse(args)) {
         // Dafny.DafnyOptions.O.ErrorTrace = 0; //FIXME
         // Dafny.DafnyOptions.O.ModelViewFile = "-";
-        Dafny.DafnyOptions.O.ProverKillTime = 10;
-        Dafny.DafnyOptions.O.VcsCores = Math.Max(1, System.Environment.ProcessorCount - 1);
+        Dafny.DafnyOptions.O.ProverKillTime = 20; //FIXME: Should this explicitly override user prefs?
+        Dafny.DafnyOptions.O.VcsCores = Math.Max(1, System.Environment.ProcessorCount - 1); //FIXME
         Dafny.DafnyOptions.O.VerifySnapshots = 2;
+        Dafny.DafnyOptions.O.Trace = true;
       } else {
         throw new ServerException("Invalid command line options");
       }
-- 
cgit v1.2.3


From 4ce6e734a389716fecaf152781702fafa42f2670 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 14 Aug 2015 10:03:25 -0700
Subject: server: Add a Checked configuration

---
 Source/Dafny.sln                      |  4 ++--
 Source/DafnyServer/DafnyServer.csproj | 39 +++++++++++++++++++++++++++++++++--
 2 files changed, 39 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny.sln b/Source/Dafny.sln
index 570922fa..db035b4a 100644
--- a/Source/Dafny.sln
+++ b/Source/Dafny.sln
@@ -57,8 +57,8 @@ Global
 		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Checked|.NET.ActiveCfg = Release|Any CPU
 		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Checked|Any CPU.ActiveCfg = Release|Any CPU
 		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Checked|Any CPU.Build.0 = Release|Any CPU
-		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Checked|Mixed Platforms.ActiveCfg = Release|Any CPU
-		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Checked|Mixed Platforms.Build.0 = Release|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Checked|Mixed Platforms.ActiveCfg = Checked|Any CPU
+		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Checked|Mixed Platforms.Build.0 = Checked|Any CPU
 		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Debug|.NET.ActiveCfg = Debug|Any CPU
 		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}.Debug|Any CPU.Build.0 = Debug|Any CPU
diff --git a/Source/DafnyServer/DafnyServer.csproj b/Source/DafnyServer/DafnyServer.csproj
index d1171d69..1a256f5f 100644
--- a/Source/DafnyServer/DafnyServer.csproj
+++ b/Source/DafnyServer/DafnyServer.csproj
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
   <PropertyGroup>
@@ -31,6 +31,41 @@
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
   </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Checked|AnyCPU'">
+    <DebugSymbols>true</DebugSymbols>
+    <OutputPath>..\..\Binaries\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <DebugType>full</DebugType>
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <ErrorReport>prompt</ErrorReport>
+    <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
+    <CodeAnalysisIgnoreBuiltInRuleSets>false</CodeAnalysisIgnoreBuiltInRuleSets>
+    <CodeContractsEnableRuntimeChecking>True</CodeContractsEnableRuntimeChecking>
+    <CodeContractsRuntimeOnlyPublicSurface>False</CodeContractsRuntimeOnlyPublicSurface>
+    <CodeContractsRuntimeThrowOnFailure>True</CodeContractsRuntimeThrowOnFailure>
+    <CodeContractsRuntimeCallSiteRequires>False</CodeContractsRuntimeCallSiteRequires>
+    <CodeContractsRuntimeSkipQuantifiers>False</CodeContractsRuntimeSkipQuantifiers>
+    <CodeContractsRunCodeAnalysis>False</CodeContractsRunCodeAnalysis>
+    <CodeContractsNonNullObligations>False</CodeContractsNonNullObligations>
+    <CodeContractsBoundsObligations>False</CodeContractsBoundsObligations>
+    <CodeContractsArithmeticObligations>False</CodeContractsArithmeticObligations>
+    <CodeContractsEnumObligations>False</CodeContractsEnumObligations>
+    <CodeContractsRedundantAssumptions>False</CodeContractsRedundantAssumptions>
+    <CodeContractsRunInBackground>True</CodeContractsRunInBackground>
+    <CodeContractsShowSquigglies>False</CodeContractsShowSquigglies>
+    <CodeContractsUseBaseLine>False</CodeContractsUseBaseLine>
+    <CodeContractsEmitXMLDocs>False</CodeContractsEmitXMLDocs>
+    <CodeContractsCustomRewriterAssembly />
+    <CodeContractsCustomRewriterClass />
+    <CodeContractsLibPaths />
+    <CodeContractsExtraRewriteOptions />
+    <CodeContractsExtraAnalysisOptions />
+    <CodeContractsBaseLineFile />
+    <CodeContractsCacheAnalysisResults>False</CodeContractsCacheAnalysisResults>
+    <CodeContractsRuntimeCheckingLevel>Full</CodeContractsRuntimeCheckingLevel>
+    <CodeContractsReferenceAssembly>Build</CodeContractsReferenceAssembly>
+    <CodeContractsAnalysisWarningLevel>0</CodeContractsAnalysisWarningLevel>
+  </PropertyGroup>
   <ItemGroup>
     <Reference Include="Core">
       <HintPath>..\..\..\boogie\Binaries\Core.dll</HintPath>
@@ -72,4 +107,4 @@
   <Target Name="AfterBuild">
   </Target>
   -->
-</Project>
\ No newline at end of file
+</Project>
-- 
cgit v1.2.3


From 8a0df70ffb8d57d1bd210ce2e1c9522ba0967365 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Tue, 18 Aug 2015 18:58:40 -0700
Subject: Refactor the error reporting code

The new error reporting system has a simpler interface, isn't tied to the
resolver, and contains error source information.
---
 Source/Dafny/Cloner.cs                    |   33 +-
 Source/Dafny/Dafny.atg                    |    6 +-
 Source/Dafny/DafnyAst.cs                  |   20 +-
 Source/Dafny/DafnyMain.cs                 |   12 +-
 Source/Dafny/DafnyPipeline.csproj         |    7 +-
 Source/Dafny/Parser.cs                    |   34 +-
 Source/Dafny/RefinementTransformer.cs     |  293 ++++----
 Source/Dafny/Reporting.cs                 |  164 +++++
 Source/Dafny/Resolver.cs                  | 1146 +++++++++++++----------------
 Source/Dafny/Rewriter.cs                  |  119 ++-
 Source/Dafny/Scanner.cs                   |   18 +-
 Source/Dafny/Translator.cs                |   15 +-
 Source/Dafny/TriggerGenerator.cs          |    4 +-
 Source/Dafny/Util.cs                      |   23 -
 Source/DafnyDriver/DafnyDriver.cs         |   35 +-
 Source/DafnyExtension/DafnyDriver.cs      |   77 +-
 Source/DafnyExtension/IdentifierTagger.cs |    4 +-
 Source/DafnyExtension/ResolverTagger.cs   |    4 +-
 Source/DafnyServer/DafnyHelper.cs         |   17 +-
 19 files changed, 1006 insertions(+), 1025 deletions(-)
 create mode 100644 Source/Dafny/Reporting.cs

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index f959b537..323abc70 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -365,6 +365,7 @@ namespace Microsoft.Dafny
         return new NamedExpr(Tok(e.tok), e.Name, CloneExpr(e.Body));
       } else if (expr is ComprehensionExpr) {
         var e = (ComprehensionExpr)expr;
+
         var tk = Tok(e.tok);
         var bvs = e.BoundVars.ConvertAll(CloneBoundVar);
         var range = CloneExpr(e.Range);
@@ -703,22 +704,16 @@ namespace Microsoft.Dafny
   abstract class FixpointCloner : Cloner
   {
     protected readonly Expression k;
-    readonly Resolver resolver;
+    protected readonly ErrorReporter reporter;
     readonly string suffix;
-    protected FixpointCloner(Expression k, Resolver resolver)
+    protected FixpointCloner(Expression k, ErrorReporter reporter)
     {
       Contract.Requires(k != null);
-      Contract.Requires(resolver != null);
+      Contract.Requires(reporter != null);
       this.k = k;
-      this.resolver = resolver;
+      this.reporter = reporter;
       this.suffix = string.Format("#[{0}]", Printer.ExprToString(k));
     }
-    protected void ReportAdditionalInformation(IToken tok, string s)
-    {
-      Contract.Requires(tok != null);
-      Contract.Requires(s != null);
-      resolver.ReportAdditionalInformation(tok, s + suffix, s.Length);
-    }
   }
 
   /// <summary>
@@ -733,12 +728,12 @@ namespace Microsoft.Dafny
   {
     readonly bool isCoContext;
     readonly ISet<Expression> friendlyCalls;
-    public FixpointLemmaSpecificationSubstituter(ISet<Expression> friendlyCalls, Expression k, Resolver resolver, bool isCoContext)
-      : base(k, resolver)
+    public FixpointLemmaSpecificationSubstituter(ISet<Expression> friendlyCalls, Expression k, ErrorReporter reporter, bool isCoContext)
+      : base(k, reporter)
     {
       Contract.Requires(friendlyCalls != null);
       Contract.Requires(k != null);
-      Contract.Requires(resolver != null);
+      Contract.Requires(reporter != null);
       this.isCoContext = isCoContext;
       this.friendlyCalls = friendlyCalls;
     }
@@ -758,7 +753,7 @@ namespace Microsoft.Dafny
             args.Add(CloneExpr(arg));
           }
           var fexp = new FunctionCallExpr(Tok(e.tok), e.Name + "#", receiver, e.OpenParen, args);
-          ReportAdditionalInformation(e.tok, e.Name);
+          reporter.Info(MessageSource.Cloner, e.tok, e.Name);
           return fexp;
         }
       } else if (expr is BinaryExpr && isCoContext) {
@@ -769,7 +764,7 @@ namespace Microsoft.Dafny
           var B = CloneExpr(e.E1);
           var teq = new TernaryExpr(Tok(e.tok), op, k, A, B);
           var opString = op == TernaryExpr.Opcode.PrefixEqOp ? "==" : "!=";
-          ReportAdditionalInformation(e.tok, opString);
+          reporter.Info(MessageSource.Cloner, e.tok, opString);
           return teq;
         }
       }
@@ -804,12 +799,12 @@ namespace Microsoft.Dafny
   class FixpointLemmaBodyCloner : FixpointCloner
   {
     readonly FixpointLemma context;
-    public FixpointLemmaBodyCloner(FixpointLemma context, Expression k, Resolver resolver)
-      : base(k, resolver)
+    public FixpointLemmaBodyCloner(FixpointLemma context, Expression k, ErrorReporter reporter)
+      : base(k, reporter)
     {
       Contract.Requires(context != null);
       Contract.Requires(k != null);
-      Contract.Requires(resolver != null);
+      Contract.Requires(reporter != null);
       this.context = context;
     }
     public override AssignmentRhs CloneRHS(AssignmentRhs rhs) {
@@ -834,7 +829,7 @@ namespace Microsoft.Dafny
           apply.Args.ForEach(arg => args.Add(CloneExpr(arg)));
           var applyClone = new ApplySuffix(Tok(apply.tok), lhsClone, args);
           var c = new ExprRhs(applyClone);
-          ReportAdditionalInformation(apply.tok, mse.Member.Name);
+          reporter.Info(MessageSource.Cloner, apply.tok, mse.Member.Name);
           return c;
         }
       }
diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index 8a3bdb0e..07f8e1c4 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -55,11 +55,11 @@ public static int Parse (string/*!*/ filename, ModuleDecl module, BuiltIns built
 /// Returns the number of parsing errors encountered.
 /// Note: first initialize the Scanner.
 ///</summary>
-public static int Parse (string/*!*/ s, string/*!*/ fullFilename, string/*!*/ filename, ModuleDecl module, BuiltIns builtIns, bool verifyThisFile=true) {
+public static int Parse (string/*!*/ s, string/*!*/ fullFilename, string/*!*/ filename, ModuleDecl module, BuiltIns builtIns, ErrorReporter reporter, bool verifyThisFile=true) {
   Contract.Requires(s != null);
   Contract.Requires(filename != null);
   Contract.Requires(module != null);
-  Errors errors = new Errors();
+  Errors errors = new Errors(reporter);
   return Parse(s, fullFilename, filename, module, builtIns, errors, verifyThisFile);
 }
 ///<summary>
@@ -79,7 +79,7 @@ public static int Parse (string/*!*/ s, string/*!*/ fullFilename, string/*!*/ fi
   Scanner scanner = new Scanner(ms, errors, fullFilename, filename);
   Parser parser = new Parser(scanner, errors, module, builtIns, verifyThisFile);
   parser.Parse();
-  return parser.errors.count;
+  return parser.errors.ErrorCount;
 }
 public Parser(Scanner/*!*/ scanner, Errors/*!*/ errors, ModuleDecl module, BuiltIns builtIns, bool verifyThisFile=true)
   : this(scanner, errors)  // the real work
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 66b91ac2..efe94c66 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -27,20 +27,22 @@ namespace Microsoft.Dafny {
     public List<ModuleDefinition> CompileModules; // filled in during resolution.
                                                   // Contains the definitions to be used for compilation.
 
-    List<AdditionalInformation> _additionalInformation = new List<AdditionalInformation>();
-    public List<AdditionalInformation> AdditionalInformation { get { return _additionalInformation; } }
     public readonly ModuleDecl DefaultModule;
     public readonly ModuleDefinition DefaultModuleDef;
     public readonly BuiltIns BuiltIns;
     public readonly List<TranslationTask> TranslationTasks;
-    public Program(string name, [Captured] ModuleDecl module, [Captured] BuiltIns builtIns) {
+    public readonly ErrorReporter reporter;
+
+    public Program(string name, [Captured] ModuleDecl module, [Captured] BuiltIns builtIns, ErrorReporter reporter) {
       Contract.Requires(name != null);
       Contract.Requires(module != null);
       Contract.Requires(module is LiteralModuleDecl);
+      Contract.Requires(reporter != null);
       FullName = name;
       DefaultModule = module;
       DefaultModuleDef = (DefaultModuleDecl)((LiteralModuleDecl)module).ModuleDef;
       BuiltIns = builtIns;
+      this.reporter = reporter;
       Modules = new List<ModuleDefinition>();
       CompileModules = new List<ModuleDefinition>();
       TranslationTasks = new List<TranslationTask>();
@@ -330,13 +332,13 @@ namespace Microsoft.Dafny {
     /// - if "allowed" contains Int and Args contains one BigInteger literal, return true and set value to the BigInteger literal.  Otherwise,
     /// - if "allowed" contains String and Args contains one string literal, return true and set value to the string literal.  Otherwise,
     /// - if "allowed" contains Expression and Args contains one element, return true and set value to the one element (of type Expression).  Otherwise,
-    /// - return false, leave value unmodified, and call errorReporter with an error string.
+    /// - return false, leave value unmodified, and call reporter with an error string.
     /// </summary>
     public enum MatchingValueOption { Empty, Bool, Int, String, Expression }
-    public static bool ContainsMatchingValue(Attributes attrs, string nm, ref object value, IEnumerable<MatchingValueOption> allowed, Action<string> errorReporter) {
+    public static bool ContainsMatchingValue(Attributes attrs, string nm, ref object value, IEnumerable<MatchingValueOption> allowed, Action<string> reporter) {
       Contract.Requires(nm != null);
       Contract.Requires(allowed != null);
-      Contract.Requires(errorReporter != null);
+      Contract.Requires(reporter != null);
       List<Expression> args = FindExpressions(attrs, nm);
       if (args == null) {
         return false;
@@ -344,7 +346,7 @@ namespace Microsoft.Dafny {
         if (allowed.Contains(MatchingValueOption.Empty)) {
           return true;
         } else {
-          errorReporter("Attribute " + nm + " requires one argument");
+          reporter("Attribute " + nm + " requires one argument");
           return false;
         }
       } else if (args.Count == 1) {
@@ -364,11 +366,11 @@ namespace Microsoft.Dafny {
           value = arg;
           return true;
         } else {
-          errorReporter("Attribute " + nm + " expects an argument in one of the following categories: " + String.Join(", ", allowed));
+          reporter("Attribute " + nm + " expects an argument in one of the following categories: " + String.Join(", ", allowed));
           return false;
         }
       } else {
-        errorReporter("Attribute " + nm + " cannot have more than one argument");
+        reporter("Attribute " + nm + " cannot have more than one argument");
         return false;
       }
     }
diff --git a/Source/Dafny/DafnyMain.cs b/Source/Dafny/DafnyMain.cs
index 012ca4df..251d8656 100644
--- a/Source/Dafny/DafnyMain.cs
+++ b/Source/Dafny/DafnyMain.cs
@@ -29,7 +29,7 @@ namespace Microsoft.Dafny {
     /// <summary>
     /// Returns null on success, or an error string otherwise.
     /// </summary>
-    public static string ParseCheck(IList<string/*!*/>/*!*/ fileNames, string/*!*/ programName, out Program program)
+    public static string ParseCheck(IList<string/*!*/>/*!*/ fileNames, string/*!*/ programName, ErrorReporter reporter, out Program program)
       //modifies Bpl.CommandLineOptions.Clo.XmlSink.*;
     {
       Contract.Requires(programName != null);
@@ -47,20 +47,20 @@ namespace Microsoft.Dafny {
           Console.WriteLine("Parsing " + dafnyFileName);
         }
 
-        string err = ParseFile(dafnyFileName, Bpl.Token.NoToken, module, builtIns, new Errors());
+        string err = ParseFile(dafnyFileName, Bpl.Token.NoToken, module, builtIns, new Errors(reporter));
         if (err != null) {
           return err;
         }        
       }
 
       if (!DafnyOptions.O.DisallowIncludes) {
-        string errString = ParseIncludes(module, builtIns, fileNames, new Errors());
+        string errString = ParseIncludes(module, builtIns, fileNames, new Errors(reporter));
         if (errString != null) {
           return errString;
         }
       }
 
-      program = new Program(programName, module, builtIns);
+      program = new Program(programName, module, builtIns, reporter);
 
       MaybePrintProgram(program, DafnyOptions.O.DafnyPrintFile);
 
@@ -70,8 +70,8 @@ namespace Microsoft.Dafny {
       r.ResolveProgram(program);
       MaybePrintProgram(program, DafnyOptions.O.DafnyPrintResolvedFile);
 
-      if (r.ErrorCount != 0) {
-        return string.Format("{0} resolution/type errors detected in {1}", r.ErrorCount, program.Name);
+      if (reporter.Count(ErrorLevel.Error) != 0) {
+        return string.Format("{0} resolution/type errors detected in {1}", reporter.Count(ErrorLevel.Error), program.Name);
       }
 
       return null;  // success
diff --git a/Source/Dafny/DafnyPipeline.csproj b/Source/Dafny/DafnyPipeline.csproj
index a1452b8a..626bb26a 100644
--- a/Source/Dafny/DafnyPipeline.csproj
+++ b/Source/Dafny/DafnyPipeline.csproj
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <PropertyGroup>
     <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
@@ -8,7 +8,7 @@
     <ProjectGuid>{FE44674A-1633-4917-99F4-57635E6FA740}</ProjectGuid>
     <OutputType>Library</OutputType>
     <AppDesignerFolder>Properties</AppDesignerFolder>
-    <RootNamespace>DafnyPipeline</RootNamespace>
+    <RootNamespace>Microsoft.Dafny</RootNamespace>
     <AssemblyName>DafnyPipeline</AssemblyName>
     <TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
     <FileAlignment>512</FileAlignment>
@@ -143,6 +143,7 @@
   </ItemGroup>
   <ItemGroup>
     <Compile Include="Cloner.cs" />
+    <Compile Include="Reporting.cs" />
     <Compile Include="TriggerGenerator.cs" />
     <Compile Include="Util.cs" />
     <Compile Include="Compiler.cs" />
@@ -193,4 +194,4 @@
   <Target Name="AfterBuild">
   </Target>
   -->
-</Project>
\ No newline at end of file
+</Project>
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index fd6fb026..2507cacc 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -126,11 +126,11 @@ public static int Parse (string/*!*/ filename, ModuleDecl module, BuiltIns built
 /// Returns the number of parsing errors encountered.
 /// Note: first initialize the Scanner.
 ///</summary>
-public static int Parse (string/*!*/ s, string/*!*/ fullFilename, string/*!*/ filename, ModuleDecl module, BuiltIns builtIns, bool verifyThisFile=true) {
+public static int Parse (string/*!*/ s, string/*!*/ fullFilename, string/*!*/ filename, ModuleDecl module, BuiltIns builtIns, ErrorReporter reporter, bool verifyThisFile=true) {
   Contract.Requires(s != null);
   Contract.Requires(filename != null);
   Contract.Requires(module != null);
-  Errors errors = new Errors();
+  Errors errors = new Errors(reporter);
   return Parse(s, fullFilename, filename, module, builtIns, errors, verifyThisFile);
 }
 ///<summary>
@@ -150,7 +150,7 @@ public static int Parse (string/*!*/ s, string/*!*/ fullFilename, string/*!*/ fi
   Scanner scanner = new Scanner(ms, errors, fullFilename, filename);
   Parser parser = new Parser(scanner, errors, module, builtIns, verifyThisFile);
   parser.Parse();
-  return parser.errors.count;
+  return parser.errors.ErrorCount;
 }
 public Parser(Scanner/*!*/ scanner, Errors/*!*/ errors, ModuleDecl module, BuiltIns builtIns, bool verifyThisFile=true)
   : this(scanner, errors)  // the real work
@@ -4426,16 +4426,22 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 
 public class Errors {
-	public int count = 0;                                    // number of errors detected
+    readonly ErrorReporter reporter;
+	public int ErrorCount;
+
+    public Errors(ErrorReporter reporter) {
+        Contract.Requires(reporter != null);
+        this.reporter = reporter;
+	}
 
 	public void SynErr(string filename, int line, int col, int n) {
 		SynErr(filename, line, col, GetSyntaxErrorString(n));
 	}
 
-	public virtual void SynErr(string filename, int line, int col, string msg) {
+	public void SynErr(string filename, int line, int col, string msg) {
 		Contract.Requires(msg != null);
-		Dafny.Util.ReportIssue("Error", filename, line, col, msg);
-		count++;
+		ErrorCount++;
+        reporter.Error(MessageSource.Parser, filename, line, col, msg);
 	}
 
 	string GetSyntaxErrorString(int n) {
@@ -4692,20 +4698,20 @@ public class Errors {
 	public void SemErr(IToken tok, string msg) {  // semantic errors
 		Contract.Requires(tok != null);
 		Contract.Requires(msg != null);
-		Dafny.Util.ReportIssue("Error", tok, msg);
-		count++;
+		ErrorCount++;
+        reporter.Error(MessageSource.Parser, tok, msg);
 	}
 
-	public virtual void SemErr(string filename, int line, int col, string msg) {
+	public void SemErr(string filename, int line, int col, string msg) {
 		Contract.Requires(msg != null);
-		Dafny.Util.ReportIssue("Error", filename, line, col, msg);
-		count++;
+		ErrorCount++;
+        reporter.Error(MessageSource.Parser, filename, line, col, msg);
 	}
 
-	public virtual void Warning(IToken tok, string msg) {  // warnings
+	public void Warning(IToken tok, string msg) {
 		Contract.Requires(tok != null);
 		Contract.Requires(msg != null);
-		Dafny.Util.ReportIssue("Warning", tok, msg);
+        reporter.Warning(MessageSource.Parser, tok, msg);
 	}
 } // Errors
 
diff --git a/Source/Dafny/RefinementTransformer.cs b/Source/Dafny/RefinementTransformer.cs
index f430933b..ba558ea6 100644
--- a/Source/Dafny/RefinementTransformer.cs
+++ b/Source/Dafny/RefinementTransformer.cs
@@ -52,16 +52,19 @@ namespace Microsoft.Dafny
 
   public class RefinementTransformer : IRewriter
   {
-    ResolutionErrorReporter reporter;
-    Action<AdditionalInformation> additionalInformationReporter;
     Cloner rawCloner; // This cloner just gives exactly the same thing back.
     RefinementCloner refinementCloner; // This cloner wraps things in a RefinementTransformer
+    
     Program program;
-    public RefinementTransformer(ResolutionErrorReporter reporter, Action<AdditionalInformation> additionalInformationReporter, Program p) {
-      Contract.Requires(reporter != null);
-      this.reporter = reporter;
-      this.additionalInformationReporter = additionalInformationReporter;
+
+    public RefinementTransformer(ErrorReporter reporter)
+      : base(reporter) {
       rawCloner = new Cloner();
+    }
+
+    public RefinementTransformer(Program p)
+      : this(p.reporter) {
+      Contract.Requires(p != null);
       program = p;
     }
 
@@ -71,17 +74,7 @@ namespace Microsoft.Dafny
     private Method currentMethod;
     public ModuleSignature RefinedSig;  // the intention is to use this field only after a successful PreResolve
 
-    void ReportAdditionalInformation(IToken token, string text, int length)
-    {
-      Contract.Requires(token != null);
-      Contract.Requires(text != null);
-      Contract.Requires(0 <= length);
-      if (additionalInformationReporter != null) {
-        additionalInformationReporter(new AdditionalInformation { Token = token, Text = text, Length = length });
-      }
-    }
-
-    public void PreResolve(ModuleDefinition m) {
+    internal override void PreResolve(ModuleDefinition m) {
       if (m.RefinementBaseRoot != null) {
         if (Resolver.ResolvePath(m.RefinementBaseRoot, m.RefinementBaseName, out RefinedSig, reporter)) {
           if (RefinedSig.ModuleDef != null) {
@@ -90,17 +83,17 @@ namespace Microsoft.Dafny
               if (null == m.RefinementBase.ExclusiveRefinement) {
                 m.RefinementBase.ExclusiveRefinement = m;
               } else {
-                this.reporter.Error(
+                reporter.Error(MessageSource.RefinementTransformer,
                     m.tok,
                     "no more than one exclusive refinement may exist for a given module.");
               }
             }
             PreResolveWorker(m);
           } else {
-            reporter.Error(m.RefinementBaseName[0], "module ({0}) named as refinement base is not a literal module or simple reference to a literal module", Util.Comma(".", m.RefinementBaseName, x => x.val));
+            reporter.Error(MessageSource.RefinementTransformer, m.RefinementBaseName[0], "module ({0}) named as refinement base is not a literal module or simple reference to a literal module", Util.Comma(".", m.RefinementBaseName, x => x.val));
           }
         } else {
-          reporter.Error(m.RefinementBaseName[0], "module ({0}) named as refinement base does not exist", Util.Comma(".", m.RefinementBaseName, x => x.val));
+          reporter.Error(MessageSource.RefinementTransformer, m.RefinementBaseName[0], "module ({0}) named as refinement base does not exist", Util.Comma(".", m.RefinementBaseName, x => x.val));
         }
       }
     }
@@ -135,9 +128,9 @@ namespace Microsoft.Dafny
           var nw = m.TopLevelDecls[index];
           if (d is ModuleDecl) {
             if (!(nw is ModuleDecl)) {
-              reporter.Error(nw, "a module ({0}) must refine another module", nw.Name);
+              reporter.Error(MessageSource.RefinementTransformer, nw, "a module ({0}) must refine another module", nw.Name);
             } else if (!(d is ModuleFacadeDecl)) {
-              reporter.Error(nw, "a module ({0}) can only refine a module facade", nw.Name);
+              reporter.Error(MessageSource.RefinementTransformer, nw, "a module ({0}) can only refine a module facade", nw.Name);
             } else {
               ModuleSignature original = ((ModuleFacadeDecl)d).OriginalSignature;
               ModuleSignature derived = null;
@@ -146,72 +139,72 @@ namespace Microsoft.Dafny
               } else if (nw is ModuleFacadeDecl) {
                 derived = ((ModuleFacadeDecl)nw).Signature;
               } else {
-                reporter.Error(nw, "a module ({0}) can only be refined by an alias module or a module facade", d.Name);
+                reporter.Error(MessageSource.RefinementTransformer, nw, "a module ({0}) can only be refined by an alias module or a module facade", d.Name);
               }
               if (derived != null) {
                 // check that the new module refines the previous declaration
                 if (!CheckIsRefinement(derived, original))
-                  reporter.Error(nw.tok, "a module ({0}) can only be replaced by a refinement of the original module", d.Name);
+                  reporter.Error(MessageSource.RefinementTransformer, nw.tok, "a module ({0}) can only be replaced by a refinement of the original module", d.Name);
               }
             }
           } else if (d is OpaqueTypeDecl) {
             if (nw is ModuleDecl) {
-              reporter.Error(nw, "a module ({0}) must refine another module", nw.Name);
+              reporter.Error(MessageSource.RefinementTransformer, nw, "a module ({0}) must refine another module", nw.Name);
             } else {
               bool dDemandsEqualitySupport = ((OpaqueTypeDecl)d).MustSupportEquality;
               if (nw is OpaqueTypeDecl) {
                 if (dDemandsEqualitySupport != ((OpaqueTypeDecl)nw).MustSupportEquality) {
-                  reporter.Error(nw, "type declaration '{0}' is not allowed to change the requirement of supporting equality", nw.Name);
+                  reporter.Error(MessageSource.RefinementTransformer, nw, "type declaration '{0}' is not allowed to change the requirement of supporting equality", nw.Name);
                 }
                 if (nw.TypeArgs.Count != d.TypeArgs.Count) {
-                  reporter.Error(nw, "type '{0}' is not allowed to change its number of type parameters (got {1}, expected {2})", nw.Name, nw.TypeArgs.Count, d.TypeArgs.Count);
+                  reporter.Error(MessageSource.RefinementTransformer, nw, "type '{0}' is not allowed to change its number of type parameters (got {1}, expected {2})", nw.Name, nw.TypeArgs.Count, d.TypeArgs.Count);
                 }
               } else if (dDemandsEqualitySupport) {
                 if (nw is ClassDecl) {
                   // fine, as long as "nw" takes the right number of type parameters
                   if (nw.TypeArgs.Count != d.TypeArgs.Count) {
-                    reporter.Error(nw, "opaque type '{0}' is not allowed to be replaced by a class that takes a different number of type parameters (got {1}, expected {2})", nw.Name, nw.TypeArgs.Count, d.TypeArgs.Count);
+                    reporter.Error(MessageSource.RefinementTransformer, nw, "opaque type '{0}' is not allowed to be replaced by a class that takes a different number of type parameters (got {1}, expected {2})", nw.Name, nw.TypeArgs.Count, d.TypeArgs.Count);
                   }
                 } else if (nw is NewtypeDecl) {
                   // fine, as long as "nw" does not take any type parameters
                   if (nw.TypeArgs.Count != 0) {
-                    reporter.Error(nw, "opaque type '{0}', which has {1} type argument{2}, is not allowed to be replaced by a newtype, which takes none", nw.Name, d.TypeArgs.Count, d.TypeArgs.Count == 1 ? "" : "s");
+                    reporter.Error(MessageSource.RefinementTransformer, nw, "opaque type '{0}', which has {1} type argument{2}, is not allowed to be replaced by a newtype, which takes none", nw.Name, d.TypeArgs.Count, d.TypeArgs.Count == 1 ? "" : "s");
                   }
                 } else if (nw is CoDatatypeDecl) {
-                  reporter.Error(nw, "a type declaration that requires equality support cannot be replaced by a codatatype");
+                  reporter.Error(MessageSource.RefinementTransformer, nw, "a type declaration that requires equality support cannot be replaced by a codatatype");
                 } else {
                   Contract.Assert(nw is IndDatatypeDecl || nw is TypeSynonymDecl);
                   if (nw.TypeArgs.Count != d.TypeArgs.Count) {
-                    reporter.Error(nw, "opaque type '{0}' is not allowed to be replaced by a type that takes a different number of type parameters (got {1}, expected {2})", nw.Name, nw.TypeArgs.Count, d.TypeArgs.Count);
+                    reporter.Error(MessageSource.RefinementTransformer, nw, "opaque type '{0}' is not allowed to be replaced by a type that takes a different number of type parameters (got {1}, expected {2})", nw.Name, nw.TypeArgs.Count, d.TypeArgs.Count);
                   } else {
                     // Here, we need to figure out if the new type supports equality.  But we won't know about that until resolution has
                     // taken place, so we defer it until the PostResolve phase.
                     var udt = UserDefinedType.FromTopLevelDecl(nw.tok, nw);
                     postTasks.Enqueue(() => {
                       if (!udt.SupportsEquality) {
-                        reporter.Error(udt.tok, "type '{0}' is used to refine an opaque type with equality support, but '{0}' does not support equality", udt.Name);
+                        reporter.Error(MessageSource.RefinementTransformer, udt.tok, "type '{0}' is used to refine an opaque type with equality support, but '{0}' does not support equality", udt.Name);
                       }
                     });
                   }
                 }
               } else if (d.TypeArgs.Count != nw.TypeArgs.Count) {
-                reporter.Error(nw, "opaque type '{0}' is not allowed to be replaced by a type that takes a different number of type parameters (got {1}, expected {2})", nw.Name, nw.TypeArgs.Count, d.TypeArgs.Count);
+                reporter.Error(MessageSource.RefinementTransformer, nw, "opaque type '{0}' is not allowed to be replaced by a type that takes a different number of type parameters (got {1}, expected {2})", nw.Name, nw.TypeArgs.Count, d.TypeArgs.Count);
               }
             }
           } else if (nw is OpaqueTypeDecl) {
-            reporter.Error(nw, "an opaque type declaration ({0}) in a refining module cannot replace a more specific type declaration in the refinement base", nw.Name);
+            reporter.Error(MessageSource.RefinementTransformer, nw, "an opaque type declaration ({0}) in a refining module cannot replace a more specific type declaration in the refinement base", nw.Name);
           } else if (nw is DatatypeDecl) {
-            reporter.Error(nw, "a datatype declaration ({0}) in a refinement module can only replace an opaque type declaration", nw.Name);
+            reporter.Error(MessageSource.RefinementTransformer, nw, "a datatype declaration ({0}) in a refinement module can only replace an opaque type declaration", nw.Name);
           } else if (nw is IteratorDecl) {
             if (d is IteratorDecl) {
               m.TopLevelDecls[index] = MergeIterator((IteratorDecl)nw, (IteratorDecl)d);
             } else {
-              reporter.Error(nw, "an iterator declaration ({0}) is a refining module cannot replace a different kind of declaration in the refinement base", nw.Name);
+              reporter.Error(MessageSource.RefinementTransformer, nw, "an iterator declaration ({0}) is a refining module cannot replace a different kind of declaration in the refinement base", nw.Name);
             }
           } else {
             Contract.Assert(nw is ClassDecl);
             if (d is DatatypeDecl) {
-              reporter.Error(nw, "a class declaration ({0}) in a refining module cannot replace a different kind of declaration in the refinement base", nw.Name);
+              reporter.Error(MessageSource.RefinementTransformer, nw, "a class declaration ({0}) in a refining module cannot replace a different kind of declaration in the refinement base", nw.Name);
             } else {
               m.TopLevelDecls[index] = MergeClass((ClassDecl)nw, (ClassDecl)d);
             }
@@ -238,42 +231,42 @@ namespace Microsoft.Dafny
       // Second, we need to determine whether the specifications will be compatible
       // (i.e. substitutable), by translating to Boogie.
 
-      var errorCount = reporter.ErrorCount;
+      var errorCount = reporter.Count(ErrorLevel.Error);
       foreach (var kv in original.TopLevels) {
         var d = kv.Value;
         TopLevelDecl nw;
         if (derived.TopLevels.TryGetValue(kv.Key, out nw)) {
           if (d is ModuleDecl) {
             if (!(nw is ModuleDecl)) {
-              reporter.Error(nw, "a module ({0}) must refine another module", nw.Name);
+              reporter.Error(MessageSource.RefinementTransformer, nw, "a module ({0}) must refine another module", nw.Name);
             } else {
               CheckIsRefinement(((ModuleDecl)nw).Signature, ((ModuleDecl)d).Signature);
             }
           } else if (d is OpaqueTypeDecl) {
             if (nw is ModuleDecl) {
-              reporter.Error(nw, "a module ({0}) must refine another module", nw.Name);
+              reporter.Error(MessageSource.RefinementTransformer, nw, "a module ({0}) must refine another module", nw.Name);
             } else {
               bool dDemandsEqualitySupport = ((OpaqueTypeDecl)d).MustSupportEquality;
               if (nw is OpaqueTypeDecl) {
                 if (dDemandsEqualitySupport != ((OpaqueTypeDecl)nw).MustSupportEquality) {
-                  reporter.Error(nw, "type declaration '{0}' is not allowed to change the requirement of supporting equality", nw.Name);
+                  reporter.Error(MessageSource.RefinementTransformer, nw, "type declaration '{0}' is not allowed to change the requirement of supporting equality", nw.Name);
                 }
               } else if (dDemandsEqualitySupport) {
                 if (nw is ClassDecl) {
                   // fine, as long as "nw" does not take any type parameters
                   if (nw.TypeArgs.Count != 0) {
-                    reporter.Error(nw, "opaque type '{0}' is not allowed to be replaced by a class that takes type parameters", nw.Name);
+                    reporter.Error(MessageSource.RefinementTransformer, nw, "opaque type '{0}' is not allowed to be replaced by a class that takes type parameters", nw.Name);
                   }
                 } else if (nw is CoDatatypeDecl) {
-                  reporter.Error(nw, "a type declaration that requires equality support cannot be replaced by a codatatype");
+                  reporter.Error(MessageSource.RefinementTransformer, nw, "a type declaration that requires equality support cannot be replaced by a codatatype");
                 } else {
                   Contract.Assert(nw is IndDatatypeDecl);
                   if (nw.TypeArgs.Count != 0) {
-                    reporter.Error(nw, "opaque type '{0}' is not allowed to be replaced by a datatype that takes type parameters", nw.Name);
+                    reporter.Error(MessageSource.RefinementTransformer, nw, "opaque type '{0}' is not allowed to be replaced by a datatype that takes type parameters", nw.Name);
                   } else {
                     var udt = new UserDefinedType(nw.tok, nw.Name, nw, new List<Type>());
                     if (!(udt.SupportsEquality)) {
-                      reporter.Error(nw.tok, "datatype '{0}' is used to refine an opaque type with equality support, but '{0}' does not support equality", nw.Name);
+                      reporter.Error(MessageSource.RefinementTransformer, nw.tok, "datatype '{0}' is used to refine an opaque type with equality support, but '{0}' does not support equality", nw.Name);
                     }
                   }
                 }
@@ -282,18 +275,18 @@ namespace Microsoft.Dafny
           } else if (d is DatatypeDecl) {
             if (nw is DatatypeDecl) {
               if (d is IndDatatypeDecl && !(nw is IndDatatypeDecl)) {
-                reporter.Error(nw, "a datatype ({0}) must be replaced by a datatype, not a codatatype", d.Name);
+                reporter.Error(MessageSource.RefinementTransformer, nw, "a datatype ({0}) must be replaced by a datatype, not a codatatype", d.Name);
               } else if (d is CoDatatypeDecl && !(nw is CoDatatypeDecl)) {
-                reporter.Error(nw, "a codatatype ({0}) must be replaced by a codatatype, not a datatype", d.Name);
+                reporter.Error(MessageSource.RefinementTransformer, nw, "a codatatype ({0}) must be replaced by a codatatype, not a datatype", d.Name);
               }
               // check constructors, formals, etc.
               CheckDatatypesAreRefinements((DatatypeDecl)d, (DatatypeDecl)nw);
             } else {
-              reporter.Error(nw, "a {0} ({1}) must be refined by a {0}", d is IndDatatypeDecl ? "datatype" : "codatatype", d.Name);
+              reporter.Error(MessageSource.RefinementTransformer, nw, "a {0} ({1}) must be refined by a {0}", d is IndDatatypeDecl ? "datatype" : "codatatype", d.Name);
             }
           } else if (d is ClassDecl) {
             if (!(nw is ClassDecl)) {
-              reporter.Error(nw, "a class declaration ({0}) must be refined by another class declaration", nw.Name);
+              reporter.Error(MessageSource.RefinementTransformer, nw, "a class declaration ({0}) must be refined by another class declaration", nw.Name);
             } else {
               CheckClassesAreRefinements((ClassDecl)nw, (ClassDecl)d);
             }
@@ -301,15 +294,15 @@ namespace Microsoft.Dafny
             Contract.Assert(false); throw new cce.UnreachableException(); // unexpected toplevel
           }
         } else {
-          reporter.Error(d, "declaration {0} must have a matching declaration in the refining module", d.Name);
+          reporter.Error(MessageSource.RefinementTransformer, d, "declaration {0} must have a matching declaration in the refining module", d.Name);
         }
       }
-      return errorCount == reporter.ErrorCount;
+      return errorCount == reporter.Count(ErrorLevel.Error);
     }
 
     private void CheckClassesAreRefinements(ClassDecl nw, ClassDecl d) {
       if (nw.TypeArgs.Count != d.TypeArgs.Count) {
-        reporter.Error(nw, "a refining class ({0}) must have the same number of type parameters", nw.Name);
+        reporter.Error(MessageSource.RefinementTransformer, nw, "a refining class ({0}) must have the same number of type parameters", nw.Name);
       } else {
         var map = new Dictionary<string, MemberDecl>();
         foreach (var mem in nw.Members) {
@@ -319,33 +312,33 @@ namespace Microsoft.Dafny
           MemberDecl newMem;
           if (map.TryGetValue(m.Name, out newMem)) {
             if (m.HasStaticKeyword != newMem.HasStaticKeyword) {
-              reporter.Error(newMem, "member {0} must {1}", m.Name, m.HasStaticKeyword ? "be static" : "not be static");
+              reporter.Error(MessageSource.RefinementTransformer, newMem, "member {0} must {1}", m.Name, m.HasStaticKeyword ? "be static" : "not be static");
             }
             if (m is Field) {
               if (newMem is Field) {
                 var newField = (Field)newMem;
                 if (!ResolvedTypesAreTheSame(newField.Type, ((Field)m).Type))
-                  reporter.Error(newMem, "field must be refined by a field with the same type (got {0}, expected {1})", newField.Type, ((Field)m).Type);
+                  reporter.Error(MessageSource.RefinementTransformer, newMem, "field must be refined by a field with the same type (got {0}, expected {1})", newField.Type, ((Field)m).Type);
                 if (m.IsGhost || !newField.IsGhost)
-                  reporter.Error(newField, "a field re-declaration ({0}) must be to ghostify the field", newField.Name, nw.Name);
+                  reporter.Error(MessageSource.RefinementTransformer, newField, "a field re-declaration ({0}) must be to ghostify the field", newField.Name, nw.Name);
               } else {
-                reporter.Error(newMem, "a field declaration ({1}) must be replaced by a field in the refinement base (not {0})", newMem.Name, nw.Name);
+                reporter.Error(MessageSource.RefinementTransformer, newMem, "a field declaration ({1}) must be replaced by a field in the refinement base (not {0})", newMem.Name, nw.Name);
               }
             } else if (m is Method) {
               if (newMem is Method) {
                 CheckMethodsAreRefinements((Method)newMem, (Method)m);
               } else {
-                reporter.Error(newMem, "method must be refined by a method");
+                reporter.Error(MessageSource.RefinementTransformer, newMem, "method must be refined by a method");
               }
             } else if (m is Function) {
               if (newMem is Function) {
                 CheckFunctionsAreRefinements((Function)newMem, (Function)m);
               } else {
-                reporter.Error(newMem, "{0} must be refined by a {0}", m.WhatKind);
+                reporter.Error(MessageSource.RefinementTransformer, newMem, "{0} must be refined by a {0}", m.WhatKind);
               }
             }
           } else {
-            reporter.Error(nw is DefaultClassDecl ? nw.Module.tok : nw.tok, "refining {0} must have member {1}", nw is DefaultClassDecl ? "module" : "class", m.Name);
+            reporter.Error(MessageSource.RefinementTransformer, nw is DefaultClassDecl ? nw.Module.tok : nw.tok, "refining {0} must have member {1}", nw is DefaultClassDecl ? "module" : "class", m.Name);
           }
         }
       }
@@ -358,17 +351,17 @@ namespace Microsoft.Dafny
       Contract.Requires(thing != null);
       Contract.Requires(parameterKind != null);
       if (old.Count != nw.Count) {
-        reporter.Error(tok, "{0} '{1}' is declared with a different number of {2} ({3} instead of {4}) than the corresponding {0} in the module it refines", thing, name, parameterKind, nw.Count, old.Count);
+        reporter.Error(MessageSource.RefinementTransformer, tok, "{0} '{1}' is declared with a different number of {2} ({3} instead of {4}) than the corresponding {0} in the module it refines", thing, name, parameterKind, nw.Count, old.Count);
       } else {
         for (int i = 0; i < old.Count; i++) {
           var o = old[i];
           var n = nw[i];
           if (!o.IsGhost && n.IsGhost) {
-            reporter.Error(n.tok, "{0} '{1}' of {2} {3} cannot be changed, compared to the corresponding {2} in the module it refines, from non-ghost to ghost", parameterKind, n.Name, thing, name);
+            reporter.Error(MessageSource.RefinementTransformer, n.tok, "{0} '{1}' of {2} {3} cannot be changed, compared to the corresponding {2} in the module it refines, from non-ghost to ghost", parameterKind, n.Name, thing, name);
           } else if (o.IsGhost && !n.IsGhost) {
-            reporter.Error(n.tok, "{0} '{1}' of {2} {3} cannot be changed, compared to the corresponding {2} in the module it refines, from ghost to non-ghost", parameterKind, n.Name, thing, name);
+            reporter.Error(MessageSource.RefinementTransformer, n.tok, "{0} '{1}' of {2} {3} cannot be changed, compared to the corresponding {2} in the module it refines, from ghost to non-ghost", parameterKind, n.Name, thing, name);
           } else if (!ResolvedTypesAreTheSame(o.Type, n.Type)) {
-            reporter.Error(n.tok, "the type of {0} '{1}' is different from the type of the same {0} in the corresponding {2} in the module it refines ('{3}' instead of '{4}')", parameterKind, n.Name, thing, n.Type, o.Type);
+            reporter.Error(MessageSource.RefinementTransformer, n.tok, "the type of {0} '{1}' is different from the type of the same {0} in the corresponding {2} in the module it refines ('{3}' instead of '{4}')", parameterKind, n.Name, thing, n.Type, o.Type);
           }
         }
       }
@@ -382,22 +375,22 @@ namespace Microsoft.Dafny
     private void CheckFunctionsAreRefinements(Function nw, Function f) {
       if (f is Predicate) {
         if (!(nw is Predicate)) {
-          reporter.Error(nw, "a predicate declaration ({0}) can only be refined by a predicate", nw.Name);
+          reporter.Error(MessageSource.RefinementTransformer, nw, "a predicate declaration ({0}) can only be refined by a predicate", nw.Name);
         } else {
           CheckAgreement_TypeParameters(nw.tok, f.TypeArgs, nw.TypeArgs, nw.Name, "predicate", false);
           CheckAgreementResolvedParameters(nw.tok, f.Formals, nw.Formals, nw.Name, "predicate", "parameter");
         }
       } else if (f is FixpointPredicate) {
-        reporter.Error(nw, "refinement of {0}s is not supported", f.WhatKind);
+        reporter.Error(MessageSource.RefinementTransformer, nw, "refinement of {0}s is not supported", f.WhatKind);
       } else {
         // f is a plain Function
         if (nw is Predicate || nw is FixpointPredicate) {
-          reporter.Error(nw, "a {0} declaration ({1}) can only be refined by a function or function method", nw.IsGhost ? "function" : "function method", nw.Name);
+          reporter.Error(MessageSource.RefinementTransformer, nw, "a {0} declaration ({1}) can only be refined by a function or function method", nw.IsGhost ? "function" : "function method", nw.Name);
         } else {
           CheckAgreement_TypeParameters(nw.tok, f.TypeArgs, nw.TypeArgs, nw.Name, "function", false);
           CheckAgreementResolvedParameters(nw.tok, f.Formals, nw.Formals, nw.Name, "function", "parameter");
           if (!ResolvedTypesAreTheSame(nw.ResultType, f.ResultType)) {
-            reporter.Error(nw, "the result type of function '{0}' ({1}) differs from the result type of the corresponding function in the module it refines ({2})", nw.Name, nw.ResultType, f.ResultType);
+            reporter.Error(MessageSource.RefinementTransformer, nw, "the result type of function '{0}' ({1}) differs from the result type of the corresponding function in the module it refines ({2})", nw.Name, nw.ResultType, f.ResultType);
           }
         }
       }
@@ -408,7 +401,7 @@ namespace Microsoft.Dafny
     private void CheckDatatypesAreRefinements(DatatypeDecl dd, DatatypeDecl nn) {
       CheckAgreement_TypeParameters(nn.tok, dd.TypeArgs, nn.TypeArgs, dd.Name, "datatype", false);
       if (dd.Ctors.Count != nn.Ctors.Count) {
-        reporter.Error(nn.tok, "a refining datatype must have the same number of constructors");
+        reporter.Error(MessageSource.RefinementTransformer, nn.tok, "a refining datatype must have the same number of constructors");
       } else {
         var map = new Dictionary<string, DatatypeCtor>();
         foreach (var ctor in nn.Ctors) {
@@ -418,21 +411,21 @@ namespace Microsoft.Dafny
           DatatypeCtor newCtor;
           if (map.TryGetValue(ctor.Name, out newCtor)) {
             if (newCtor.Formals.Count != ctor.Formals.Count) {
-              reporter.Error(newCtor, "the constructor ({0}) must have the same number of formals as in the refined module", newCtor.Name); 
+              reporter.Error(MessageSource.RefinementTransformer, newCtor, "the constructor ({0}) must have the same number of formals as in the refined module", newCtor.Name);
             } else {
               for (int i = 0; i < newCtor.Formals.Count; i++) {
                 var a = ctor.Formals[i]; var b = newCtor.Formals[i];
                 if (a.HasName) {
                   if (!b.HasName || a.Name != b.Name)
-                    reporter.Error(b, "formal argument {0} in constructor {1} does not have the same name as in the refined module (should be {2})", i, ctor.Name, a.Name);
+                    reporter.Error(MessageSource.RefinementTransformer, b, "formal argument {0} in constructor {1} does not have the same name as in the refined module (should be {2})", i, ctor.Name, a.Name);
                 }
                 if (!ResolvedTypesAreTheSame(a.Type, b.Type)) {
-                  reporter.Error(b, "formal argument {0} in constructor {1} does not have the same type as in the refined module (should be {2}, not {3})", i, ctor.Name, a.Type.ToString(), b.Type.ToString());
+                  reporter.Error(MessageSource.RefinementTransformer, b, "formal argument {0} in constructor {1} does not have the same type as in the refined module (should be {2}, not {3})", i, ctor.Name, a.Type.ToString(), b.Type.ToString());
                 }
               }
             }
           } else {
-            reporter.Error(nn, "the constructor {0} must be present in the refining datatype", ctor.Name);
+            reporter.Error(MessageSource.RefinementTransformer, nn, "the constructor {0} must be present in the refining datatype", ctor.Name);
           }
         }
       }
@@ -501,7 +494,8 @@ namespace Microsoft.Dafny
         Contract.Assert(false); throw new cce.UnreachableException();  // unexpected type
       }
     }
-    public void PostResolve(ModuleDefinition m) {
+
+    internal override void PostResolve(ModuleDefinition m) {
       if (m == moduleUnderConstruction) {
         while (this.postTasks.Count != 0) {
           var a = postTasks.Dequeue();
@@ -512,8 +506,7 @@ namespace Microsoft.Dafny
       }
       moduleUnderConstruction = null;
     }
-    public void PostCyclicityResolve(ModuleDefinition m) { 
-    }
+
     Function CloneFunction(IToken tok, Function f, bool isGhost, List<Expression> moreEnsures, Expression moreBody, Expression replacementBody, bool checkPrevPostconditions, Attributes moreAttributes) {
       Contract.Requires(tok != null);
       Contract.Requires(moreBody == null || f is Predicate);
@@ -611,26 +604,26 @@ namespace Microsoft.Dafny
       Contract.Requires(prev != null);
 
       if (nw.Requires.Count != 0) {
-        reporter.Error(nw.Requires[0].E.tok, "a refining iterator is not allowed to add preconditions");
+        reporter.Error(MessageSource.RefinementTransformer, nw.Requires[0].E.tok, "a refining iterator is not allowed to add preconditions");
       }
       if (nw.YieldRequires.Count != 0) {
-        reporter.Error(nw.YieldRequires[0].E.tok, "a refining iterator is not allowed to add yield preconditions");
+        reporter.Error(MessageSource.RefinementTransformer, nw.YieldRequires[0].E.tok, "a refining iterator is not allowed to add yield preconditions");
       }
       if (nw.Reads.Expressions.Count != 0) {
-        reporter.Error(nw.Reads.Expressions[0].E.tok, "a refining iterator is not allowed to extend the reads clause");
+        reporter.Error(MessageSource.RefinementTransformer, nw.Reads.Expressions[0].E.tok, "a refining iterator is not allowed to extend the reads clause");
       }
       if (nw.Modifies.Expressions.Count != 0) {
-        reporter.Error(nw.Modifies.Expressions[0].E.tok, "a refining iterator is not allowed to extend the modifies clause");
+        reporter.Error(MessageSource.RefinementTransformer, nw.Modifies.Expressions[0].E.tok, "a refining iterator is not allowed to extend the modifies clause");
       }
       if (nw.Decreases.Expressions.Count != 0) {
-        reporter.Error(nw.Decreases.Expressions[0].tok, "a refining iterator is not allowed to extend the decreases clause");
+        reporter.Error(MessageSource.RefinementTransformer, nw.Decreases.Expressions[0].tok, "a refining iterator is not allowed to extend the decreases clause");
       }
 
       if (nw.SignatureIsOmitted) {
         Contract.Assert(nw.TypeArgs.Count == 0);
         Contract.Assert(nw.Ins.Count == 0);
         Contract.Assert(nw.Outs.Count == 0);
-        ReportAdditionalInformation(nw.SignatureEllipsis, Printer.IteratorSignatureToString(prev), 3);
+        reporter.Info(MessageSource.RefinementTransformer, nw.SignatureEllipsis, Printer.IteratorSignatureToString(prev));
       } else {
         CheckAgreement_TypeParameters(nw.tok, prev.TypeArgs, nw.TypeArgs, nw.Name, "iterator");
         CheckAgreement_Parameters(nw.tok, prev.Ins, nw.Ins, nw.Name, "iterator", "in-parameter");
@@ -694,9 +687,9 @@ namespace Microsoft.Dafny
           if (nwMember is Field) {
             if (member is Field && TypesAreSyntacticallyEqual(((Field)nwMember).Type, ((Field)member).Type)) {
               if (member.IsGhost || !nwMember.IsGhost)
-                reporter.Error(nwMember, "a field re-declaration ({0}) must be to ghostify the field", nwMember.Name, nw.Name);
+                reporter.Error(MessageSource.RefinementTransformer, nwMember, "a field re-declaration ({0}) must be to ghostify the field", nwMember.Name, nw.Name);
             } else {
-              reporter.Error(nwMember, "a field declaration ({0}) in a refining class ({1}) must replace a field in the refinement base", nwMember.Name, nw.Name);
+              reporter.Error(MessageSource.RefinementTransformer, nwMember, "a field declaration ({0}) in a refining class ({1}) must replace a field in the refinement base", nwMember.Name, nw.Name);
             }
             nwMember.RefinementBase = member;
 
@@ -709,38 +702,38 @@ namespace Microsoft.Dafny
               (isPredicate && !(member is Predicate)) ||
               (isIndPredicate && !(member is InductivePredicate)) ||
               (isCoPredicate && !(member is CoPredicate))) {
-              reporter.Error(nwMember, "a {0} declaration ({1}) can only refine a {0}", f.WhatKind, nwMember.Name);
+              reporter.Error(MessageSource.RefinementTransformer, nwMember, "a {0} declaration ({1}) can only refine a {0}", f.WhatKind, nwMember.Name);
             } else if (f.IsProtected != ((Function)member).IsProtected) {
-              reporter.Error(f, "a {0} in a refinement module must be declared 'protected' if and only if the refined {0} is", f.WhatKind);
+              reporter.Error(MessageSource.RefinementTransformer, f, "a {0} in a refinement module must be declared 'protected' if and only if the refined {0} is", f.WhatKind);
             } else {
               var prevFunction = (Function)member;
               if (f.Req.Count != 0) {
-                reporter.Error(f.Req[0].tok, "a refining {0} is not allowed to add preconditions", f.WhatKind);
+                reporter.Error(MessageSource.RefinementTransformer, f.Req[0].tok, "a refining {0} is not allowed to add preconditions", f.WhatKind);
               }
               if (f.Reads.Count != 0) {
-                reporter.Error(f.Reads[0].E.tok, "a refining {0} is not allowed to extend the reads clause", f.WhatKind);
+                reporter.Error(MessageSource.RefinementTransformer, f.Reads[0].E.tok, "a refining {0} is not allowed to extend the reads clause", f.WhatKind);
               }
               if (f.Decreases.Expressions.Count != 0) {
-                reporter.Error(f.Decreases.Expressions[0].tok, "decreases clause on refining {0} not supported", f.WhatKind);
+                reporter.Error(MessageSource.RefinementTransformer, f.Decreases.Expressions[0].tok, "decreases clause on refining {0} not supported", f.WhatKind);
               }
 
               if (prevFunction.HasStaticKeyword != f.HasStaticKeyword) {
-                reporter.Error(f, "a function in a refining module cannot be changed from static to non-static or vice versa: {0}", f.Name);
+                reporter.Error(MessageSource.RefinementTransformer, f, "a function in a refining module cannot be changed from static to non-static or vice versa: {0}", f.Name);
               }
               if (!prevFunction.IsGhost && f.IsGhost) {
-                reporter.Error(f, "a function method cannot be changed into a (ghost) function in a refining module: {0}", f.Name);
+                reporter.Error(MessageSource.RefinementTransformer, f, "a function method cannot be changed into a (ghost) function in a refining module: {0}", f.Name);
               } else if (prevFunction.IsGhost && !f.IsGhost && prevFunction.Body != null) {
-                reporter.Error(f, "a function can be changed into a function method in a refining module only if the function has not yet been given a body: {0}", f.Name);
+                reporter.Error(MessageSource.RefinementTransformer, f, "a function can be changed into a function method in a refining module only if the function has not yet been given a body: {0}", f.Name);
               }
               if (f.SignatureIsOmitted) {
                 Contract.Assert(f.TypeArgs.Count == 0);
                 Contract.Assert(f.Formals.Count == 0);
-                ReportAdditionalInformation(f.SignatureEllipsis, Printer.FunctionSignatureToString(prevFunction), 3);
+                reporter.Info(MessageSource.RefinementTransformer, f.SignatureEllipsis, Printer.FunctionSignatureToString(prevFunction));
               } else {
                 CheckAgreement_TypeParameters(f.tok, prevFunction.TypeArgs, f.TypeArgs, f.Name, "function");
                 CheckAgreement_Parameters(f.tok, prevFunction.Formals, f.Formals, f.Name, "function", "parameter");
                 if (!TypesAreSyntacticallyEqual(prevFunction.ResultType, f.ResultType)) {
-                  reporter.Error(f, "the result type of function '{0}' ({1}) differs from the result type of the corresponding function in the module it refines ({2})", f.Name, f.ResultType, prevFunction.ResultType);
+                  reporter.Error(MessageSource.RefinementTransformer, f, "the result type of function '{0}' ({1}) differs from the result type of the corresponding function in the module it refines ({2})", f.Name, f.ResultType, prevFunction.ResultType);
                 }
               }
 
@@ -752,9 +745,9 @@ namespace Microsoft.Dafny
                 if (isPredicate && f.IsProtected) {
                   moreBody = f.Body;
                 } else if (isPredicate) {
-                  reporter.Error(nwMember, "a refining predicate is not allowed to extend/change the body unless it is declared 'protected'");
+                  reporter.Error(MessageSource.RefinementTransformer, nwMember, "a refining predicate is not allowed to extend/change the body unless it is declared 'protected'");
                 } else {
-                  reporter.Error(nwMember, "a refining function is not allowed to extend/change the body");
+                  reporter.Error(MessageSource.RefinementTransformer, nwMember, "a refining function is not allowed to extend/change the body");
                 }
               }
               var newF = CloneFunction(f.tok, prevFunction, f.IsGhost, f.Ens, moreBody, replacementBody, prevFunction.Body == null, f.Attributes);
@@ -765,14 +758,14 @@ namespace Microsoft.Dafny
           } else {
             var m = (Method)nwMember;
             if (!(member is Method)) {
-              reporter.Error(nwMember, "a method declaration ({0}) can only refine a method", nwMember.Name);
+              reporter.Error(MessageSource.RefinementTransformer, nwMember, "a method declaration ({0}) can only refine a method", nwMember.Name);
             } else {
               var prevMethod = (Method)member;
               if (m.Req.Count != 0) {
-                reporter.Error(m.Req[0].E.tok, "a refining method is not allowed to add preconditions");
+                reporter.Error(MessageSource.RefinementTransformer, m.Req[0].E.tok, "a refining method is not allowed to add preconditions");
               }
               if (m.Mod.Expressions.Count != 0) {
-                reporter.Error(m.Mod.Expressions[0].E.tok, "a refining method is not allowed to extend the modifies clause");
+                reporter.Error(MessageSource.RefinementTransformer, m.Mod.Expressions[0].E.tok, "a refining method is not allowed to extend the modifies clause");
               }
               // If the previous method was not specified with "decreases *", then the new method is not allowed to provide any "decreases" clause.
               // Any "decreases *" clause is not inherited, so if the previous method was specified with "decreases *", then the new method needs
@@ -785,23 +778,23 @@ namespace Microsoft.Dafny
               } else {
                 if (!Contract.Exists(prevMethod.Decreases.Expressions, e => e is WildcardExpr)) {
                   // If the previous loop was not specified with "decreases *", then the new loop is not allowed to provide any "decreases" clause.
-                  reporter.Error(m.Decreases.Expressions[0].tok, "decreases clause on refining method not supported, unless the refined method was specified with 'decreases *'");
+                  reporter.Error(MessageSource.RefinementTransformer, m.Decreases.Expressions[0].tok, "decreases clause on refining method not supported, unless the refined method was specified with 'decreases *'");
                 }
                 decreases = m.Decreases;
               }
               if (prevMethod.HasStaticKeyword != m.HasStaticKeyword) {
-                reporter.Error(m, "a method in a refining module cannot be changed from static to non-static or vice versa: {0}", m.Name);
+                reporter.Error(MessageSource.RefinementTransformer, m, "a method in a refining module cannot be changed from static to non-static or vice versa: {0}", m.Name);
               }
               if (prevMethod.IsGhost && !m.IsGhost) {
-                reporter.Error(m, "a method cannot be changed into a ghost method in a refining module: {0}", m.Name);
+                reporter.Error(MessageSource.RefinementTransformer, m, "a method cannot be changed into a ghost method in a refining module: {0}", m.Name);
               } else if (!prevMethod.IsGhost && m.IsGhost) {
-                reporter.Error(m, "a ghost method cannot be changed into a non-ghost method in a refining module: {0}", m.Name);
+                reporter.Error(MessageSource.RefinementTransformer, m, "a ghost method cannot be changed into a non-ghost method in a refining module: {0}", m.Name);
               }
               if (m.SignatureIsOmitted) {
                 Contract.Assert(m.TypeArgs.Count == 0);
                 Contract.Assert(m.Ins.Count == 0);
                 Contract.Assert(m.Outs.Count == 0);
-                ReportAdditionalInformation(m.SignatureEllipsis, Printer.MethodSignatureToString(prevMethod), 3);
+                reporter.Info(MessageSource.RefinementTransformer, m.SignatureEllipsis, Printer.MethodSignatureToString(prevMethod));
               } else {
                 CheckAgreement_TypeParameters(m.tok, prevMethod.TypeArgs, m.TypeArgs, m.Name, "method");
                 CheckAgreement_Parameters(m.tok, prevMethod.Ins, m.Ins, m.Name, "method", "in-parameter");
@@ -833,13 +826,13 @@ namespace Microsoft.Dafny
       Contract.Requires(name != null);
       Contract.Requires(thing != null);
       if (old.Count != nw.Count) {
-        reporter.Error(tok, "{0} '{1}' is declared with a different number of type parameters ({2} instead of {3}) than the corresponding {0} in the module it refines", thing, name, nw.Count, old.Count);
+        reporter.Error(MessageSource.RefinementTransformer, tok, "{0} '{1}' is declared with a different number of type parameters ({2} instead of {3}) than the corresponding {0} in the module it refines", thing, name, nw.Count, old.Count);
       } else {
         for (int i = 0; i < old.Count; i++) {
           var o = old[i];
           var n = nw[i];
           if (o.Name != n.Name && checkNames) { // if checkNames is false, then just treat the parameters positionally.
-            reporter.Error(n.tok, "type parameters are not allowed to be renamed from the names given in the {0} in the module being refined (expected '{1}', found '{2}')", thing, o.Name, n.Name);
+            reporter.Error(MessageSource.RefinementTransformer, n.tok, "type parameters are not allowed to be renamed from the names given in the {0} in the module being refined (expected '{1}', found '{2}')", thing, o.Name, n.Name);
           } else {
             // This explains what we want to do and why:
             // switch (o.EqualitySupport) {
@@ -859,7 +852,7 @@ namespace Microsoft.Dafny
             // }
             // Here's how we actually compute it:
             if (o.EqualitySupport != TypeParameter.EqualitySupportValue.InferredRequired && o.EqualitySupport != n.EqualitySupport) {
-              reporter.Error(n.tok, "type parameter '{0}' is not allowed to change the requirement of supporting equality", n.Name);
+              reporter.Error(MessageSource.RefinementTransformer, n.tok, "type parameter '{0}' is not allowed to change the requirement of supporting equality", n.Name);
             }
           }
         }
@@ -872,7 +865,7 @@ namespace Microsoft.Dafny
         CheckOverrideResolvedParameters(nw.tok, f.Formals, nw.Formals, nw.Name, "function", "parameter");
         if (!ResolvedTypesAreTheSame(nw.ResultType, f.ResultType))
         {
-            reporter.Error(nw, "the result type of function '{0}' ({1}) differs from the result type of the corresponding function in the module it overrides ({2})", nw.Name, nw.ResultType, f.ResultType);
+            reporter.Error(MessageSource.RefinementTransformer, nw, "the result type of function '{0}' ({1}) differs from the result type of the corresponding function in the module it overrides ({2})", nw.Name, nw.ResultType, f.ResultType);
         }
     }
 
@@ -892,7 +885,7 @@ namespace Microsoft.Dafny
         Contract.Requires(thing != null);
         if (old.Count != nw.Count)
         {
-            reporter.Error(tok, "{0} '{1}' is declared with a different number of type parameters ({2} instead of {3}) than the corresponding {0} in the module it overrides", thing, name, nw.Count, old.Count);
+            reporter.Error(MessageSource.RefinementTransformer, tok, "{0} '{1}' is declared with a different number of type parameters ({2} instead of {3}) than the corresponding {0} in the module it overrides", thing, name, nw.Count, old.Count);
         }
         else
         {
@@ -902,14 +895,14 @@ namespace Microsoft.Dafny
                 var n = nw[i];
                 if (o.Name != n.Name && checkNames)
                 { // if checkNames is false, then just treat the parameters positionally.
-                    reporter.Error(n.tok, "type parameters are not allowed to be renamed from the names given in the {0} in the module being overriden (expected '{1}', found '{2}')", thing, o.Name, n.Name);
+                    reporter.Error(MessageSource.RefinementTransformer, n.tok, "type parameters are not allowed to be renamed from the names given in the {0} in the module being overriden (expected '{1}', found '{2}')", thing, o.Name, n.Name);
                 }
                 else
                 {
                     // Here's how we actually compute it:
                     if (o.EqualitySupport != TypeParameter.EqualitySupportValue.InferredRequired && o.EqualitySupport != n.EqualitySupport)
                     {
-                        reporter.Error(n.tok, "type parameter '{0}' is not allowed to change the requirement of supporting equality", n.Name);
+                        reporter.Error(MessageSource.RefinementTransformer, n.tok, "type parameter '{0}' is not allowed to change the requirement of supporting equality", n.Name);
                     }
                 }
             }
@@ -926,7 +919,7 @@ namespace Microsoft.Dafny
         Contract.Requires(parameterKind != null);
         if (old.Count != nw.Count)
         {
-            reporter.Error(tok, "{0} '{1}' is declared with a different number of {2} ({3} instead of {4}) than the corresponding {0} in the module it overrides", thing, name, parameterKind, nw.Count, old.Count);
+            reporter.Error(MessageSource.RefinementTransformer, tok, "{0} '{1}' is declared with a different number of {2} ({3} instead of {4}) than the corresponding {0} in the module it overrides", thing, name, parameterKind, nw.Count, old.Count);
         }
         else
         {
@@ -936,15 +929,15 @@ namespace Microsoft.Dafny
                 var n = nw[i];
                 if (!o.IsGhost && n.IsGhost)
                 {
-                    reporter.Error(n.tok, "{0} '{1}' of {2} {3} cannot be changed, compared to the corresponding {2} in the module it overrides, from non-ghost to ghost", parameterKind, n.Name, thing, name);
+                    reporter.Error(MessageSource.RefinementTransformer, n.tok, "{0} '{1}' of {2} {3} cannot be changed, compared to the corresponding {2} in the module it overrides, from non-ghost to ghost", parameterKind, n.Name, thing, name);
                 }
                 else if (o.IsGhost && !n.IsGhost)
                 {
-                    reporter.Error(n.tok, "{0} '{1}' of {2} {3} cannot be changed, compared to the corresponding {2} in the module it overrides, from ghost to non-ghost", parameterKind, n.Name, thing, name);
+                    reporter.Error(MessageSource.RefinementTransformer, n.tok, "{0} '{1}' of {2} {3} cannot be changed, compared to the corresponding {2} in the module it overrides, from ghost to non-ghost", parameterKind, n.Name, thing, name);
                 }
                 else if (!ResolvedTypesAreTheSame(o.Type, n.Type))
                 {
-                    reporter.Error(n.tok, "the type of {0} '{1}' is different from the type of the same {0} in the corresponding {2} in the module it overrides ('{3}' instead of '{4}')", parameterKind, n.Name, thing, n.Type, o.Type);
+                    reporter.Error(MessageSource.RefinementTransformer, n.tok, "the type of {0} '{1}' is different from the type of the same {0} in the corresponding {2} in the module it overrides ('{3}' instead of '{4}')", parameterKind, n.Name, thing, n.Type, o.Type);
                 }
             }
         }
@@ -958,19 +951,19 @@ namespace Microsoft.Dafny
       Contract.Requires(thing != null);
       Contract.Requires(parameterKind != null);
       if (old.Count != nw.Count) {
-        reporter.Error(tok, "{0} '{1}' is declared with a different number of {2} ({3} instead of {4}) than the corresponding {0} in the module it refines", thing, name, parameterKind, nw.Count, old.Count);
+        reporter.Error(MessageSource.RefinementTransformer, tok, "{0} '{1}' is declared with a different number of {2} ({3} instead of {4}) than the corresponding {0} in the module it refines", thing, name, parameterKind, nw.Count, old.Count);
       } else {
         for (int i = 0; i < old.Count; i++) {
           var o = old[i];
           var n = nw[i];
           if (o.Name != n.Name) {
-            reporter.Error(n.tok, "there is a difference in name of {0} {1} ('{2}' versus '{3}') of {4} {5} compared to corresponding {4} in the module it refines", parameterKind, i, n.Name, o.Name, thing, name);
+            reporter.Error(MessageSource.RefinementTransformer, n.tok, "there is a difference in name of {0} {1} ('{2}' versus '{3}') of {4} {5} compared to corresponding {4} in the module it refines", parameterKind, i, n.Name, o.Name, thing, name);
           } else if (!o.IsGhost && n.IsGhost) {
-            reporter.Error(n.tok, "{0} '{1}' of {2} {3} cannot be changed, compared to the corresponding {2} in the module it refines, from non-ghost to ghost", parameterKind, n.Name, thing, name);
+            reporter.Error(MessageSource.RefinementTransformer, n.tok, "{0} '{1}' of {2} {3} cannot be changed, compared to the corresponding {2} in the module it refines, from non-ghost to ghost", parameterKind, n.Name, thing, name);
           } else if (o.IsGhost && !n.IsGhost) {
-            reporter.Error(n.tok, "{0} '{1}' of {2} {3} cannot be changed, compared to the corresponding {2} in the module it refines, from ghost to non-ghost", parameterKind, n.Name, thing, name);
+            reporter.Error(MessageSource.RefinementTransformer, n.tok, "{0} '{1}' of {2} {3} cannot be changed, compared to the corresponding {2} in the module it refines, from ghost to non-ghost", parameterKind, n.Name, thing, name);
           } else if (!TypesAreSyntacticallyEqual(o.Type, n.Type)) {
-            reporter.Error(n.tok, "the type of {0} '{1}' is different from the type of the same {0} in the corresponding {2} in the module it refines ('{3}' instead of '{4}')", parameterKind, n.Name, thing, n.Type, o.Type);
+            reporter.Error(MessageSource.RefinementTransformer, n.tok, "the type of {0} '{1}' is different from the type of the same {0} in the corresponding {2} in the module it refines ('{3}' instead of '{4}')", parameterKind, n.Name, thing, n.Type, o.Type);
           }
         }
       }
@@ -996,7 +989,7 @@ namespace Microsoft.Dafny
           } else if (((SkeletonStatement)cur).S == null) {
             // the "..." matches the empty statement sequence
           } else {
-            reporter.Error(cur.Tok, "skeleton statement does not match old statement");
+            reporter.Error(MessageSource.RefinementTransformer, cur.Tok, "skeleton statement does not match old statement");
           }
           i++;
         } else {
@@ -1050,7 +1043,7 @@ namespace Microsoft.Dafny
                   Contract.Assert(c.NameReplacements.Count == c.ExprReplacements.Count);
                   for (int k = 0; k < c.NameReplacements.Count; k++) {
                     if (subExprs.ContainsKey(c.NameReplacements[k].val)) {
-                      reporter.Error(c.NameReplacements[k], "replacement definition must contain at most one definition for a given label");
+                      reporter.Error(MessageSource.RefinementTransformer, c.NameReplacements[k], "replacement definition must contain at most one definition for a given label");
                     } else subExprs.Add(c.NameReplacements[k].val, c.ExprReplacements[k]);
                   }
                   subber = new SubstitutionCloner(subExprs, rawCloner);
@@ -1071,12 +1064,12 @@ namespace Microsoft.Dafny
                   oldS = oldStmt.Body[j];
                 }
                 if (hoverTextA.Length != 0) {
-                  ReportAdditionalInformation(c.Tok, hoverTextA, 3);
+                  reporter.Info(MessageSource.RefinementTransformer, c.Tok, hoverTextA);
                 }
                 if (subber != null && subber.SubstitutionsMade.Count < subber.Exprs.Count) {
                   foreach (var s in subber.SubstitutionsMade)
                     subber.Exprs.Remove(s);
-                  reporter.Error(c.Tok, "could not find labeled expression(s): " + Util.Comma(", ", subber.Exprs.Keys, x => x));
+                  reporter.Error(MessageSource.RefinementTransformer, c.Tok, "could not find labeled expression(s): " + Util.Comma(", ", subber.Exprs.Keys, x => x));
                 }
               }
               i++;
@@ -1086,7 +1079,7 @@ namespace Microsoft.Dafny
               Contract.Assert(c.ConditionOmitted);
               var oldAssume = oldS as PredicateStmt;
               if (oldAssume == null) {
-                reporter.Error(cur.Tok, "assert template does not match inherited statement");
+                reporter.Error(MessageSource.RefinementTransformer, cur.Tok, "assert template does not match inherited statement");
                 i++;
               } else {
                 // Clone the expression, but among the new assert's attributes, indicate
@@ -1097,7 +1090,7 @@ namespace Microsoft.Dafny
                 var attrs = refinementCloner.MergeAttributes(oldAssume.Attributes, skel.Attributes);
                 body.Add(new AssertStmt(new Translator.ForceCheckToken(skel.Tok), new Translator.ForceCheckToken(skel.EndTok),
                   e, new Attributes("prependAssertToken", new List<Expression>(), attrs)));
-                ReportAdditionalInformation(c.ConditionEllipsis, "assume->assert: " + Printer.ExprToString(e), 3);
+                reporter.Info(MessageSource.RefinementTransformer, c.ConditionEllipsis, "assume->assert: " + Printer.ExprToString(e));
                 i++; j++;
               }
 
@@ -1106,13 +1099,13 @@ namespace Microsoft.Dafny
               Contract.Assert(c.ConditionOmitted);
               var oldAssume = oldS as AssumeStmt;
               if (oldAssume == null) {
-                reporter.Error(cur.Tok, "assume template does not match inherited statement");
+                reporter.Error(MessageSource.RefinementTransformer, cur.Tok, "assume template does not match inherited statement");
                 i++;
               } else {
                 var e = refinementCloner.CloneExpr(oldAssume.Expr);
                 var attrs = refinementCloner.MergeAttributes(oldAssume.Attributes, skel.Attributes);
                 body.Add(new AssumeStmt(skel.Tok, skel.EndTok, e, attrs));
-                ReportAdditionalInformation(c.ConditionEllipsis, Printer.ExprToString(e), 3);
+                reporter.Info(MessageSource.RefinementTransformer, c.ConditionEllipsis, Printer.ExprToString(e));
                 i++; j++;
               }
 
@@ -1121,7 +1114,7 @@ namespace Microsoft.Dafny
               Contract.Assert(c.ConditionOmitted);
               var oldIf = oldS as IfStmt;
               if (oldIf == null) {
-                reporter.Error(cur.Tok, "if-statement template does not match inherited statement");
+                reporter.Error(MessageSource.RefinementTransformer, cur.Tok, "if-statement template does not match inherited statement");
                 i++;
               } else {
                 var resultingThen = MergeBlockStmt(skel.Thn, oldIf.Thn);
@@ -1129,7 +1122,7 @@ namespace Microsoft.Dafny
                 var e = refinementCloner.CloneExpr(oldIf.Guard);
                 var r = new IfStmt(skel.Tok, skel.EndTok, e, resultingThen, resultingElse);
                 body.Add(r);
-                ReportAdditionalInformation(c.ConditionEllipsis, Printer.GuardToString(e), 3);
+                reporter.Info(MessageSource.RefinementTransformer, c.ConditionEllipsis, Printer.GuardToString(e));
                 i++; j++;
               }
 
@@ -1137,16 +1130,16 @@ namespace Microsoft.Dafny
               var skel = (WhileStmt)S;
               var oldWhile = oldS as WhileStmt;
               if (oldWhile == null) {
-                reporter.Error(cur.Tok, "while-statement template does not match inherited statement");
+                reporter.Error(MessageSource.RefinementTransformer, cur.Tok, "while-statement template does not match inherited statement");
                 i++;
               } else {
                 Expression guard;
                 if (c.ConditionOmitted) {
                   guard = refinementCloner.CloneExpr(oldWhile.Guard);
-                  ReportAdditionalInformation(c.ConditionEllipsis, Printer.GuardToString(oldWhile.Guard), 3);
+                  reporter.Info(MessageSource.RefinementTransformer, c.ConditionEllipsis, Printer.GuardToString(oldWhile.Guard));
                 } else {
                   if (oldWhile.Guard != null) {
-                    reporter.Error(skel.Guard.tok, "a skeleton while statement with a guard can only replace a while statement with a non-deterministic guard");
+                    reporter.Error(MessageSource.RefinementTransformer, skel.Guard.tok, "a skeleton while statement with a guard can only replace a while statement with a non-deterministic guard");
                   }
                   guard = skel.Guard;
                 }
@@ -1162,7 +1155,7 @@ namespace Microsoft.Dafny
               Contract.Assert(c.ConditionOmitted);
               var oldModifyStmt = oldS as ModifyStmt;
               if (oldModifyStmt == null) {
-                reporter.Error(cur.Tok, "modify template does not match inherited statement");
+                reporter.Error(MessageSource.RefinementTransformer, cur.Tok, "modify template does not match inherited statement");
                 i++;
               } else {
                 var mod = refinementCloner.CloneSpecFrameExpr(oldModifyStmt.Mod);
@@ -1172,13 +1165,13 @@ namespace Microsoft.Dafny
                 } else if (oldModifyStmt.Body == null) {
                   mbody = skel.Body;
                 } else if (skel.Body == null) {
-                  reporter.Error(cur.Tok, "modify template must have a body if the inherited modify statement does");
+                  reporter.Error(MessageSource.RefinementTransformer, cur.Tok, "modify template must have a body if the inherited modify statement does");
                   mbody = null;
                 } else {
                   mbody = MergeBlockStmt(skel.Body, oldModifyStmt.Body);
                 }
                 body.Add(new ModifyStmt(skel.Tok, skel.EndTok, mod.Expressions, mod.Attributes, mbody));
-                ReportAdditionalInformation(c.ConditionEllipsis, Printer.FrameExprListToString(mod.Expressions), 3);
+                reporter.Info(MessageSource.RefinementTransformer, c.ConditionEllipsis, Printer.FrameExprListToString(mod.Expressions));
                 i++; j++;
               }
 
@@ -1341,7 +1334,7 @@ namespace Microsoft.Dafny
         sep = "\n";
       }
       if (hoverText.Length != 0) {
-        ReportAdditionalInformation(skeleton.EndTok, hoverText, 3);
+        reporter.Info(MessageSource.RefinementTransformer, skeleton.EndTok, hoverText);
       }
       return new BlockStmt(skeleton.Tok, skeleton.EndTok, body);
     }
@@ -1447,7 +1440,7 @@ namespace Microsoft.Dafny
       } else {
         if (!Contract.Exists(cOld.Decreases.Expressions, e => e is WildcardExpr)) {
           // If the previous loop was not specified with "decreases *", then the new loop is not allowed to provide any "decreases" clause.
-          reporter.Error(cNew.Decreases.Expressions[0].tok, "a refining loop can provide a decreases clause only if the loop being refined was declared with 'decreases *'");
+          reporter.Error(MessageSource.RefinementTransformer, cNew.Decreases.Expressions[0].tok, "a refining loop can provide a decreases clause only if the loop being refined was declared with 'decreases *'");
         }
         decr = cNew.Decreases;
       }
@@ -1489,9 +1482,9 @@ namespace Microsoft.Dafny
     void MergeAddStatement(Statement s, List<Statement> stmtList) {
       Contract.Requires(s != null);
       Contract.Requires(stmtList != null);
-      var prevErrorCount = reporter.ErrorCount;
+      var prevErrorCount = reporter.Count(ErrorLevel.Error);
       CheckIsOkayNewStatement(s, new Stack<string>(), 0);
-      if (reporter.ErrorCount == prevErrorCount) {
+      if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
         stmtList.Add(s);
       }
     }
@@ -1508,30 +1501,30 @@ namespace Microsoft.Dafny
         labels.Push(n.Data.Name);
       }
       if (s is SkeletonStatement) {
-        reporter.Error(s, "skeleton statement may not be used here; it does not have a matching statement in what is being replaced");
+        reporter.Error(MessageSource.RefinementTransformer, s, "skeleton statement may not be used here; it does not have a matching statement in what is being replaced");
       } else if (s is ReturnStmt) {
         // allow return statements, but make note of that this requires verifying the postcondition
         ((ReturnStmt)s).ReverifyPost = true;
       } else if (s is YieldStmt) {
-        reporter.Error(s, "yield statements are not allowed in skeletons");
+        reporter.Error(MessageSource.RefinementTransformer, s, "yield statements are not allowed in skeletons");
       } else if (s is BreakStmt) {
         var b = (BreakStmt)s;
         if (b.TargetLabel != null ? !labels.Contains(b.TargetLabel) : loopLevels < b.BreakCount) {
-          reporter.Error(s, "break statement in skeleton is not allowed to break outside the skeleton fragment");
+          reporter.Error(MessageSource.RefinementTransformer, s, "break statement in skeleton is not allowed to break outside the skeleton fragment");
         }
       } else if (s is AssignStmt) {
         // TODO: To be a refinement automatically (that is, without any further verification), only variables and fields defined
         // in this module are allowed.  This needs to be checked.  If the LHS refers to an l-value that was not declared within
         // this module, then either an error should be reported or the Translator needs to know to translate new proof obligations.
         var a = (AssignStmt)s;
-        reporter.Error(a.Tok, "cannot have assignment statement");
+        reporter.Error(MessageSource.RefinementTransformer, a.Tok, "cannot have assignment statement");
       } else if (s is ConcreteUpdateStatement) {
         postTasks.Enqueue(() =>
         {
-          CheckIsOkayUpdateStmt((ConcreteUpdateStatement)s, moduleUnderConstruction, reporter);
+          CheckIsOkayUpdateStmt((ConcreteUpdateStatement)s, moduleUnderConstruction);
         });
       } else if (s is CallStmt) {
-        reporter.Error(s.Tok, "cannot have call statement");
+        reporter.Error(MessageSource.RefinementTransformer, s.Tok, "cannot have call statement");
       } else {
         if (s is WhileStmt || s is AlternativeLoopStmt) {
           loopLevels++;
@@ -1547,7 +1540,7 @@ namespace Microsoft.Dafny
     }
 
     // Checks that statement stmt, defined in the constructed module m, is a refinement of skip in the parent module
-    void CheckIsOkayUpdateStmt(ConcreteUpdateStatement stmt, ModuleDefinition m, ResolutionErrorReporter reporter) {
+    void CheckIsOkayUpdateStmt(ConcreteUpdateStatement stmt, ModuleDefinition m) {
       foreach (var lhs in stmt.Lhss) {
         var l = lhs.Resolved;
         if (l is IdentifierExpr) {
@@ -1555,23 +1548,23 @@ namespace Microsoft.Dafny
           Contract.Assert(ident.Var is LocalVariable || ident.Var is Formal); // LHS identifier expressions must be locals or out parameters (ie. formals)
           if ((ident.Var is LocalVariable && RefinementToken.IsInherited(((LocalVariable)ident.Var).Tok, m)) || ident.Var is Formal) {
             // for some reason, formals are not considered to be inherited.
-            reporter.Error(l.tok, "refinement method cannot assign to variable defined in parent module ('{0}')", ident.Var.Name);
+            reporter.Error(MessageSource.RefinementTransformer, l.tok, "refinement method cannot assign to variable defined in parent module ('{0}')", ident.Var.Name);
           }
         } else if (l is MemberSelectExpr) {
           var member = ((MemberSelectExpr)l).Member;
           if (RefinementToken.IsInherited(member.tok, m)) {
-            reporter.Error(l.tok, "refinement method cannot assign to a field defined in parent module ('{0}')", member.Name);
+            reporter.Error(MessageSource.RefinementTransformer, l.tok, "refinement method cannot assign to a field defined in parent module ('{0}')", member.Name);
           }
         } else {
           // must be an array element
-          reporter.Error(l.tok, "new assignments in a refinement method can only assign to state that the module defines (which never includes array elements)");
+          reporter.Error(MessageSource.RefinementTransformer, l.tok, "new assignments in a refinement method can only assign to state that the module defines (which never includes array elements)");
         }
       }
       if (stmt is UpdateStmt) {
         var s = (UpdateStmt)stmt;
         foreach (var rhs in s.Rhss) {
           if (rhs.CanAffectPreviouslyKnownExpressions) {
-            reporter.Error(rhs.Tok, "assignment RHS in refinement method is not allowed to affect previously defined state");
+            reporter.Error(MessageSource.RefinementTransformer, rhs.Tok, "assignment RHS in refinement method is not allowed to affect previously defined state");
           }
         }
       }
diff --git a/Source/Dafny/Reporting.cs b/Source/Dafny/Reporting.cs
new file mode 100644
index 00000000..c3797574
--- /dev/null
+++ b/Source/Dafny/Reporting.cs
@@ -0,0 +1,164 @@
+using Microsoft.Boogie;
+using System;
+using System.Collections.Generic;
+using System.Diagnostics.Contracts;
+using System.Linq;
+using System.Text;
+
+namespace Microsoft.Dafny {
+  public enum ErrorLevel {
+    Info, Warning, Error
+  }
+
+  public enum MessageSource {
+    Parser, Resolver, Translator, Rewriter, Other,
+    RefinementTransformer,
+    Cloner
+  }
+
+  public struct ErrorMessage {
+    public IToken token;
+    public string message;
+    public MessageSource source;
+  }
+
+  public abstract class ErrorReporter {
+    public bool ErrorsOnly { get; set; }
+    public Dictionary<ErrorLevel, List<ErrorMessage>> AllMessages { get; private set; }
+
+    protected ErrorReporter() {
+      ErrorsOnly = false;
+      AllMessages = new Dictionary<ErrorLevel, List<ErrorMessage>>();
+      AllMessages[ErrorLevel.Error] = new List<ErrorMessage>();
+      AllMessages[ErrorLevel.Warning] = new List<ErrorMessage>();
+      AllMessages[ErrorLevel.Info] = new List<ErrorMessage>();
+    }
+
+    protected bool ShouldDiscard(MessageSource source, ErrorLevel level) {
+      return ((ErrorsOnly && level != ErrorLevel.Error) ||
+              (!DafnyOptions.O.PrintTooltips && level == ErrorLevel.Info));
+    }
+
+    // This is the only thing that needs to be overriden
+    public virtual bool Message(MessageSource source, ErrorLevel level, IToken tok, string msg) {
+      var discard = ShouldDiscard(source, level);
+
+      if (!discard) {
+        AllMessages[level].Add(new ErrorMessage { token = tok, message = msg });
+        return true;
+      }
+
+      return false;
+    }
+
+    public int Count(ErrorLevel level) {
+      return AllMessages[level].Count;
+    }
+
+    public void Error(MessageSource source, IToken tok, string msg) {
+      Contract.Requires(tok != null);
+      Contract.Requires(msg != null);
+      Message(source, ErrorLevel.Error, tok, msg);
+    }
+
+    // This method required by the Parser
+    internal void Error(MessageSource source, string filename, int line, int col, string msg) {
+      var tok = new Token(line, col);
+      tok.filename = filename;
+      Error(source, tok, msg);
+    }
+
+    public void Error(MessageSource source, IToken tok, string msg, params object[] args) {
+      Contract.Requires(tok != null);
+      Contract.Requires(msg != null);
+      Error(source, tok, String.Format(msg, args));
+    }
+
+    public void Error(MessageSource source, Declaration d, string msg, params object[] args) {
+      Contract.Requires(d != null);
+      Contract.Requires(msg != null);
+      Error(source, d.tok, msg, args);
+    }
+
+    public void Error(MessageSource source, Statement s, string msg, params object[] args) {
+      Contract.Requires(s != null);
+      Contract.Requires(msg != null);
+      Error(source, s.Tok, msg, args);
+    }
+
+    public void Error(MessageSource source, NonglobalVariable v, string msg, params object[] args) {
+      Contract.Requires(v != null);
+      Contract.Requires(msg != null);
+      Error(source, v.tok, msg, args);
+    }
+
+    public void Error(MessageSource source, Expression e, string msg, params object[] args) {
+      Contract.Requires(e != null);
+      Contract.Requires(msg != null);
+      Error(source, e.tok, msg, args);
+    }
+
+    public void Warning(MessageSource source, IToken tok, string msg) {
+      Contract.Requires(tok != null);
+      Contract.Requires(msg != null);
+      Message(source, ErrorLevel.Warning, tok, msg);
+    }
+
+    public void Warning(MessageSource source, IToken tok, string msg, params object[] args) {
+      Contract.Requires(tok != null);
+      Contract.Requires(msg != null);
+      Warning(source, tok, String.Format(msg, args));
+    }
+
+    public void Info(MessageSource source, IToken tok, string msg) {
+      Contract.Requires(tok != null);
+      Contract.Requires(msg != null);
+      Message(source, ErrorLevel.Info, tok, msg);
+    }
+
+    public void Info(MessageSource source, IToken tok, string msg, params object[] args) {
+      Contract.Requires(tok != null);
+      Contract.Requires(msg != null);
+      Info(source, tok, String.Format(msg, args));
+    }
+
+    public string ErrorToString(ErrorLevel header, IToken tok, string msg) {
+      return ErrorToString_Internal(": " + header.ToString(), tok.filename, tok.line, tok.col, ": " + msg);
+    }
+
+    public string ErrorToString(ErrorLevel header, string filename, int oneBasedLine, int oneBasedColumn, string msg) {
+      return ErrorToString_Internal(": " + header.ToString(), filename, oneBasedLine, oneBasedColumn, ": " + msg);
+    }
+
+    public string ErrorToString_Internal(string header, string filename, int oneBasedLine, int oneBasedColumn, string msg) {
+      return String.Format("{0}({1},{2}){3}{4}", filename, oneBasedLine, oneBasedColumn - 1, header, msg ?? "");
+    }
+  }
+
+  public class ConsoleErrorReporter : ErrorReporter {
+    private ConsoleColor ColorForLevel(ErrorLevel level) {
+      switch (level) {
+        case ErrorLevel.Error:
+          return ConsoleColor.Red;
+        case ErrorLevel.Warning:
+          return ConsoleColor.Yellow;
+        case ErrorLevel.Info:
+          return ConsoleColor.Green;
+        default:
+          throw new cce.UnreachableException();
+      }
+    }
+
+    public override bool Message(MessageSource source, ErrorLevel level, IToken tok, string msg) {
+      if (base.Message(source, level, tok, msg)) {
+        ConsoleColor previousColor = Console.ForegroundColor;
+        Console.ForegroundColor = ColorForLevel(level);
+        Console.WriteLine(ErrorToString(level, tok, msg));
+        Console.ForegroundColor = previousColor;
+        return true;
+      } else {
+        return false;
+      }
+    }
+  }
+}
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index a58d6e6c..db087109 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -12,75 +12,11 @@ using Microsoft.Boogie;
 
 namespace Microsoft.Dafny
 {
-  public class ResolutionErrorReporter
-  {
-    public int ErrorCount = 0;
-
-    /// <summary>
-    /// This method is virtual, because it is overridden in the VSX plug-in for Dafny.
-    /// </summary>
-    public virtual void Error(IToken tok, string msg, params object[] args) {
-      Contract.Requires(tok != null);
-      Contract.Requires(msg != null);
-      ConsoleColor col = Console.ForegroundColor;
-      Console.ForegroundColor = ConsoleColor.Red;
-      Dafny.Util.ReportIssue("Error", tok, msg, args);
-      Console.ForegroundColor = col;
-      ErrorCount++;
-    }
-    public void Error(Declaration d, string msg, params object[] args) {
-      Contract.Requires(d != null);
-      Contract.Requires(msg != null);
-      Error(d.tok, msg, args);
-    }
-    public void Error(Statement s, string msg, params object[] args) {
-      Contract.Requires(s != null);
-      Contract.Requires(msg != null);
-      Error(s.Tok, msg, args);
-    }
-    public void Error(NonglobalVariable v, string msg, params object[] args) {
-      Contract.Requires(v != null);
-      Contract.Requires(msg != null);
-      Error(v.tok, msg, args);
-    }
-    public void Error(Expression e, string msg, params object[] args) {
-      Contract.Requires(e != null);
-      Contract.Requires(msg != null);
-      Error(e.tok, msg, args);
-    }
-
-    protected bool reportWarnings = true;
-    /// <summary>
-    /// Set whether or not to report warnings. Return the state of the previous behavior.
-    /// </summary>
-    public bool ReportWarnings(bool b) {
-      var old = reportWarnings;
-      reportWarnings = b;
-      return old;
-    }
-    public virtual void Warning(IToken tok, string msg, params object[] args) {
-      Contract.Requires(tok != null);
-      Contract.Requires(msg != null);
-      if (reportWarnings) {
-        ConsoleColor col = Console.ForegroundColor;
-        Console.ForegroundColor = ConsoleColor.Yellow;
-        Dafny.Util.ReportIssue("Warning", tok, msg, args);
-        Console.ForegroundColor = col;
-      }
-    }
-  }
-
-  public struct AdditionalInformation
-  {
-    public IToken Token;
-    public string Text;
-    public int Length;
-  }
-
-  public class Resolver : ResolutionErrorReporter
+  public class Resolver
   {
     readonly BuiltIns builtIns;
 
+    readonly ErrorReporter reporter;
     ModuleSignature moduleInfo = null;
 
     FreshIdGenerator defaultTempVarIdGenerator;
@@ -99,18 +35,6 @@ namespace Microsoft.Dafny
       return defaultTempVarIdGenerator.FreshId(prefix);
     }
 
-    public Action<AdditionalInformation> AdditionalInformationReporter;
-
-    internal void ReportAdditionalInformation(IToken token, string text, int length)
-    {
-      Contract.Requires(token != null);
-      Contract.Requires(text != null);
-      Contract.Requires(0 <= length); //FIXME: KRML: This should (probably) be the length of the token
-      if (AdditionalInformationReporter != null) {
-        AdditionalInformationReporter(new AdditionalInformation { Token = token, Text = text, Length = length });
-      }
-    }
-
     interface IAmbiguousThing<Thing>
     {
       /// <summary>
@@ -259,13 +183,10 @@ namespace Microsoft.Dafny
     public Resolver(Program prog) {
       Contract.Requires(prog != null);
       builtIns = prog.BuiltIns;
+      reporter = prog.reporter;
       // Populate the members of the basic types
       var trunc = new SpecialField(Token.NoToken, "Trunc", "ToBigInteger()", "", "", false, false, false, Type.Int, null);
       basicTypeMembers[(int)BasicTypeVariety.Real].Add(trunc.Name, trunc);
-
-      if (DafnyOptions.O.PrintTooltips) {
-        AdditionalInformationReporter = DefaultInformationReporter;
-      }
     }
 
     [ContractInvariantMethod]
@@ -276,26 +197,22 @@ namespace Microsoft.Dafny
       Contract.Invariant(cce.NonNullDictionaryAndValues(datatypeCtors) && Contract.ForAll(datatypeCtors.Values, v => cce.NonNullDictionaryAndValues(v)));
     }
 
-    public static void DefaultInformationReporter(AdditionalInformation info) {
-      Dafny.Util.ReportIssue("Info", info.Token, info.Text);
-    }
-
     public void ResolveProgram(Program prog) {
       Contract.Requires(prog != null);
-      var origErrorCount = ErrorCount;
+      var origErrorCount = reporter.Count(ErrorLevel.Error); //FIXME (Clement): This is used further below, but not in the >0 comparisons in the next few lines. Is that right?
       var bindings = new ModuleBindings(null);
       var b = BindModuleNames(prog.DefaultModuleDef, bindings);
       bindings.BindName("_module", prog.DefaultModule, b);
-      if (ErrorCount > 0) { return; } // if there were errors, then the implict ModuleBindings data structure invariant
+      if (reporter.Count(ErrorLevel.Error) > 0) { return; } // if there were errors, then the implict ModuleBindings data structure invariant
       // is violated, so Processing dependencies will not succeed.
       ProcessDependencies(prog.DefaultModule, b, dependencies);
       // check for cycles in the import graph
       List<ModuleDecl> cycle = dependencies.TryFindCycle();
       if (cycle != null) {
         var cy = Util.Comma(" -> ", cycle, m => m.Name);
-        Error(cycle[0], "module definition contains a cycle (note: parent modules implicitly depend on submodules): {0}", cy);
+        reporter.Error(MessageSource.Resolver, cycle[0], "module definition contains a cycle (note: parent modules implicitly depend on submodules): {0}", cy);
       }
-      if (ErrorCount > 0) { return; } // give up on trying to resolve anything else
+      if (reporter.Count(ErrorLevel.Error) > 0) { return; } // give up on trying to resolve anything else
 
       // fill in module heights
       List<ModuleDecl> sortedDecls = dependencies.TopologicallySortedComponents();
@@ -311,16 +228,16 @@ namespace Microsoft.Dafny
       }
 
       var rewriters = new List<IRewriter>();
-      var refinementTransformer = new RefinementTransformer(this, AdditionalInformationReporter, prog);
+      var refinementTransformer = new RefinementTransformer(prog);
       rewriters.Add(refinementTransformer);
-      rewriters.Add(new AutoContractsRewriter());
-      var opaqueRewriter = new OpaqueFunctionRewriter(this);
-      rewriters.Add(new AutoReqFunctionRewriter(this, opaqueRewriter));
+      rewriters.Add(new AutoContractsRewriter(reporter));
+      var opaqueRewriter = new OpaqueFunctionRewriter(this.reporter);
+      rewriters.Add(new AutoReqFunctionRewriter(this.reporter, opaqueRewriter));
       rewriters.Add(opaqueRewriter);
-      rewriters.Add(new TimeLimitRewriter());
+      rewriters.Add(new TimeLimitRewriter(reporter));
 
       if (DafnyOptions.O.AutoTriggers) {
-        rewriters.Add(new TriggersRewriter(this));
+        rewriters.Add(new TriggerGeneratingRewriter(this.reporter));
       }
 
       systemNameInfo = RegisterTopLevelDecls(prog.BuiltIns.SystemModule, false);
@@ -365,7 +282,7 @@ namespace Microsoft.Dafny
           var literalDecl = (LiteralModuleDecl)decl;
           var m = literalDecl.ModuleDef;
 
-          var errorCount = ErrorCount;
+          var errorCount = reporter.Count(ErrorLevel.Error);
           foreach (var r in rewriters) {
             r.PreResolve(m);
           }
@@ -374,19 +291,20 @@ namespace Microsoft.Dafny
           literalDecl.Signature.Refines = refinementTransformer.RefinedSig;
           var sig = literalDecl.Signature;
           // set up environment
-          var preResolveErrorCount = ErrorCount;
+          var preResolveErrorCount = reporter.Count(ErrorLevel.Error);
           ResolveModuleDefinition(m, sig);
           foreach (var r in rewriters) {
-            if (ErrorCount != preResolveErrorCount) {
+            if (reporter.Count(ErrorLevel.Error) != preResolveErrorCount) {
               break;
             }
             r.PostResolve(m);
           }
-          if (ErrorCount == errorCount && !m.IsAbstract) {
+          if (reporter.Count(ErrorLevel.Error) == errorCount && !m.IsAbstract) {
             // compilation should only proceed if everything is good, including the signature (which preResolveErrorCount does not include);
             Contract.Assert(!useCompileSignatures);
             useCompileSignatures = true;  // set Resolver-global flag to indicate that Signatures should be followed to their CompiledSignature
-            var oldWarnings = ReportWarnings(false);  // turn off warning reporting for the clone
+            var oldErrorsOnly = reporter.ErrorsOnly;
+            reporter.ErrorsOnly = true; // turn off warning reporting for the clone
             var nw = new Cloner().CloneModuleDefinition(m, m.CompileName + "_Compile");
             var compileSig = RegisterTopLevelDecls(nw, true);
             compileSig.Refines = refinementTransformer.RefinedSig;
@@ -394,13 +312,13 @@ namespace Microsoft.Dafny
             ResolveModuleDefinition(nw, compileSig);
             prog.CompileModules.Add(nw);
             useCompileSignatures = false;  // reset the flag
-            ReportWarnings(oldWarnings);
+            reporter.ErrorsOnly = oldErrorsOnly;
           }
         } else if (decl is AliasModuleDecl) {
           var alias = (AliasModuleDecl)decl;
           // resolve the path
           ModuleSignature p;
-          if (ResolvePath(alias.Root, alias.Path, out p, this)) {
+          if (ResolvePath(alias.Root, alias.Path, out p, reporter)) {
             alias.Signature = p;
           } else {
             alias.Signature = new ModuleSignature(); // there was an error, give it a valid but empty signature
@@ -408,18 +326,18 @@ namespace Microsoft.Dafny
         } else if (decl is ModuleFacadeDecl) {
           var abs = (ModuleFacadeDecl)decl;
           ModuleSignature p;
-          if (ResolvePath(abs.Root, abs.Path, out p, this)) {
+          if (ResolvePath(abs.Root, abs.Path, out p, reporter)) {
             abs.OriginalSignature = p;
             // ModuleDefinition.ExclusiveRefinement may not be set at this point but ExclusiveRefinementCount will be.
             if (0 == abs.Root.Signature.ModuleDef.ExclusiveRefinementCount) {
               abs.Signature = MakeAbstractSignature(p, abs.FullCompileName, abs.Height, prog.Modules);
               ModuleSignature compileSig;
               if (abs.CompilePath != null) {
-                if (ResolvePath(abs.CompileRoot, abs.CompilePath, out compileSig, this)) {
+                if (ResolvePath(abs.CompileRoot, abs.CompilePath, out compileSig, reporter)) {
                   if (refinementTransformer.CheckIsRefinement(compileSig, p)) {
                     abs.Signature.CompileSignature = compileSig;
                   } else {
-                    Error(
+                    reporter.Error(MessageSource.Resolver,
                       abs.CompilePath[0],
                       "module " + Util.Comma(".", abs.CompilePath, x => x.val) + " must be a refinement of "
                       + Util.Comma(".", abs.Path, x => x.val));
@@ -437,7 +355,7 @@ namespace Microsoft.Dafny
         } else { Contract.Assert(false); }
         Contract.Assert(decl.Signature != null);
       }
-      if (ErrorCount != origErrorCount) {
+      if (reporter.Count(ErrorLevel.Error) != origErrorCount) {
         // do nothing else
         return;
       }
@@ -493,7 +411,7 @@ namespace Microsoft.Dafny
       }
       foreach (var module in prog.Modules) {
         foreach (var iter in ModuleDefinition.AllIteratorDecls(module.TopLevelDecls)) {
-          ReportAdditionalInformation(iter.tok, Printer.IteratorClassToString(iter), iter.Name.Length);
+          reporter.Info(MessageSource.Resolver, iter.tok, Printer.IteratorClassToString(iter));
         }
       }
       // fill in other additional information
@@ -514,19 +432,19 @@ namespace Microsoft.Dafny
 
       // Determine, for each function, whether someone tries to adjust its fuel parameter
       foreach (var module in prog.Modules) {
-        CheckForFuelAdjustments(module.tok, module.Attributes, module, this);
+        CheckForFuelAdjustments(module.tok, module.Attributes, module);
         foreach (var clbl in ModuleDefinition.AllItersAndCallables(module.TopLevelDecls)) {
           Statement body = null;
           if (clbl is Method) {
             body = ((Method)clbl).Body;
-            CheckForFuelAdjustments(clbl.Tok,((Method)clbl).Attributes, module, this);
+            CheckForFuelAdjustments(clbl.Tok,((Method)clbl).Attributes, module);
           } else if (clbl is IteratorDecl) {
             body = ((IteratorDecl)clbl).Body;
-            CheckForFuelAdjustments(clbl.Tok, ((IteratorDecl)clbl).Attributes, module, this);
+            CheckForFuelAdjustments(clbl.Tok, ((IteratorDecl)clbl).Attributes, module);
           }
           if (body != null) {
             var c = new FuelAdjustment_Visitor(this);
-            c.Visit(body, new FuelAdjustment_Context(module, this));
+            c.Visit(body, new FuelAdjustment_Context(module));
           }
         }
       }
@@ -572,7 +490,7 @@ namespace Microsoft.Dafny
               }
               // Note, in the following line, we use the location information for "clbl", not "m".  These
               // are the same, except in the case where "clbl" is a CoLemma and "m" is a prefix lemma.
-              ReportAdditionalInformation(clbl.Tok, s, clbl.Tok.val.Length);
+              reporter.Info(MessageSource.Resolver, clbl.Tok, s);
             }
           }
         }
@@ -595,7 +513,7 @@ namespace Microsoft.Dafny
       var decr = clbl.Decreases.Expressions;
       if (DafnyOptions.O.Dafnycc) {
         if (decr.Count > 1) {
-          Error(decr[1].tok, "In dafnycc mode, only one decreases expression is allowed");
+          reporter.Error(MessageSource.Resolver, decr[1].tok, "In dafnycc mode, only one decreases expression is allowed");
         }
         // In dafnycc mode, only consider first argument
         if (decr.Count == 0 && clbl.Ins.Count > 0) {
@@ -757,11 +675,11 @@ namespace Microsoft.Dafny
       // resolve
       var datatypeDependencies = new Graph<IndDatatypeDecl>();
       var codatatypeDependencies = new Graph<CoDatatypeDecl>();
-      int prevErrorCount = ErrorCount;
+      int prevErrorCount = reporter.Count(ErrorLevel.Error);
       ResolveTopLevelDecls_Signatures(m, m.TopLevelDecls, datatypeDependencies, codatatypeDependencies);
       ResolveAttributes(m.Attributes, new ResolveOpts(new NoContext(m.Module), false)); // Must follow ResolveTopLevelDecls_Signatures, in case attributes refer to members
-      if (ErrorCount == prevErrorCount) {
-        ResolveTopLevelDecls_Meat(m.TopLevelDecls, datatypeDependencies, codatatypeDependencies);
+      if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
+        ResolveTopLevelDecls_Core(m.TopLevelDecls, datatypeDependencies, codatatypeDependencies);
       }
     }
 
@@ -819,17 +737,17 @@ namespace Microsoft.Dafny
           var subdecl = (LiteralModuleDecl)tld;
           var subBindings = BindModuleNames(subdecl.ModuleDef, bindings);
           if (!bindings.BindName(subdecl.Name, subdecl, subBindings)) {
-            Error(subdecl.tok, "Duplicate module name: {0}", subdecl.Name);
+            reporter.Error(MessageSource.Resolver, subdecl.tok, "Duplicate module name: {0}", subdecl.Name);
           }
         } else if (tld is ModuleFacadeDecl) {
           var subdecl = (ModuleFacadeDecl)tld;
           if (!bindings.BindName(subdecl.Name, subdecl, null)) {
-            Error(subdecl.tok, "Duplicate module name: {0}", subdecl.Name);
+            reporter.Error(MessageSource.Resolver, subdecl.tok, "Duplicate module name: {0}", subdecl.Name);
           }
         } else if (tld is AliasModuleDecl) {
           var subdecl = (AliasModuleDecl)tld;
           if (!bindings.BindName(subdecl.Name, subdecl, null)) {
-            Error(subdecl.tok, "Duplicate module name: {0}", subdecl.Name);
+            reporter.Error(MessageSource.Resolver, subdecl.tok, "Duplicate module name: {0}", subdecl.Name);
           }
         }
       }
@@ -840,9 +758,9 @@ namespace Microsoft.Dafny
       if (m.RefinementBaseName != null) {
         ModuleDecl other;
         if (!bindings.TryLookup(m.RefinementBaseName[0], out other)) {
-          Error(m.RefinementBaseName[0], "module {0} named as refinement base does not exist", m.RefinementBaseName[0].val);
+          reporter.Error(MessageSource.Resolver, m.RefinementBaseName[0], "module {0} named as refinement base does not exist", m.RefinementBaseName[0].val);
         } else if (other is LiteralModuleDecl && ((LiteralModuleDecl)other).ModuleDef == m) {
-          Error(m.RefinementBaseName[0], "module cannot refine itself: {0}", m.RefinementBaseName[0].val);
+          reporter.Error(MessageSource.Resolver, m.RefinementBaseName[0], "module cannot refine itself: {0}", m.RefinementBaseName[0].val);
         } else {
           Contract.Assert(other != null);  // follows from postcondition of TryGetValue
           dependencies.AddEdge(decl, other);
@@ -866,7 +784,7 @@ namespace Microsoft.Dafny
         var alias = moduleDecl as AliasModuleDecl;
         ModuleDecl root;
         if (!bindings.TryLookupIgnore(alias.Path[0], out root, alias))
-          Error(alias.tok, ModuleNotFoundErrorMessage(0, alias.Path));
+          reporter.Error(MessageSource.Resolver, alias.tok, ModuleNotFoundErrorMessage(0, alias.Path));
         else {
           dependencies.AddEdge(moduleDecl, root);
           alias.Root = root;
@@ -875,14 +793,14 @@ namespace Microsoft.Dafny
         var abs = moduleDecl as ModuleFacadeDecl;
         ModuleDecl root;
         if (!bindings.TryLookup(abs.Path[0], out root))
-          Error(abs.tok, ModuleNotFoundErrorMessage(0, abs.Path));
+          reporter.Error(MessageSource.Resolver, abs.tok, ModuleNotFoundErrorMessage(0, abs.Path));
         else {
           dependencies.AddEdge(moduleDecl, root);
           abs.Root = root;
         }
         if (abs.CompilePath != null) {
           if (!bindings.TryLookup(abs.CompilePath[0], out root))
-            Error(abs.tok, ModuleNotFoundErrorMessage(0, abs.CompilePath));
+            reporter.Error(MessageSource.Resolver, abs.tok, ModuleNotFoundErrorMessage(0, abs.CompilePath));
           else {
             dependencies.AddEdge(moduleDecl, root);
             abs.CompileRoot = root;
@@ -990,7 +908,7 @@ namespace Microsoft.Dafny
         Contract.Assert(d != null);
         // register the class/datatype/module name
         if (toplevels.ContainsKey(d.Name)) {
-          Error(d, "Duplicate name of top-level declaration: {0}", d.Name);
+          reporter.Error(MessageSource.Resolver, d, "Duplicate name of top-level declaration: {0}", d.Name);
         } else {
           toplevels[d.Name] = d;
           sig.TopLevels[d.Name] = d;
@@ -1014,7 +932,7 @@ namespace Microsoft.Dafny
           // First, register the iterator's in- and out-parameters as readonly fields
           foreach (var p in iter.Ins) {
             if (members.ContainsKey(p.Name)) {
-              Error(p, "Name of in-parameter is used by another member of the iterator: {0}", p.Name);
+              reporter.Error(MessageSource.Resolver, p, "Name of in-parameter is used by another member of the iterator: {0}", p.Name);
             } else {
               var field = new SpecialField(p.tok, p.Name, p.CompileName, "", "", p.IsGhost, false, false, p.Type, null);
               field.EnclosingClass = iter;  // resolve here
@@ -1024,7 +942,7 @@ namespace Microsoft.Dafny
           }
           foreach (var p in iter.Outs) {
             if (members.ContainsKey(p.Name)) {
-              Error(p, "Name of yield-parameter is used by another member of the iterator: {0}", p.Name);
+              reporter.Error(MessageSource.Resolver, p, "Name of yield-parameter is used by another member of the iterator: {0}", p.Name);
             } else {
               var field = new SpecialField(p.tok, p.Name, p.CompileName, "", "", p.IsGhost, true, true, p.Type, null);
               field.EnclosingClass = iter;  // resolve here
@@ -1036,7 +954,7 @@ namespace Microsoft.Dafny
           foreach (var p in iter.Outs) {
             var nm = p.Name + "s";
             if (members.ContainsKey(nm)) {
-              Error(p.tok, "Name of implicit yield-history variable '{0}' is already used by another member of the iterator", p.Name);
+              reporter.Error(MessageSource.Resolver, p.tok, "Name of implicit yield-history variable '{0}' is already used by another member of the iterator", p.Name);
             } else {
               var tp = new SeqType(p.Type.IsSubrangeType ? new IntType() : p.Type);
               var field = new SpecialField(p.tok, nm, nm, "", "", true, true, false, tp, null);
@@ -1108,7 +1026,7 @@ namespace Microsoft.Dafny
           iter.Member_MoveNext = moveNext;
           MemberDecl member;
           if (members.TryGetValue(init.Name, out member)) {
-            Error(member.tok, "member name '{0}' is already predefined for this iterator", init.Name);
+            reporter.Error(MessageSource.Resolver, member.tok, "member name '{0}' is already predefined for this iterator", init.Name);
           } else {
             members.Add(init.Name, init);
             iter.Members.Add(init);
@@ -1116,13 +1034,13 @@ namespace Microsoft.Dafny
           // If the name of the iterator is "Valid" or "MoveNext", one of the following will produce an error message.  That
           // error message may not be as clear as it could be, but the situation also seems unlikely to ever occur in practice.
           if (members.TryGetValue("Valid", out member)) {
-            Error(member.tok, "member name 'Valid' is already predefined for iterators");
+            reporter.Error(MessageSource.Resolver, member.tok, "member name 'Valid' is already predefined for iterators");
           } else {
             members.Add(valid.Name, valid);
             iter.Members.Add(valid);
           }
           if (members.TryGetValue("MoveNext", out member)) {
-            Error(member.tok, "member name 'MoveNext' is already predefined for iterators");
+            reporter.Error(MessageSource.Resolver, member.tok, "member name 'MoveNext' is already predefined for iterators");
           } else {
             members.Add(moveNext.Name, moveNext);
             iter.Members.Add(moveNext);
@@ -1140,7 +1058,7 @@ namespace Microsoft.Dafny
               members.Add(m.Name, m);
               if (m is Constructor) {
                 if (cl is TraitDecl) {
-                  Error(m.tok, "a trait is not allowed to declare a constructor");
+                  reporter.Error(MessageSource.Resolver, m.tok, "a trait is not allowed to declare a constructor");
                 } else {
                   cl.HasConstructor = true;
                 }
@@ -1196,9 +1114,9 @@ namespace Microsoft.Dafny
                 members.Add(extraName, extraMember);
               }
             } else if (m is Constructor && !((Constructor)m).HasName) {
-              Error(m, "More than one anonymous constructor");
+              reporter.Error(MessageSource.Resolver, m, "More than one anonymous constructor");
             } else {
-              Error(m, "Duplicate member name: {0}", m.Name);
+              reporter.Error(MessageSource.Resolver, m, "Duplicate member name: {0}", m.Name);
             }
           }
           if (cl.IsDefaultClass) {
@@ -1222,9 +1140,9 @@ namespace Microsoft.Dafny
 
           foreach (DatatypeCtor ctor in dt.Ctors) {
             if (ctor.Name.EndsWith("?")) {
-              Error(ctor, "a datatype constructor name is not allowed to end with '?'");
+              reporter.Error(MessageSource.Resolver, ctor, "a datatype constructor name is not allowed to end with '?'");
             } else if (ctors.ContainsKey(ctor.Name)) {
-              Error(ctor, "Duplicate datatype constructor name: {0}", ctor.Name);
+              reporter.Error(MessageSource.Resolver, ctor, "Duplicate datatype constructor name: {0}", ctor.Name);
             } else {
               ctors.Add(ctor.Name, ctor);
 
@@ -1251,7 +1169,7 @@ namespace Microsoft.Dafny
             foreach (var formal in ctor.Formals) {
               bool nameError = false;
               if (formal.HasName && members.ContainsKey(formal.Name)) {
-                Error(ctor, "Name of deconstructor is used by another member of the datatype: {0}", formal.Name);
+                reporter.Error(MessageSource.Resolver, ctor, "Name of deconstructor is used by another member of the datatype: {0}", formal.Name);
                 nameError = true;
               }
               var dtor = new DatatypeDestructor(formal.tok, ctor, formal, formal.Name, "dtor_" + formal.CompileName, "", "", formal.IsGhost, formal.Type, null);
@@ -1301,8 +1219,7 @@ namespace Microsoft.Dafny
     }
 
 
-    public static bool ResolvePath(ModuleDecl root, List<IToken> Path, out ModuleSignature p, ResolutionErrorReporter reporter) {
-      Contract.Requires(reporter != null);
+    public static bool ResolvePath(ModuleDecl root, List<IToken> Path, out ModuleSignature p, ErrorReporter reporter) {
       p = root.Signature;
       int i = 1;
       while (i < Path.Count) {
@@ -1311,7 +1228,7 @@ namespace Microsoft.Dafny
           p = pp;
           i++;
         } else {
-          reporter.Error(Path[i], ModuleNotFoundErrorMessage(i, Path));
+          reporter.Error(MessageSource.Resolver, Path[i], ModuleNotFoundErrorMessage(i, Path));
           break;
         }
       }
@@ -1366,7 +1283,7 @@ namespace Microsoft.Dafny
               {
                 if (!(def.IsDefaultModule)) // _module is allowed to contain abstract modules, but not be abstract itself. Note this presents a challenge to
                                             // trusted verification, as toplevels can't be trusted if they invoke abstract module members.
-                Error(d.tok, "an abstract module can only be imported into other abstract modules, not a concrete one.");
+                  reporter.Error(MessageSource.Resolver, d.tok, "an abstract module can only be imported into other abstract modules, not a concrete one.");
               } else {
                 // physical modules are allowed everywhere
               }
@@ -1392,7 +1309,7 @@ namespace Microsoft.Dafny
       if (cycle != null) {
         Contract.Assert(cycle.Count != 0);
         var erste = cycle[0];
-        Error(erste.Tok, "Cycle among redirecting types (newtypes, type synonyms): {0} -> {1}", Util.Comma(" -> ", cycle, syn => syn.Name), erste.Name);
+        reporter.Error(MessageSource.Resolver, erste.Tok, "Cycle among redirecting types (newtypes, type synonyms): {0} -> {1}", Util.Comma(" -> ", cycle, syn => syn.Name), erste.Name);
       }
     }
 
@@ -1416,14 +1333,14 @@ namespace Microsoft.Dafny
       new NativeType("long", Int64.MinValue, 0x8000000000000000, "L", false),
     };
 
-    public void ResolveTopLevelDecls_Meat(List<TopLevelDecl/*!*/>/*!*/ declarations, Graph<IndDatatypeDecl/*!*/>/*!*/ datatypeDependencies, Graph<CoDatatypeDecl/*!*/>/*!*/ codatatypeDependencies) {
+    public void ResolveTopLevelDecls_Core(List<TopLevelDecl/*!*/>/*!*/ declarations, Graph<IndDatatypeDecl/*!*/>/*!*/ datatypeDependencies, Graph<CoDatatypeDecl/*!*/>/*!*/ codatatypeDependencies) {
       Contract.Requires(declarations != null);
       Contract.Requires(cce.NonNullElements(datatypeDependencies));
       Contract.Requires(cce.NonNullElements(codatatypeDependencies));
       Contract.Requires(NFBC_Count == 0);
       Contract.Ensures(NFBC_Count == 0);
 
-      int prevErrorCount = ErrorCount;
+      int prevErrorCount = reporter.Count(ErrorLevel.Error);
 
       // Resolve the meat of classes and iterators, the definitions of type synonyms, and the type parameters of all top-level type declarations
       // First, resolve the newtype declarations and the constraint clauses, including filling in .ResolvedOp fields.  This is needed for the
@@ -1438,7 +1355,7 @@ namespace Microsoft.Dafny
           ResolveAttributes(d.Attributes, new ResolveOpts(new NoContext(d.Module), false));
           // this check can be done only after it has been determined that the redirected types do not involve cycles
           if (!dd.BaseType.IsNumericBased()) {
-            Error(dd.tok, "newtypes must be based on some numeric type (got {0})", dd.BaseType);
+            reporter.Error(MessageSource.Resolver, dd.tok, "newtypes must be based on some numeric type (got {0})", dd.BaseType);
           }
           // type check the constraint, if any
           if (dd.Var != null) {
@@ -1451,10 +1368,10 @@ namespace Microsoft.Dafny
             ResolveExpression(dd.Constraint, new ResolveOpts(dd, false, true));
             Contract.Assert(dd.Constraint.Type != null);  // follows from postcondition of ResolveExpression
             if (!UnifyTypes(dd.Constraint.Type, Type.Bool)) {
-              Error(dd.Constraint, "newtype constraint must be of type bool (instead got {0})", dd.Constraint.Type);
+              reporter.Error(MessageSource.Resolver, dd.Constraint, "newtype constraint must be of type bool (instead got {0})", dd.Constraint.Type);
             }
             if (!CheckTypeInference_Visitor.IsDetermined(dd.BaseType.NormalizeExpand())) {
-              Error(dd.tok, "newtype's base type is not fully determined; add an explicit type for '{0}'", dd.Var.Name);
+              reporter.Error(MessageSource.Resolver, dd.tok, "newtype's base type is not fully determined; add an explicit type for '{0}'", dd.Var.Name);
             }
             CheckTypeInference(dd.Constraint);
             scope.PopMarker();
@@ -1464,7 +1381,7 @@ namespace Microsoft.Dafny
       // Now, we're ready for the other declarations.
       foreach (TopLevelDecl d in declarations) {
         if (d is TraitDecl && d.TypeArgs.Count > 0) {
-          Error(d, "sorry, traits with type parameters are not supported");
+          reporter.Error(MessageSource.Resolver, d, "sorry, traits with type parameters are not supported");
         }
         allTypeParameters.PushMarker();
         ResolveTypeParameters(d.TypeArgs, false, d);
@@ -1483,15 +1400,15 @@ namespace Microsoft.Dafny
         allTypeParameters.PopMarker();
       }
 
-      if (ErrorCount == prevErrorCount) {
+      if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
         foreach (var e in needFiniteBoundsChecks_SetComprehension) {
           var missingBounds = new List<BoundVar>();
           CheckTypeInference(e.Range);  // we need to resolve operators before the call to DiscoverBounds
-          e.Bounds = DiscoverBounds(e.tok, e.BoundVars, e.Range, true, false, missingBounds);
+          e.Bounds = DiscoverBounds(e.tok, e.BoundVars, e.Range, true, false, missingBounds, reporter);
           if (missingBounds.Count != 0) {
             e.MissingBounds = missingBounds;
             foreach (var bv in e.MissingBounds) {
-              Error(e, "a set comprehension must produce a finite set, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
+              reporter.Error(MessageSource.Resolver, e, "a set comprehension must produce a finite set, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
             }
           }
         }
@@ -1501,11 +1418,11 @@ namespace Microsoft.Dafny
           var constraint = e.RHSs[0];
           var missingBounds = new List<IVariable>();
           CheckTypeInference(constraint);  // we need to resolve operators before the call to DiscoverBounds
-          var allBounds = DiscoverBoundsAux(e.tok, new List<IVariable>(e.BoundVars), constraint, true, true, true, missingBounds);
+          var allBounds = DiscoverBoundsAux(e.tok, new List<IVariable>(e.BoundVars), constraint, true, true, true, missingBounds, reporter);
           if (missingBounds.Count != 0) {
             e.Constraint_MissingBounds = missingBounds;
             foreach (var bv in e.Constraint_MissingBounds) {
-              Error(e, "a non-ghost let-such-that constraint must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
+              reporter.Error(MessageSource.Resolver, e, "a non-ghost let-such-that constraint must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
             }
           } else {
             e.Constraint_Bounds = new List<ComprehensionExpr.BoundedPool>();
@@ -1525,7 +1442,7 @@ namespace Microsoft.Dafny
         nativeTypeMap.Add(nativeType.Name, nativeType);
       }
 
-      if (ErrorCount == prevErrorCount) {
+      if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
         // Check that type inference went well everywhere; this will also fill in the .ResolvedOp field in binary expressions
         foreach (TopLevelDecl d in declarations) {
           if (d is IteratorDecl) {
@@ -1547,7 +1464,7 @@ namespace Microsoft.Dafny
                 Attributes.MatchingValueOption.Empty,
                 Attributes.MatchingValueOption.Bool,
                 Attributes.MatchingValueOption.String },
-              err => Error(dd, err));
+              err => reporter.Error(MessageSource.Resolver, dd, err));
             if (hasNativeTypeAttr) {
               if (nativeTypeAttr is bool) {
                 boolNativeType = (bool)nativeTypeAttr;
@@ -1556,16 +1473,16 @@ namespace Microsoft.Dafny
                 if (nativeTypeMap.ContainsKey(keyString)) {
                   stringNativeType = nativeTypeMap[keyString];
                 } else {
-                  Error(dd, "Unsupported nativeType {0}", keyString);
+                  reporter.Error(MessageSource.Resolver, dd, "Unsupported nativeType {0}", keyString);
                 }
               }
             }
             if (stringNativeType != null || boolNativeType == true) {
               if (!dd.BaseType.IsNumericBased(Type.NumericPersuation.Int)) {
-                Error(dd, "nativeType can only be used on integral types");
+                reporter.Error(MessageSource.Resolver, dd, "nativeType can only be used on integral types");
               }
               if (dd.Var == null) {
-                Error(dd, "nativeType can only be used if newtype specifies a constraint");
+                reporter.Error(MessageSource.Resolver, dd, "nativeType can only be used if newtype specifies a constraint");
               }
             }
             if (dd.Var != null) {
@@ -1588,7 +1505,7 @@ namespace Microsoft.Dafny
               };
               var missingBounds = new List<BoundVar>();
               var bounds = DiscoverBounds(dd.Constraint.tok, new List<BoundVar> { dd.Var }, dd.Constraint,
-                true, true, missingBounds);
+                true, true, missingBounds, reporter);
               List<NativeType> potentialNativeTypes =
                 (stringNativeType != null) ? new List<NativeType> { stringNativeType } :
                 (boolNativeType == false) ? new List<NativeType>() :
@@ -1621,18 +1538,18 @@ namespace Microsoft.Dafny
                 }
               }
               if (dd.NativeType == null && (boolNativeType == true || stringNativeType != null)) {
-                Error(dd, "Dafny's heuristics cannot find a compatible native type.  " +
+                reporter.Error(MessageSource.Resolver, dd, "Dafny's heuristics cannot find a compatible native type.  " +
                   "Hint: try writing a newtype constraint of the form 'i:int | lowerBound <= i < upperBound && (...any additional constraints...)'");
               }
               if (dd.NativeType != null && stringNativeType == null) {
-                ReportAdditionalInformation(dd.tok, "{:nativeType \"" + dd.NativeType.Name + "\"}", dd.tok.val.Length);
+                reporter.Info(MessageSource.Resolver, dd.tok, "{:nativeType \"" + dd.NativeType.Name + "\"}");
               }
             }
           }
         }
       }
 
-      if (ErrorCount == prevErrorCount) {
+      if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
         // fill in the postconditions and bodies of prefix lemmas
         foreach (var com in ModuleDefinition.AllFixpointLemmas(declarations)) {
           var prefixLemma = com.PrefixLemma;
@@ -1646,7 +1563,7 @@ namespace Microsoft.Dafny
             foreach (var p in com.Ens) {
               var coConclusions = new HashSet<Expression>();
               CollectFriendlyCallsInFixpointLemmaSpecification(p.E, true, coConclusions, true);
-              var subst = new FixpointLemmaSpecificationSubstituter(coConclusions, new IdentifierExpr(k.tok, k.Name), this, true);
+              var subst = new FixpointLemmaSpecificationSubstituter(coConclusions, new IdentifierExpr(k.tok, k.Name), this.reporter, true);
               var post = subst.CloneExpr(p.E);
               prefixLemma.Ens.Add(new MaybeFreeExpression(post, p.IsFree));
             }
@@ -1656,7 +1573,7 @@ namespace Microsoft.Dafny
             foreach (var p in com.Req) {
               var antecedents = new HashSet<Expression>();
               CollectFriendlyCallsInFixpointLemmaSpecification(p.E, true, antecedents, false);
-              var subst = new FixpointLemmaSpecificationSubstituter(antecedents, new IdentifierExpr(k.tok, k.Name), this, false);
+              var subst = new FixpointLemmaSpecificationSubstituter(antecedents, new IdentifierExpr(k.tok, k.Name), this.reporter, false);
               var pre = subst.CloneExpr(p.E);
               prefixLemma.Req.Add(new MaybeFreeExpression(pre, p.IsFree));
             }
@@ -1665,7 +1582,7 @@ namespace Microsoft.Dafny
           Contract.Assume(prefixLemma.Body == null);  // this is not supposed to have been filled in before
           if (com.Body != null) {
             var kMinusOne = new BinaryExpr(com.tok, BinaryExpr.Opcode.Sub, new IdentifierExpr(k.tok, k.Name), new LiteralExpr(com.tok, 1));
-            var subst = new FixpointLemmaBodyCloner(com, kMinusOne, this);
+            var subst = new FixpointLemmaBodyCloner(com, kMinusOne, this.reporter);
             var mainBody = subst.CloneBlockStmt(com.Body);
             var kPositive = new BinaryExpr(com.tok, BinaryExpr.Opcode.Lt, new LiteralExpr(com.tok, 0), new IdentifierExpr(k.tok, k.Name));
             var condBody = new IfStmt(com.BodyStartTok, mainBody.EndTok, kPositive, mainBody, null);
@@ -1699,7 +1616,7 @@ namespace Microsoft.Dafny
         }
       }
 
-      if (ErrorCount == prevErrorCount) {  // because CheckCoCalls requires the given expression to have been successfully resolved
+      if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {  // because CheckCoCalls requires the given expression to have been successfully resolved
         // Perform the guardedness check on co-datatypes
         foreach (var repr in ModuleDefinition.AllFunctionSCCs(declarations)) {
           var module = repr.EnclosingModule;
@@ -1734,7 +1651,7 @@ namespace Microsoft.Dafny
               foreach (var c in coCandidates) {
                 c.CandidateCall.CoCall = FunctionCallExpr.CoCallResolution.Yes;
                 c.EnclosingCoConstructor.IsCoCall = true;
-                ReportAdditionalInformation(c.CandidateCall.tok, "co-recursive call", c.CandidateCall.Name.Length);
+                reporter.Info(MessageSource.Resolver, c.CandidateCall.tok, "co-recursive call");
               }
               // Finally, fill in the CoClusterTarget field
               // Start by setting all the CoClusterTarget fields to CoRecursiveTargetAllTheWay.
@@ -1929,11 +1846,11 @@ namespace Microsoft.Dafny
                 // Check here for the presence of any 'ensures' clauses, which are not allowed (because we're not sure
                 // of their soundness)
                 if (fn.Ens.Count != 0) {
-                  Error(fn.Ens[0].tok, "a {0} is not allowed to declare any ensures clause", member.WhatKind);
+                  reporter.Error(MessageSource.Resolver, fn.Ens[0].tok, "a {0} is not allowed to declare any ensures clause", member.WhatKind);
                 }
                 // Also check for 'reads' clauses
                 if (fn.Reads.Count != 0) {
-                  Error(fn.Reads[0].tok, "a {0} is not allowed to declare any reads clause", member.WhatKind);  // (why?)
+                  reporter.Error(MessageSource.Resolver, fn.Reads[0].tok, "a {0} is not allowed to declare any reads clause", member.WhatKind);  // (why?)
                 }
                 if (fn.Body != null) {
                   FixpointPredicateChecks(fn.Body, fn, CallingPosition.Positive);
@@ -1949,7 +1866,7 @@ namespace Microsoft.Dafny
             var dd = (NewtypeDecl)d;
             if (dd.Module.CallGraph.GetSCCSize(dd) != 1) {
               var cycle = Util.Comma(" -> ", dd.Module.CallGraph.GetSCC(dd), clbl => clbl.NameRelativeToModule);
-              Error(dd.tok, "recursive dependency involving a newtype: " + cycle);
+              reporter.Error(MessageSource.Resolver, dd.tok, "recursive dependency involving a newtype: " + cycle);
             }
           }
         }
@@ -1967,45 +1884,14 @@ namespace Microsoft.Dafny
         Contract.Requires(resolver != null);
         this.resolver = resolver;
       }
-      public void Error(IToken tok, string msg, params object[] args) {
-        Contract.Requires(tok != null);
-        Contract.Requires(msg != null);
-        Contract.Requires(args != null);
-        resolver.Error(tok, msg, args);
-      }
-      public void Error(Expression expr, string msg, params object[] args) {
-        Contract.Requires(expr != null);
-        Contract.Requires(msg != null);
-        Contract.Requires(args != null);
-        Error(expr.tok, msg, args);
-      }
     }
     abstract class ResolverTopDownVisitor<T> : TopDownVisitor<T>
     {
-      Resolver resolver;
+      protected Resolver resolver;
       public ResolverTopDownVisitor(Resolver resolver) {
         Contract.Requires(resolver != null);
         this.resolver = resolver;
       }
-      protected void Error(IToken tok, string msg, params object[] args)
-      {
-        Contract.Requires(tok != null);
-        Contract.Requires(msg != null);
-        Contract.Requires(args != null);
-        resolver.Error(tok, msg, args);
-      }
-      protected void Error(Expression expr, string msg, params object[] args)
-      {
-        Contract.Requires(expr != null);
-        Contract.Requires(msg != null);
-        Contract.Requires(args != null);
-        Error(expr.tok, msg, args);
-      }
-      protected void ReportAdditionalInformation(IToken tok, string text, int length)
-      {
-        Contract.Requires(tok != null);
-        resolver.ReportAdditionalInformation(tok, text, length);
-      }
     }
     #endregion Visitors
 
@@ -2027,12 +1913,12 @@ namespace Microsoft.Dafny
           if (hasTailRecursionPreference && !tail) {
             // the user specifically requested no tail recursion, so do nothing else
           } else if (hasTailRecursionPreference && tail && m.IsGhost) {
-            Error(m.tok, "tail recursion can be specified only for methods that will be compiled, not for ghost methods");
+            reporter.Error(MessageSource.Resolver, m.tok, "tail recursion can be specified only for methods that will be compiled, not for ghost methods");
           } else {
             var module = m.EnclosingClass.Module;
             var sccSize = module.CallGraph.GetSCCSize(m);
             if (hasTailRecursionPreference && 2 <= sccSize) {
-              Error(m.tok, "sorry, tail-call optimizations are not supported for mutually recursive methods");
+              reporter.Error(MessageSource.Resolver, m.tok, "sorry, tail-call optimizations are not supported for mutually recursive methods");
             } else if (hasTailRecursionPreference || sccSize == 1) {
               CallStmt tailCall = null;
               var status = CheckTailRecursive(m.Body.Body, m, ref tailCall, hasTailRecursionPreference);
@@ -2040,7 +1926,7 @@ namespace Microsoft.Dafny
                 m.IsTailRecursive = true;
                 if (tailCall != null) {
                   // this means there was at least one recursive call
-                  ReportAdditionalInformation(m.tok, "tail recursive", m.Name.Length);
+                  reporter.Info(MessageSource.Resolver, m.tok, "tail recursive");
                 }
               }
             }
@@ -2048,7 +1934,7 @@ namespace Microsoft.Dafny
         }
       } else if (member is Function) {
         var f = (Function)member;
-        var errorCount = ErrorCount;
+        var errorCount = reporter.Count(ErrorLevel.Error);
         f.Req.Iter(CheckTypeInference);
         f.Ens.Iter(CheckTypeInference);
         f.Reads.Iter(fe => CheckTypeInference(fe.E));
@@ -2057,10 +1943,10 @@ namespace Microsoft.Dafny
           CheckTypeInference(f.Body);
           bool tail = true;
           if (Attributes.ContainsBool(f.Attributes, "tailrecursion", ref tail) && tail) {
-            Error(f.tok, "sorry, tail-call functions are not supported");
+            reporter.Error(MessageSource.Resolver, f.tok, "sorry, tail-call functions are not supported");
           }
         }
-        if (errorCount == ErrorCount && f is FixpointPredicate) {
+        if (errorCount == reporter.Count(ErrorLevel.Error) && f is FixpointPredicate) {
           var cop = (FixpointPredicate)f;
           CheckTypeInference_Member(cop.PrefixPredicate);
         }
@@ -2120,7 +2006,7 @@ namespace Microsoft.Dafny
           if (e != null) {
             foreach (var bv in e.BoundVars) {
               if (!IsDetermined(bv.Type.Normalize())) {
-                Error(bv.tok, "type of bound variable '{0}' could not be determined; please specify the type explicitly",
+                resolver.reporter.Error(MessageSource.Resolver, bv.tok, "type of bound variable '{0}' could not be determined; please specify the type explicitly",
                   bv.Name);
               }
             }
@@ -2130,7 +2016,7 @@ namespace Microsoft.Dafny
           if (e.Member is Function || e.Member is Method) {
             foreach (var p in e.TypeApplication) {
               if (!IsDetermined(p.Normalize())) {
-                Error(e.tok, "type '{0}' to the {2} '{1}' is not determined", p, e.Member.Name, e.Member.WhatKind);
+                resolver.reporter.Error(MessageSource.Resolver, e.tok, "type '{0}' to the {2} '{1}' is not determined", p, e.Member.Name, e.Member.WhatKind);
               }
             }
           }
@@ -2138,7 +2024,7 @@ namespace Microsoft.Dafny
           var e = (FunctionCallExpr)expr;
           foreach (var p in e.TypeArgumentSubstitutions) {
             if (!IsDetermined(p.Value.Normalize())) {
-              Error(e.tok, "type variable '{0}' in the function call to '{1}' could not be determined{2}", p.Key.Name, e.Name,
+              resolver.reporter.Error(MessageSource.Resolver, e.tok, "type variable '{0}' in the function call to '{1}' could not be determined{2}", p.Key.Name, e.Name,
                 (e.Name.Contains("reveal_") || e.Name.Contains("_FULL")) //CLEMENT should this be StartsWith and EndsWith?
                 ? ". If you are making an opaque function, make sure that the function can be called."
                 : ""
@@ -2150,7 +2036,7 @@ namespace Microsoft.Dafny
           foreach (var p in e.LHSs) {
             foreach (var x in p.Vars) {
               if (!IsDetermined(x.Type.Normalize())) {
-                Error(e.tok, "the type of the bound variable '{0}' could not be determined", x.Name);
+                resolver.reporter.Error(MessageSource.Resolver, e.tok, "the type of the bound variable '{0}' could not be determined", x.Name);
               }
             }
           }
@@ -2218,7 +2104,7 @@ namespace Microsoft.Dafny
           var proxy = (TypeProxy)t;
           if (!UnderspecifiedTypeProxies.Contains(proxy)) {
             // report an error for this TypeProxy only once
-            Error(tok, "the type of this {0} is underspecified", what);
+            resolver.reporter.Error(MessageSource.Resolver, tok, "the type of this {0} is underspecified", what);
             UnderspecifiedTypeProxies.Add(proxy);
           }
           return false;
@@ -2274,7 +2160,7 @@ namespace Microsoft.Dafny
           if (status == TailRecursionStatus.TailCallSpent) {
             // a tail call cannot be followed by non-ghost code
             if (reportErrors) {
-              Error(tailCall.Tok, "this recursive call is not recognized as being tail recursive, because it is followed by non-ghost code");
+              reporter.Error(MessageSource.Resolver, tailCall.Tok, "this recursive call is not recognized as being tail recursive, because it is followed by non-ghost code");
             }
             return TailRecursionStatus.NotTailRecursive;
           }
@@ -2322,7 +2208,7 @@ namespace Microsoft.Dafny
                 // all is good
               } else {
                 if (reportErrors) {
-                  Error(s.Tok, "the recursive call to '{0}' is not tail recursive because the actual out-parameter {1} is not the formal out-parameter '{2}'", s.Method.Name, i, formal.Name);
+                  reporter.Error(MessageSource.Resolver, s.Tok, "the recursive call to '{0}' is not tail recursive because the actual out-parameter {1} is not the formal out-parameter '{2}'", s.Method.Name, i, formal.Name);
                 }
                 return TailRecursionStatus.NotTailRecursive;
               }
@@ -2368,7 +2254,7 @@ namespace Microsoft.Dafny
           if (status == TailRecursionStatus.NotTailRecursive) {
             // an error has already been reported
           } else if (reportErrors) {
-            Error(tailCall.Tok, "a recursive call inside a loop is not recognized as being a tail call");
+            reporter.Error(MessageSource.Resolver, tailCall.Tok, "a recursive call inside a loop is not recognized as being a tail call");
           }
           return TailRecursionStatus.NotTailRecursive;
         }
@@ -2380,7 +2266,7 @@ namespace Microsoft.Dafny
             if (status == TailRecursionStatus.NotTailRecursive) {
               // an error has already been reported
             } else if (reportErrors) {
-              Error(tailCall.Tok, "a recursive call inside a loop is not recognized as being a tail call");
+              reporter.Error(MessageSource.Resolver, tailCall.Tok, "a recursive call inside a loop is not recognized as being a tail call");
             }
             return TailRecursionStatus.NotTailRecursive;
           }
@@ -2395,7 +2281,7 @@ namespace Microsoft.Dafny
           if (status == TailRecursionStatus.NotTailRecursive) {
             // an error has already been reported
           } else if (reportErrors) {
-            Error(tailCall.Tok, "a recursive call inside a forall statement is not a tail call");
+            reporter.Error(MessageSource.Resolver, tailCall.Tok, "a recursive call inside a forall statement is not a tail call");
           }
           return TailRecursionStatus.NotTailRecursive;
         }
@@ -2432,7 +2318,7 @@ namespace Microsoft.Dafny
     // ------------------------------------------------------------------------------------------------------
     #region FuelAdjustmentChecks
 
-    protected static void CheckForFuelAdjustments(IToken tok, Attributes attrs, ModuleDefinition currentModule, ResolutionErrorReporter reporter) {
+    protected void CheckForFuelAdjustments(IToken tok, Attributes attrs, ModuleDefinition currentModule) {
       List<List<Expression>> results = Attributes.FindAllExpressions(attrs, "fuel");
 
       if (results != null) {
@@ -2445,7 +2331,7 @@ namespace Microsoft.Dafny
               if (f != null) {
                 f.IsFueled = true;
                 if (f.IsProtected && currentModule != f.EnclosingClass.Module) {
-                  reporter.Error(tok, "cannot adjust fuel for protected function {0} from another module", f.Name);
+                  reporter.Error(MessageSource.Resolver, tok, "cannot adjust fuel for protected function {0} from another module", f.Name);
                 }
               }
             }
@@ -2457,10 +2343,8 @@ namespace Microsoft.Dafny
     public class FuelAdjustment_Context
     {
       public ModuleDefinition currentModule;
-      public ResolutionErrorReporter reporter;
-      public FuelAdjustment_Context(ModuleDefinition currentModule, ResolutionErrorReporter reporter) {
+      public FuelAdjustment_Context(ModuleDefinition currentModule) {
         this.currentModule = currentModule;
-        this.reporter = reporter;
       }
     }
 
@@ -2472,7 +2356,7 @@ namespace Microsoft.Dafny
       }
 
       protected override bool VisitOneStmt(Statement stmt, ref FuelAdjustment_Context st) {
-        Resolver.CheckForFuelAdjustments(stmt.Tok, stmt.Attributes, st.currentModule, st.reporter);
+        resolver.CheckForFuelAdjustments(stmt.Tok, stmt.Attributes, st.currentModule);
         return true;
       }
     }
@@ -2594,7 +2478,7 @@ namespace Microsoft.Dafny
             var article = context is InductivePredicate ? "an" : "a";
             // we're looking at a recursive call
             if (!(context is InductivePredicate ? e.Function is InductivePredicate : e.Function is CoPredicate)) {
-              Error(e, "a recursive call from {0} {1} can go only to other {1}s", article, context.WhatKind);
+              resolver.reporter.Error(MessageSource.Resolver, e, "a recursive call from {0} {1} can go only to other {1}s", article, context.WhatKind);
             } else if (cp != CallingPosition.Positive) {
               var msg = string.Format("{0} {1} can be called recursively only in positive positions", article, context.WhatKind);
               if (cp == CallingPosition.Neither) {
@@ -2603,10 +2487,10 @@ namespace Microsoft.Dafny
               } else {
                 // the fixpoint-call is not inside an quantifier, so don't bother mentioning the part of existentials/universals in the error message
               }
-              Error(e, msg);
+              resolver.reporter.Error(MessageSource.Resolver, e, msg);
             } else {
               e.CoCall = FunctionCallExpr.CoCallResolution.Yes;
-              ReportAdditionalInformation(e.tok, e.Function.Name + "#[_k - 1]", e.Function.Name.Length);
+              resolver.reporter.Info(MessageSource.Resolver, e.tok, e.Function.Name + "#[_k - 1]");
             }
           }
           // do the sub-parts with cp := Neither
@@ -2621,7 +2505,7 @@ namespace Microsoft.Dafny
           if (ModuleDefinition.InSameSCC(context, s.Method)) {
             // we're looking at a recursive call
             var article = context is InductivePredicate ? "an" : "a";
-            Error(stmt.Tok, "a recursive call from {0} {1} can go only to other {1}s", article, context.WhatKind);
+            resolver.reporter.Error(MessageSource.Resolver, stmt.Tok, "a recursive call from {0} {1} can go only to other {1}s", article, context.WhatKind);
           }
           // do the sub-parts with the same "cp"
           return true;
@@ -2662,7 +2546,7 @@ namespace Microsoft.Dafny
             if (ModuleDefinition.InSameSCC(context, s.Method)) {
               // we're looking at a recursive call (to a non-fixpoint-lemma)
               var article = context is InductiveLemma ? "an" : "a";
-              Error(s.Tok, "a recursive call from {0} {1} can go only to other {1}s and prefix lemmas", article, context.WhatKind);
+              resolver.reporter.Error(MessageSource.Resolver, s.Tok, "a recursive call from {0} {1} can go only to other {1}s and prefix lemmas", article, context.WhatKind);
             }
           }
         }
@@ -2674,7 +2558,7 @@ namespace Microsoft.Dafny
           // the call goes from a colemma context to a non-colemma callee
           if (ModuleDefinition.InSameSCC(context, e.Function)) {
             // we're looking at a recursive call (to a non-colemma)
-            Error(e.tok, "a recursive call from a colemma can go only to other colemmas and prefix lemmas");
+            resolver.reporter.Error(MessageSource.Resolver, e.tok, "a recursive call from a colemma can go only to other colemmas and prefix lemmas");
           }
         }
       }
@@ -2733,7 +2617,7 @@ namespace Microsoft.Dafny
           foreach (var formalTypeArg in s.Method.TypeArgs) {
             var actualTypeArg = s.MethodSelect.TypeArgumentSubstitutions()[formalTypeArg];
             if (formalTypeArg.MustSupportEquality && !actualTypeArg.SupportsEquality) {
-              Error(s.Tok, "type parameter {0} ({1}) passed to method {2} must support equality (got {3}){4}", i, formalTypeArg.Name, s.Method.Name, actualTypeArg, TypeEqualityErrorMessageHint(actualTypeArg));
+              resolver.reporter.Error(MessageSource.Resolver, s.Tok, "type parameter {0} ({1}) passed to method {2} must support equality (got {3}){4}", i, formalTypeArg.Name, s.Method.Name, actualTypeArg, TypeEqualityErrorMessageHint(actualTypeArg));
             }
             i++;
           }
@@ -2788,9 +2672,9 @@ namespace Microsoft.Dafny
               } else if (e1 != null && e1.Arguments.Count == 0) {
                 // oh yeah!
               } else if (!t0.SupportsEquality) {
-                Error(e.E0, "{0} can only be applied to expressions of types that support equality (got {1}){2}", BinaryExpr.OpcodeString(e.Op), t0, TypeEqualityErrorMessageHint(t0));
+                resolver.reporter.Error(MessageSource.Resolver, e.E0, "{0} can only be applied to expressions of types that support equality (got {1}){2}", BinaryExpr.OpcodeString(e.Op), t0, TypeEqualityErrorMessageHint(t0));
               } else if (!t1.SupportsEquality) {
-                Error(e.E1, "{0} can only be applied to expressions of types that support equality (got {1}){2}", BinaryExpr.OpcodeString(e.Op), t1, TypeEqualityErrorMessageHint(t1));
+                resolver.reporter.Error(MessageSource.Resolver, e.E1, "{0} can only be applied to expressions of types that support equality (got {1}){2}", BinaryExpr.OpcodeString(e.Op), t1, TypeEqualityErrorMessageHint(t1));
               }
               break;
             default:
@@ -2803,12 +2687,12 @@ namespace Microsoft.Dafny
                 case BinaryExpr.ResolvedOpcode.Prefix:
                 case BinaryExpr.ResolvedOpcode.ProperPrefix:
                   if (!t1.SupportsEquality) {
-                    Error(e.E1, "{0} can only be applied to expressions of sequence types that support equality (got {1}){2}", BinaryExpr.OpcodeString(e.Op), t1, TypeEqualityErrorMessageHint(t1));
+                    resolver.reporter.Error(MessageSource.Resolver, e.E1, "{0} can only be applied to expressions of sequence types that support equality (got {1}){2}", BinaryExpr.OpcodeString(e.Op), t1, TypeEqualityErrorMessageHint(t1));
                   } else if (!t0.SupportsEquality) {
                     if (e.ResolvedOp == BinaryExpr.ResolvedOpcode.InSet || e.ResolvedOp == BinaryExpr.ResolvedOpcode.NotInSeq) {
-                      Error(e.E0, "{0} can only be applied to expressions of types that support equality (got {1}){2}", BinaryExpr.OpcodeString(e.Op), t0, TypeEqualityErrorMessageHint(t0));
+                      resolver.reporter.Error(MessageSource.Resolver, e.E0, "{0} can only be applied to expressions of types that support equality (got {1}){2}", BinaryExpr.OpcodeString(e.Op), t0, TypeEqualityErrorMessageHint(t0));
                     } else {
-                      Error(e.E0, "{0} can only be applied to expressions of sequence types that support equality (got {1}){2}", BinaryExpr.OpcodeString(e.Op), t0, TypeEqualityErrorMessageHint(t0));
+                      resolver.reporter.Error(MessageSource.Resolver, e.E0, "{0} can only be applied to expressions of sequence types that support equality (got {1}){2}", BinaryExpr.OpcodeString(e.Op), t0, TypeEqualityErrorMessageHint(t0));
                     }
                   }
                   break;
@@ -2834,7 +2718,7 @@ namespace Microsoft.Dafny
             foreach (var tp in ((ICallable)e.Member).TypeArgs) {
               var actualTp = e.TypeApplication[e.Member.EnclosingClass.TypeArgs.Count + i];
               if (tp.MustSupportEquality && !actualTp.SupportsEquality) {
-                Error(e.tok, "type parameter {0} ({1}) passed to {5} '{2}' must support equality (got {3}){4}", i, tp.Name, e.Member.Name, actualTp, TypeEqualityErrorMessageHint(actualTp), e.Member.WhatKind);
+                resolver.reporter.Error(MessageSource.Resolver, e.tok, "type parameter {0} ({1}) passed to {5} '{2}' must support equality (got {3}){4}", i, tp.Name, e.Member.Name, actualTp, TypeEqualityErrorMessageHint(actualTp), e.Member.WhatKind);
               }
               i++;
             }
@@ -2846,7 +2730,7 @@ namespace Microsoft.Dafny
           foreach (var formalTypeArg in e.Function.TypeArgs) {
             var actualTypeArg = e.TypeArgumentSubstitutions[formalTypeArg];
             if (formalTypeArg.MustSupportEquality && !actualTypeArg.SupportsEquality) {
-              Error(e.tok, "type parameter {0} ({1}) passed to function {2} must support equality (got {3}){4}", i, formalTypeArg.Name, e.Function.Name, actualTypeArg, TypeEqualityErrorMessageHint(actualTypeArg));
+              resolver.reporter.Error(MessageSource.Resolver, e.tok, "type parameter {0} ({1}) passed to function {2} must support equality (got {3}){4}", i, formalTypeArg.Name, e.Function.Name, actualTypeArg, TypeEqualityErrorMessageHint(actualTypeArg));
             }
             i++;
           }
@@ -2878,21 +2762,21 @@ namespace Microsoft.Dafny
           var st = (SetType)type;
           var argType = st.Arg;
           if (!argType.SupportsEquality) {
-            Error(tok, "{2}set argument type must support equality (got {0}){1}", argType, TypeEqualityErrorMessageHint(argType), st.Finite ? "" : "i");
+            resolver.reporter.Error(MessageSource.Resolver, tok, "{2}set argument type must support equality (got {0}){1}", argType, TypeEqualityErrorMessageHint(argType), st.Finite ? "" : "i");
           }
           CheckEqualityTypes_Type(tok, argType);
 
         } else if (type is MultiSetType) {
           var argType = ((MultiSetType)type).Arg;
           if (!argType.SupportsEquality) {
-            Error(tok, "multiset argument type must support equality (got {0}){1}", argType, TypeEqualityErrorMessageHint(argType));
+            resolver.reporter.Error(MessageSource.Resolver, tok, "multiset argument type must support equality (got {0}){1}", argType, TypeEqualityErrorMessageHint(argType));
           }
           CheckEqualityTypes_Type(tok, argType);
 
         } else if (type is MapType) {
           var mt = (MapType)type;
           if (!mt.Domain.SupportsEquality) {
-            Error(tok, "{2}map domain type must support equality (got {0}){1}", mt.Domain, TypeEqualityErrorMessageHint(mt.Domain), mt.Finite ? "" : "i");
+            resolver.reporter.Error(MessageSource.Resolver, tok, "{2}map domain type must support equality (got {0}){1}", mt.Domain, TypeEqualityErrorMessageHint(mt.Domain), mt.Finite ? "" : "i");
           }
           CheckEqualityTypes_Type(tok, mt.Domain);
           CheckEqualityTypes_Type(tok, mt.Range);
@@ -2918,7 +2802,7 @@ namespace Microsoft.Dafny
             foreach (var argType in udt.TypeArgs) {
               var formalTypeArg = formalTypeArgs[i];
               if (formalTypeArg.MustSupportEquality && !argType.SupportsEquality) {
-                Error(tok, "type parameter {0} ({1}) passed to type {2} must support equality (got {3}){4}", i, formalTypeArg.Name, udt.ResolvedClass.Name, argType, TypeEqualityErrorMessageHint(argType));
+                resolver.reporter.Error(MessageSource.Resolver, tok, "type parameter {0} ({1}) passed to type {2} must support equality (got {3}){4}", i, formalTypeArg.Name, udt.ResolvedClass.Name, argType, TypeEqualityErrorMessageHint(argType));
               }
               CheckEqualityTypes_Type(tok, argType);
               i++;
@@ -3007,10 +2891,10 @@ namespace Microsoft.Dafny
             for (int i = 0; i < cs.Method.Ins.Count; i++) {
               argsSubstMap.Add(cs.Method.Ins[i], cs.Args[i]);
             }
-            var substituter = new Translator.AlphaConverting_Substituter(cs.Receiver, argsSubstMap, new Dictionary<TypeParameter, Type>(), new Translator());
+            var substituter = new Translator.AlphaConverting_Substituter(cs.Receiver, argsSubstMap, new Dictionary<TypeParameter, Type>(), new Translator(resolver.reporter));
             foreach (var ens in cs.Method.Ens) {
               var p = substituter.Substitute(ens.E);  // substitute the call's actuals for the method's formals
-              resolver.ReportAdditionalInformation(s.Tok, "ensures " + Printer.ExprToString(p) + ";", s.Tok.val.Length);
+              resolver.reporter.Info(MessageSource.Resolver, s.Tok, "ensures " + Printer.ExprToString(p) + ";");
             }
           }
         }
@@ -3088,26 +2972,26 @@ namespace Microsoft.Dafny
       currentClass = cl;
 
       if (cl.TraitsTyp.Count > 0 && cl.TypeArgs.Count > 0) {
-        Error(cl.tok, "sorry, traits are currently supported only for classes that take no type arguments");  // TODO: do the work to remove this limitation
+        reporter.Error(MessageSource.Resolver, cl.tok, "sorry, traits are currently supported only for classes that take no type arguments");  // TODO: do the work to remove this limitation
       }
 
       // Resolve names of traits extended
       foreach (var tt in cl.TraitsTyp) {
-        var prevErrorCount = ErrorCount;
+        var prevErrorCount = reporter.Count(ErrorLevel.Error);
         ResolveType(cl.tok, tt, new NoContext(cl.Module), ResolveTypeOptionEnum.DontInfer, null);
-        if (ErrorCount == prevErrorCount) {
+        if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
           var udt = tt as UserDefinedType;
           if (udt != null && udt.ResolvedClass is TraitDecl) {
             var trait = (TraitDecl)udt.ResolvedClass;
             //disallowing inheritance in multi module case
             if (cl.Module != trait.Module) {
-              Error(udt.tok, "class '{0}' is in a different module than trait '{1}'. A class may only extend a trait in the same module.", cl.Name, trait.FullName);
+              reporter.Error(MessageSource.Resolver, udt.tok, "class '{0}' is in a different module than trait '{1}'. A class may only extend a trait in the same module.", cl.Name, trait.FullName);
             } else {
               // all is good
               cl.TraitsObj.Add(trait);
             }
           } else {
-            Error(udt != null ? udt.tok : cl.tok, "a class can only extend traits (found '{0}')", tt);
+            reporter.Error(MessageSource.Resolver, udt != null ? udt.tok : cl.tok, "a class can only extend traits (found '{0}')", tt);
           }
         }
       }
@@ -3150,12 +3034,12 @@ namespace Microsoft.Dafny
 
         } else if (member is Function) {
           var f = (Function)member;
-          var ec = ErrorCount;
+          var ec = reporter.Count(ErrorLevel.Error);
           allTypeParameters.PushMarker();
           ResolveTypeParameters(f.TypeArgs, true, f);
           ResolveFunctionSignature(f);
           allTypeParameters.PopMarker();
-          if (f is FixpointPredicate && ec == ErrorCount) {
+          if (f is FixpointPredicate && ec == reporter.Count(ErrorLevel.Error)) {
             var ff = ((FixpointPredicate)f).PrefixPredicate;
             ff.EnclosingClass = cl;
             allTypeParameters.PushMarker();
@@ -3166,13 +3050,13 @@ namespace Microsoft.Dafny
 
         } else if (member is Method) {
           var m = (Method)member;
-          var ec = ErrorCount;
+          var ec = reporter.Count(ErrorLevel.Error);
           allTypeParameters.PushMarker();
           ResolveTypeParameters(m.TypeArgs, true, m);
           ResolveMethodSignature(m);
           allTypeParameters.PopMarker();
           var com = m as FixpointLemma;
-          if (com != null && com.PrefixLemma != null && ec == ErrorCount) {
+          if (com != null && com.PrefixLemma != null && ec == reporter.Count(ErrorLevel.Error)) {
             var mm = com.PrefixLemma;
             // resolve signature of the prefix lemma
             mm.EnclosingClass = cl;
@@ -3193,7 +3077,7 @@ namespace Microsoft.Dafny
     void InheritTraitMembers(ClassDecl cl) {
       Contract.Requires(cl != null);
 
-      var refinementTransformer = new RefinementTransformer(this, AdditionalInformationReporter, null);
+      var refinementTransformer = new RefinementTransformer(reporter);
       //merging class members with parent members if any
       var clMembers = classMembers[cl];
       foreach (TraitDecl trait in cl.TraitsObj) {
@@ -3213,37 +3097,37 @@ namespace Microsoft.Dafny
             } else if (traitMember is Function) {
               var func = (Function)traitMember;
               if (func.Body == null) {
-                Error(cl.tok, "class '{0}' does not implement trait function '{1}.{2}'", cl.Name, trait.Name, traitMember.Name);
+                reporter.Error(MessageSource.Resolver, cl.tok, "class '{0}' does not implement trait function '{1}.{2}'", cl.Name, trait.Name, traitMember.Name);
               } else if (!func.IsGhost && !func.IsStatic) {
                 cl.InheritedMembers.Add(func);
               }
             } else if (traitMember is Method) {
               var method = (Method)traitMember;
               if (method.Body == null) {
-                Error(cl.tok, "class '{0}' does not implement trait method '{1}.{2}'", cl.Name, trait.Name, traitMember.Name);
+                reporter.Error(MessageSource.Resolver, cl.tok, "class '{0}' does not implement trait method '{1}.{2}'", cl.Name, trait.Name, traitMember.Name);
               } else if (!method.IsGhost && !method.IsStatic) {
                 cl.InheritedMembers.Add(method);
               }
             }
           } else if (clMember.EnclosingClass != cl) {
             // The class inherits the member from two places
-            Error(clMember.tok, "member name '{0}' in class '{1}' inherited from both traits '{2}' and '{3}'", traitMember.Name, cl.Name, clMember.EnclosingClass.Name, trait.Name);
+            reporter.Error(MessageSource.Resolver, clMember.tok, "member name '{0}' in class '{1}' inherited from both traits '{2}' and '{3}'", traitMember.Name, cl.Name, clMember.EnclosingClass.Name, trait.Name);
 
           } else if (traitMember is Field) {
             // The class is not allowed to do anything with the field other than silently inherit it.
             if (clMember is Field) {
-              Error(clMember.tok, "field '{0}' is inherited from trait '{1}' and is not allowed to be re-declared", traitMember.Name, trait.Name);
+              reporter.Error(MessageSource.Resolver, clMember.tok, "field '{0}' is inherited from trait '{1}' and is not allowed to be re-declared", traitMember.Name, trait.Name);
             } else {
-              Error(clMember.tok, "member name '{0}' in class '{1}' clashes with inherited field from trait '{2}'", traitMember.Name, cl.Name, trait.Name);
+              reporter.Error(MessageSource.Resolver, clMember.tok, "member name '{0}' in class '{1}' clashes with inherited field from trait '{2}'", traitMember.Name, cl.Name, trait.Name);
             }
 
           } else if (traitMember is Method) {
             var traitMethod = (Method)traitMember;
             if (traitMethod.Body != null) {
               // The method was defined in the trait, so the class is not allowed to do anything with the method other than silently inherit it.
-              Error(clMember.tok, "member '{0}' in class '{1}' overrides fully defined method inherited from trait '{2}'", clMember.Name, cl.Name, trait.Name);
+              reporter.Error(MessageSource.Resolver, clMember.tok, "member '{0}' in class '{1}' overrides fully defined method inherited from trait '{2}'", clMember.Name, cl.Name, trait.Name);
             } else if (!(clMember is Method)) {
-              Error(clMember.tok, "non-method member '{0}' overrides method '{1}' inherited from trait '{2}'", clMember.Name, traitMethod.Name, trait.Name);
+              reporter.Error(MessageSource.Resolver, clMember.tok, "non-method member '{0}' overrides method '{1}' inherited from trait '{2}'", clMember.Name, traitMethod.Name, trait.Name);
             } else {
               var classMethod = (Method)clMember;
               classMethod.OverriddenMethod = traitMethod;
@@ -3255,7 +3139,7 @@ namespace Microsoft.Dafny
               var traitMethodAllowsNonTermination = Contract.Exists(traitMethod.Decreases.Expressions, e => e is WildcardExpr);
               var classMethodAllowsNonTermination = Contract.Exists(classMethod.Decreases.Expressions, e => e is WildcardExpr);
               if (classMethodAllowsNonTermination && !traitMethodAllowsNonTermination) {
-                Error(classMethod.tok, "not allowed to override a terminating method with a possibly non-terminating method ('{0}')", classMethod.Name);
+                reporter.Error(MessageSource.Resolver, classMethod.tok, "not allowed to override a terminating method with a possibly non-terminating method ('{0}')", classMethod.Name);
               }
             }
 
@@ -3263,9 +3147,9 @@ namespace Microsoft.Dafny
             var traitFunction = (Function)traitMember;
             if (traitFunction.Body != null) {
               // The function was defined in the trait, so the class is not allowed to do anything with the function other than silently inherit it.
-              Error(clMember.tok, "member '{0}' in class '{1}' overrides fully defined function inherited from trait '{2}'", clMember.Name, cl.Name, trait.Name);
+              reporter.Error(MessageSource.Resolver, clMember.tok, "member '{0}' in class '{1}' overrides fully defined function inherited from trait '{2}'", clMember.Name, cl.Name, trait.Name);
             } else if (!(clMember is Function)) {
-              Error(clMember.tok, "non-function member '{0}' overrides function '{1}' inherited from trait '{2}'", clMember.Name, traitFunction.Name, trait.Name);
+              reporter.Error(MessageSource.Resolver, clMember.tok, "non-function member '{0}' overrides function '{1}' inherited from trait '{2}'", clMember.Name, traitFunction.Name, trait.Name);
             } else {
               var classFunction = (Function)clMember;
               classFunction.OverriddenFunction = traitFunction;
@@ -3298,12 +3182,12 @@ namespace Microsoft.Dafny
 
         } else if (member is Function) {
           var f = (Function)member;
-          var ec = ErrorCount;
+          var ec = reporter.Count(ErrorLevel.Error);
           allTypeParameters.PushMarker();
           ResolveTypeParameters(f.TypeArgs, false, f);
           ResolveFunction(f);
           allTypeParameters.PopMarker();
-          if (f is FixpointPredicate && ec == ErrorCount) {
+          if (f is FixpointPredicate && ec == reporter.Count(ErrorLevel.Error)) {
             var ff = ((FixpointPredicate)f).PrefixPredicate;
             allTypeParameters.PushMarker();
             ResolveTypeParameters(ff.TypeArgs, false, ff);
@@ -3313,7 +3197,7 @@ namespace Microsoft.Dafny
 
         } else if (member is Method) {
           var m = (Method)member;
-          var ec = ErrorCount;
+          var ec = reporter.Count(ErrorLevel.Error);
           allTypeParameters.PushMarker();
           ResolveTypeParameters(m.TypeArgs, false, m);
           ResolveMethod(m);
@@ -3420,7 +3304,7 @@ namespace Microsoft.Dafny
           // whatever is in scc-cleared now failed to pass the test
           foreach (var dt in scc) {
             if (dt.DefaultCtor == null) {
-              Error(dt, "because of cyclic dependencies among constructor argument types, no instances of datatype '{0}' can be constructed", dt.Name);
+              reporter.Error(MessageSource.Resolver, dt, "because of cyclic dependencies among constructor argument types, no instances of datatype '{0}' can be constructed", dt.Name);
             }
           }
           return;
@@ -3598,12 +3482,12 @@ namespace Microsoft.Dafny
       Contract.Requires(args != null);
       foreach (var arg in args) {
         Contract.Assert(arg != null);
-        int prevErrors = ErrorCount;
+        int prevErrors = reporter.Count(ErrorLevel.Error);
         ResolveExpression(arg, opts);
         if (!allowGhosts) {
           CheckIsNonGhost(arg);
         }
-        if (prevErrors == ErrorCount) {
+        if (prevErrors == reporter.Count(ErrorLevel.Error)) {
           CheckTypeInference(arg);
         }
       }
@@ -3623,9 +3507,9 @@ namespace Microsoft.Dafny
         var r = allTypeParameters.Push(tp.Name, tp);
         if (emitErrors) {
           if (r == Scope<TypeParameter>.PushResult.Duplicate) {
-            Error(tp, "Duplicate type-parameter name: {0}", tp.Name);
+            reporter.Error(MessageSource.Resolver, tp, "Duplicate type-parameter name: {0}", tp.Name);
           } else if (r == Scope<TypeParameter>.PushResult.Shadow) {
-            Warning(tp.tok, "Shadowed type-parameter name: {0}", tp.Name);
+            reporter.Warning(MessageSource.Resolver, tp.tok, "Shadowed type-parameter name: {0}", tp.Name);
           }
         }
       }
@@ -3649,10 +3533,10 @@ namespace Microsoft.Dafny
         case Scope<Thing>.PushResult.Success:
           break;
         case Scope<Thing>.PushResult.Duplicate:
-          Error(tok, "Duplicate {0} name: {1}", kind, name);
+          reporter.Error(MessageSource.Resolver, tok, "Duplicate {0} name: {1}", kind, name);
           break;
         case Scope<Thing>.PushResult.Shadow:
-          Warning(tok, "Shadowed {0} name: {1}", kind, name);
+          reporter.Warning(MessageSource.Resolver, tok, "Shadowed {0} name: {1}", kind, name);
           break;
       }
     }
@@ -3664,7 +3548,7 @@ namespace Microsoft.Dafny
       Contract.Requires(f != null);
       scope.PushMarker();
       if (f.SignatureIsOmitted) {
-        Error(f, "function signature can be omitted only in refining functions");
+        reporter.Error(MessageSource.Resolver, f, "function signature can be omitted only in refining functions");
       }
       var option = f.TypeArgs.Count == 0 ? new ResolveTypeOption(f) : new ResolveTypeOption(ResolveTypeOptionEnum.AllowPrefix);
       foreach (Formal p in f.Formals) {
@@ -3692,7 +3576,7 @@ namespace Microsoft.Dafny
         ResolveExpression(r, new ResolveOpts(f, false, true));
         Contract.Assert(r.Type != null);  // follows from postcondition of ResolveExpression
         if (!UnifyTypes(r.Type, Type.Bool)) {
-          Error(r, "Precondition must be a boolean (got {0})", r.Type);
+          reporter.Error(MessageSource.Resolver, r, "Precondition must be a boolean (got {0})", r.Type);
         }
       }
       foreach (FrameExpression fr in f.Reads) {
@@ -3702,7 +3586,7 @@ namespace Microsoft.Dafny
         ResolveExpression(r, new ResolveOpts(f, false, true));  // since this is a function, the postcondition is still a one-state predicate
         Contract.Assert(r.Type != null);  // follows from postcondition of ResolveExpression
         if (!UnifyTypes(r.Type, Type.Bool)) {
-          Error(r, "Postcondition must be a boolean (got {0})", r.Type);
+          reporter.Error(MessageSource.Resolver, r, "Postcondition must be a boolean (got {0})", r.Type);
         }
       }
       ResolveAttributes(f.Decreases.Attributes, new ResolveOpts(f, false, true));
@@ -3711,14 +3595,14 @@ namespace Microsoft.Dafny
         // any type is fine
       }
       if (f.Body != null) {
-        var prevErrorCount = ErrorCount;
+        var prevErrorCount = reporter.Count(ErrorLevel.Error);
         ResolveExpression(f.Body, new ResolveOpts(f, false));
-        if (!f.IsGhost && prevErrorCount == ErrorCount) {
+        if (!f.IsGhost && prevErrorCount == reporter.Count(ErrorLevel.Error)) {
           CheckIsNonGhost(f.Body);
         }
         Contract.Assert(f.Body.Type != null);  // follows from postcondition of ResolveExpression
         if (!UnifyTypes(f.Body.Type, f.ResultType)) {
-          Error(f, "Function body type mismatch (expected {0}, got {1})", f.ResultType, f.Body.Type);
+          reporter.Error(MessageSource.Resolver, f, "Function body type mismatch (expected {0}, got {1})", f.ResultType, f.Body.Type);
         }
       }
       scope.PopMarker();
@@ -3746,7 +3630,7 @@ namespace Microsoft.Dafny
         t = collType.Arg;
       }
       if (!UnifyTypes(t, new ObjectType())) {
-        Error(fe.E, "a {0}-clause expression must denote an object or a collection of objects (instead got {1})", readsFrame ? "reads" : "modifies", fe.E.Type);
+        reporter.Error(MessageSource.Resolver, fe.E, "a {0}-clause expression must denote an object or a collection of objects (instead got {1})", readsFrame ? "reads" : "modifies", fe.E.Type);
       } else if (fe.FieldName != null) {
         NonProxyType nptype;
         MemberDecl member = ResolveMember(fe.E.tok, t, fe.FieldName, out nptype);
@@ -3754,9 +3638,9 @@ namespace Microsoft.Dafny
         if (member == null) {
           // error has already been reported by ResolveMember
         } else if (!(member is Field)) {
-          Error(fe.E, "member {0} in type {1} does not refer to a field", fe.FieldName, ctype.Name);
+          reporter.Error(MessageSource.Resolver, fe.E, "member {0} in type {1} does not refer to a field", fe.FieldName, ctype.Name);
         } else if (!readsFrame && isGhostContext && !member.IsGhost) {
-          Error(fe.E, "in a ghost context, only ghost fields can be mentioned as modifies frame targets ({0})", fe.FieldName);
+          reporter.Error(MessageSource.Resolver, fe.E, "in a ghost context, only ghost fields can be mentioned as modifies frame targets ({0})", fe.FieldName);
         } else {
           Contract.Assert(ctype != null && ctype.ResolvedClass != null);  // follows from postcondition of ResolveMember
           fe.Field = (Field)member;
@@ -3771,7 +3655,7 @@ namespace Microsoft.Dafny
       Contract.Requires(m != null);
       scope.PushMarker();
       if (m.SignatureIsOmitted) {
-        Error(m, "method signature can be omitted only in refining methods");
+        reporter.Error(MessageSource.Resolver, m, "method signature can be omitted only in refining methods");
       }
       var option = m.TypeArgs.Count == 0 ? new ResolveTypeOption(m) : new ResolveTypeOption(ResolveTypeOptionEnum.AllowPrefix);
       // resolve in-parameters
@@ -3812,14 +3696,14 @@ namespace Microsoft.Dafny
           ResolveExpression(e.E, new ResolveOpts(m, false, true));
           Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
           if (!UnifyTypes(e.E.Type, Type.Bool)) {
-            Error(e.E, "Precondition must be a boolean (got {0})", e.E.Type);
+            reporter.Error(MessageSource.Resolver, e.E, "Precondition must be a boolean (got {0})", e.E.Type);
           }
         }
         ResolveAttributes(m.Mod.Attributes, new ResolveOpts(m, false, true));
         foreach (FrameExpression fe in m.Mod.Expressions) {
           ResolveFrameExpression(fe, false, m.IsGhost, m);
           if (m is Lemma || m is FixpointLemma) {
-            Error(fe.tok, "{0}s are not allowed to have modifies clauses", m.WhatKind);
+            reporter.Error(MessageSource.Resolver, fe.tok, "{0}s are not allowed to have modifies clauses", m.WhatKind);
           }
         }
         ResolveAttributes(m.Decreases.Attributes, new ResolveOpts(m, false, true));
@@ -3827,7 +3711,7 @@ namespace Microsoft.Dafny
           ResolveExpression(e, new ResolveOpts(m, false, true));
           // any type is fine
           if (m.IsGhost && e is WildcardExpr) {
-            Error(e, "'decreases *' is not allowed on ghost methods");
+            reporter.Error(MessageSource.Resolver, e, "'decreases *' is not allowed on ghost methods");
           }
         }
 
@@ -3835,7 +3719,7 @@ namespace Microsoft.Dafny
         // Don't care about any duplication errors among the out-parameters, since they have already been reported
         scope.PushMarker();
         if (m is FixpointLemma && m.Outs.Count != 0) {
-          Error(m.Outs[0].tok, "{0}s are not allowed to have out-parameters", m.WhatKind);
+          reporter.Error(MessageSource.Resolver, m.Outs[0].tok, "{0}s are not allowed to have out-parameters", m.WhatKind);
         } else {
           foreach (Formal p in m.Outs) {
             scope.Push(p.Name, p);
@@ -3848,7 +3732,7 @@ namespace Microsoft.Dafny
           ResolveExpression(e.E, new ResolveOpts(m, true, true));
           Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
           if (!UnifyTypes(e.E.Type, Type.Bool)) {
-            Error(e.E, "Postcondition must be a boolean (got {0})", e.E.Type);
+            reporter.Error(MessageSource.Resolver, e.E, "Postcondition must be a boolean (got {0})", e.E.Type);
           }
         }
 
@@ -3896,7 +3780,7 @@ namespace Microsoft.Dafny
       Contract.Requires(iter != null);
       scope.PushMarker();
       if (iter.SignatureIsOmitted) {
-        Error(iter, "iterator signature can be omitted only in refining methods");
+        reporter.Error(MessageSource.Resolver, iter, "iterator signature can be omitted only in refining methods");
       }
       var option = iter.TypeArgs.Count == 0 ? new ResolveTypeOption(iter) : new ResolveTypeOption(ResolveTypeOptionEnum.AllowPrefix);
       // resolve the types of the parameters
@@ -3918,7 +3802,7 @@ namespace Microsoft.Dafny
       Contract.Requires(currentClass == null);
       Contract.Ensures(currentClass == null);
 
-      var initialErrorCount = ErrorCount;
+      var initialErrorCount = reporter.Count(ErrorLevel.Error);
 
       // Add in-parameters to the scope, but don't care about any duplication errors, since they have already been reported
       scope.PushMarker();
@@ -3937,7 +3821,7 @@ namespace Microsoft.Dafny
         var d = iter.DecreasesFields[i];
         if (!UnifyTypes(d.Type, e.Type)) {
           // bummer, there was a use--and a bad use--of the field before, so this won't be the best of error messages
-          Error(e, "type of field {0} is {1}, but has been constrained elsewhere to be of type {2}", d.Name, e.Type, d.Type);
+          reporter.Error(MessageSource.Resolver, e, "type of field {0} is {1}, but has been constrained elsewhere to be of type {2}", d.Name, e.Type, d.Type);
         }
       }
       foreach (FrameExpression fe in iter.Reads.Expressions) {
@@ -3950,7 +3834,7 @@ namespace Microsoft.Dafny
         ResolveExpression(e.E, new ResolveOpts(iter, false, true));
         Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
         if (!UnifyTypes(e.E.Type, Type.Bool)) {
-          Error(e.E, "Precondition must be a boolean (got {0})", e.E.Type);
+          reporter.Error(MessageSource.Resolver, e.E, "Precondition must be a boolean (got {0})", e.E.Type);
         }
       }
 
@@ -3966,27 +3850,27 @@ namespace Microsoft.Dafny
         ResolveExpression(e.E, new ResolveOpts(iter, false, true));
         Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
         if (!UnifyTypes(e.E.Type, Type.Bool)) {
-          Error(e.E, "Yield precondition must be a boolean (got {0})", e.E.Type);
+          reporter.Error(MessageSource.Resolver, e.E, "Yield precondition must be a boolean (got {0})", e.E.Type);
         }
       }
       foreach (MaybeFreeExpression e in iter.YieldEnsures) {
         ResolveExpression(e.E, new ResolveOpts(iter, true, true));
         Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
         if (!UnifyTypes(e.E.Type, Type.Bool)) {
-          Error(e.E, "Yield postcondition must be a boolean (got {0})", e.E.Type);
+          reporter.Error(MessageSource.Resolver, e.E, "Yield postcondition must be a boolean (got {0})", e.E.Type);
         }
       }
       foreach (MaybeFreeExpression e in iter.Ensures) {
         ResolveExpression(e.E, new ResolveOpts(iter, true, true));
         Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
         if (!UnifyTypes(e.E.Type, Type.Bool)) {
-          Error(e.E, "Postcondition must be a boolean (got {0})", e.E.Type);
+          reporter.Error(MessageSource.Resolver, e.E, "Postcondition must be a boolean (got {0})", e.E.Type);
         }
       }
 
       ResolveAttributes(iter.Attributes, new ResolveOpts(iter, false, true));
 
-      var postSpecErrorCount = ErrorCount;
+      var postSpecErrorCount = reporter.Count(ErrorLevel.Error);
 
       // Resolve body
       if (iter.Body != null) {
@@ -4031,7 +3915,7 @@ namespace Microsoft.Dafny
       Expression frameSet = new SetDisplayExpr(iter.tok, true, modSetSingletons);
       foreach (var fr in iter.Reads.Expressions) {
         if (fr.FieldName != null) {
-          Error(fr.tok, "sorry, a reads clause for an iterator is not allowed to designate specific fields");
+          reporter.Error(MessageSource.Resolver, fr.tok, "sorry, a reads clause for an iterator is not allowed to designate specific fields");
         } else if (fr.E.Type.IsRefType) {
           modSetSingletons.Add(fr.E);
         } else {
@@ -4046,7 +3930,7 @@ namespace Microsoft.Dafny
       frameSet = new SetDisplayExpr(iter.tok, true, modSetSingletons);
       foreach (var fr in iter.Modifies.Expressions) {
         if (fr.FieldName != null) {
-          Error(fr.tok, "sorry, a modifies clause for an iterator is not allowed to designate specific fields");
+          reporter.Error(MessageSource.Resolver, fr.tok, "sorry, a modifies clause for an iterator is not allowed to designate specific fields");
         } else if (fr.E.Type.IsRefType) {
           modSetSingletons.Add(fr.E);
         } else {
@@ -4232,7 +4116,7 @@ namespace Microsoft.Dafny
         // nothing to resolve
       } else if (type is MapType) {
         var mt = (MapType)type;
-        var errorCount = ErrorCount;
+        var errorCount = reporter.Count(ErrorLevel.Error);
         int typeArgumentCount = 0;
         if (mt.HasTypeArg()) {
           ResolveType(tok, mt.Domain, context, option, defaultTypeArguments);
@@ -4253,19 +4137,19 @@ namespace Microsoft.Dafny
         }
         // defaults and auto have been applied; check if we now have the right number of arguments
         if (2 != typeArgumentCount) {
-          Error(tok, "Wrong number of type arguments ({0} instead of 2) passed to type: {1}", typeArgumentCount, mt.CollectionTypeName);
+          reporter.Error(MessageSource.Resolver, tok, "Wrong number of type arguments ({0} instead of 2) passed to type: {1}", typeArgumentCount, mt.CollectionTypeName);
           // add proxy types, to make sure that MapType will have have a non-null Arg/Domain and Range
           if (typeArgumentCount == 0) {
             mt.SetTypeArg(new InferredTypeProxy());
           }
           mt.SetRangetype(new InferredTypeProxy());
         }
-        if (errorCount == ErrorCount && (mt.Domain.IsSubrangeType || mt.Range.IsSubrangeType)) {
-          Error(tok, "sorry, cannot instantiate collection type with a subrange type");
+        if (errorCount == reporter.Count(ErrorLevel.Error) && (mt.Domain.IsSubrangeType || mt.Range.IsSubrangeType)) {
+          reporter.Error(MessageSource.Resolver, tok, "sorry, cannot instantiate collection type with a subrange type");
         }
       } else if (type is CollectionType) {
         var t = (CollectionType)type;
-        var errorCount = ErrorCount;
+        var errorCount = reporter.Count(ErrorLevel.Error);
         if (t.HasTypeArg()) {
           ResolveType(tok, t.Arg, context, option, defaultTypeArguments);
         } else if (option.Opt != ResolveTypeOptionEnum.DontInfer) {
@@ -4278,13 +4162,13 @@ namespace Microsoft.Dafny
         }
         if (!t.HasTypeArg()) {
           // defaults and auto have been applied; check if we now have the right number of arguments
-          Error(tok, "Wrong number of type arguments (0 instead of 1) passed to type: {0}", t.CollectionTypeName);
+          reporter.Error(MessageSource.Resolver, tok, "Wrong number of type arguments (0 instead of 1) passed to type: {0}", t.CollectionTypeName);
           // add a proxy type, to make sure that CollectionType will have have a non-null Arg
           t.SetTypeArg(new InferredTypeProxy());
         }
 
-        if (errorCount == ErrorCount && t.Arg.IsSubrangeType) {
-          Error(tok, "sorry, cannot instantiate collection type with a subrange type");
+        if (errorCount == reporter.Count(ErrorLevel.Error) && t.Arg.IsSubrangeType) {
+          reporter.Error(MessageSource.Resolver, tok, "sorry, cannot instantiate collection type with a subrange type");
         }
 
       } else if (type is UserDefinedType) {
@@ -4293,7 +4177,7 @@ namespace Microsoft.Dafny
           // Apparently, this type has already been resolved
           return null;
         }
-        var prevErrorCount = ErrorCount;
+        var prevErrorCount = reporter.Count(ErrorLevel.Error);
         if (t.NamePath is ExprDotName) {
           var ret = ResolveDotSuffix_Type((ExprDotName)t.NamePath, new ResolveOpts(context, true, true), allowDanglingDotName, option, defaultTypeArguments);
           if (ret != null) {
@@ -4303,10 +4187,10 @@ namespace Microsoft.Dafny
           var s = (NameSegment)t.NamePath;
           ResolveNameSegment_Type(s, new ResolveOpts(context, true, true), option, defaultTypeArguments);
         }
-        if (ErrorCount == prevErrorCount) {
+        if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
           var r = t.NamePath.Resolved as Resolver_IdentifierExpr;
           if (r == null || !(r.Type is Resolver_IdentifierExpr.ResolverType_Type)) {
-            Error(t.tok, "expected type");
+            reporter.Error(MessageSource.Resolver, t.tok, "expected type");
           } else if (r.Type is Resolver_IdentifierExpr.ResolverType_Type && r.TypeParamDecl != null) {
             t.ResolvedParam = r.TypeParamDecl;
           } else if (r.Type is Resolver_IdentifierExpr.ResolverType_Type) {
@@ -4328,7 +4212,7 @@ namespace Microsoft.Dafny
                 caller.EnclosingModule.CallGraph.AddEdge(caller, dd);
                 if (caller == dd) {
                   // detect self-loops here, since they don't show up in the graph's SSC methods
-                  Error(dd.tok, "recursive dependency involving a newtype: {0} -> {0}", dd.Name);
+                  reporter.Error(MessageSource.Resolver, dd.tok, "recursive dependency involving a newtype: {0} -> {0}", dd.Name);
                 }
               }
               t.ResolvedClass = dd;
@@ -4343,7 +4227,7 @@ namespace Microsoft.Dafny
             }
             // defaults and auto have been applied; check if we now have the right number of arguments
             if (d.TypeArgs.Count != t.TypeArgs.Count) {
-              Error(t.tok, "Wrong number of type arguments ({0} instead of {1}) passed to {2}: {3}", t.TypeArgs.Count, d.TypeArgs.Count, d.WhatKind, t.Name);
+              reporter.Error(MessageSource.Resolver, t.tok, "Wrong number of type arguments ({0} instead of {1}) passed to {2}: {3}", t.TypeArgs.Count, d.TypeArgs.Count, d.WhatKind, t.Name);
             }
 
           }
@@ -4839,14 +4723,14 @@ namespace Microsoft.Dafny
         ResolveExpression(s.Expr, new ResolveOpts(codeContext, true, true));
         Contract.Assert(s.Expr.Type != null);  // follows from postcondition of ResolveExpression
         if (!UnifyTypes(s.Expr.Type, Type.Bool)) {
-          Error(s.Expr, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Expr.Type);
+          reporter.Error(MessageSource.Resolver, s.Expr, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Expr.Type);
         }
 
       } else if (stmt is PrintStmt) {
         PrintStmt s = (PrintStmt)stmt;
         ResolveAttributeArgs(s.Args, new ResolveOpts(codeContext, false, specContextOnly), false);
         if (specContextOnly) {
-          Error(stmt, "print statement is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
+          reporter.Error(MessageSource.Resolver, stmt, "print statement is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
         }
 
       } else if (stmt is BreakStmt) {
@@ -4854,17 +4738,17 @@ namespace Microsoft.Dafny
         if (s.TargetLabel != null) {
           Statement target = labeledStatements.Find(s.TargetLabel);
           if (target == null) {
-            Error(s, "break label is undefined or not in scope: {0}", s.TargetLabel);
+            reporter.Error(MessageSource.Resolver, s, "break label is undefined or not in scope: {0}", s.TargetLabel);
           } else {
             s.TargetStmt = target;
             bool targetIsLoop = target is WhileStmt || target is AlternativeLoopStmt;
             if (specContextOnly && !s.TargetStmt.IsGhost && !inSpecOnlyContext[s.TargetStmt]) {
-              Error(stmt, "ghost-context break statement is not allowed to break out of non-ghost " + (targetIsLoop ? "loop" : "structure"));
+              reporter.Error(MessageSource.Resolver, stmt, "ghost-context break statement is not allowed to break out of non-ghost " + (targetIsLoop ? "loop" : "structure"));
             }
           }
         } else {
           if (loopStack.Count < s.BreakCount) {
-            Error(s, "trying to break out of more loop levels than there are enclosing loops");
+            reporter.Error(MessageSource.Resolver, s, "trying to break out of more loop levels than there are enclosing loops");
           } else {
             Statement target = loopStack[loopStack.Count - s.BreakCount];
             if (target.Labels == null) {
@@ -4873,7 +4757,7 @@ namespace Microsoft.Dafny
             }
             s.TargetStmt = target;
             if (specContextOnly && !target.IsGhost && !inSpecOnlyContext[target]) {
-              Error(stmt, "ghost-context break statement is not allowed to break out of non-ghost loop");
+              reporter.Error(MessageSource.Resolver, stmt, "ghost-context break statement is not allowed to break out of non-ghost loop");
             }
           }
         }
@@ -4881,11 +4765,11 @@ namespace Microsoft.Dafny
       } else if (stmt is ProduceStmt) {
         var kind = stmt is YieldStmt ? "yield" : "return";
         if (stmt is YieldStmt && !(codeContext is IteratorDecl)) {
-          Error(stmt, "yield statement is allowed only in iterators");
+          reporter.Error(MessageSource.Resolver, stmt, "yield statement is allowed only in iterators");
         } else if (stmt is ReturnStmt && !(codeContext is Method)) {
-          Error(stmt, "return statement is allowed only in method");
+          reporter.Error(MessageSource.Resolver, stmt, "return statement is allowed only in method");
         } else if (specContextOnly && !codeContext.IsGhost) {
-          Error(stmt, "{0} statement is not allowed in this context (because it is guarded by a specification-only expression)", kind);
+          reporter.Error(MessageSource.Resolver, stmt, "{0} statement is not allowed in this context (because it is guarded by a specification-only expression)", kind);
         }
         var s = (ProduceStmt)stmt;
         if (s.rhss != null) {
@@ -4893,7 +4777,7 @@ namespace Microsoft.Dafny
           if (cmc == null) {
             // an error has already been reported above
           } else if (cmc.Outs.Count != s.rhss.Count) {
-            Error(s, "number of {2} parameters does not match declaration (found {0}, expected {1})", s.rhss.Count, cmc.Outs.Count, kind);
+            reporter.Error(MessageSource.Resolver, s, "number of {2} parameters does not match declaration (found {0}, expected {1})", s.rhss.Count, cmc.Outs.Count, kind);
           } else {
             Contract.Assert(s.rhss.Count > 0);
             // Create a hidden update statement using the out-parameter formals, resolve the RHS, and check that the RHS is good.
@@ -4986,24 +4870,24 @@ namespace Microsoft.Dafny
           {
             if (currentMethod == null)
             {
-              Error(local.Tok, "assumption variable can only be declared in a method");
+              reporter.Error(MessageSource.Resolver, local.Tok, "assumption variable can only be declared in a method");
             }
             if (!local.IsGhost)
             {
-              Error(local.Tok, "assumption variable must be ghost");
+              reporter.Error(MessageSource.Resolver, local.Tok, "assumption variable must be ghost");
             }
             if (!(local.Type.IsBoolType))
             {
-              Error(s, "assumption variable must be of type 'bool'");
+              reporter.Error(MessageSource.Resolver, s, "assumption variable must be of type 'bool'");
             }
           }
         }
 
       } else if (stmt is AssignStmt) {
         AssignStmt s = (AssignStmt)stmt;
-        int prevErrorCount = ErrorCount;
+        int prevErrorCount = reporter.Count(ErrorLevel.Error);
         ResolveExpression(s.Lhs, new ResolveOpts(codeContext, true, specContextOnly));  // allow ghosts for now, tighted up below
-        bool lhsResolvedSuccessfully = ErrorCount == prevErrorCount;
+        bool lhsResolvedSuccessfully = reporter.Count(ErrorLevel.Error) == prevErrorCount;
         Contract.Assert(s.Lhs.Type != null);  // follows from postcondition of ResolveExpression
         // check that LHS denotes a mutable variable or a field
         bool lvalueIsGhost = false;
@@ -5016,7 +4900,7 @@ namespace Microsoft.Dafny
             lvalueIsGhost = var.IsGhost || codeContext.IsGhost;
             CheckIsLvalue(lhs, codeContext);
             if (!lvalueIsGhost && specContextOnly) {
-              Error(stmt, "Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
+              reporter.Error(MessageSource.Resolver, stmt, "Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
             }
 
             var localVar = var as LocalVariable;
@@ -5035,7 +4919,7 @@ namespace Microsoft.Dafny
               }
               else
               {
-                Error(stmt, string.Format("there may be at most one assignment to an assumption variable, the RHS of which must match the expression \"{0} && <boolean expression>\"", localVar.Name));
+                reporter.Error(MessageSource.Resolver, stmt, string.Format("there may be at most one assignment to an assumption variable, the RHS of which must match the expression \"{0} && <boolean expression>\"", localVar.Name));
               }
             }
           }
@@ -5045,12 +4929,12 @@ namespace Microsoft.Dafny
             lvalueIsGhost = fse.Member.IsGhost;
             if (!lvalueIsGhost) {
               if (specContextOnly) {
-                Error(stmt, "Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
+                reporter.Error(MessageSource.Resolver, stmt, "Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
               } else {
                 // It is now that we wish we would have resolved s.Lhs to not allow ghosts.  Too late, so we do
                 // the next best thing.
                 if (lhsResolvedSuccessfully && UsesSpecFeatures(fse.Obj)) {
-                  Error(stmt, "Assignment to non-ghost field is not allowed to use specification-only expressions in the receiver");
+                  reporter.Error(MessageSource.Resolver, stmt, "Assignment to non-ghost field is not allowed to use specification-only expressions in the receiver");
                 }
               }
             }
@@ -5062,14 +4946,14 @@ namespace Microsoft.Dafny
           if (lhsResolvedSuccessfully) {
             Contract.Assert(slhs.Seq.Type != null);
             if (specContextOnly) {
-              Error(stmt, "Assignment to array element is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
+              reporter.Error(MessageSource.Resolver, stmt, "Assignment to array element is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
             }
             CheckIsLvalue(slhs, codeContext);
           }
 
         } else if (lhs is MultiSelectExpr) {
           if (specContextOnly) {
-            Error(stmt, "Assignment to array element is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
+            reporter.Error(MessageSource.Resolver, stmt, "Assignment to array element is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
           }
           CheckIsLvalue(lhs, codeContext);
 
@@ -5087,7 +4971,7 @@ namespace Microsoft.Dafny
           }
           Contract.Assert(rr.Expr.Type != null);  // follows from postcondition of ResolveExpression
           if (!UnifyTypes(lhsType, rr.Expr.Type)) {
-            Error(stmt, "RHS (of type {0}) not assignable to LHS (of type {1})", rr.Expr.Type, lhsType);
+            reporter.Error(MessageSource.Resolver, stmt, "RHS (of type {0}) not assignable to LHS (of type {1})", rr.Expr.Type, lhsType);
           }
         } else if (s.Rhs is TypeRhs) {
           TypeRhs rr = (TypeRhs)s.Rhs;
@@ -5105,7 +4989,7 @@ namespace Microsoft.Dafny
             }
           }
           if (!UnifyTypes(lhsType, t)) {
-            Error(stmt, "type {0} is not assignable to LHS (of type {1})", t, lhsType);
+            reporter.Error(MessageSource.Resolver, stmt, "type {0} is not assignable to LHS (of type {1})", t, lhsType);
           }
         } else if (s.Rhs is HavocRhs) {
           // nothing else to do
@@ -5130,12 +5014,12 @@ namespace Microsoft.Dafny
         IfStmt s = (IfStmt)stmt;
         bool branchesAreSpecOnly = specContextOnly;
         if (s.Guard != null) {
-          int prevErrorCount = ErrorCount;
+          int prevErrorCount = reporter.Count(ErrorLevel.Error);
           ResolveExpression(s.Guard, new ResolveOpts(codeContext, true, specContextOnly));
           Contract.Assert(s.Guard.Type != null);  // follows from postcondition of ResolveExpression
-          bool successfullyResolved = ErrorCount == prevErrorCount;
+          bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
           if (!UnifyTypes(s.Guard.Type, Type.Bool)) {
-            Error(s.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Guard.Type);
+            reporter.Error(MessageSource.Resolver, s.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Guard.Type);
           }
           if (!specContextOnly && successfullyResolved) {
             branchesAreSpecOnly = UsesSpecFeatures(s.Guard);
@@ -5163,13 +5047,13 @@ namespace Microsoft.Dafny
         bool bodyMustBeSpecOnly = specContextOnly;
         var fvs = new HashSet<IVariable>();
         if (s.Guard != null) {
-          int prevErrorCount = ErrorCount;
+          int prevErrorCount = reporter.Count(ErrorLevel.Error);
           ResolveExpression(s.Guard, new ResolveOpts(codeContext, true, specContextOnly));
           Contract.Assert(s.Guard.Type != null);  // follows from postcondition of ResolveExpression
-          bool successfullyResolved = ErrorCount == prevErrorCount;
+          bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
           Translator.ComputeFreeVariables(s.Guard, fvs);
           if (!UnifyTypes(s.Guard.Type, Type.Bool)) {
-            Error(s.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Guard.Type);
+            reporter.Error(MessageSource.Resolver, s.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Guard.Type);
           }
           if (!specContextOnly && successfullyResolved) {
             bodyMustBeSpecOnly = UsesSpecFeatures(s.Guard);
@@ -5182,7 +5066,7 @@ namespace Microsoft.Dafny
           Contract.Assert(inv.E.Type != null);  // follows from postcondition of ResolveExpression
           Translator.ComputeFreeVariables(inv.E, fvs);
           if (!UnifyTypes(inv.E.Type, Type.Bool)) {
-            Error(inv.E, "invariant is expected to be of type {0}, but is {1}", Type.Bool, inv.E.Type);
+            reporter.Error(MessageSource.Resolver, inv.E, "invariant is expected to be of type {0}, but is {1}", Type.Bool, inv.E.Type);
           }
         }
 
@@ -5191,9 +5075,9 @@ namespace Microsoft.Dafny
           ResolveExpression(e, new ResolveOpts(codeContext, true, true));
           if (e is WildcardExpr) {
             if (bodyMustBeSpecOnly) {
-              Error(e, "'decreases *' is not allowed on ghost loops");
+              reporter.Error(MessageSource.Resolver, e, "'decreases *' is not allowed on ghost loops");
             } else if (!codeContext.AllowsNontermination && !DafnyOptions.O.Dafnycc) {
-              Error(e, "a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating");
+              reporter.Error(MessageSource.Resolver, e, "a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating");
             }
           }
           // any type is fine
@@ -5225,7 +5109,7 @@ namespace Microsoft.Dafny
             }
           }
           text += "};";  // always terminate with a semi-colon
-          ReportAdditionalInformation(s.Tok, text, s.Tok.val.Length);
+          reporter.Info(MessageSource.Resolver, s.Tok, text);
         }
 
       } else if (stmt is AlternativeLoopStmt) {
@@ -5235,7 +5119,7 @@ namespace Microsoft.Dafny
           ResolveExpression(inv.E, new ResolveOpts(codeContext, true, true));
           Contract.Assert(inv.E.Type != null);  // follows from postcondition of ResolveExpression
           if (!UnifyTypes(inv.E.Type, Type.Bool)) {
-            Error(inv.E, "invariant is expected to be of type {0}, but is {1}", Type.Bool, inv.E.Type);
+            reporter.Error(MessageSource.Resolver, inv.E, "invariant is expected to be of type {0}, but is {1}", Type.Bool, inv.E.Type);
           }
         }
 
@@ -5243,9 +5127,9 @@ namespace Microsoft.Dafny
           ResolveExpression(e, new ResolveOpts(codeContext, true, true));
           if (e is WildcardExpr) {
             if (s.IsGhost) {
-              Error(e, "'decreases *' is not allowed on ghost loops");
+              reporter.Error(MessageSource.Resolver, e, "'decreases *' is not allowed on ghost loops");
             } else if (!codeContext.AllowsNontermination && !DafnyOptions.O.Dafnycc) {
-              Error(e, "a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating");
+              reporter.Error(MessageSource.Resolver, e, "a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating");
             }
           }
           // any type is fine
@@ -5254,7 +5138,7 @@ namespace Microsoft.Dafny
       } else if (stmt is ForallStmt) {
         var s = (ForallStmt)stmt;
 
-        int prevErrorCount = ErrorCount;
+        int prevErrorCount = reporter.Count(ErrorLevel.Error);
         scope.PushMarker();
         foreach (BoundVar v in s.BoundVars) {
           ScopePushAndReport(scope, v, "local-variable");
@@ -5263,24 +5147,24 @@ namespace Microsoft.Dafny
         ResolveExpression(s.Range, new ResolveOpts(codeContext, true, specContextOnly));
         Contract.Assert(s.Range.Type != null);  // follows from postcondition of ResolveExpression
         if (!UnifyTypes(s.Range.Type, Type.Bool)) {
-          Error(stmt, "range restriction in forall statement must be of type bool (instead got {0})", s.Range.Type);
+          reporter.Error(MessageSource.Resolver, stmt, "range restriction in forall statement must be of type bool (instead got {0})", s.Range.Type);
         }
         foreach (var ens in s.Ens) {
           ResolveExpression(ens.E, new ResolveOpts(codeContext, true, true));
           Contract.Assert(ens.E.Type != null);  // follows from postcondition of ResolveExpression
           if (!UnifyTypes(ens.E.Type, Type.Bool)) {
-            Error(ens.E, "ensures condition is expected to be of type {0}, but is {1}", Type.Bool, ens.E.Type);
+            reporter.Error(MessageSource.Resolver, ens.E, "ensures condition is expected to be of type {0}, but is {1}", Type.Bool, ens.E.Type);
           }
         }
         // Since the range and postconditions are more likely to infer the types of the bound variables, resolve them
         // first (above) and only then resolve the attributes (below).
         ResolveAttributes(s.Attributes, new ResolveOpts(codeContext, true, true));
 
-        bool bodyMustBeSpecOnly = specContextOnly || (prevErrorCount == ErrorCount && UsesSpecFeatures(s.Range));
-        if (!bodyMustBeSpecOnly && prevErrorCount == ErrorCount) {
+        bool bodyMustBeSpecOnly = specContextOnly || (prevErrorCount == reporter.Count(ErrorLevel.Error) && UsesSpecFeatures(s.Range));
+        if (!bodyMustBeSpecOnly && prevErrorCount == reporter.Count(ErrorLevel.Error)) {
           var missingBounds = new List<BoundVar>();
           CheckTypeInference(s.Range);  // we need to resolve operators before the call to DiscoverBounds
-          s.Bounds = DiscoverBounds(s.Tok, s.BoundVars, s.Range, true, false, missingBounds);
+          s.Bounds = DiscoverBounds(s.Tok, s.BoundVars, s.Range, true, false, missingBounds, reporter);
           if (missingBounds.Count != 0) {
             bodyMustBeSpecOnly = true;
           }
@@ -5299,7 +5183,7 @@ namespace Microsoft.Dafny
         }
         scope.PopMarker();
 
-        if (prevErrorCount == ErrorCount) {
+        if (prevErrorCount == reporter.Count(ErrorLevel.Error)) {
           // determine the Kind and run some additional checks on the body
           if (s.Ens.Count != 0) {
             // The only supported kind with ensures clauses is Proof.
@@ -5323,13 +5207,13 @@ namespace Microsoft.Dafny
               // add the conclusion of the calc as a free postcondition
               var result = ((CalcStmt)s0).Result;
               s.Ens.Add(new MaybeFreeExpression(result, true));
-              ReportAdditionalInformation(s.Tok, "ensures " + Printer.ExprToString(result) + ";", s.Tok.val.Length);
+              reporter.Info(MessageSource.Resolver, s.Tok, "ensures " + Printer.ExprToString(result) + ";");
             } else {
               s.Kind = ForallStmt.ParBodyKind.Proof;
               if (s.Body is BlockStmt && ((BlockStmt)s.Body).Body.Count == 0) {
                 // an empty statement, so don't produce any warning
               } else {
-                Warning(s.Tok, "the conclusion of the body of this forall statement will not be known outside the forall statement; consider using an 'ensures' clause");
+                reporter.Warning(MessageSource.Resolver, s.Tok, "the conclusion of the body of this forall statement will not be known outside the forall statement; consider using an 'ensures' clause");
               }
             }
           }
@@ -5351,7 +5235,7 @@ namespace Microsoft.Dafny
         s.IsGhost = specContextOnly;
 
       } else if (stmt is CalcStmt) {
-        var prevErrorCount = ErrorCount;
+        var prevErrorCount = reporter.Count(ErrorLevel.Error);
         CalcStmt s = (CalcStmt)stmt;
         s.IsGhost = true;
         if (s.Lines.Count > 0) {
@@ -5359,12 +5243,12 @@ namespace Microsoft.Dafny
           ResolveExpression(e0, new ResolveOpts(codeContext, true, true));
           Contract.Assert(e0.Type != null);  // follows from postcondition of ResolveExpression
           for (int i = 1; i < s.Lines.Count; i++) {
-            if (i < s.Lines.Count - 1 || prevErrorCount == ErrorCount) { // do not resolve the dummy step if there were errors, it might generate more errors
+            if (i < s.Lines.Count - 1 || prevErrorCount == reporter.Count(ErrorLevel.Error)) { // do not resolve the dummy step if there were errors, it might generate more errors
               var e1 = s.Lines[i];
               ResolveExpression(e1, new ResolveOpts(codeContext, true, true));
               Contract.Assert(e1.Type != null);  // follows from postcondition of ResolveExpression
               if (!UnifyTypes(e0.Type, e1.Type)) {
-                Error(e1, "all lines in a calculation must have the same type (got {0} after {1})", e1.Type, e0.Type);
+                reporter.Error(MessageSource.Resolver, e1, "all lines in a calculation must have the same type (got {0} after {1})", e1.Type, e0.Type);
               } else {
                 var step = s.StepOps[i - 1].StepExpr(e0, e1); // Use custom line operator
                 ResolveExpression(step, new ResolveOpts(codeContext, true, true));
@@ -5387,7 +5271,7 @@ namespace Microsoft.Dafny
           loopStack = prevLoopStack;
 
         }
-        if (prevErrorCount == ErrorCount && s.Lines.Count > 0) {
+        if (prevErrorCount == reporter.Count(ErrorLevel.Error) && s.Lines.Count > 0) {
           // do not build Result from the lines if there were errors, as it might be ill-typed and produce unnecessary resolution errors
           s.Result = s.ResultOp.StepExpr(s.Lines.First(), s.Lines.Last());
         } else {
@@ -5395,13 +5279,13 @@ namespace Microsoft.Dafny
         }
         ResolveExpression(s.Result, new ResolveOpts(codeContext, true, true));
         Contract.Assert(s.Result != null);
-        Contract.Assert(prevErrorCount != ErrorCount || s.Steps.Count == s.Hints.Count);
+        Contract.Assert(prevErrorCount != reporter.Count(ErrorLevel.Error) || s.Steps.Count == s.Hints.Count);
 
       } else if (stmt is MatchStmt) {
         ResolveMatchStmt(stmt, specContextOnly, codeContext);
       } else if (stmt is SkeletonStatement) {
         var s = (SkeletonStatement)stmt;
-        Error(s.Tok, "skeleton statements are allowed only in refining methods");
+        reporter.Error(MessageSource.Resolver, s.Tok, "skeleton statements are allowed only in refining methods");
         // nevertheless, resolve the underlying statement; hey, why not
         if (s.S != null) {
           ResolveStatement(s.S, specContextOnly, codeContext);
@@ -5416,10 +5300,10 @@ namespace Microsoft.Dafny
       DesugarMatchStmtWithTupleExpression(s);
 
       bool bodyIsSpecOnly = specContextOnly;
-      int prevErrorCount = ErrorCount;
+      int prevErrorCount = reporter.Count(ErrorLevel.Error);
       ResolveExpression(s.Source, new ResolveOpts(codeContext, true, specContextOnly));
       Contract.Assert(s.Source.Type != null);  // follows from postcondition of ResolveExpression
-      bool successfullyResolved = ErrorCount == prevErrorCount;
+      bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
       if (!specContextOnly && successfullyResolved) {
         bodyIsSpecOnly = UsesSpecFeatures(s.Source);
       }
@@ -5432,7 +5316,7 @@ namespace Microsoft.Dafny
       var subst = new Dictionary<TypeParameter, Type>();
       Dictionary<string, DatatypeCtor> ctors;
       if (dtd == null) {
-        Error(s.Source, "the type of the match source expression must be a datatype (instead found {0})", s.Source.Type);
+        reporter.Error(MessageSource.Resolver, s.Source, "the type of the match source expression must be a datatype (instead found {0})", s.Source.Type);
         ctors = null;
       } else {
         Contract.Assert(sourceType != null);  // dtd and sourceType are set together above
@@ -5462,15 +5346,15 @@ namespace Microsoft.Dafny
         if (ctors != null) {
           Contract.Assert(dtd != null);
           if (!ctors.TryGetValue(mc.Id, out ctor)) {
-            Error(mc.tok, "member {0} does not exist in datatype {1}", mc.Id, dtd.Name);
+            reporter.Error(MessageSource.Resolver, mc.tok, "member {0} does not exist in datatype {1}", mc.Id, dtd.Name);
           } else {
             Contract.Assert(ctor != null);  // follows from postcondition of TryGetValue
             mc.Ctor = ctor;
             if (ctor.Formals.Count != mc.Arguments.Count) {
-              Error(mc.tok, "member {0} has wrong number of formals (found {1}, expected {2})", mc.Id, mc.Arguments.Count, ctor.Formals.Count);
+              reporter.Error(MessageSource.Resolver, mc.tok, "member {0} has wrong number of formals (found {1}, expected {2})", mc.Id, mc.Arguments.Count, ctor.Formals.Count);
             }
             if (memberNamesUsed.Contains(mc.Id)) {
-              Error(mc.tok, "member {0} appears in more than one case", mc.Id);
+              reporter.Error(MessageSource.Resolver, mc.tok, "member {0} appears in more than one case", mc.Id);
             } else {
               memberNamesUsed.Add(mc.Id);  // add mc.Id to the set of names used
             }
@@ -5486,7 +5370,7 @@ namespace Microsoft.Dafny
               Formal formal = ctor.Formals[i];
               Type st = SubstType(formal.Type, subst);
               if (!UnifyTypes(v.Type, st)) {
-                Error(stmt, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
+                reporter.Error(MessageSource.Resolver, stmt, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
               }
               v.IsGhost = formal.IsGhost;
 
@@ -5557,7 +5441,7 @@ namespace Microsoft.Dafny
       if (me.Source is DatatypeValue) {
         var e = (DatatypeValue)me.Source;
         if (e.Arguments.Count < 1) {
-          Error(me.Tok, "match source tuple needs at least 1 argument");
+          reporter.Error(MessageSource.Resolver, me.Tok, "match source tuple needs at least 1 argument");
         } else {
           Expression source = e.Arguments[0];
           List<MatchCaseStmt> cases = new List<MatchCaseStmt>();
@@ -5566,7 +5450,7 @@ namespace Microsoft.Dafny
           bool keepOrigToken = true; 
           foreach (MatchCaseStmt mc in me.Cases) {
             if (mc.CasePatterns == null || mc.CasePatterns.Count != e.Arguments.Count) {
-              Error(mc.tok, "case arguments count does not match source arguments count");
+              reporter.Error(MessageSource.Resolver, mc.tok, "case arguments count does not match source arguments count");
             } else {
               CasePattern cp = mc.CasePatterns[0];
               List<CasePattern> patterns;
@@ -5723,7 +5607,7 @@ namespace Microsoft.Dafny
           ScopePushAndReport(scope, v, "parameter");
         } else {
           if (scope.Find(v.Name) != null) {
-            Error(v, "Duplicate parameter name: {0}", v.Name);
+            reporter.Error(MessageSource.Resolver, v, "Duplicate parameter name: {0}", v.Name);
           }
         }
       } else {
@@ -5938,26 +5822,26 @@ namespace Microsoft.Dafny
           }
         }
         s += ";";  // always terminate with a semi-colon, even in the case of an empty decreases clause
-        ReportAdditionalInformation(loopStmt.Tok, s, loopStmt.Tok.val.Length);
+        reporter.Info(MessageSource.Resolver, loopStmt.Tok, s);
       }
     }
     private void ResolveConcreteUpdateStmt(ConcreteUpdateStatement s, bool specContextOnly, ICodeContext codeContext) {
       Contract.Requires(codeContext != null);
 
       // First, resolve all LHS's and expression-looking RHS's.
-      int errorCountBeforeCheckingLhs = ErrorCount;
+      int errorCountBeforeCheckingLhs = reporter.Count(ErrorLevel.Error);
       var update = s as UpdateStmt;
 
       var lhsNameSet = new HashSet<string>();  // used to check for duplicate identifiers on the left (full duplication checking for references and the like is done during verification)
       foreach (var lhs in s.Lhss) {
-        var ec = ErrorCount;
+        var ec = reporter.Count(ErrorLevel.Error);
         ResolveExpression(lhs, new ResolveOpts(codeContext, true, specContextOnly));
-        if (ec == ErrorCount) {
+        if (ec == reporter.Count(ErrorLevel.Error)) {
           if (update == null && specContextOnly && !AssignStmt.LhsIsToGhost(lhs) && !codeContext.IsGhost) {
-            Error(lhs, "cannot assign to non-ghost variable in a ghost context");
+            reporter.Error(MessageSource.Resolver, lhs, "cannot assign to non-ghost variable in a ghost context");
           }
           if (lhs is SeqSelectExpr && !((SeqSelectExpr)lhs).SelectOne) {
-            Error(lhs, "cannot assign to a range of array elements (try the 'forall' statement)");
+            reporter.Error(MessageSource.Resolver, lhs, "cannot assign to a range of array elements (try the 'forall' statement)");
           }
         }
       }
@@ -6018,10 +5902,10 @@ namespace Microsoft.Dafny
       if (firstEffectfulRhs == null) {
         if (update.Lhss.Count == 0) {
           Contract.Assert(update.Rhss.Count == 1);  // guaranteed by the parser
-          Error(update, "expected method call, found expression");
+          reporter.Error(MessageSource.Resolver, update, "expected method call, found expression");
         } else if (update.Lhss.Count != update.Rhss.Count) {
-          Error(update, "the number of left-hand sides ({0}) and right-hand sides ({1}) must match for a multi-assignment", update.Lhss.Count, update.Rhss.Count);
-        } else if (ErrorCount == errorCountBeforeCheckingLhs) {
+          reporter.Error(MessageSource.Resolver, update, "the number of left-hand sides ({0}) and right-hand sides ({1}) must match for a multi-assignment", update.Lhss.Count, update.Rhss.Count);
+        } else if (reporter.Count(ErrorLevel.Error) == errorCountBeforeCheckingLhs) {
           // add the statements here in a sequence, but don't use that sequence later for translation (instead, should translate properly as multi-assignment)
           for (int i = 0; i < update.Lhss.Count; i++) {
             var a = new AssignStmt(update.Tok, update.EndTok, update.Lhss[i].Resolved, update.Rhss[i]);
@@ -6031,19 +5915,19 @@ namespace Microsoft.Dafny
 
       } else if (update.CanMutateKnownState) {
         if (1 < update.Rhss.Count) {
-          Error(firstEffectfulRhs, "cannot have effectful parameter in multi-return statement.");
+          reporter.Error(MessageSource.Resolver, firstEffectfulRhs, "cannot have effectful parameter in multi-return statement.");
         } else { // it might be ok, if it is a TypeRhs
           Contract.Assert(update.Rhss.Count == 1);
           if (methodCallInfo != null) {
-            Error(methodCallInfo.Tok, "cannot have method call in return statement.");
+            reporter.Error(MessageSource.Resolver, methodCallInfo.Tok, "cannot have method call in return statement.");
           } else {
             // we have a TypeRhs
             Contract.Assert(update.Rhss[0] is TypeRhs);
             var tr = (TypeRhs)update.Rhss[0];
             Contract.Assert(tr.InitCall != null); // there were effects, so this must have been a call.
             if (tr.CanAffectPreviouslyKnownExpressions) {
-              Error(tr.Tok, "can only have initialization methods which modify at most 'this'.");
-            } else if (ErrorCount == errorCountBeforeCheckingLhs) {
+              reporter.Error(MessageSource.Resolver, tr.Tok, "can only have initialization methods which modify at most 'this'.");
+            } else if (reporter.Count(ErrorLevel.Error) == errorCountBeforeCheckingLhs) {
               var a = new AssignStmt(update.Tok, update.EndTok, update.Lhss[0].Resolved, tr);
               update.ResolvedStatements.Add(a);
             }
@@ -6053,17 +5937,17 @@ namespace Microsoft.Dafny
       } else {
         // if there was an effectful RHS, that must be the only RHS
         if (update.Rhss.Count != 1) {
-          Error(firstEffectfulRhs, "an update statement is allowed an effectful RHS only if there is just one RHS");
+          reporter.Error(MessageSource.Resolver, firstEffectfulRhs, "an update statement is allowed an effectful RHS only if there is just one RHS");
         } else if (methodCallInfo == null) {
           // must be a single TypeRhs
           if (update.Lhss.Count != 1) {
             Contract.Assert(2 <= update.Lhss.Count);  // the parser allows 0 Lhss only if the whole statement looks like an expression (not a TypeRhs)
-            Error(update.Lhss[1].tok, "the number of left-hand sides ({0}) and right-hand sides ({1}) must match for a multi-assignment", update.Lhss.Count, update.Rhss.Count);
-          } else if (ErrorCount == errorCountBeforeCheckingLhs) {
+            reporter.Error(MessageSource.Resolver, update.Lhss[1].tok, "the number of left-hand sides ({0}) and right-hand sides ({1}) must match for a multi-assignment", update.Lhss.Count, update.Rhss.Count);
+          } else if (reporter.Count(ErrorLevel.Error) == errorCountBeforeCheckingLhs) {
             var a = new AssignStmt(update.Tok, update.EndTok, update.Lhss[0].Resolved, update.Rhss[0]);
             update.ResolvedStatements.Add(a);
           }
-        } else if (ErrorCount == errorCountBeforeCheckingLhs) {
+        } else if (reporter.Count(ErrorLevel.Error) == errorCountBeforeCheckingLhs) {
           // a call statement
           var resolvedLhss = new List<Expression>();
           foreach (var ll in update.Lhss) {
@@ -6090,7 +5974,7 @@ namespace Microsoft.Dafny
         foreach (var lhs in s.Lhss) {
           var ide = lhs.Resolved as IdentifierExpr;
           if (ide == null) {
-            Error(lhs, "the assign-such-that statement currently only supports local-variable LHSs");
+            reporter.Error(MessageSource.Resolver, lhs, "the assign-such-that statement currently only supports local-variable LHSs");
           } else {
             varLhss.Add(ide.Var);
           }
@@ -6098,17 +5982,17 @@ namespace Microsoft.Dafny
       }
 
       s.IsGhost = s.Lhss.TrueForAll(AssignStmt.LhsIsToGhost);
-      var ec = ErrorCount;
+      var ec = reporter.Count(ErrorLevel.Error);
       ResolveExpression(s.Expr, new ResolveOpts(codeContext, true, specContextOnly));
       if (!UnifyTypes(s.Expr.Type, Type.Bool)) {
-        Error(s.Expr, "type of RHS of assign-such-that statement must be boolean (got {0})", s.Expr.Type);
+        reporter.Error(MessageSource.Resolver, s.Expr, "type of RHS of assign-such-that statement must be boolean (got {0})", s.Expr.Type);
       }
-      if (ec == ErrorCount && !s.IsGhost && s.AssumeToken == null && !specContextOnly) {
+      if (ec == reporter.Count(ErrorLevel.Error) && !s.IsGhost && s.AssumeToken == null && !specContextOnly) {
         CheckIsNonGhost(s.Expr);
 
         var missingBounds = new List<IVariable>();
         CheckTypeInference(s.Expr);  // we need to resolve operators before the call to DiscoverBoundsAux
-        var allBounds = DiscoverBoundsAux(s.Tok, varLhss, s.Expr, true, true, true, missingBounds);
+        var allBounds = DiscoverBoundsAux(s.Tok, varLhss, s.Expr, true, true, true, missingBounds, reporter);
         if (missingBounds.Count != 0) {
           s.MissingBounds = missingBounds;  // so that an error message can be produced during compilation
         } else {
@@ -6130,12 +6014,12 @@ namespace Microsoft.Dafny
       bool isGhost = specContextOnly;
       // first, resolve the guards, which tells us whether or not the entire statement is a ghost statement
       foreach (var alternative in alternatives) {
-        int prevErrorCount = ErrorCount;
+        int prevErrorCount = reporter.Count(ErrorLevel.Error);
         ResolveExpression(alternative.Guard, new ResolveOpts(codeContext, true, specContextOnly));
         Contract.Assert(alternative.Guard.Type != null);  // follows from postcondition of ResolveExpression
-        bool successfullyResolved = ErrorCount == prevErrorCount;
+        bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
         if (!UnifyTypes(alternative.Guard.Type, Type.Bool)) {
-          Error(alternative.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, alternative.Guard.Type);
+          reporter.Error(MessageSource.Resolver, alternative.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, alternative.Guard.Type);
         }
         if (!specContextOnly && successfullyResolved) {
           isGhost = isGhost || UsesSpecFeatures(alternative.Guard);
@@ -6174,11 +6058,11 @@ namespace Microsoft.Dafny
       var callee = s.Method;
       Contract.Assert(callee != null);  // follows from the invariant of CallStmt
       if (!isInitCall && callee is Constructor) {
-        Error(s, "a constructor is allowed to be called only when an object is being allocated");
+        reporter.Error(MessageSource.Resolver, s, "a constructor is allowed to be called only when an object is being allocated");
       }
       s.IsGhost = callee.IsGhost;
       if (specContextOnly && !callee.IsGhost) {
-        Error(s, "only ghost methods can be called from this context");
+        reporter.Error(MessageSource.Resolver, s, "only ghost methods can be called from this context");
       }
 
       // resolve left-hand sides
@@ -6192,49 +6076,49 @@ namespace Microsoft.Dafny
       int j = 0;
       foreach (Expression e in s.Args) {
         bool allowGhost = s.IsGhost || callee.Ins.Count <= j || callee.Ins[j].IsGhost;
-        var ec = ErrorCount;
+        var ec = reporter.Count(ErrorLevel.Error);
         ResolveExpression(e, new ResolveOpts(codeContext, true, allowGhost));
-        if (ec == ErrorCount && !allowGhost) {
+        if (ec == reporter.Count(ErrorLevel.Error) && !allowGhost) {
           CheckIsNonGhost(e);
         }
         j++;
       }
 
       if (callee.Ins.Count != s.Args.Count) {
-        Error(s, "wrong number of method arguments (got {0}, expected {1})", s.Args.Count, callee.Ins.Count);
+        reporter.Error(MessageSource.Resolver, s, "wrong number of method arguments (got {0}, expected {1})", s.Args.Count, callee.Ins.Count);
       } else if (callee.Outs.Count != s.Lhs.Count) {
         if (isInitCall) {
-          Error(s, "a method called as an initialization method must not have any result arguments");
+          reporter.Error(MessageSource.Resolver, s, "a method called as an initialization method must not have any result arguments");
         } else {
-          Error(s, "wrong number of method result arguments (got {0}, expected {1})", s.Lhs.Count, callee.Outs.Count);
+          reporter.Error(MessageSource.Resolver, s, "wrong number of method result arguments (got {0}, expected {1})", s.Lhs.Count, callee.Outs.Count);
         }
       } else {
         if (isInitCall) {
           if (callee.IsStatic) {
-            Error(s.Tok, "a method called as an initialization method must not be 'static'");
+            reporter.Error(MessageSource.Resolver, s.Tok, "a method called as an initialization method must not be 'static'");
           }
         } else if (!callee.IsStatic) {
           if (!scope.AllowInstance && s.Receiver is ThisExpr) {
             // The call really needs an instance, but that instance is given as 'this', which is not
             // available in this context.  For more details, see comment in the resolution of a
             // FunctionCallExpr.
-            Error(s.Receiver, "'this' is not allowed in a 'static' context");
+            reporter.Error(MessageSource.Resolver, s.Receiver, "'this' is not allowed in a 'static' context");
           } else if (s.Receiver is StaticReceiverExpr) {
-            Error(s.Receiver, "call to instance method requires an instance");
+            reporter.Error(MessageSource.Resolver, s.Receiver, "call to instance method requires an instance");
           }
         }
         // type check the arguments
         for (int i = 0; i < callee.Ins.Count; i++) {
           Type st = SubstType(callee.Ins[i].Type, s.MethodSelect.TypeArgumentSubstitutions());
           if (!UnifyTypes(cce.NonNull(s.Args[i].Type), st)) {
-            Error(s, "incorrect type of method in-parameter {0} (expected {1}, got {2})", i, st, s.Args[i].Type);
+            reporter.Error(MessageSource.Resolver, s, "incorrect type of method in-parameter {0} (expected {1}, got {2})", i, st, s.Args[i].Type);
           }
         }
         for (int i = 0; i < callee.Outs.Count; i++) {
           Type st = SubstType(callee.Outs[i].Type, s.MethodSelect.TypeArgumentSubstitutions());
           var lhs = s.Lhs[i];
           if (!UnifyTypes(cce.NonNull(lhs.Type), st)) {
-            Error(s, "incorrect type of method out-parameter {0} (expected {1}, got {2})", i, st, lhs.Type);
+            reporter.Error(MessageSource.Resolver, s, "incorrect type of method out-parameter {0} (expected {1}, got {2})", i, st, lhs.Type);
           } else {
             var resolvedLhs = lhs.Resolved;
             if (!specContextOnly && (s.IsGhost || callee.Outs[i].IsGhost)) {
@@ -6246,17 +6130,17 @@ namespace Microsoft.Dafny
                     // the variable was actually declared in this statement, so auto-declare it as ghost
                     ((LocalVariable)ll.Var).MakeGhost();
                   } else {
-                    Error(s, "actual out-parameter {0} is required to be a ghost variable", i);
+                    reporter.Error(MessageSource.Resolver, s, "actual out-parameter {0} is required to be a ghost variable", i);
                   }
                 }
               } else if (resolvedLhs is MemberSelectExpr) {
                 var ll = (MemberSelectExpr)resolvedLhs;
                 if (!ll.Member.IsGhost) {
-                  Error(s, "actual out-parameter {0} is required to be a ghost field", i);
+                  reporter.Error(MessageSource.Resolver, s, "actual out-parameter {0} is required to be a ghost field", i);
                 }
               } else {
                 // this is an array update, and arrays are always non-ghost
-                Error(s, "actual out-parameter {0} is required to be a ghost variable", i);
+                reporter.Error(MessageSource.Resolver, s, "actual out-parameter {0} is required to be a ghost variable", i);
               }
             }
             // LHS must denote a mutable field.
@@ -6283,7 +6167,7 @@ namespace Microsoft.Dafny
         }
       }
       if (Contract.Exists(callee.Decreases.Expressions, e => e is WildcardExpr) && !codeContext.AllowsNontermination) {
-        Error(s.Tok, "a call to a possibly non-terminating method is allowed only if the calling method is also declared (with 'decreases *') to be possibly non-terminating");
+        reporter.Error(MessageSource.Resolver, s.Tok, "a call to a possibly non-terminating method is allowed only if the calling method is also declared (with 'decreases *') to be possibly non-terminating");
       }
     }
 
@@ -6298,26 +6182,26 @@ namespace Microsoft.Dafny
       if (lhs is IdentifierExpr) {
         var ll = (IdentifierExpr)lhs;
         if (!ll.Var.IsMutable) {
-          Error(lhs, "LHS of assignment must denote a mutable variable");
+          reporter.Error(MessageSource.Resolver, lhs, "LHS of assignment must denote a mutable variable");
         }
       } else if (lhs is MemberSelectExpr) {
         var ll = (MemberSelectExpr)lhs;
         var field = ll.Member as Field;
         if (field == null || !field.IsUserMutable) {
-          Error(lhs, "LHS of assignment must denote a mutable field");
+          reporter.Error(MessageSource.Resolver, lhs, "LHS of assignment must denote a mutable field");
         }
       } else if (lhs is SeqSelectExpr) {
         var ll = (SeqSelectExpr)lhs;
         if (!UnifyTypes(ll.Seq.Type, ResolvedArrayType(ll.Seq.tok, 1, new InferredTypeProxy(), codeContext))) {
-          Error(ll.Seq, "LHS of array assignment must denote an array element (found {0})", ll.Seq.Type);
+          reporter.Error(MessageSource.Resolver, ll.Seq, "LHS of array assignment must denote an array element (found {0})", ll.Seq.Type);
         }
         if (!ll.SelectOne) {
-          Error(ll.Seq, "cannot assign to a range of array elements (try the 'forall' statement)");
+          reporter.Error(MessageSource.Resolver, ll.Seq, "cannot assign to a range of array elements (try the 'forall' statement)");
         }
       } else if (lhs is MultiSelectExpr) {
         // nothing to check; this can only denote an array element
       } else {
-        Error(lhs, "LHS of assignment must denote a mutable variable or field");
+        reporter.Error(MessageSource.Resolver, lhs, "LHS of assignment must denote a mutable variable or field");
       }
     }
 
@@ -6333,9 +6217,9 @@ namespace Microsoft.Dafny
           Contract.Assert(lnode.Name != null);  // LabelNode's with .Label==null are added only during resolution of the break statements with 'stmt' as their target, which hasn't happened yet
           var prev = labeledStatements.Find(lnode.Name);
           if (prev == ss) {
-            Error(lnode.Tok, "duplicate label");
+            reporter.Error(MessageSource.Resolver, lnode.Tok, "duplicate label");
           } else if (prev != null) {
-            Error(lnode.Tok, "label shadows an enclosing label");
+            reporter.Error(MessageSource.Resolver, lnode.Tok, "label shadows an enclosing label");
           } else {
             var r = labeledStatements.Push(lnode.Name, ss);
             Contract.Assert(r == Scope<Statement>.PushResult.Success);  // since we just checked for duplicates, we expect the Push to succeed
@@ -6357,13 +6241,13 @@ namespace Microsoft.Dafny
       if (stmt is PredicateStmt) {
         // cool
       } else if (stmt is PrintStmt) {
-        Error(stmt, "print statement is not allowed inside a forall statement");
+        reporter.Error(MessageSource.Resolver, stmt, "print statement is not allowed inside a forall statement");
       } else if (stmt is BreakStmt) {
         // this case is checked already in the first pass through the forall-statement body, by doing so from an empty set of labeled statements and resetting the loop-stack
       } else if (stmt is ReturnStmt) {
-        Error(stmt, "return statement is not allowed inside a forall statement");
+        reporter.Error(MessageSource.Resolver, stmt, "return statement is not allowed inside a forall statement");
       } else if (stmt is YieldStmt) {
-        Error(stmt, "yield statement is not allowed inside a forall statement");
+        reporter.Error(MessageSource.Resolver, stmt, "yield statement is not allowed inside a forall statement");
       } else if (stmt is AssignSuchThatStmt) {
         var s = (AssignSuchThatStmt)stmt;
         foreach (var lhs in s.Lhss) {
@@ -6385,9 +6269,9 @@ namespace Microsoft.Dafny
         var rhs = s.Rhs;  // ExprRhs and HavocRhs are fine, but TypeRhs is not
         if (rhs is TypeRhs) {
           if (kind == ForallStmt.ParBodyKind.Assign) {
-            Error(rhs.Tok, "new allocation not supported in forall statements");
+            reporter.Error(MessageSource.Resolver, rhs.Tok, "new allocation not supported in forall statements");
           } else {
-            Error(rhs.Tok, "new allocation not allowed in ghost context");
+            reporter.Error(MessageSource.Resolver, rhs.Tok, "new allocation not allowed in ghost context");
           }
         }
       } else if (stmt is CallStmt) {
@@ -6396,14 +6280,14 @@ namespace Microsoft.Dafny
           var idExpr = lhs as IdentifierExpr;
           if (idExpr != null) {
             if (scope.ContainsDecl(idExpr.Var)) {
-              Error(stmt, "body of forall statement is attempting to update a variable declared outside the forall statement");
+              reporter.Error(MessageSource.Resolver, stmt, "body of forall statement is attempting to update a variable declared outside the forall statement");
             }
           } else {
-            Error(stmt, "the body of the enclosing forall statement is not allowed to update heap locations");
+            reporter.Error(MessageSource.Resolver, stmt, "the body of the enclosing forall statement is not allowed to update heap locations");
           }
         }
         if (s.Method.Mod.Expressions.Count != 0) {
-          Error(stmt, "the body of the enclosing forall statement is not allowed to update heap locations, so any call must be to a method with an empty modifies clause");
+          reporter.Error(MessageSource.Resolver, stmt, "the body of the enclosing forall statement is not allowed to update heap locations, so any call must be to a method with an empty modifies clause");
         }
         if (!s.Method.IsGhost) {
           // The reason for this restriction is that the compiler is going to omit the forall statement altogether--it has
@@ -6411,7 +6295,7 @@ namespace Microsoft.Dafny
           // a method that prints something, all calls to non-ghost methods are disallowed.  (Note, if this restriction
           // is somehow lifted in the future, then it is still necessary to enforce s.Method.Mod.Expressions.Count != 0 for
           // calls to non-ghost methods.)
-          Error(s, "the body of the enclosing forall statement is not allowed to call non-ghost methods");
+          reporter.Error(MessageSource.Resolver, s, "the body of the enclosing forall statement is not allowed to call non-ghost methods");
         }
 
       } else if (stmt is BlockStmt) {
@@ -6455,7 +6339,7 @@ namespace Microsoft.Dafny
         var s = (ForallStmt)stmt;
         switch (s.Kind) {
           case ForallStmt.ParBodyKind.Assign:
-            Error(stmt, "a forall statement with heap updates is not allowed inside the body of another forall statement");
+            reporter.Error(MessageSource.Resolver, stmt, "a forall statement with heap updates is not allowed inside the body of another forall statement");
             break;
           case ForallStmt.ParBodyKind.Call:
           case ForallStmt.ParBodyKind.Proof:
@@ -6486,10 +6370,10 @@ namespace Microsoft.Dafny
       var idExpr = lhs as IdentifierExpr;
       if (idExpr != null) {
         if (scope.ContainsDecl(idExpr.Var)) {
-          Error(tok, "body of forall statement is attempting to update a variable declared outside the forall statement");
+          reporter.Error(MessageSource.Resolver, tok, "body of forall statement is attempting to update a variable declared outside the forall statement");
         }
       } else if (kind != ForallStmt.ParBodyKind.Assign) {
-        Error(tok, "the body of the enclosing forall statement is not allowed to update heap locations");
+        reporter.Error(MessageSource.Resolver, tok, "the body of the enclosing forall statement is not allowed to update heap locations");
       }
     }
 
@@ -6506,9 +6390,9 @@ namespace Microsoft.Dafny
       } else if (stmt is BreakStmt) {
         // already checked while resolving hints
       } else if (stmt is ReturnStmt) {
-        Error(stmt, "return statement is not allowed inside a hint");
+        reporter.Error(MessageSource.Resolver, stmt, "return statement is not allowed inside a hint");
       } else if (stmt is YieldStmt) {
-        Error(stmt, "yield statement is not allowed inside a hint");
+        reporter.Error(MessageSource.Resolver, stmt, "yield statement is not allowed inside a hint");
       } else if (stmt is AssignSuchThatStmt) {
         var s = (AssignSuchThatStmt)stmt;
         foreach (var lhs in s.Lhss) {
@@ -6520,7 +6404,7 @@ namespace Microsoft.Dafny
       } else if (stmt is CallStmt) {
         var s = (CallStmt)stmt;
         if (s.Method.Mod.Expressions.Count != 0) {
-          Error(stmt, "calls to methods with side-effects are not allowed inside a hint");
+          reporter.Error(MessageSource.Resolver, stmt, "calls to methods with side-effects are not allowed inside a hint");
         }
       } else if (stmt is UpdateStmt) {
         var s = (UpdateStmt)stmt;
@@ -6558,7 +6442,7 @@ namespace Microsoft.Dafny
       } else if (stmt is WhileStmt) {
         var s = (WhileStmt)stmt;
         if (s.Mod.Expressions != null && s.Mod.Expressions.Count != 0) {
-          Error(s.Mod.Expressions[0].tok, "a while statement used inside a hint is not allowed to have a modifies clause");
+          reporter.Error(MessageSource.Resolver, s.Mod.Expressions[0].tok, "a while statement used inside a hint is not allowed to have a modifies clause");
         }
         if (s.Body != null) {
           CheckHintRestrictions(s.Body);
@@ -6576,7 +6460,7 @@ namespace Microsoft.Dafny
         var s = (ForallStmt)stmt;
         switch (s.Kind) {
           case ForallStmt.ParBodyKind.Assign:
-            Error(stmt, "a forall statement with heap updates is not allowed inside a hint");
+            reporter.Error(MessageSource.Resolver, stmt, "a forall statement with heap updates is not allowed inside a hint");
             break;
           case ForallStmt.ParBodyKind.Call:
           case ForallStmt.ParBodyKind.Proof:
@@ -6609,9 +6493,9 @@ namespace Microsoft.Dafny
     void CheckHintLhs(IToken tok, Expression lhs) {
       var idExpr = lhs as IdentifierExpr;
       if (idExpr == null) {
-        Error(tok, "a hint is not allowed to update heap locations");
+        reporter.Error(MessageSource.Resolver, tok, "a hint is not allowed to update heap locations");
       } else if (scope.ContainsDecl(idExpr.Var)) {
-        Error(tok, "a hint is not allowed to update a variable declared outside the hint");
+        reporter.Error(MessageSource.Resolver, tok, "a hint is not allowed to update a variable declared outside the hint");
       }
     }
 
@@ -6623,7 +6507,7 @@ namespace Microsoft.Dafny
 
       // "new" is not allowed in ghost contexts
       if (specContextOnly) {
-        Error(rr.Tok, "'new' is not allowed in ghost contexts");
+        reporter.Error(MessageSource.Resolver, rr.Tok, "'new' is not allowed in ghost contexts");
       }
       if (rr.Type == null) {
         if (rr.ArrayDimensions != null) {
@@ -6635,7 +6519,7 @@ namespace Microsoft.Dafny
             Contract.Assert(dim != null);
             ResolveExpression(dim, new ResolveOpts(codeContext, true));
             if (!UnifyTypes(dim.Type, new OperationTypeProxy(true, false, false, false, false, false))) {
-              Error(stmt, "new must use an integer-based expression for the array size (got {0} for index {1})", dim.Type, i);
+              reporter.Error(MessageSource.Resolver, stmt, "new must use an integer-based expression for the array size (got {0} for index {1})", dim.Type, i);
             }
             i++;
           }
@@ -6645,7 +6529,7 @@ namespace Microsoft.Dafny
           if (rr.Arguments == null) {
             ResolveType(stmt.Tok, rr.EType, codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
             if (!rr.EType.IsRefType) {
-              Error(stmt, "new can be applied only to reference types (got {0})", rr.EType);
+              reporter.Error(MessageSource.Resolver, stmt, "new can be applied only to reference types (got {0})", rr.EType);
             }
           } else {
             string initCallName = null;
@@ -6668,18 +6552,18 @@ namespace Microsoft.Dafny
               initCallTok = rr.Tok;
             }
             if (!rr.EType.IsRefType) {
-              Error(stmt, "new can be applied only to reference types (got {0})", rr.EType);
+              reporter.Error(MessageSource.Resolver, stmt, "new can be applied only to reference types (got {0})", rr.EType);
             } else {
               // ---------- new C.Init(EE)
               Contract.Assert(initCallName != null);
-              var prevErrorCount = ErrorCount;
+              var prevErrorCount = reporter.Count(ErrorLevel.Error);
 
               // We want to create a MemberSelectExpr for the initializing method.  To do that, we create a throw-away receiver of the appropriate
               // type, create an dot-suffix expression around this receiver, and then resolve it in the usual way for dot-suffix expressions.
               var lhs = new ImplicitThisExpr(initCallTok) { Type = rr.EType };
               var callLhs = new ExprDotName(initCallTok, lhs, initCallName, ret == null ? null : ret.LastComponent.OptTypeArguments);
               ResolveDotSuffix(callLhs, true, rr.Arguments, new ResolveOpts(codeContext, true, specContextOnly), true);
-              if (prevErrorCount == ErrorCount) {
+              if (prevErrorCount == reporter.Count(ErrorLevel.Error)) {
                 Contract.Assert(callLhs.ResolvedExpression is MemberSelectExpr);  // since ResolveApplySuffix succeeded and call.Lhs denotes an expression (not a module or a type)
                 var methodSel = (MemberSelectExpr)callLhs.ResolvedExpression;
                 if (methodSel.Member is Method) {
@@ -6689,7 +6573,7 @@ namespace Microsoft.Dafny
                     callsConstructor = true;
                   }
                 } else {
-                  Error(initCallTok, "object initialization must denote an initializing method or constructor ({0})", initCallName);
+                  reporter.Error(MessageSource.Resolver, initCallTok, "object initialization must denote an initializing method or constructor ({0})", initCallName);
                 }
               }
             }
@@ -6699,10 +6583,10 @@ namespace Microsoft.Dafny
             if (udt != null) {
               var cl = (ClassDecl)udt.ResolvedClass;  // cast is guaranteed by the call to rr.EType.IsRefType above, together with the "rr.EType is UserDefinedType" test
               if (cl is TraitDecl) {
-                Error(stmt, "new cannot be applied to a trait");
+                reporter.Error(MessageSource.Resolver, stmt, "new cannot be applied to a trait");
               }
               if (!callsConstructor && cl.HasConstructor) {
-                Error(stmt, "when allocating an object of type '{0}', one of its constructor methods must be called", cl.Name);
+                reporter.Error(MessageSource.Resolver, stmt, "when allocating an object of type '{0}', one of its constructor methods must be called", cl.Name);
               }
             }
           }
@@ -6731,7 +6615,7 @@ namespace Microsoft.Dafny
         }
       }
       if (receiverType is TypeProxy) {
-        Error(tok, "type of the receiver is not fully determined at this program point", receiverType);
+        reporter.Error(MessageSource.Resolver, tok, "type of the receiver is not fully determined at this program point", receiverType);
         return null;
       }
       Contract.Assert(receiverType is NonProxyType);  // there are only two kinds of types: proxies and non-proxies
@@ -6744,20 +6628,20 @@ namespace Microsoft.Dafny
         if (!classMembers[cd].TryGetValue(memberName, out member)) {
           var kind = cd is IteratorDecl ? "iterator" : "class";
           if (memberName == "_ctor") {
-            Error(tok, "{0} {1} does not have an anonymous constructor", kind, ctype.Name);
+            reporter.Error(MessageSource.Resolver, tok, "{0} {1} does not have an anonymous constructor", kind, ctype.Name);
           } else {
             // search the static members of the enclosing module or its imports
             if (moduleInfo.StaticMembers.TryGetValue(memberName, out member)) {
               Contract.Assert(member.IsStatic); // moduleInfo.StaticMembers is supposed to contain only static members of the module's implicit class _default
               if (member is AmbiguousMemberDecl) {
                 var ambiguousMember = (AmbiguousMemberDecl)member;
-                Error(tok, "The name {0} ambiguously refers to a static member in one of the modules {1} (try qualifying the member name with the module name)", memberName, ambiguousMember.ModuleNames());
+                reporter.Error(MessageSource.Resolver, tok, "The name {0} ambiguously refers to a static member in one of the modules {1} (try qualifying the member name with the module name)", memberName, ambiguousMember.ModuleNames());
               } else {
                 nptype = GetReceiverType(tok, member);
                 return member;
               }
             } else {
-              Error(tok, "member {0} does not exist in {2} {1}", memberName, ctype.Name, kind);
+              reporter.Error(MessageSource.Resolver, tok, "member {0} does not exist in {2} {1}", memberName, ctype.Name, kind);
             }
           }
           return null;
@@ -6771,7 +6655,7 @@ namespace Microsoft.Dafny
       if (dtd != null) {
         MemberDecl member;
         if (!datatypeMembers[dtd].TryGetValue(memberName, out member)) {
-          Error(tok, "member {0} does not exist in datatype {1}", memberName, dtd.Name);
+          reporter.Error(MessageSource.Resolver, tok, "member {0} does not exist in datatype {1}", memberName, dtd.Name);
           return null;
         } else {
           nptype = (UserDefinedType)receiverType;
@@ -6797,7 +6681,7 @@ namespace Microsoft.Dafny
         }
       }
 
-      Error(tok, "type {0} does not have a member {1}", receiverType, memberName);
+      reporter.Error(MessageSource.Resolver, tok, "type {0} does not have a member {1}", receiverType, memberName);
       return null;
     }
 
@@ -7021,10 +6905,10 @@ namespace Microsoft.Dafny
 
       } else if (expr is NegationExpression) {
         var e = (NegationExpression)expr;
-        var errorCount = ErrorCount;
+        var errorCount = reporter.Count(ErrorLevel.Error);
         ResolveExpression(e.E, opts);
         e.Type = e.E.Type;
-        if (errorCount != ErrorCount) {
+        if (errorCount != reporter.Count(ErrorLevel.Error)) {
           // there were errors resolving the operand; take the quick way out and
           // just let the (already erronous) subexpression be what the negation expression
           // will resolve to
@@ -7074,7 +6958,7 @@ namespace Microsoft.Dafny
         }
       } else if (expr is ThisExpr) {
         if (!scope.AllowInstance) {
-          Error(expr, "'this' is not allowed in a 'static' context");
+          reporter.Error(MessageSource.Resolver, expr, "'this' is not allowed in a 'static' context");
         }
         if (currentClass != null) {
           expr.Type = GetThisType(expr.tok, currentClass);  // do this regardless of scope.AllowInstance, for better error reporting
@@ -7086,19 +6970,19 @@ namespace Microsoft.Dafny
         if (e.Var != null) {
           expr.Type = e.Var.Type;
         } else {
-          Error(expr, "Identifier does not denote a local variable, parameter, or bound variable: {0}", e.Name);
+          reporter.Error(MessageSource.Resolver, expr, "Identifier does not denote a local variable, parameter, or bound variable: {0}", e.Name);
         }
 
       } else if (expr is DatatypeValue) {
         DatatypeValue dtv = (DatatypeValue)expr;
         TopLevelDecl d;
         if (!moduleInfo.TopLevels.TryGetValue(dtv.DatatypeName, out d)) {
-          Error(expr.tok, "Undeclared datatype: {0}", dtv.DatatypeName);
+          reporter.Error(MessageSource.Resolver, expr.tok, "Undeclared datatype: {0}", dtv.DatatypeName);
         } else if (d is AmbiguousTopLevelDecl) {
           var ad = (AmbiguousTopLevelDecl)d;
-          Error(expr.tok, "The name {0} ambiguously refers to a type in one of the modules {1} (try qualifying the type name with the module name)", dtv.DatatypeName, ad.ModuleNames());
+          reporter.Error(MessageSource.Resolver, expr.tok, "The name {0} ambiguously refers to a type in one of the modules {1} (try qualifying the type name with the module name)", dtv.DatatypeName, ad.ModuleNames());
         } else if (!(d is DatatypeDecl)) {
-          Error(expr.tok, "Expected datatype: {0}", dtv.DatatypeName);
+          reporter.Error(MessageSource.Resolver, expr.tok, "Expected datatype: {0}", dtv.DatatypeName);
         } else {
           ResolveDatatypeValue(opts, dtv, (DatatypeDecl)d);
         }
@@ -7110,7 +6994,7 @@ namespace Microsoft.Dafny
           ResolveExpression(ee, opts);
           Contract.Assert(ee.Type != null);  // follows from postcondition of ResolveExpression
           if (!UnifyTypes(elementType, ee.Type)) {
-            Error(ee, "All elements of display must be of the same type (got {0}, but type of previous elements is {1})", ee.Type, elementType);
+            reporter.Error(MessageSource.Resolver, ee, "All elements of display must be of the same type (got {0}, but type of previous elements is {1})", ee.Type, elementType);
           }
         }
         if (expr is SetDisplayExpr) {
@@ -7129,12 +7013,12 @@ namespace Microsoft.Dafny
           ResolveExpression(p.A, opts);
           Contract.Assert(p.A.Type != null);  // follows from postcondition of ResolveExpression
           if (!UnifyTypes(domainType, p.A.Type)) {
-            Error(p.A, "All elements of display must be of the same type (got {0}, but type of previous elements is {1})", p.A.Type, domainType);
+            reporter.Error(MessageSource.Resolver, p.A, "All elements of display must be of the same type (got {0}, but type of previous elements is {1})", p.A.Type, domainType);
           }
           ResolveExpression(p.B, opts);
           Contract.Assert(p.B.Type != null);  // follows from postcondition of ResolveExpression
           if (!UnifyTypes(rangeType, p.B.Type)) {
-            Error(p.B, "All elements of display must be of the same type (got {0}, but type of previous elements is {1})", p.B.Type, rangeType);
+            reporter.Error(MessageSource.Resolver, p.B, "All elements of display must be of the same type (got {0}, but type of previous elements is {1})", p.B.Type, rangeType);
           }
         }
         expr.Type = new MapType(e.Finite, domainType, rangeType);
@@ -7142,18 +7026,18 @@ namespace Microsoft.Dafny
         var e = (NameSegment)expr;
         ResolveNameSegment(e, true, null, opts, false);
         if (e.Type is Resolver_IdentifierExpr.ResolverType_Module) {
-          Error(e.tok, "name of module ({0}) is used as a variable", e.Name);
+          reporter.Error(MessageSource.Resolver, e.tok, "name of module ({0}) is used as a variable", e.Name);
         } else if (e.Type is Resolver_IdentifierExpr.ResolverType_Type) {
-          Error(e.tok, "name of type ({0}) is used as a variable", e.Name);
+          reporter.Error(MessageSource.Resolver, e.tok, "name of type ({0}) is used as a variable", e.Name);
         }
 
       } else if (expr is ExprDotName) {
         var e = (ExprDotName)expr;
         ResolveDotSuffix(e, true, null, opts, false);
         if (e.Type is Resolver_IdentifierExpr.ResolverType_Module) {
-          Error(e.tok, "name of module ({0}) is used as a variable", e.SuffixName);
+          reporter.Error(MessageSource.Resolver, e.tok, "name of module ({0}) is used as a variable", e.SuffixName);
         } else if (e.Type is Resolver_IdentifierExpr.ResolverType_Type) {
-          Error(e.tok, "name of type ({0}) is used as a variable", e.SuffixName);
+          reporter.Error(MessageSource.Resolver, e.tok, "name of type ({0}) is used as a variable", e.SuffixName);
         }
 
       } else if (expr is ApplySuffix) {
@@ -7193,7 +7077,7 @@ namespace Microsoft.Dafny
           var field = (Field)member;
           e.Member = field;
           if (e.Obj is StaticReceiverExpr) {
-            Error(expr, "a field must be selected via an object, not just a class name");
+            reporter.Error(MessageSource.Resolver, expr, "a field must be selected via an object, not just a class name");
           }
           var ctype = nptype as UserDefinedType;
           if (ctype == null) {
@@ -7205,7 +7089,7 @@ namespace Microsoft.Dafny
             e.Type = SubstType(field.Type, subst);
           }
         } else {
-          Error(expr, "member {0} in type {1} does not refer to a field or a function", e.MemberName, nptype);
+          reporter.Error(MessageSource.Resolver, expr, "member {0} in type {1} does not refer to a field or a function", e.MemberName, nptype);
         }
 
       } else if (expr is SeqSelectExpr) {
@@ -7219,7 +7103,7 @@ namespace Microsoft.Dafny
         Contract.Assert(e.Array.Type != null);  // follows from postcondition of ResolveExpression
         Type elementType = new InferredTypeProxy();
         if (!UnifyTypes(e.Array.Type, ResolvedArrayType(e.Array.tok, e.Indices.Count, elementType, opts.codeContext))) {
-          Error(e.Array, "array selection requires an array{0} (got {1})", e.Indices.Count, e.Array.Type);
+          reporter.Error(MessageSource.Resolver, e.Array, "array selection requires an array{0} (got {1})", e.Indices.Count, e.Array.Type);
         }
         int i = 0;
         foreach (Expression idx in e.Indices) {
@@ -7227,7 +7111,7 @@ namespace Microsoft.Dafny
           ResolveExpression(idx, opts);
           Contract.Assert(idx.Type != null);  // follows from postcondition of ResolveExpression
           if (!UnifyTypes(idx.Type, new OperationTypeProxy(true, false, false, false, false, false))) {
-            Error(idx, "array selection requires integer-based numeric indices (got {0} for index {1})", idx.Type, i);
+            reporter.Error(MessageSource.Resolver, idx, "array selection requires integer-based numeric indices (got {0} for index {1})", idx.Type, i);
           }
           i++;
         }
@@ -7244,42 +7128,42 @@ namespace Microsoft.Dafny
           ResolveExpression(e.Index, opts);
           Contract.Assert(e.Index.Type != null);  // follows from postcondition of ResolveExpression
           if (!UnifyTypes(e.Index.Type, Type.Int)) {
-            Error(e.Index, "sequence update requires integer index (got {0})", e.Index.Type);
+            reporter.Error(MessageSource.Resolver, e.Index, "sequence update requires integer index (got {0})", e.Index.Type);
           }
           ResolveExpression(e.Value, opts);
           Contract.Assert(e.Value.Type != null);  // follows from postcondition of ResolveExpression
           if (!UnifyTypes(e.Value.Type, elementType)) {
-            Error(e.Value, "sequence update requires the value to have the element type of the sequence (got {0})", e.Value.Type);
+            reporter.Error(MessageSource.Resolver, e.Value, "sequence update requires the value to have the element type of the sequence (got {0})", e.Value.Type);
           }
           expr.Type = e.Seq.Type;
         } else if (UnifyTypes(e.Seq.Type, new MapType(true, domainType, rangeType))) {
           ResolveExpression(e.Index, opts);
           if (!UnifyTypes(e.Index.Type, domainType)) {
-            Error(e.Index, "map update requires domain element to be of type {0} (got {1})", domainType, e.Index.Type);
+            reporter.Error(MessageSource.Resolver, e.Index, "map update requires domain element to be of type {0} (got {1})", domainType, e.Index.Type);
           }
           ResolveExpression(e.Value, opts);
           if (!UnifyTypes(e.Value.Type, rangeType)) {
-            Error(e.Value, "map update requires the value to have the range type {0} (got {1})", rangeType, e.Value.Type);
+            reporter.Error(MessageSource.Resolver, e.Value, "map update requires the value to have the range type {0} (got {1})", rangeType, e.Value.Type);
           }
           expr.Type = e.Seq.Type;
         } else if (UnifyTypes(e.Seq.Type, new MapType(false, domainType, rangeType))) {
           ResolveExpression(e.Index, opts);
           if (!UnifyTypes(e.Index.Type, domainType)) {
-            Error(e.Index, "imap update requires domain element to be of type {0} (got {1})", domainType, e.Index.Type);
+            reporter.Error(MessageSource.Resolver, e.Index, "imap update requires domain element to be of type {0} (got {1})", domainType, e.Index.Type);
           }
           ResolveExpression(e.Value, opts);
           if (!UnifyTypes(e.Value.Type, rangeType)) {
-            Error(e.Value, "imap update requires the value to have the range type {0} (got {1})", rangeType, e.Value.Type);
+            reporter.Error(MessageSource.Resolver, e.Value, "imap update requires the value to have the range type {0} (got {1})", rangeType, e.Value.Type);
           }
           expr.Type = e.Seq.Type;
         } else if (UnifyTypes(e.Seq.Type, new MultiSetType(elementType))) {
           ResolveExpression(e.Index, opts);
           if (!UnifyTypes(e.Index.Type, elementType)) {
-            Error(e.Index, "multiset update requires domain element to be of type {0} (got {1})", elementType, e.Index.Type);
+            reporter.Error(MessageSource.Resolver, e.Index, "multiset update requires domain element to be of type {0} (got {1})", elementType, e.Index.Type);
           }
           ResolveExpression(e.Value, opts);
           if (!UnifyTypes(e.Value.Type, new OperationTypeProxy(true, false, false, false, false, false))) {
-            Error(e.Value, "multiset update requires integer-based numeric value (got {0})", e.Value.Type);
+            reporter.Error(MessageSource.Resolver, e.Value, "multiset update requires integer-based numeric value (got {0})", e.Value.Type);
           }
           expr.Type = e.Seq.Type;
 
@@ -7297,7 +7181,7 @@ namespace Microsoft.Dafny
             var ei = (SeqUpdateExpr)eIter;
 
             if (!(ei.Index is NameSegment|| (ei.Index is LiteralExpr && ((LiteralExpr)ei.Index).Value is BigInteger))) {
-              Error(expr, "datatype updates must be to datatype destructors");
+              reporter.Error(MessageSource.Resolver, expr, "datatype updates must be to datatype destructors");
             } else {
               string destructor_str = null;
 
@@ -7313,12 +7197,12 @@ namespace Microsoft.Dafny
               if (IndexToValue.ContainsKey(destructor_str)) {
                 // Don't bother trying to optimize this case; we'd have to drop one of the updates,
                 // which makes resolving the dropped update an annoyance.
-                Warning(ei.tok, "update to {0} overwritten by another update to {1}", destructor_str, destructor_str);
+                reporter.Warning(MessageSource.Resolver, ei.tok, "update to {0} overwritten by another update to {1}", destructor_str, destructor_str);
                 break;
               }
               MemberDecl member;
               if (!datatypeMembers[dt].TryGetValue(destructor_str, out member)) {
-                Error(expr, "member {0} does not exist in datatype {1}", destructor_str, dt.Name);
+                reporter.Error(MessageSource.Resolver, expr, "member {0} does not exist in datatype {1}", destructor_str, dt.Name);
               } else {
                 DatatypeDestructor destructor = (DatatypeDestructor)member;
                 if (ctor != null && ctor != destructor.EnclosingCtor) {
@@ -7367,7 +7251,7 @@ namespace Microsoft.Dafny
 
           expr.Type = e0.Type;
         } else {
-          Error(expr, "update requires a sequence, map, or datatype (got {0})", e.Seq.Type);
+          reporter.Error(MessageSource.Resolver, expr, "update requires a sequence, map, or datatype (got {0})", e.Seq.Type);
         }
 
       } else if (expr is FunctionCallExpr) {
@@ -7382,13 +7266,13 @@ namespace Microsoft.Dafny
         }
         var fnType = e.Function.Type.AsArrowType;
         if (fnType == null) {
-          Error(e.tok, "non-function expression (of type {0}) is called with parameters", e.Function.Type);
+          reporter.Error(MessageSource.Resolver, e.tok, "non-function expression (of type {0}) is called with parameters", e.Function.Type);
         } else if (fnType.Arity != e.Args.Count) {
-          Error(e.tok, "wrong number of arguments to function application (function type '{0}' expects {1}, got {2})", fnType, fnType.Arity, e.Args.Count);
+          reporter.Error(MessageSource.Resolver, e.tok, "wrong number of arguments to function application (function type '{0}' expects {1}, got {2})", fnType, fnType.Arity, e.Args.Count);
         } else {
           for (var i = 0; i < fnType.Arity; i++) {
             if (!UnifyTypes(fnType.Args[i], e.Args[i].Type)) {
-              Error(e.Args[i].tok, "type mismatch for argument {0} (function expects {1}, got {2})", i, fnType.Args[i], e.Args[i].Type);
+              reporter.Error(MessageSource.Resolver, e.Args[i].tok, "type mismatch for argument {0} (function expects {1}, got {2})", i, fnType.Args[i], e.Args[i].Type);
             }
           }
         }
@@ -7397,7 +7281,7 @@ namespace Microsoft.Dafny
       } else if (expr is OldExpr) {
         OldExpr e = (OldExpr)expr;
         if (!opts.twoState) {
-          Error(expr, "old expressions are not allowed in this context");
+          reporter.Error(MessageSource.Resolver, expr, "old expressions are not allowed in this context");
         }
         ResolveExpression(e.E, opts);
         expr.Type = e.E.Type;
@@ -7406,7 +7290,7 @@ namespace Microsoft.Dafny
         MultiSetFormingExpr e = (MultiSetFormingExpr)expr;
         ResolveExpression(e.E, opts);
         if (!UnifyTypes(e.E.Type, new SetType(true, new InferredTypeProxy())) && !UnifyTypes(e.E.Type, new SeqType(new InferredTypeProxy()))) {
-          Error(e.tok, "can only form a multiset from a seq or set.");
+          reporter.Error(MessageSource.Resolver, e.tok, "can only form a multiset from a seq or set.");
         }
         expr.Type = new MultiSetType(e.E.Type.AsCollectionType.Arg);
 
@@ -7417,19 +7301,19 @@ namespace Microsoft.Dafny
         switch (e.Op) {
           case UnaryOpExpr.Opcode.Not:
             if (!UnifyTypes(e.E.Type, Type.Bool)) {
-              Error(expr, "logical negation expects a boolean argument (instead got {0})", e.E.Type);
+              reporter.Error(MessageSource.Resolver, expr, "logical negation expects a boolean argument (instead got {0})", e.E.Type);
             }
             expr.Type = Type.Bool;
             break;
           case UnaryOpExpr.Opcode.Cardinality:
             if (!UnifyTypes(e.E.Type, new CollectionTypeProxy(new InferredTypeProxy(), false, false))) {
-              Error(expr, "size operator expects a collection argument (instead got {0})", e.E.Type);
+              reporter.Error(MessageSource.Resolver, expr, "size operator expects a collection argument (instead got {0})", e.E.Type);
             }
             expr.Type = Type.Int;
             break;
           case UnaryOpExpr.Opcode.Fresh:
             if (!opts.twoState) {
-              Error(expr, "fresh expressions are not allowed in this context");
+              reporter.Error(MessageSource.Resolver, expr, "fresh expressions are not allowed in this context");
             }
             // the type of e.E must be either an object or a collection of objects
             Type t = e.E.Type.NormalizeExpand();
@@ -7444,7 +7328,7 @@ namespace Microsoft.Dafny
             } else if (t.IsDatatype) {
               // fine, treat this as the datatype itself.
             } else {
-              Error(expr, "the argument of a fresh expression must denote an object or a collection of objects (instead got {0})", e.E.Type);
+              reporter.Error(MessageSource.Resolver, expr, "the argument of a fresh expression must denote an object or a collection of objects (instead got {0})", e.E.Type);
             }
             expr.Type = Type.Bool;
             break;
@@ -7458,14 +7342,14 @@ namespace Microsoft.Dafny
         ResolveExpression(e.E, opts);
         if (e.ToType.IsNumericBased(Type.NumericPersuation.Int)) {
           if (!UnifyTypes(e.E.Type, new OperationTypeProxy(true, true, false, false, false, false))) {
-            Error(expr, "type conversion to an int-based type is allowed only from numeric types (got {0})", e.E.Type);
+            reporter.Error(MessageSource.Resolver, expr, "type conversion to an int-based type is allowed only from numeric types (got {0})", e.E.Type);
           }
         } else if (e.ToType.IsNumericBased(Type.NumericPersuation.Real)) {
           if (!UnifyTypes(e.E.Type, new OperationTypeProxy(true, true, false, false, false, false))) {
-            Error(expr, "type conversion to a real-based type is allowed only from numeric types (got {0})", e.E.Type);
+            reporter.Error(MessageSource.Resolver, expr, "type conversion to a real-based type is allowed only from numeric types (got {0})", e.E.Type);
           }
         } else {
-          Error(expr, "type conversions are not supported to this type (got {0})", e.ToType);
+          reporter.Error(MessageSource.Resolver, expr, "type conversions are not supported to this type (got {0})", e.ToType);
         }
         e.Type = e.ToType;
 
@@ -7482,10 +7366,10 @@ namespace Microsoft.Dafny
           case BinaryExpr.Opcode.And:
           case BinaryExpr.Opcode.Or:
             if (!UnifyTypes(e.E0.Type, Type.Bool)) {
-              Error(expr, "first argument to {0} must be of type bool (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type);
+              reporter.Error(MessageSource.Resolver, expr, "first argument to {0} must be of type bool (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type);
             }
             if (!UnifyTypes(e.E1.Type, Type.Bool)) {
-              Error(expr, "second argument to {0} must be of type bool (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E1.Type);
+              reporter.Error(MessageSource.Resolver, expr, "second argument to {0} must be of type bool (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E1.Type);
             }
             expr.Type = Type.Bool;
             break;
@@ -7506,7 +7390,7 @@ namespace Microsoft.Dafny
               // unification will succeed.
             } else {
               // The types are not comparable and do not unify.  It's time for an error message.
-              Error(expr, "arguments must have the same type (got {0} and {1})", e.E0.Type, e.E1.Type);
+              reporter.Error(MessageSource.Resolver, expr, "arguments must have the same type (got {0} and {1})", e.E0.Type, e.E1.Type);
             }
             expr.Type = Type.Bool;
             break;
@@ -7514,12 +7398,12 @@ namespace Microsoft.Dafny
           case BinaryExpr.Opcode.Disjoint:
             // TODO: the error messages are backwards from what (ideally) they should be. this is necessary because UnifyTypes can't backtrack.
             if (!UnifyTypes(e.E0.Type, e.E1.Type)) {
-              Error(expr, "arguments must have the same type (got {0} and {1})", e.E0.Type, e.E1.Type);
+              reporter.Error(MessageSource.Resolver, expr, "arguments must have the same type (got {0} and {1})", e.E0.Type, e.E1.Type);
             }
             if (!UnifyTypes(e.E0.Type, new SetType(true, new InferredTypeProxy())) &&
                 !UnifyTypes(e.E0.Type, new MultiSetType(new InferredTypeProxy())) &&
                 !UnifyTypes(e.E0.Type, new MapType(true, new InferredTypeProxy(), new InferredTypeProxy()))) {
-              Error(expr, "arguments must be of a [multi]set or map type (got {0})", e.E0.Type);
+              reporter.Error(MessageSource.Resolver, expr, "arguments must be of a [multi]set or map type (got {0})", e.E0.Type);
             }
             expr.Type = Type.Bool;
             break;
@@ -7531,26 +7415,26 @@ namespace Microsoft.Dafny
                 if (UnifyTypes(e.E1.Type, new DatatypeProxy(false, false))) {
                   e.ResolvedOp = BinaryExpr.ResolvedOpcode.RankLt;
                 } else {
-                  Error(expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E1.Type);
+                  reporter.Error(MessageSource.Resolver, expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E1.Type);
                 }
                 expr.Type = Type.Bool;
               } else if (e.Op == BinaryExpr.Opcode.Lt && e.E1.Type.NormalizeExpand().IsIndDatatype) {
                 if (UnifyTypes(e.E0.Type, new DatatypeProxy(false, true))) {
                   e.ResolvedOp = BinaryExpr.ResolvedOpcode.RankLt;
                 } else {
-                  Error(expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E0.Type);
+                  reporter.Error(MessageSource.Resolver, expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E0.Type);
                 }
                 expr.Type = Type.Bool;
               } else {
                 bool err = false;
                 bool isComparison = e.Op != BinaryExpr.Opcode.Add;
                 if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, true, isComparison, true, true, true))) {
-                  Error(expr, "arguments to {0} must be of a numeric type{2} or a collection type (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type,
+                  reporter.Error(MessageSource.Resolver, expr, "arguments to {0} must be of a numeric type{2} or a collection type (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type,
                     isComparison ? ", char," : "");
                   err = true;
                 }
                 if (!UnifyTypes(e.E1.Type, e.E0.Type)) {
-                  Error(expr, "arguments to {0} must have the same type (got {1} and {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
+                  reporter.Error(MessageSource.Resolver, expr, "arguments to {0} must have the same type (got {1} and {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
                   err = true;
                 }
                 if (isComparison) {
@@ -7570,26 +7454,26 @@ namespace Microsoft.Dafny
                 if (UnifyTypes(e.E1.Type, new DatatypeProxy(false, true))) {
                   e.ResolvedOp = BinaryExpr.ResolvedOpcode.RankGt;
                 } else {
-                  Error(expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E1.Type);
+                  reporter.Error(MessageSource.Resolver, expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E1.Type);
                 }
                 expr.Type = Type.Bool;
               } else if (e.Op == BinaryExpr.Opcode.Gt && (e.E1.Type.NormalizeExpand().IsIndDatatype || e.E1.Type.IsTypeParameter)) {
                 if (UnifyTypes(e.E0.Type, new DatatypeProxy(false, false))) {
                   e.ResolvedOp = BinaryExpr.ResolvedOpcode.RankGt;
                 } else {
-                  Error(expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E0.Type);
+                  reporter.Error(MessageSource.Resolver, expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E0.Type);
                 }
                 expr.Type = Type.Bool;
               } else {
                 bool err = false;
                 bool isComparison = e.Op == BinaryExpr.Opcode.Gt || e.Op == BinaryExpr.Opcode.Ge;
                 if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, true, isComparison, false, true, true))) {
-                  Error(expr, "arguments to {0} must be of a numeric type{2} or a set type (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type,
+                  reporter.Error(MessageSource.Resolver, expr, "arguments to {0} must be of a numeric type{2} or a set type (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type,
                     isComparison ? ", char, " : "");
                   err = true;
                 }
                 if (!UnifyTypes(e.E1.Type, e.E0.Type)) {
-                  Error(expr, "arguments to {0} must have the same type (got {1} and {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
+                  reporter.Error(MessageSource.Resolver, expr, "arguments to {0} must have the same type (got {1} and {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
                   err = true;
                 }
                 if (isComparison) {
@@ -7604,27 +7488,27 @@ namespace Microsoft.Dafny
           case BinaryExpr.Opcode.In:
           case BinaryExpr.Opcode.NotIn:
             if (!UnifyTypes(e.E1.Type, new CollectionTypeProxy(e.E0.Type, true, true))) {
-              Error(expr, "second argument to \"{0}\" must be a set, multiset, or sequence with elements of type {1}, or a map with domain {1} (instead got {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
+              reporter.Error(MessageSource.Resolver, expr, "second argument to \"{0}\" must be a set, multiset, or sequence with elements of type {1}, or a map with domain {1} (instead got {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
             }
             expr.Type = Type.Bool;
             break;
 
           case BinaryExpr.Opcode.Div:
             if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, true, false, false, false, false))) {
-              Error(expr, "first argument to {0} must be of numeric type (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type);
+              reporter.Error(MessageSource.Resolver, expr, "first argument to {0} must be of numeric type (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type);
             }
             if (!UnifyTypes(e.E1.Type, e.E0.Type)) {
-              Error(expr, "arguments to {0} must have the same type (got {1} and {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
+              reporter.Error(MessageSource.Resolver, expr, "arguments to {0} must have the same type (got {1} and {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
             }
             expr.Type = e.E0.Type;
             break;
 
           case BinaryExpr.Opcode.Mod:
             if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, false, false, false, false, false))) {
-              Error(expr, "first argument to {0} must be of type int (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type);
+              reporter.Error(MessageSource.Resolver, expr, "first argument to {0} must be of type int (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type);
             }
             if (!UnifyTypes(e.E1.Type, e.E0.Type)) {
-              Error(expr, "second argument to {0} must be of type int (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E1.Type);
+              reporter.Error(MessageSource.Resolver, expr, "second argument to {0} must be of type int (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E1.Type);
             }
             expr.Type = e.E0.Type;
             break;
@@ -7644,13 +7528,13 @@ namespace Microsoft.Dafny
           case TernaryExpr.Opcode.PrefixEqOp:
           case TernaryExpr.Opcode.PrefixNeqOp:
             if (!UnifyTypes(e.E0.Type, Type.Int)) {
-              Error(e.E0, "prefix-equality limit argument must be an integer expression (got {0})", e.E0.Type);
+              reporter.Error(MessageSource.Resolver, e.E0, "prefix-equality limit argument must be an integer expression (got {0})", e.E0.Type);
             }
             if (!UnifyTypes(e.E1.Type, new DatatypeProxy(true))) {
-              Error(expr, "arguments to prefix equality must be codatatypes (instead of {0})", e.E1.Type);
+              reporter.Error(MessageSource.Resolver, expr, "arguments to prefix equality must be codatatypes (instead of {0})", e.E1.Type);
             }
             if (!UnifyTypes(e.E1.Type, e.E2.Type)) {
-              Error(expr, "arguments must have the same type (got {0} and {1})", e.E1.Type, e.E2.Type);
+              reporter.Error(MessageSource.Resolver, expr, "arguments must have the same type (got {0} and {1})", e.E1.Type, e.E2.Type);
             }
             expr.Type = Type.Bool;
             break;
@@ -7667,7 +7551,7 @@ namespace Microsoft.Dafny
           }
           scope.PushMarker();
           if (e.LHSs.Count != e.RHSs.Count) {
-            Error(expr, "let expression must have same number of LHSs (found {0}) as RHSs (found {1})", e.LHSs.Count, e.RHSs.Count);
+            reporter.Error(MessageSource.Resolver, expr, "let expression must have same number of LHSs (found {0}) as RHSs (found {1})", e.LHSs.Count, e.RHSs.Count);
           }
           var i = 0;
           foreach (var lhs in e.LHSs) {
@@ -7681,14 +7565,14 @@ namespace Microsoft.Dafny
             }
             if (c == 0) {
               // Every identifier-looking thing in the pattern resolved to a constructor; that is, this LHS is a constant literal
-              Error(lhs.tok, "LHS is a constant literal; to be legal, it must introduce at least one bound variable");
+              reporter.Error(MessageSource.Resolver, lhs.tok, "LHS is a constant literal; to be legal, it must introduce at least one bound variable");
             }
             i++;
           }
         } else {
           // let-such-that expression
           if (e.RHSs.Count != 1) {
-            Error(expr, "let-such-that expression must have just one RHS (found {0})", e.RHSs.Count);
+            reporter.Error(MessageSource.Resolver, expr, "let-such-that expression must have just one RHS (found {0})", e.RHSs.Count);
           }
           // the bound variables are in scope in the RHS of a let-such-that expression
           scope.PushMarker();
@@ -7701,7 +7585,7 @@ namespace Microsoft.Dafny
           foreach (var rhs in e.RHSs) {
             ResolveExpression(rhs, opts);
             if (!UnifyTypes(rhs.Type, Type.Bool)) {
-              Error(rhs.tok, "type of RHS of let-such-that expression must be boolean (got {0})", rhs.Type);
+              reporter.Error(MessageSource.Resolver, rhs.tok, "type of RHS of let-such-that expression must be boolean (got {0})", rhs.Type);
             }
           }
           if (!opts.DontCareAboutCompilation && !e.BoundVars.All(bv => bv.IsGhost)) {
@@ -7720,7 +7604,7 @@ namespace Microsoft.Dafny
         e.Type = e.Body.Type;
       } else if (expr is QuantifierExpr) {
         QuantifierExpr e = (QuantifierExpr)expr;
-        int prevErrorCount = ErrorCount;
+        int prevErrorCount = reporter.Count(ErrorLevel.Error);
         bool _val = true;
         bool typeQuantifier = Attributes.ContainsBool(e.Attributes, "typeQuantifier", ref _val) && _val;
         allTypeParameters.PushMarker();
@@ -7732,19 +7616,19 @@ namespace Microsoft.Dafny
           ResolveType(v.tok, v.Type, opts.codeContext, option, typeQuantifier ? e.TypeArgs : null);
         }
         if (e.TypeArgs.Count > 0 && !typeQuantifier) {
-          Error(expr, "a quantifier cannot quantify over types. Possible fix: use the experimental attribute :typeQuantifier");
+          reporter.Error(MessageSource.Resolver, expr, "a quantifier cannot quantify over types. Possible fix: use the experimental attribute :typeQuantifier");
         }
         if (e.Range != null) {
           ResolveExpression(e.Range, new ResolveOpts(opts, true));
           Contract.Assert(e.Range.Type != null);  // follows from postcondition of ResolveExpression
           if (!UnifyTypes(e.Range.Type, Type.Bool)) {
-            Error(expr, "range of quantifier must be of type bool (instead got {0})", e.Range.Type);
+            reporter.Error(MessageSource.Resolver, expr, "range of quantifier must be of type bool (instead got {0})", e.Range.Type);
           }
         }
         ResolveExpression(e.Term, new ResolveOpts(opts, true));
         Contract.Assert(e.Term.Type != null);  // follows from postcondition of ResolveExpression
         if (!UnifyTypes(e.Term.Type, Type.Bool)) {
-          Error(expr, "body of quantifier must be of type bool (instead got {0})", e.Term.Type);
+          reporter.Error(MessageSource.Resolver, expr, "body of quantifier must be of type bool (instead got {0})", e.Term.Type);
         }
         // Since the body is more likely to infer the types of the bound variables, resolve it
         // first (above) and only then resolve the attributes (below).
@@ -7753,10 +7637,10 @@ namespace Microsoft.Dafny
         allTypeParameters.PopMarker();
         expr.Type = Type.Bool;
 
-        if (prevErrorCount == ErrorCount) {
+        if (prevErrorCount == reporter.Count(ErrorLevel.Error)) {
           var missingBounds = new List<BoundVar>();
           CheckTypeInference(e.LogicalBody());  // we need to resolve operators before the call to DiscoverBounds
-          e.Bounds = DiscoverBounds(e.tok, e.BoundVars, e.LogicalBody(), e is ExistsExpr, false, missingBounds);
+          e.Bounds = DiscoverBounds(e.tok, e.BoundVars, e.LogicalBody(), e is ExistsExpr, false, missingBounds, reporter);
           if (missingBounds.Count != 0) {
             // Report errors here about quantifications that depend on the allocation state.
             var mb = missingBounds;
@@ -7764,7 +7648,7 @@ namespace Microsoft.Dafny
               mb = new List<BoundVar>();  // (who cares if we allocate another array; this happens only in the case of a resolution error anyhow)
               foreach (var bv in missingBounds) {
                 if (bv.Type.IsRefType) {
-                  Error(expr, "a quantifier involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of '{0}'", bv.Name);
+                  reporter.Error(MessageSource.Resolver, expr, "a quantifier involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of '{0}'", bv.Name);
                 } else {
                   mb.Add(bv);
                 }
@@ -7778,7 +7662,7 @@ namespace Microsoft.Dafny
 
       } else if (expr is SetComprehension) {
         var e = (SetComprehension)expr;
-        int prevErrorCount = ErrorCount;
+        int prevErrorCount = reporter.Count(ErrorLevel.Error);
         scope.PushMarker();
         foreach (BoundVar v in e.BoundVars) {
           ScopePushAndReport(scope, v, "bound-variable");
@@ -7787,7 +7671,7 @@ namespace Microsoft.Dafny
         ResolveExpression(e.Range, opts);
         Contract.Assert(e.Range.Type != null);  // follows from postcondition of ResolveExpression
         if (!UnifyTypes(e.Range.Type, Type.Bool)) {
-          Error(expr, "range of comprehension must be of type bool (instead got {0})", e.Range.Type);
+          reporter.Error(MessageSource.Resolver, expr, "range of comprehension must be of type bool (instead got {0})", e.Range.Type);
         }
         ResolveExpression(e.Term, opts);
         Contract.Assert(e.Term.Type != null);  // follows from postcondition of ResolveExpression
@@ -7804,10 +7688,10 @@ namespace Microsoft.Dafny
 
       } else if (expr is MapComprehension) {
         var e = (MapComprehension)expr;
-        int prevErrorCount = ErrorCount;
+        int prevErrorCount = reporter.Count(ErrorLevel.Error);
         scope.PushMarker();
         if (e.BoundVars.Count != 1) {
-          Error(e.tok, "a map comprehension must have exactly one bound variable.");
+          reporter.Error(MessageSource.Resolver, e.tok, "a map comprehension must have exactly one bound variable.");
         }
         foreach (BoundVar v in e.BoundVars) {
           ScopePushAndReport(scope, v, "bound-variable");
@@ -7816,7 +7700,7 @@ namespace Microsoft.Dafny
         ResolveExpression(e.Range, opts);
         Contract.Assert(e.Range.Type != null);  // follows from postcondition of ResolveExpression
         if (!UnifyTypes(e.Range.Type, Type.Bool)) {
-          Error(expr, "range of comprehension must be of type bool (instead got {0})", e.Range.Type);
+          reporter.Error(MessageSource.Resolver, expr, "range of comprehension must be of type bool (instead got {0})", e.Range.Type);
         }
         ResolveExpression(e.Term, opts);
         Contract.Assert(e.Term.Type != null);  // follows from postcondition of ResolveExpression
@@ -7825,22 +7709,22 @@ namespace Microsoft.Dafny
         scope.PopMarker();
         expr.Type = new MapType(e.Finite, e.BoundVars[0].Type, e.Term.Type);
 
-        if (prevErrorCount == ErrorCount) {
+        if (prevErrorCount == reporter.Count(ErrorLevel.Error)) {
           var missingBounds = new List<BoundVar>();
           CheckTypeInference(e.Range);  // we need to resolve operators before the call to DiscoverBounds
-          e.Bounds = DiscoverBounds(e.tok, e.BoundVars, e.Range, true, false, missingBounds);
+          e.Bounds = DiscoverBounds(e.tok, e.BoundVars, e.Range, true, false, missingBounds, reporter);
           if (missingBounds.Count != 0) {
             e.MissingBounds = missingBounds;
             if (e.Finite) {
               foreach (var bv in e.MissingBounds) {
-                Error(expr, "a map comprehension must produce a finite domain, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
+                reporter.Error(MessageSource.Resolver, expr, "a map comprehension must produce a finite domain, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
               }
             }
           }
         }
       } else if (expr is LambdaExpr) {
         var e = (LambdaExpr)expr;
-        int prevErrorCount = ErrorCount;
+        int prevErrorCount = reporter.Count(ErrorLevel.Error);
         scope.PushMarker();
         foreach (BoundVar v in e.BoundVars) {
           ScopePushAndReport(scope, v, "bound-variable");
@@ -7851,7 +7735,7 @@ namespace Microsoft.Dafny
           ResolveExpression(e.Range, opts);
           Contract.Assert(e.Range.Type != null);  // follows from postcondition of ResolveExpression
           if (!UnifyTypes(e.Range.Type, Type.Bool)) {
-            Error(expr, "Precondition must be boolean (got {0})", e.Range.Type);
+            reporter.Error(MessageSource.Resolver, expr, "Precondition must be boolean (got {0})", e.Range.Type);
           }
         }
 
@@ -7867,14 +7751,14 @@ namespace Microsoft.Dafny
         expr.Type = new SetType(true, new ObjectType());
       } else if (expr is StmtExpr) {
         var e = (StmtExpr)expr;
-        int prevErrorCount = ErrorCount;
+        int prevErrorCount = reporter.Count(ErrorLevel.Error);
         ResolveStatement(e.S, true, opts.codeContext);
-        if (ErrorCount == prevErrorCount) {
+        if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
           var r = e.S as UpdateStmt;
           if (r != null && r.ResolvedStatements.Count == 1) {
             var call = r.ResolvedStatements[0] as CallStmt;
             if (call.Method.Mod.Expressions.Count != 0) {
-              Error(call, "calls to methods with side-effects are not allowed inside a statement expression");
+              reporter.Error(MessageSource.Resolver, call, "calls to methods with side-effects are not allowed inside a statement expression");
             }
           }
         }
@@ -7891,12 +7775,12 @@ namespace Microsoft.Dafny
         ResolveExpression(e.Els, opts);
         Contract.Assert(e.Els.Type != null);  // follows from postcondition of ResolveExpression
         if (!UnifyTypes(e.Test.Type, Type.Bool)) {
-          Error(expr, "guard condition in if-then-else expression must be a boolean (instead got {0})", e.Test.Type);
+          reporter.Error(MessageSource.Resolver, expr, "guard condition in if-then-else expression must be a boolean (instead got {0})", e.Test.Type);
         }
         if (UnifyTypes(e.Thn.Type, e.Els.Type)) {
           expr.Type = e.Thn.Type;
         } else {
-          Error(expr, "the two branches of an if-then-else expression must have the same type (got {0} and {1})", e.Thn.Type, e.Els.Type);
+          reporter.Error(MessageSource.Resolver, expr, "the two branches of an if-then-else expression must have the same type (got {0} and {1})", e.Thn.Type, e.Els.Type);
         }
 
       } else if (expr is MatchExpr) {
@@ -7926,7 +7810,7 @@ namespace Microsoft.Dafny
       var subst = new Dictionary<TypeParameter, Type>();
       Dictionary<string, DatatypeCtor> ctors;
       if (dtd == null) {
-        Error(me.Source, "the type of the match source expression must be a datatype (instead found {0})", me.Source.Type);
+        reporter.Error(MessageSource.Resolver, me.Source, "the type of the match source expression must be a datatype (instead found {0})", me.Source.Type);
         ctors = null;
       } else {
         Contract.Assert(sourceType != null);  // dtd and sourceType are set together above
@@ -7955,15 +7839,15 @@ namespace Microsoft.Dafny
         if (ctors != null) {
           Contract.Assert(dtd != null);
           if (!ctors.TryGetValue(mc.Id, out ctor)) {
-            Error(mc.tok, "member {0} does not exist in datatype {1}", mc.Id, dtd.Name);
+            reporter.Error(MessageSource.Resolver, mc.tok, "member {0} does not exist in datatype {1}", mc.Id, dtd.Name);
           } else {
             Contract.Assert(ctor != null);  // follows from postcondition of TryGetValue
             mc.Ctor = ctor;
             if (ctor.Formals.Count != mc.Arguments.Count) {
-              Error(mc.tok, "member {0} has wrong number of formals (found {1}, expected {2})", mc.Id, mc.Arguments.Count, ctor.Formals.Count);
+              reporter.Error(MessageSource.Resolver, mc.tok, "member {0} has wrong number of formals (found {1}, expected {2})", mc.Id, mc.Arguments.Count, ctor.Formals.Count);
             }
             if (memberNamesUsed.Contains(mc.Id)) {
-              Error(mc.tok, "member {0} appears in more than one case", mc.Id);
+              reporter.Error(MessageSource.Resolver, mc.tok, "member {0} appears in more than one case", mc.Id);
             } else {
               memberNamesUsed.Add(mc.Id);  // add mc.Id to the set of names used
             }
@@ -7979,7 +7863,7 @@ namespace Microsoft.Dafny
               Formal formal = ctor.Formals[i];
               Type st = SubstType(formal.Type, subst);
               if (!UnifyTypes(v.Type, st)) {
-                Error(expr, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
+                reporter.Error(MessageSource.Resolver, expr, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
               }
               v.IsGhost = formal.IsGhost;
 
@@ -8006,7 +7890,7 @@ namespace Microsoft.Dafny
 
         Contract.Assert(mc.Body.Type != null);  // follows from postcondition of ResolveExpression
         if (!UnifyTypes(expr.Type, mc.Body.Type)) {
-          Error(mc.Body.tok, "type of case bodies do not agree (found {0}, previous types {1})", mc.Body.Type, expr.Type);
+          reporter.Error(MessageSource.Resolver, mc.Body.tok, "type of case bodies do not agree (found {0}, previous types {1})", mc.Body.Type, expr.Type);
         }
         scope.PopMarker();
       }
@@ -8044,13 +7928,13 @@ namespace Microsoft.Dafny
       if (me.Source is DatatypeValue) {
         var e = (DatatypeValue)me.Source;
         if (e.Arguments.Count < 1) {
-          Error(me.tok, "match source tuple needs at least 1 argument");
+          reporter.Error(MessageSource.Resolver, me.tok, "match source tuple needs at least 1 argument");
         } else {
           Expression source = e.Arguments[0];
           List<MatchCaseExpr> cases = new List<MatchCaseExpr>();
           foreach (MatchCaseExpr mc in me.Cases) {
             if (mc.CasePatterns == null || mc.CasePatterns.Count != e.Arguments.Count) {
-              Error(mc.tok, "case arguments count does not match source arguments count");
+              reporter.Error(MessageSource.Resolver, mc.tok, "case arguments count does not match source arguments count");
             } else {
               CasePattern cp = mc.CasePatterns[0];
               List<CasePattern> patterns;
@@ -8342,17 +8226,17 @@ namespace Microsoft.Dafny
         var v = pat.Var;
         ResolveType(v.tok, v.Type, context, ResolveTypeOptionEnum.InferTypeProxies, null);
         if (!UnifyTypes(v.Type, sourceType)) {
-          Error(v.tok, "type of corresponding source/RHS ({0}) does not match type of bound variable ({1})", sourceType, v.Type);
+          reporter.Error(MessageSource.Resolver, v.tok, "type of corresponding source/RHS ({0}) does not match type of bound variable ({1})", sourceType, v.Type);
         }
         pat.AssembleExpr(null);
       } else if (dtd == null) {
-        Error(pat.tok, "to use a pattern, the type of the source/RHS expression must be a datatype (instead found {0})", sourceType);
+        reporter.Error(MessageSource.Resolver, pat.tok, "to use a pattern, the type of the source/RHS expression must be a datatype (instead found {0})", sourceType);
       } else if (ctor == null) {
-        Error(pat.tok, "constructor {0} does not exist in datatype {1}", pat.Id, dtd.Name);
+        reporter.Error(MessageSource.Resolver, pat.tok, "constructor {0} does not exist in datatype {1}", pat.Id, dtd.Name);
       } else {
         var argCount = pat.Arguments == null ? 0 : pat.Arguments.Count;
         if (ctor.Formals.Count != argCount) {
-          Error(pat.tok, "pattern for constructor {0} has wrong number of formals (found {1}, expected {2})", pat.Id, argCount, ctor.Formals.Count);
+          reporter.Error(MessageSource.Resolver, pat.tok, "pattern for constructor {0} has wrong number of formals (found {1}, expected {2})", pat.Id, argCount, ctor.Formals.Count);
         }
         // build the type-parameter substitution map for this use of the datatype
         Contract.Assert(dtd.TypeArgs.Count == udt.TypeArgs.Count);  // follows from the type previously having been successfully resolved
@@ -8408,7 +8292,7 @@ namespace Microsoft.Dafny
         foreach (var ty in expr.OptTypeArguments) {
           ResolveType(expr.tok, ty, opts.codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
           if (ty.IsSubrangeType) {
-            Error(expr.tok, "sorry, cannot instantiate type parameter with a subrange type");
+            reporter.Error(MessageSource.Resolver, expr.tok, "sorry, cannot instantiate type parameter with a subrange type");
           }
         }
       }
@@ -8431,7 +8315,7 @@ namespace Microsoft.Dafny
       if (v != null) {
         // ----- 0. local variable, parameter, or bound variable
         if (expr.OptTypeArguments != null) {
-          Error(expr.tok, "variable '{0}' does not take any type parameters", expr.Name);
+          reporter.Error(MessageSource.Resolver, expr.tok, "variable '{0}' does not take any type parameters", expr.Name);
         }
         var rr = new IdentifierExpr(expr.tok, expr.Name);
         rr.Var = v; rr.Type = v.Type;
@@ -8443,7 +8327,7 @@ namespace Microsoft.Dafny
           receiver = new StaticReceiverExpr(expr.tok, (ClassDecl)member.EnclosingClass, true);
         } else {
           if (!scope.AllowInstance) {
-            Error(expr.tok, "'this' is not allowed in a 'static' context"); //FIXME: Rephrase this
+            reporter.Error(MessageSource.Resolver, expr.tok, "'this' is not allowed in a 'static' context"); //FIXME: Rephrase this
             // nevertheless, set "receiver" to a value so we can continue resolution
           }
           receiver = new ImplicitThisExpr(expr.tok);
@@ -8454,10 +8338,10 @@ namespace Microsoft.Dafny
         // ----- 2. datatype constructor
         if (pair.Item2) {
           // there is more than one constructor with this name
-          Error(expr.tok, "the name '{0}' denotes a datatype constructor, but does not do so uniquely; add an explicit qualification (for example, '{1}.{0}')", expr.Name, pair.Item1.EnclosingDatatype.Name);
+          reporter.Error(MessageSource.Resolver, expr.tok, "the name '{0}' denotes a datatype constructor, but does not do so uniquely; add an explicit qualification (for example, '{1}.{0}')", expr.Name, pair.Item1.EnclosingDatatype.Name);
         } else {
           if (expr.OptTypeArguments != null) {
-            Error(expr.tok, "datatype constructor does not take any type parameters ('{0}')", expr.Name);
+            reporter.Error(MessageSource.Resolver, expr.tok, "datatype constructor does not take any type parameters ('{0}')", expr.Name);
           }
           var rr = new DatatypeValue(expr.tok, pair.Item1.EnclosingDatatype.Name, expr.Name, args ?? new List<Expression>());
           ResolveDatatypeValue(opts, rr, pair.Item1.EnclosingDatatype);
@@ -8472,7 +8356,7 @@ namespace Microsoft.Dafny
         // ----- 3. Member of the enclosing module
         if (decl is AmbiguousTopLevelDecl) {
           var ad = (AmbiguousTopLevelDecl)decl;
-          Error(expr.tok, "The name {0} ambiguously refers to a type in one of the modules {1} (try qualifying the type name with the module name)", expr.Name, ad.ModuleNames());
+          reporter.Error(MessageSource.Resolver, expr.tok, "The name {0} ambiguously refers to a type in one of the modules {1} (try qualifying the type name with the module name)", expr.Name, ad.ModuleNames());
         } else {
           // We have found a module name or a type name, neither of which is an expression. However, the NameSegment we're
           // looking at may be followed by a further suffix that makes this into an expresion. We postpone the rest of the
@@ -8486,7 +8370,7 @@ namespace Microsoft.Dafny
         Contract.Assert(member.IsStatic); // moduleInfo.StaticMembers is supposed to contain only static members of the module's implicit class _default
         if (member is AmbiguousMemberDecl) {
           var ambiguousMember = (AmbiguousMemberDecl)member;
-          Error(expr.tok, "The name {0} ambiguously refers to a static member in one of the modules {1} (try qualifying the member name with the module name)", expr.Name, ambiguousMember.ModuleNames());
+          reporter.Error(MessageSource.Resolver, expr.tok, "The name {0} ambiguously refers to a static member in one of the modules {1} (try qualifying the member name with the module name)", expr.Name, ambiguousMember.ModuleNames());
         } else {
           var receiver = new StaticReceiverExpr(expr.tok, (ClassDecl)member.EnclosingClass, true);
           r = ResolveExprDotCall(expr.tok, receiver, member, expr.OptTypeArguments, opts.codeContext, allowMethodCall);
@@ -8494,7 +8378,7 @@ namespace Microsoft.Dafny
 
       } else {
         // ----- None of the above
-        Error(expr.tok, "unresolved identifier: {0}", expr.Name);
+        reporter.Error(MessageSource.Resolver, expr.tok, "unresolved identifier: {0}", expr.Name);
       }
 
       if (r == null) {
@@ -8526,7 +8410,7 @@ namespace Microsoft.Dafny
         foreach (var ty in expr.OptTypeArguments) {
           ResolveType(expr.tok, ty, opts.codeContext, option, defaultTypeArguments);
           if (ty.IsSubrangeType) {
-            Error(expr.tok, "sorry, cannot instantiate type parameter with a subrange type");
+            reporter.Error(MessageSource.Resolver, expr.tok, "sorry, cannot instantiate type parameter with a subrange type");
           }
         }
       }
@@ -8550,7 +8434,7 @@ namespace Microsoft.Dafny
         if (expr.OptTypeArguments == null) {
           r = new Resolver_IdentifierExpr(expr.tok, tp);
         } else {
-          Error(expr.tok, "Type parameter expects no type arguments: {0}", expr.Name);
+          reporter.Error(MessageSource.Resolver, expr.tok, "Type parameter expects no type arguments: {0}", expr.Name);
         }
 #if ASYNC_TASK_TYPES  // At the moment, there is no way for a class member to part of a type name, but this changes with async task types
       } else if (currentClass != null && classMembers.TryGetValue(currentClass, out members) && members.TryGetValue(expr.Name, out member)) {
@@ -8572,7 +8456,7 @@ namespace Microsoft.Dafny
         // ----- 2. Member of the enclosing module
         if (decl is AmbiguousTopLevelDecl) {
           var ad = (AmbiguousTopLevelDecl)decl;
-          Error(expr.tok, "The name {0} ambiguously refers to a type in one of the modules {1} (try qualifying the type name with the module name)", expr.Name, ad.ModuleNames());
+          reporter.Error(MessageSource.Resolver, expr.tok, "The name {0} ambiguously refers to a type in one of the modules {1} (try qualifying the type name with the module name)", expr.Name, ad.ModuleNames());
         } else {
           // We have found a module name or a type name, neither of which is a type expression. However, the NameSegment we're
           // looking at may be followed by a further suffix that makes this into a type expresion. We postpone the rest of the
@@ -8594,7 +8478,7 @@ namespace Microsoft.Dafny
 #endif
       } else {
         // ----- None of the above
-        Error(expr.tok, "Undeclared top-level type or type parameter: {0} (did you forget to qualify a name or declare a module import 'opened?')", expr.Name);
+        reporter.Error(MessageSource.Resolver, expr.tok, "Undeclared top-level type or type parameter: {0} (did you forget to qualify a name or declare a module import 'opened?')", expr.Name);
       }
 
       if (r == null) {
@@ -8615,7 +8499,7 @@ namespace Microsoft.Dafny
       if (optTypeArguments != null) {
         // type arguments were supplied; they must be equal in number to those expected
         if (n != decl.TypeArgs.Count) {
-          Error(tok, "Wrong number of type arguments ({0} instead of {1}) passed to {2}: {3}", n, decl.TypeArgs.Count, decl.WhatKind, name);
+          reporter.Error(MessageSource.Resolver, tok, "Wrong number of type arguments ({0} instead of {1}) passed to {2}: {3}", n, decl.TypeArgs.Count, decl.WhatKind, name);
         }
       }
       List<Type> tpArgs = new List<Type>();
@@ -8667,7 +8551,7 @@ namespace Microsoft.Dafny
         foreach (var ty in expr.OptTypeArguments) {
           ResolveType(expr.tok, ty, opts.codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
           if (ty.IsSubrangeType) {
-            Error(expr.tok, "sorry, cannot instantiate type parameter with a subrange type");
+            reporter.Error(MessageSource.Resolver, expr.tok, "sorry, cannot instantiate type parameter with a subrange type");
           }
         }
       }
@@ -8690,10 +8574,10 @@ namespace Microsoft.Dafny
           // ----- 0. datatype constructor
           if (pair.Item2) {
             // there is more than one constructor with this name
-            Error(expr.tok, "the name '{0}' denotes a datatype constructor in module {2}, but does not do so uniquely; add an explicit qualification (for example, '{1}.{0}')", expr.SuffixName, pair.Item1.EnclosingDatatype.Name, ((ModuleDecl)ri.Decl).Name);
+            reporter.Error(MessageSource.Resolver, expr.tok, "the name '{0}' denotes a datatype constructor in module {2}, but does not do so uniquely; add an explicit qualification (for example, '{1}.{0}')", expr.SuffixName, pair.Item1.EnclosingDatatype.Name, ((ModuleDecl)ri.Decl).Name);
           } else {
             if (expr.OptTypeArguments != null) {
-              Error(expr.tok, "datatype constructor does not take any type parameters ('{0}')", expr.SuffixName);
+              reporter.Error(MessageSource.Resolver, expr.tok, "datatype constructor does not take any type parameters ('{0}')", expr.SuffixName);
             }
             var rr = new DatatypeValue(expr.tok, pair.Item1.EnclosingDatatype.Name, expr.SuffixName, args ?? new List<Expression>());
             ResolveExpression(rr, opts);
@@ -8708,7 +8592,7 @@ namespace Microsoft.Dafny
           // ----- 1. Member of the specified module
           if (decl is AmbiguousTopLevelDecl) {
             var ad = (AmbiguousTopLevelDecl)decl;
-            Error(expr.tok, "The name {0} ambiguously refers to a type in one of the modules {1} (try qualifying the type name with the module name)", expr.SuffixName, ad.ModuleNames());
+            reporter.Error(MessageSource.Resolver, expr.tok, "The name {0} ambiguously refers to a type in one of the modules {1} (try qualifying the type name with the module name)", expr.SuffixName, ad.ModuleNames());
           } else {
             // We have found a module name or a type name, neither of which is an expression. However, the ExprDotName we're
             // looking at may be followed by a further suffix that makes this into an expresion. We postpone the rest of the
@@ -8721,13 +8605,13 @@ namespace Microsoft.Dafny
           Contract.Assert(member.IsStatic); // moduleInfo.StaticMembers is supposed to contain only static members of the module's implicit class _default
           if (member is AmbiguousMemberDecl) {
             var ambiguousMember = (AmbiguousMemberDecl)member;
-            Error(expr.tok, "The name {0} ambiguously refers to a static member in one of the modules {1} (try qualifying the member name with the module name)", expr.SuffixName, ambiguousMember.ModuleNames());
+            reporter.Error(MessageSource.Resolver, expr.tok, "The name {0} ambiguously refers to a static member in one of the modules {1} (try qualifying the member name with the module name)", expr.SuffixName, ambiguousMember.ModuleNames());
           } else {
             var receiver = new StaticReceiverExpr(expr.tok, (ClassDecl)member.EnclosingClass, true);
             r = ResolveExprDotCall(expr.tok, receiver, member, expr.OptTypeArguments, opts.codeContext, allowMethodCall);
           }
         } else {
-          Error(expr.tok, "unresolved identifier: {0}", expr.SuffixName);
+          reporter.Error(MessageSource.Resolver, expr.tok, "unresolved identifier: {0}", expr.SuffixName);
         }
 
       } else if (lhs != null && lhs.Type is Resolver_IdentifierExpr.ResolverType_Type) {
@@ -8746,7 +8630,7 @@ namespace Microsoft.Dafny
           Dictionary<string, MemberDecl> members;
           if (classMembers.TryGetValue(cd, out members) && members.TryGetValue(expr.SuffixName, out member)) {
             if (!member.IsStatic) {
-              Error(expr.tok, "accessing member '{0}' requires an instance expression", expr.SuffixName); //FIXME Unify with similar error message
+              reporter.Error(MessageSource.Resolver, expr.tok, "accessing member '{0}' requires an instance expression", expr.SuffixName); //FIXME Unify with similar error message
               // nevertheless, continue creating an expression that approximates a correct one
             }
             var receiver = new StaticReceiverExpr(expr.tok, (UserDefinedType)ty.NormalizeExpand(), (ClassDecl)member.EnclosingClass, false);
@@ -8759,7 +8643,7 @@ namespace Microsoft.Dafny
           DatatypeCtor ctor;
           if (datatypeCtors.TryGetValue(dt, out members) && members.TryGetValue(expr.SuffixName, out ctor)) {
             if (expr.OptTypeArguments != null) {
-              Error(expr.tok, "datatype constructor does not take any type parameters ('{0}')", expr.SuffixName);
+              reporter.Error(MessageSource.Resolver, expr.tok, "datatype constructor does not take any type parameters ('{0}')", expr.SuffixName);
             }
             var rr = new DatatypeValue(expr.tok, ctor.EnclosingDatatype.Name, expr.SuffixName, args ?? new List<Expression>());
             ResolveDatatypeValue(opts, rr, ctor.EnclosingDatatype);
@@ -8772,7 +8656,7 @@ namespace Microsoft.Dafny
           }
         }
         if (r == null) {
-          Error(expr.tok, "member '{0}' does not exist in type '{1}'", expr.SuffixName, ri.TypeParamDecl != null ? ri.TypeParamDecl.Name : ri.Decl.Name);
+          reporter.Error(MessageSource.Resolver, expr.tok, "member '{0}' does not exist in type '{1}'", expr.SuffixName, ri.TypeParamDecl != null ? ri.TypeParamDecl.Name : ri.Decl.Name);
         }
       } else if (lhs != null) {
         // ----- 4. Look up name in the type of the Lhs
@@ -8832,7 +8716,7 @@ namespace Microsoft.Dafny
         foreach (var ty in expr.OptTypeArguments) {
           ResolveType(expr.tok, ty, opts.codeContext, option, defaultTypeArguments);
           if (ty.IsSubrangeType) {
-            Error(expr.tok, "sorry, cannot instantiate type parameter with a subrange type");
+            reporter.Error(MessageSource.Resolver, expr.tok, "sorry, cannot instantiate type parameter with a subrange type");
           }
         }
       }
@@ -8851,7 +8735,7 @@ namespace Microsoft.Dafny
           // ----- 0. Member of the specified module
           if (decl is AmbiguousTopLevelDecl) {
             var ad = (AmbiguousTopLevelDecl)decl;
-            Error(expr.tok, "The name {0} ambiguously refers to a type in one of the modules {1} (try qualifying the type name with the module name)", expr.SuffixName, ad.ModuleNames());
+            reporter.Error(MessageSource.Resolver, expr.tok, "The name {0} ambiguously refers to a type in one of the modules {1} (try qualifying the type name with the module name)", expr.SuffixName, ad.ModuleNames());
           } else {
             // We have found a module name or a type name.  We create a temporary expression that will never be seen by the compiler
             // or verifier, just to have a placeholder where we can recorded what we have found.
@@ -8869,7 +8753,7 @@ namespace Microsoft.Dafny
           }
 #endif
         } else {
-          Error(expr.tok, "module '{0}' does not declare a type '{1}'", ri.Decl.Name, expr.SuffixName);
+          reporter.Error(MessageSource.Resolver, expr.tok, "module '{0}' does not declare a type '{1}'", ri.Decl.Name, expr.SuffixName);
         }
 
       } else if (lhs != null && lhs.Type is Resolver_IdentifierExpr.ResolverType_Type) {
@@ -8885,7 +8769,7 @@ namespace Microsoft.Dafny
           return new ResolveTypeReturn(ty, expr);
         }
         if (r == null) {
-          Error(expr.tok, "member '{0}' does not exist in type '{1}' or cannot be part of type name", expr.SuffixName, ri.TypeParamDecl != null ? ri.TypeParamDecl.Name : ri.Decl.Name);
+          reporter.Error(MessageSource.Resolver, expr.tok, "member '{0}' does not exist in type '{1}' or cannot be part of type name", expr.SuffixName, ri.TypeParamDecl != null ? ri.TypeParamDecl.Name : ri.Decl.Name);
         }
       }
 
@@ -8922,14 +8806,14 @@ namespace Microsoft.Dafny
 
       if (member is Field) {
         if (optTypeArguments != null) {
-          Error(tok, "a field ({0}) does not take any type arguments (got {1})", member.Name, optTypeArguments.Count);
+          reporter.Error(MessageSource.Resolver, tok, "a field ({0}) does not take any type arguments (got {1})", member.Name, optTypeArguments.Count);
         }
         rr.Type = SubstType(((Field)member).Type, subst);
       } else if (member is Function) {
         var fn = (Function)member;
         int suppliedTypeArguments = optTypeArguments == null ? 0 : optTypeArguments.Count;
         if (optTypeArguments != null && suppliedTypeArguments != fn.TypeArgs.Count) {
-          Error(tok, "function '{0}' expects {1} type arguments (got {2})", member.Name, fn.TypeArgs.Count, suppliedTypeArguments);
+          reporter.Error(MessageSource.Resolver, tok, "function '{0}' expects {1} type arguments (got {2})", member.Name, fn.TypeArgs.Count, suppliedTypeArguments);
         }
         rr.TypeApplication = new List<Type>();
         if (udt != null && udt.ResolvedClass != null) {
@@ -8947,11 +8831,11 @@ namespace Microsoft.Dafny
         var m = (Method)member;
         if (!allowMethodCall) {
           // it's a method and method calls are not allowed in the given context
-          Error(tok, "expression is not allowed to invoke a method ({0})", member.Name);
+          reporter.Error(MessageSource.Resolver, tok, "expression is not allowed to invoke a method ({0})", member.Name);
         }
         int suppliedTypeArguments = optTypeArguments == null ? 0 : optTypeArguments.Count;
         if (optTypeArguments != null && suppliedTypeArguments != m.TypeArgs.Count) {
-          Error(tok, "method '{0}' expects {1} type arguments (got {2})", member.Name, m.TypeArgs.Count, suppliedTypeArguments);
+          reporter.Error(MessageSource.Resolver, tok, "method '{0}' expects {1} type arguments (got {2})", member.Name, m.TypeArgs.Count, suppliedTypeArguments);
         }
         rr.TypeApplication = new List<Type>();
         if (udt != null && udt.ResolvedClass != null) {
@@ -8996,7 +8880,7 @@ namespace Microsoft.Dafny
       Contract.Requires(opts != null);
       Contract.Ensures(Contract.Result<MethodCallInformation>() == null || allowMethodCall);
       Expression r = null;  // upon success, the expression to which the ApplySuffix resolves
-      var errorCount = ErrorCount;
+      var errorCount = reporter.Count(ErrorLevel.Error);
       if (e.Lhs is NameSegment) {
         r = ResolveNameSegment((NameSegment)e.Lhs, true, e.Args, opts, allowMethodCall);
         // note, if r is non-null, then e.Args have been resolved and r is a resolved expression that incorporates e.Args
@@ -9014,18 +8898,18 @@ namespace Microsoft.Dafny
         if (fnType == null) {
           var lhs = e.Lhs.Resolved;
           if (lhs != null && lhs.Type is Resolver_IdentifierExpr.ResolverType_Module) {
-            Error(e.tok, "name of module ({0}) is used as a function", ((Resolver_IdentifierExpr)lhs).Decl.Name);
+            reporter.Error(MessageSource.Resolver, e.tok, "name of module ({0}) is used as a function", ((Resolver_IdentifierExpr)lhs).Decl.Name);
           } else if (lhs != null && lhs.Type is Resolver_IdentifierExpr.ResolverType_Type) {
             // It may be a conversion expression
             var ri = (Resolver_IdentifierExpr)lhs;
             if (ri.TypeParamDecl != null) {
-              Error(e.tok, "name of type parameter ({0}) is used as a function", ri.TypeParamDecl.Name);
+              reporter.Error(MessageSource.Resolver, e.tok, "name of type parameter ({0}) is used as a function", ri.TypeParamDecl.Name);
             } else {
               var decl = ri.Decl;
               var ty = new UserDefinedType(e.tok, decl.Name, decl, ri.TypeArgs);
               if (ty.AsNewtype != null) {
                 if (e.Args.Count != 1) {
-                  Error(e.tok, "conversion operation to {0} got wrong number of arguments (expected 1, got {1})", decl.Name, e.Args.Count);
+                  reporter.Error(MessageSource.Resolver, e.tok, "conversion operation to {0} got wrong number of arguments (expected 1, got {1})", decl.Name, e.Args.Count);
                 }
                 var conversionArg = 1 <= e.Args.Count ? e.Args[0] :
                   ty.IsNumericBased(Type.NumericPersuation.Int) ? LiteralExpr.CreateIntLiteral(e.tok, 0) :
@@ -9037,7 +8921,7 @@ namespace Microsoft.Dafny
                   ResolveExpression(e.Args[i], opts);
                 }
               } else {
-                Error(e.tok, "name of type ({0}) is used as a function", decl.Name);
+                reporter.Error(MessageSource.Resolver, e.tok, "name of type ({0}) is used as a function", decl.Name);
               }
             }
           } else {
@@ -9047,10 +8931,10 @@ namespace Microsoft.Dafny
                 var cRhs = new MethodCallInformation(e.tok, mse, e.Args);
                 return cRhs;
               } else {
-                Error(e.tok, "method call is not allowed to be used in an expression context ({0})", mse.Member.Name);
+                reporter.Error(MessageSource.Resolver, e.tok, "method call is not allowed to be used in an expression context ({0})", mse.Member.Name);
               }
             } else if (lhs != null) {  // if e.Lhs.Resolved is null, then e.Lhs was not successfully resolved and an error has already been reported
-              Error(e.tok, "non-function expression (of type {0}) is called with parameters", e.Lhs.Type);
+              reporter.Error(MessageSource.Resolver, e.tok, "non-function expression (of type {0}) is called with parameters", e.Lhs.Type);
             }
           }
         } else {
@@ -9058,14 +8942,14 @@ namespace Microsoft.Dafny
           var callee = mse == null ? null : mse.Member as Function;
           if (fnType.Arity != e.Args.Count) {
             var what = callee != null ? string.Format("function '{0}'", callee.Name) : string.Format("function type '{0}'", fnType);
-            Error(e.tok, "wrong number of arguments to function application ({0} expects {1}, got {2})", what, fnType.Arity, e.Args.Count);
+            reporter.Error(MessageSource.Resolver, e.tok, "wrong number of arguments to function application ({0} expects {1}, got {2})", what, fnType.Arity, e.Args.Count);
           } else {
             for (var i = 0; i < fnType.Arity; i++) {
               if (!UnifyTypes(fnType.Args[i], e.Args[i].Type)) {
-                Error(e.Args[i].tok, "type mismatch for argument {0} (function expects {1}, got {2})", i, fnType.Args[i], e.Args[i].Type);
+                reporter.Error(MessageSource.Resolver, e.Args[i].tok, "type mismatch for argument {0} (function expects {1}, got {2})", i, fnType.Args[i], e.Args[i].Type);
               }
             }
-            if (errorCount != ErrorCount) {
+            if (errorCount != reporter.Count(ErrorLevel.Error)) {
               // do nothing else; error has been reported
             } else if (callee != null) {
               // produce a FunctionCallExpr instead of an ApplyExpr(MemberSelectExpr)
@@ -9090,7 +8974,7 @@ namespace Microsoft.Dafny
                 Contract.Assert(farg.Type != null);  // follows from postcondition of ResolveExpression
                 Type s = SubstType(callee.Formals[i].Type, rr.TypeArgumentSubstitutions);
                 if (!UnifyTypes(farg.Type, s)) {
-                  Error(rr, "incorrect type of function argument {0} (expected {1}, got {2})", i, s, farg.Type);
+                  reporter.Error(MessageSource.Resolver, rr, "incorrect type of function argument {0} (expected {1}, got {2})", i, s, farg.Type);
                 }
               }
               rr.Type = SubstType(callee.ResultType, rr.TypeArgumentSubstitutions);
@@ -9132,12 +9016,12 @@ namespace Microsoft.Dafny
 
       DatatypeCtor ctor;
       if (!datatypeCtors[dt].TryGetValue(dtv.MemberName, out ctor)) {
-        Error(dtv.tok, "undeclared constructor {0} in datatype {1}", dtv.MemberName, dtv.DatatypeName);
+        reporter.Error(MessageSource.Resolver, dtv.tok, "undeclared constructor {0} in datatype {1}", dtv.MemberName, dtv.DatatypeName);
       } else {
         Contract.Assert(ctor != null);  // follows from postcondition of TryGetValue
         dtv.Ctor = ctor;
         if (ctor.Formals.Count != dtv.Arguments.Count) {
-          Error(dtv.tok, "wrong number of arguments to datatype constructor {0} (found {1}, expected {2})", ctor.Name, dtv.Arguments.Count, ctor.Formals.Count);
+          reporter.Error(MessageSource.Resolver, dtv.tok, "wrong number of arguments to datatype constructor {0} (found {1}, expected {2})", ctor.Name, dtv.Arguments.Count, ctor.Formals.Count);
         }
       }
       int j = 0;
@@ -9148,7 +9032,7 @@ namespace Microsoft.Dafny
         if (formal != null) {
           Type st = SubstType(formal.Type, subst);
           if (!UnifyTypes(arg.Type, st)) {
-            Error(arg.tok, "incorrect type of datatype constructor argument (found {0}, expected {1})", arg.Type, st);
+            reporter.Error(MessageSource.Resolver, arg.tok, "incorrect type of datatype constructor argument (found {0}, expected {1})", arg.Type, st);
           }
         }
         j++;
@@ -9192,14 +9076,14 @@ namespace Microsoft.Dafny
       if (expr is IdentifierExpr) {
         var e = (IdentifierExpr)expr;
         if (e.Var != null && e.Var.IsGhost) {
-          Error(expr, "ghost variables are allowed only in specification contexts");
+          reporter.Error(MessageSource.Resolver, expr, "ghost variables are allowed only in specification contexts");
           return;
         }
 
       } else if (expr is MemberSelectExpr) {
         var e = (MemberSelectExpr)expr;
         if (e.Member != null && e.Member.IsGhost) {
-          Error(expr, "ghost fields are allowed only in specification contexts");
+          reporter.Error(MessageSource.Resolver, expr, "ghost fields are allowed only in specification contexts");
           return;
         }
 
@@ -9207,7 +9091,7 @@ namespace Microsoft.Dafny
         var e = (FunctionCallExpr)expr;
         if (e.Function != null) {
           if (e.Function.IsGhost) {
-            Error(expr, "function calls are allowed only in specification contexts (consider declaring the function a 'function method')");
+            reporter.Error(MessageSource.Resolver, expr, "function calls are allowed only in specification contexts (consider declaring the function a 'function method')");
             return;
           }
           // function is okay, so check all NON-ghost arguments
@@ -9232,13 +9116,13 @@ namespace Microsoft.Dafny
         return;
 
       } else if (expr is OldExpr) {
-        Error(expr, "old expressions are allowed only in specification and ghost contexts");
+        reporter.Error(MessageSource.Resolver, expr, "old expressions are allowed only in specification and ghost contexts");
         return;
 
       } else if (expr is UnaryOpExpr) {
         var e = (UnaryOpExpr)expr;
         if (e.Op == UnaryOpExpr.Opcode.Fresh) {
-          Error(expr, "fresh expressions are allowed only in specification and ghost contexts");
+          reporter.Error(MessageSource.Resolver, expr, "fresh expressions are allowed only in specification and ghost contexts");
           return;
         }
 
@@ -9253,7 +9137,7 @@ namespace Microsoft.Dafny
         switch (e.ResolvedOp_PossiblyStillUndetermined) {
           case BinaryExpr.ResolvedOpcode.RankGt:
           case BinaryExpr.ResolvedOpcode.RankLt:
-            Error(expr, "rank comparisons are allowed only in specification and ghost contexts");
+            reporter.Error(MessageSource.Resolver, expr, "rank comparisons are allowed only in specification and ghost contexts");
             return;
           default:
             break;
@@ -9264,7 +9148,7 @@ namespace Microsoft.Dafny
         switch (e.Op) {
           case TernaryExpr.Opcode.PrefixEqOp:
           case TernaryExpr.Opcode.PrefixNeqOp:
-            Error(expr, "prefix equalities are allowed only in specification and ghost contexts");
+            reporter.Error(MessageSource.Resolver, expr, "prefix equalities are allowed only in specification and ghost contexts");
             return;
           default:
             break;
@@ -9294,7 +9178,7 @@ namespace Microsoft.Dafny
         var e = (QuantifierExpr)expr;
         if (e.MissingBounds != null) {
           foreach (var bv in e.MissingBounds) {
-            Error(expr, "quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
+            reporter.Error(MessageSource.Resolver, expr, "quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
           }
           return;
         }
@@ -9302,7 +9186,7 @@ namespace Microsoft.Dafny
         var e = (MapComprehension)expr;
         if (e.MissingBounds != null && !e.Finite) {
           foreach (var bv in e.MissingBounds) {
-            Error(expr, "imaps in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
+            reporter.Error(MessageSource.Resolver, expr, "imaps in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
           }
           return;
         }
@@ -9339,9 +9223,9 @@ namespace Microsoft.Dafny
       if (member == null) {
         // error has already been reported by ResolveMember
       } else if (member is Method) {
-        Error(e, "member {0} in type {1} refers to a method, but only functions can be used in this context", e.Name, cce.NonNull(ctype).Name);
+        reporter.Error(MessageSource.Resolver, e, "member {0} in type {1} refers to a method, but only functions can be used in this context", e.Name, cce.NonNull(ctype).Name);
       } else if (!(member is Function)) {
-        Error(e, "member {0} in type {1} does not refer to a function", e.Name, cce.NonNull(ctype).Name);
+        reporter.Error(MessageSource.Resolver, e, "member {0} in type {1} does not refer to a function", e.Name, cce.NonNull(ctype).Name);
       } else {
         Function function = (Function)member;
         e.Function = function;
@@ -9349,10 +9233,10 @@ namespace Microsoft.Dafny
           ((FixpointPredicate)function).Uses.Add(e);
         }
         if (e.Receiver is StaticReceiverExpr && !function.IsStatic) {
-          Error(e, "an instance function must be selected via an object, not just a class name");
+          reporter.Error(MessageSource.Resolver, e, "an instance function must be selected via an object, not just a class name");
         }
         if (function.Formals.Count != e.Args.Count) {
-          Error(e, "wrong number of function arguments (got {0}, expected {1})", e.Args.Count, function.Formals.Count);
+          reporter.Error(MessageSource.Resolver, e, "wrong number of function arguments (got {0}, expected {1})", e.Args.Count, function.Formals.Count);
         } else {
           Contract.Assert(ctype != null);  // follows from postcondition of ResolveMember
           if (!function.IsStatic) {
@@ -9364,9 +9248,9 @@ namespace Microsoft.Dafny
               // in the event that a static function calls another static function (and note that we need the
               // type of the receiver in order to find the method, so we could not have made this check
               // earlier).
-              Error(e.Receiver, "'this' is not allowed in a 'static' context");
+              reporter.Error(MessageSource.Resolver, e.Receiver, "'this' is not allowed in a 'static' context");
             } else if (e.Receiver is StaticReceiverExpr) {
-              Error(e.Receiver, "call to instance function requires an instance");
+              reporter.Error(MessageSource.Resolver, e.Receiver, "call to instance function requires an instance");
             }
           }
           // build the type substitution map
@@ -9384,7 +9268,7 @@ namespace Microsoft.Dafny
             Contract.Assert(farg.Type != null);  // follows from postcondition of ResolveExpression
             Type s = SubstType(function.Formals[i].Type, e.TypeArgumentSubstitutions);
             if (!UnifyTypes(farg.Type, s)) {
-              Error(e, "incorrect type of function argument {0} (expected {1}, got {2})", i, s, farg.Type);
+              reporter.Error(MessageSource.Resolver, e, "incorrect type of function argument {0} (expected {1}, got {2})", i, s, farg.Type);
             }
           }
           e.Type = SubstType(function.ResultType, e.TypeArgumentSubstitutions);
@@ -9435,8 +9319,8 @@ namespace Microsoft.Dafny
     /// <summary>
     /// For a description, see DiscoverBoundsAux.
     /// </summary>
-    public static List<ComprehensionExpr.BoundedPool> DiscoverBounds<VT>(IToken tok, List<VT> bvars, Expression expr, bool polarity, bool returnAllBounds, List<VT> missingBounds) where VT : IVariable {
-      var pairs = DiscoverBoundsAux(tok, bvars, expr, polarity, returnAllBounds, false, missingBounds);
+    public static List<ComprehensionExpr.BoundedPool> DiscoverBounds<VT>(IToken tok, List<VT> bvars, Expression expr, bool polarity, bool returnAllBounds, List<VT> missingBounds, ErrorReporter reporter) where VT : IVariable {
+      var pairs = DiscoverBoundsAux(tok, bvars, expr, polarity, returnAllBounds, false, missingBounds, reporter);
       if (pairs == null) {
         return null;
       }
@@ -9464,7 +9348,7 @@ namespace Microsoft.Dafny
     /// If "allowAnyIntegers", then integer variables will always be given a bound, but this bound may be WiggleWaggle if
     /// there is no better bound.
     /// </summary>
-    public static List<Tuple<VT, List<ComprehensionExpr.BoundedPool>>> DiscoverBoundsAux<VT>(IToken tok, List<VT> bvars, Expression expr, bool polarity, bool returnAllBounds, bool allowAnyIntegers, List<VT> missingBounds) where VT : IVariable {
+    public static List<Tuple<VT, List<ComprehensionExpr.BoundedPool>>> DiscoverBoundsAux<VT>(IToken tok, List<VT> bvars, Expression expr, bool polarity, bool returnAllBounds, bool allowAnyIntegers, List<VT> missingBounds, ErrorReporter reporter) where VT : IVariable {
       Contract.Requires(tok != null);
       Contract.Requires(bvars != null);
       Contract.Requires(missingBounds != null);
@@ -9483,7 +9367,7 @@ namespace Microsoft.Dafny
       var allBounds = new List<Tuple<VT, List<ComprehensionExpr.BoundedPool>>>();
       bool foundError = false;
       foreach (var bv in bvars) {
-        var c = TypeConstraint(bv, bv.Type);
+        var c = TypeConstraint(bv, bv.Type, reporter);
         expr = polarity ? Expression.CreateAnd(c, expr) : Expression.CreateImplies(c, expr);
       }
       for (int j = 0; j < bvars.Count; j++) {
@@ -9619,15 +9503,15 @@ namespace Microsoft.Dafny
       return foundError ? null : allBounds;
     }
 
-    static Expression TypeConstraint(IVariable bv, Type ty) {
+    static Expression TypeConstraint(IVariable bv, Type ty, ErrorReporter reporter) {
       Contract.Requires(bv != null);
       Contract.Requires(ty != null);
       ty = ty.NormalizeExpand();
       var dd = ty.AsNewtype;
       if (dd != null) {
-        var c = TypeConstraint(bv, dd.BaseType);
+        var c = TypeConstraint(bv, dd.BaseType, reporter);
         if (dd.Var != null) {
-          c = Expression.CreateAnd(c, new Translator().Substitute(dd.Constraint, dd.Var, Expression.CreateIdentExpr(bv)));
+          c = Expression.CreateAnd(c, new Translator(reporter).Substitute(dd.Constraint, dd.Var, Expression.CreateIdentExpr(bv)));
         }
         return c;
       }
@@ -9971,7 +9855,7 @@ namespace Microsoft.Dafny
 
       IndexableTypeProxy expectedType = new IndexableTypeProxy(domainType, elementType, argType, true, true, true);
       if (!UnifyTypes(e.Seq.Type, expectedType)) {
-        Error(e, "sequence/array/multiset/map selection requires a sequence, array, multiset, or map (got {0})", e.Seq.Type);
+        reporter.Error(MessageSource.Resolver, e, "sequence/array/multiset/map selection requires a sequence, array, multiset, or map (got {0})", e.Seq.Type);
         seqErr = true;
       }
       if (!e.SelectOne)  // require sequence or array
@@ -9979,13 +9863,13 @@ namespace Microsoft.Dafny
         if (!allowNonUnitArraySelection) {
           // require seq
           if (!UnifyTypes(expectedType, new SeqType(new InferredTypeProxy()))) {
-            Error(e, "selection requires a sequence (got {0})", e.Seq.Type);
+            reporter.Error(MessageSource.Resolver, e, "selection requires a sequence (got {0})", e.Seq.Type);
           }
         } else {
           if (UnifyTypes(expectedType, new MapType(true, new InferredTypeProxy(), new InferredTypeProxy()))) {
-            Error(e, "cannot multiselect a map (got {0} as map type)", e.Seq.Type);
+            reporter.Error(MessageSource.Resolver, e, "cannot multiselect a map (got {0} as map type)", e.Seq.Type);
           } else if (UnifyTypes(expectedType, new MapType(false, new InferredTypeProxy(), new InferredTypeProxy()))) {
-            Error(e, "cannot multiselect an imap (got {0} as imap type)", e.Seq.Type);
+            reporter.Error(MessageSource.Resolver, e, "cannot multiselect an imap (got {0} as imap type)", e.Seq.Type);
           }
         }
       }
@@ -9993,7 +9877,7 @@ namespace Microsoft.Dafny
         ResolveExpression(e.E0, opts);
         Contract.Assert(e.E0.Type != null);  // follows from postcondition of ResolveExpression
         if (!UnifyTypes(e.E0.Type, domainType)) {
-          Error(e.E0, "sequence/array/multiset/map selection requires {1} indices (got {0})", e.E0.Type, domainType);
+          reporter.Error(MessageSource.Resolver, e.E0, "sequence/array/multiset/map selection requires {1} indices (got {0})", e.E0.Type, domainType);
         }
       }
       if (e.E1 != null) {
@@ -10001,7 +9885,7 @@ namespace Microsoft.Dafny
         Contract.Assert(e.E1.Type != null);  // follows from postcondition of ResolveExpression
         var domType = e.E0 == null ? domainType : new OperationTypeProxy(true, false, false, false, false, false);  // reuse 'domainType' if .E0 did not use it; otherwise, create a new proxy to allow .E1 to be any integer-based numeric type, independent of the integer-based numeric type used by .E0
         if (!UnifyTypes(e.E1.Type, domType)) {
-          Error(e.E1, "sequence/array/multiset/map selection requires {1} indices (got {0})", e.E1.Type, domType);
+          reporter.Error(MessageSource.Resolver, e.E1, "sequence/array/multiset/map selection requires {1} indices (got {0})", e.E1.Type, domType);
         }
       }
       if (!seqErr) {
@@ -10193,7 +10077,7 @@ namespace Microsoft.Dafny
         } else {
           return false;
         }
-    } else if (expr is SeqSelectExpr) {
+      } else if (expr is SeqSelectExpr) {
         SeqSelectExpr e = (SeqSelectExpr)expr;
         return UsesSpecFeatures(e.Seq) ||
                (e.E0 != null && UsesSpecFeatures(e.E0)) ||
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 4223fb7f..cb71b80d 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -6,24 +6,25 @@ using IToken = Microsoft.Boogie.IToken;
 
 namespace Microsoft.Dafny
 {
-  [ContractClass(typeof(IRewriterContracts))]
-  public interface IRewriter
+  public abstract class IRewriter
   {
-    void PreResolve(ModuleDefinition m);
-    void PostResolve(ModuleDefinition m);
-    // After SCC/Cyclicity/Recursivity analysis:
-    void PostCyclicityResolve(ModuleDefinition m);
-  }
-  [ContractClassFor(typeof(IRewriter))]
-  abstract class IRewriterContracts : IRewriter
-  {
-    public void PreResolve(ModuleDefinition m) {
+    protected readonly ErrorReporter reporter;
+
+    public IRewriter(ErrorReporter reporter) {
+      Contract.Requires(reporter != null);
+      this.reporter = reporter;
+    }
+
+    internal virtual void PreResolve(ModuleDefinition m) {
       Contract.Requires(m != null);
     }
-    public void PostResolve(ModuleDefinition m) {
+
+    internal virtual void PostResolve(ModuleDefinition m) {
       Contract.Requires(m != null);
     }
-    public void PostCyclicityResolve(ModuleDefinition m) {
+
+    // After SCC/Cyclicity/Recursivity analysis:
+    internal virtual void PostCyclicityResolve(ModuleDefinition m) {
       Contract.Requires(m != null);
     }
   }
@@ -37,33 +38,26 @@ namespace Microsoft.Dafny
     }
   }
 
-  public class TriggersRewriter : IRewriter {
-    Resolver Resolver;
-
-    internal TriggersRewriter(Resolver resolver) {
-      Contract.Requires(resolver != null);
-      this.Resolver = resolver;
+  public class TriggerGeneratingRewriter : IRewriter {
+    internal TriggerGeneratingRewriter(ErrorReporter reporter) : base(reporter) {
+      Contract.Requires(reporter != null);
     }
 
-    public void PreResolve(ModuleDefinition m) { }
-
-    public void PostResolve(ModuleDefinition m) {
+    internal override void PostResolve(ModuleDefinition m) {
       foreach (var decl in ModuleDefinition.AllCallables(m.TopLevelDecls)) {
         if (decl is Function) {
           var function = (Function)decl;
-          TriggerGenerator.AddTriggers(function.Ens, Resolver);
-          TriggerGenerator.AddTriggers(function.Req, Resolver);
-          TriggerGenerator.AddTriggers(function.Body, Resolver);
+          //TriggerGenerator.AddTriggers(function.Ens, Resolver);
+          //TriggerGenerator.AddTriggers(function.Req, Resolver);
+          //TriggerGenerator.AddTriggers(function.Body, Resolver);
         } else if (decl is Method) {
           var method = (Method)decl;
-          TriggerGenerator.AddTriggers(method.Ens, Resolver);
-          TriggerGenerator.AddTriggers(method.Req, Resolver);
-          TriggerGenerator.AddTriggers(method.Body, Resolver);
+          //TriggerGenerator.AddTriggers(method.Ens, Resolver);
+          //TriggerGenerator.AddTriggers(method.Req, Resolver);
+          //TriggerGenerator.AddTriggers(method.Body, Resolver);
         }
       }
     }
-
-    public void PostCyclicityResolve(ModuleDefinition m) { }
   }
 
   /// <summary>
@@ -106,7 +100,12 @@ namespace Microsoft.Dafny
   /// </summary>
   public class AutoContractsRewriter : IRewriter
   {
-    public void PreResolve(ModuleDefinition m) {
+    public AutoContractsRewriter(ErrorReporter reporter)
+      : base(reporter) {
+      Contract.Requires(reporter != null);
+    }
+
+    internal override void PreResolve(ModuleDefinition m) {
       foreach (var d in m.TopLevelDecls) {
         bool sayYes = true;
         if (d is ClassDecl && Attributes.ContainsBool(d.Attributes, "autocontracts", ref sayYes) && sayYes) {
@@ -162,7 +161,7 @@ namespace Microsoft.Dafny
       }
     }
 
-    public void PostResolve(ModuleDefinition m) {
+    internal override void PostResolve(ModuleDefinition m) {
       foreach (var d in m.TopLevelDecls) {
         bool sayYes = true;
         if (d is ClassDecl && Attributes.ContainsBool(d.Attributes, "autocontracts", ref sayYes) && sayYes) {
@@ -171,9 +170,6 @@ namespace Microsoft.Dafny
       }
     }
 
-    public void PostCyclicityResolve(ModuleDefinition m) { 
-    }
-
     void ProcessClassPostResolve(ClassDecl cl) {
       // Find all fields of a reference type, and make a note of whether or not the reference type has a Repr field.
       // Also, find the Repr field and the function Valid in class "cl"
@@ -416,20 +412,20 @@ namespace Microsoft.Dafny
   /// specifically asks to see it via the reveal_foo() lemma
   /// </summary>
   public class OpaqueFunctionRewriter : IRewriter {
-    readonly ResolutionErrorReporter reporter;
     protected Dictionary<Function, Function> fullVersion; // Given an opaque function, retrieve the full
     protected Dictionary<Function, Function> original;    // Given a full version of an opaque function, find the original opaque version
     protected Dictionary<Lemma, Function> revealOriginal; // Map reveal_* lemmas back to their original functions
 
-    public OpaqueFunctionRewriter(ResolutionErrorReporter reporter)
-      : base() {
-      this.reporter = reporter;
+    public OpaqueFunctionRewriter(ErrorReporter reporter)
+      : base(reporter) {
+      Contract.Requires(reporter != null);
+
       fullVersion = new Dictionary<Function, Function>();
       original = new Dictionary<Function, Function>();
       revealOriginal = new Dictionary<Lemma, Function>();
     }
 
-    public void PreResolve(ModuleDefinition m) {
+    internal override void PreResolve(ModuleDefinition m) {
       foreach (var d in m.TopLevelDecls) {
         if (d is ClassDecl) {
           DuplicateOpaqueClassFunctions((ClassDecl)d);
@@ -437,7 +433,7 @@ namespace Microsoft.Dafny
       }
     }    
 
-    public void PostResolve(ModuleDefinition m) {
+    internal override void PostResolve(ModuleDefinition m) {
       // Fix up the ensures clause of the full version of the function,
       // since it may refer to the original opaque function      
       foreach (var fn in ModuleDefinition.AllFunctions(m.TopLevelDecls)) {        
@@ -462,7 +458,7 @@ namespace Microsoft.Dafny
       }
     }
 
-    public void PostCyclicityResolve(ModuleDefinition m) {
+    internal override void PostCyclicityResolve(ModuleDefinition m) {
       // Add layer quantifier if the function is recursive 
       foreach (var decl in ModuleDefinition.AllCallables(m.TopLevelDecls)) {
         if (decl is Lemma) {
@@ -507,7 +503,7 @@ namespace Microsoft.Dafny
           if (!Attributes.Contains(f.Attributes, "opaque")) {
             // Nothing to do
           } else if (f.IsProtected) {
-            reporter.Error(f.tok, ":opaque is not allowed to be applied to protected functions (this will be allowed when the language introduces 'opaque'/'reveal' as keywords)");
+            reporter.Error(MessageSource.Rewriter, f.tok, ":opaque is not allowed to be applied to protected functions (this will be allowed when the language introduces 'opaque'/'reveal' as keywords)");
           } else if (!RefinementToken.IsInherited(f.tok, c.Module)) {
             // Create a copy, which will be the internal version with a full body
             // which will allow us to verify that the ensures are true
@@ -721,19 +717,16 @@ namespace Microsoft.Dafny
   /// </summary>
   public class AutoReqFunctionRewriter : IRewriter {
     Function parentFunction;
-    Resolver resolver;
     OpaqueFunctionRewriter opaqueInfo;
     bool containsMatch; // TODO: Track this per-requirement, rather than per-function
 
-    public AutoReqFunctionRewriter(Resolver r, OpaqueFunctionRewriter o) {
-      this.resolver = r;
+    public AutoReqFunctionRewriter(ErrorReporter reporter, OpaqueFunctionRewriter o)
+      : base(reporter) {
+      Contract.Requires(reporter != null);
       this.opaqueInfo = o;
     }
 
-    public void PreResolve(ModuleDefinition m) { 
-    }    
-
-    public void PostResolve(ModuleDefinition m) {
+    internal override void PostResolve(ModuleDefinition m) {
       var components = m.CallGraph.TopologicallySortedComponents();
 
       foreach (var scComponent in components) {  // Visit the call graph bottom up, so anything we call already has its prequisites calculated
@@ -806,9 +799,6 @@ namespace Microsoft.Dafny
       }
     }
 
-    public void PostCyclicityResolve(ModuleDefinition m) { 
-    }
-
     Expression subVars(List<Formal> formals, List<Expression> values, Expression e, Expression f_this) {
       Contract.Assert(formals != null);
       Contract.Assert(values != null);
@@ -839,7 +829,7 @@ namespace Microsoft.Dafny
       }
 
       if (!tip.Equals("")) {
-        resolver.ReportAdditionalInformation(f.tok, tip, f.tok.val.Length);
+        reporter.Info(MessageSource.Rewriter, f.tok, tip);
         if (DafnyOptions.O.AutoReqPrintFile != null) {
           using (System.IO.TextWriter writer = new System.IO.StreamWriter(DafnyOptions.O.AutoReqPrintFile, true)) {
             writer.WriteLine(f.Name);
@@ -866,7 +856,7 @@ namespace Microsoft.Dafny
       }
 
       if (!tip.Equals("")) {
-        resolver.ReportAdditionalInformation(method.tok, tip, method.tok.val.Length);
+        reporter.Info(MessageSource.Rewriter, method.tok, tip);
         if (DafnyOptions.O.AutoReqPrintFile != null) {
           using (System.IO.TextWriter writer = new System.IO.StreamWriter(DafnyOptions.O.AutoReqPrintFile, true)) {
             writer.WriteLine(method.Name);
@@ -1061,7 +1051,7 @@ namespace Microsoft.Dafny
             Expression allReqsSatisfied = andify(e.Term.tok, auto_reqs);
             Expression allReqsSatisfiedAndTerm = Expression.CreateAnd(allReqsSatisfied, e.Term);
             e.UpdateTerm(allReqsSatisfiedAndTerm);
-            resolver.ReportAdditionalInformation(e.tok, "autoreq added (" + Printer.ExtendedExprToString(allReqsSatisfied) + ") &&", e.tok.val.Length);
+            reporter.Info(MessageSource.Rewriter, e.tok, "autoreq added (" + Printer.ExtendedExprToString(allReqsSatisfied) + ") &&");
         }
       } else if (expr is SetComprehension) {
         var e = (SetComprehension)expr;
@@ -1108,7 +1098,12 @@ namespace Microsoft.Dafny
   /// </summary>
   public class TimeLimitRewriter : IRewriter
   {
-    public void PreResolve(ModuleDefinition m) {
+    public TimeLimitRewriter(ErrorReporter reporter)
+      : base(reporter) {
+      Contract.Requires(reporter != null);
+    }
+
+    internal override void PreResolve(ModuleDefinition m) {
       foreach (var d in m.TopLevelDecls) {
         if (d is ClassDecl) {
           var c = (ClassDecl)d;
@@ -1136,16 +1131,6 @@ namespace Microsoft.Dafny
         }
       }
     }
-
-    public void PostResolve(ModuleDefinition m)
-    {
-      // Nothing to do here
-    }
-
-    public void PostCyclicityResolve(ModuleDefinition m) {
-      // Nothing to do here
-    }
-
   }
 
 
diff --git a/Source/Dafny/Scanner.cs b/Source/Dafny/Scanner.cs
index a73f510d..e6c97f22 100644
--- a/Source/Dafny/Scanner.cs
+++ b/Source/Dafny/Scanner.cs
@@ -314,8 +314,8 @@ public class Scanner {
 
 //	[NotDelayed]
 	public Scanner (string/*!*/ fullFilename, string/*!*/ fileName, Errors/*!*/ errorHandler, bool useBaseName = false) : base() {
-	  Contract.Requires(fileName != null);
-	  Contract.Requires(errorHandler != null);
+		Contract.Requires(fileName != null);
+		Contract.Requires(errorHandler != null);
 		this.errorHandler = errorHandler;
 		pt = tokens = new Token();  // first token is a dummy
 		t = new Token(); // dummy because t is a non-null field
@@ -332,9 +332,9 @@ public class Scanner {
 
 //	[NotDelayed]
 	public Scanner (Stream/*!*/ s, Errors/*!*/ errorHandler, string/*!*/ fullFilename, string/*!*/ fileName, bool useBaseName = false) : base() {
-	  Contract.Requires(s != null);
-	  Contract.Requires(errorHandler != null);
-	  Contract.Requires(fileName != null);
+		Contract.Requires(s != null);
+		Contract.Requires(errorHandler != null);
+		Contract.Requires(fileName != null);
 		pt = tokens = new Token();  // first token is a dummy
 		t = new Token(); // dummy because t is a non-null field
 		this._buffer = new Buffer(s, true);
@@ -344,9 +344,9 @@ public class Scanner {
 		Init();
 	}
 
-    string GetBaseName(string fileName) {
-        return System.IO.Path.GetFileName(fileName); // Return basename
-    }
+	string GetBaseName(string fileName) {
+		return System.IO.Path.GetFileName(fileName); // Return basename
+	}
 
 	void Init() {
 		pos = -1; line = 1; col = 0;
@@ -991,6 +991,4 @@ public class Scanner {
 } // end Scanner
 
 public delegate void ErrorProc(int n, string filename, int line, int col);
-
-
 }
\ No newline at end of file
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index b8c4b8ec..039aa56f 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -93,9 +93,13 @@ namespace Microsoft.Dafny {
   }
 
   public class Translator {
+    readonly ErrorReporter reporter;
 
     [NotDelayed]
-    public Translator() {
+    public Translator(ErrorReporter reporter) {
+      Contract.Requires(reporter != null);
+      
+      this.reporter = reporter;
       InsertChecksums = 0 < CommandLineOptions.Clo.VerifySnapshots;
       Bpl.Program boogieProgram = ReadPrelude();
       if (boogieProgram != null) {
@@ -3609,7 +3613,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(tok != null);
       Contract.Ensures(Contract.Result<Bpl.Cmd>() != null);
       var col = tok.col + (isEndToken ? tok.val.Length : 0);
-      string description = Util.ReportIssueToString_Bare(additionalInfo == null ? "" : ": ", tok.filename, tok.line, tok.col, additionalInfo ?? "");
+      string description = reporter.ErrorToString_Internal(additionalInfo == null ? "" : ": ", tok.filename, tok.line, tok.col, additionalInfo ?? "");
       QKeyValue kv = new QKeyValue(tok, "captureState", new List<object>() { description }, null);
       return new Bpl.AssumeCmd(tok, Bpl.Expr.True, kv);
     }
@@ -7679,7 +7683,7 @@ namespace Microsoft.Dafny {
       }
 
       var missingBounds = new List<BoundVar>();
-      var bounds = Resolver.DiscoverBounds(x.tok, new List<BoundVar>() { x }, expr, true, true, missingBounds);
+      var bounds = Resolver.DiscoverBounds(x.tok, new List<BoundVar>() { x }, expr, true, true, missingBounds, reporter);
       if (missingBounds.Count == 0) {
         foreach (var bound in bounds) {
           if (bound is ComprehensionExpr.IntBoundedPool) {
@@ -12955,9 +12959,8 @@ namespace Microsoft.Dafny {
             return true;
           } else {
             // Skip inlining, as it would cause arbitrary expressions to pop up in the trigger
-            // CLEMENT: Report inlining issue in a VS plugin friendly way
-            //CLEMENT this should appear at the outmost call site, not at the innermost. See SnapshotableTrees.dfy
-            Dafny.Util.ReportIssue("Info", fexp.tok, "Some instances of this call cannot safely be inlined.");
+            // CLEMENT this should appear at the outmost call site, not at the innermost. See SnapshotableTrees.dfy
+            reporter.Info(MessageSource.Translator, fexp.tok, "Some instances of this call cannot safely be inlined.");
           }
         }
 
diff --git a/Source/Dafny/TriggerGenerator.cs b/Source/Dafny/TriggerGenerator.cs
index cf677e0e..04d96b01 100644
--- a/Source/Dafny/TriggerGenerator.cs
+++ b/Source/Dafny/TriggerGenerator.cs
@@ -513,7 +513,7 @@ namespace Microsoft.Dafny {
         return;
 
       DebugTriggers("== From {0} visiting expr: {1}", new StackFrame(1).GetMethod().Name, Printer.ExprToString(root));
-      TriggerGenerator generator = new TriggerGenerator(resolver.ReportAdditionalInformation);
+      TriggerGenerator generator = new TriggerGenerator(null);
       generator.AddTriggers_Internal(root);
     }
 
@@ -522,7 +522,7 @@ namespace Microsoft.Dafny {
         return;
 
       DebugTriggers("== From {0} visiting statement: {1}", new StackFrame(1).GetMethod().Name, Printer.StatementToString(root));
-      TriggerGenerator generator = new TriggerGenerator(resolver.ReportAdditionalInformation);
+      TriggerGenerator generator = new TriggerGenerator(null);
       generator.AddTriggers_Internal(root);
     }
 
diff --git a/Source/Dafny/Util.cs b/Source/Dafny/Util.cs
index 508d23c6..eaf599e3 100644
--- a/Source/Dafny/Util.cs
+++ b/Source/Dafny/Util.cs
@@ -67,29 +67,6 @@ namespace Microsoft.Dafny {
       return res;
     }
 
-    public static void ReportIssue(string header, IToken tok, string msg, params object[] args) {
-      ReportIssue(header, tok, String.Format(msg, args));
-    }
-
-    public static void ReportIssue(string header, IToken tok, string msg) {
-      ReportIssue(header, tok.filename, tok.line, tok.col, msg);
-    }
-
-    public static void ReportIssue(string header, string filename, int line, int column, string msg) {
-      Console.WriteLine(ReportIssueToString(header, filename, line, column, msg));
-    }
-
-    public static string ReportIssueToString(string header, string filename, int line, int column, string msg) {
-      Contract.Requires(header != null);
-      Contract.Requires(filename != null);
-      Contract.Requires(msg != null);
-      return ReportIssueToString_Bare(": " + header, filename, line, column, ": " + msg);
-    }
-
-    public static string ReportIssueToString_Bare(string header, string filename, int line, int column, string msg) {
-      return String.Format("{0}({1},{2}){3}{4}", filename, line, column - 1, header, msg ?? "");
-    }
-
     /// <summary>
     /// Returns s but with all occurrences of '_' removed.
     /// </summary>
diff --git a/Source/DafnyDriver/DafnyDriver.cs b/Source/DafnyDriver/DafnyDriver.cs
index d22899ab..4b5ae8d8 100644
--- a/Source/DafnyDriver/DafnyDriver.cs
+++ b/Source/DafnyDriver/DafnyDriver.cs
@@ -22,7 +22,6 @@ namespace Microsoft.Dafny
 
   public class DafnyDriver
   {
-
     enum ExitValue { VERIFIED = 0, PREPROCESSING_ERROR, DAFNY_ERROR, NOT_VERIFIED }
 
 
@@ -42,8 +41,7 @@ namespace Microsoft.Dafny
     {
       Contract.Requires(cce.NonNullElements(args));
          
-      printer = new DafnyConsolePrinter();
-      ExecutionEngine.printer = printer;
+      ExecutionEngine.printer = new DafnyConsolePrinter(); // For boogie errors
 
       DafnyOptions.Install(new DafnyOptions());
 
@@ -57,14 +55,14 @@ namespace Microsoft.Dafny
 
       if (CommandLineOptions.Clo.Files.Count == 0)
       {
-        printer.ErrorWriteLine(Console.Out, "*** Error: No input files were specified.");
+        ExecutionEngine.printer.ErrorWriteLine(Console.Out, "*** Error: No input files were specified.");
         exitValue = ExitValue.PREPROCESSING_ERROR;
         goto END;
       }
       if (CommandLineOptions.Clo.XmlSink != null) {
         string errMsg = CommandLineOptions.Clo.XmlSink.Open();
         if (errMsg != null) {
-          printer.ErrorWriteLine(Console.Out, "*** Error: " + errMsg);
+          ExecutionEngine.printer.ErrorWriteLine(Console.Out, "*** Error: " + errMsg);
           exitValue = ExitValue.PREPROCESSING_ERROR;
           goto END;
         }
@@ -87,12 +85,11 @@ namespace Microsoft.Dafny
       {Contract.Assert(file != null);
         string extension = Path.GetExtension(file);
         if (extension != null) { extension = extension.ToLower(); }
-        if (extension != ".dfy")
-        {
-            printer.ErrorWriteLine(Console.Out, "*** Error: '{0}': Filename extension '{1}' is not supported. Input files must be Dafny programs (.dfy).", file,
-                extension == null ? "" : extension);
-            exitValue = ExitValue.PREPROCESSING_ERROR;
-            goto END;
+        if (extension != ".dfy") {
+          ExecutionEngine.printer.ErrorWriteLine(Console.Out, "*** Error: '{0}': Filename extension '{1}' is not supported. Input files must be Dafny programs (.dfy).", file,
+            extension == null ? "" : extension);
+          exitValue = ExitValue.PREPROCESSING_ERROR;
+          goto END;
         }
       }
       exitValue = ProcessFiles(CommandLineOptions.Clo.Files);
@@ -156,14 +153,15 @@ namespace Microsoft.Dafny
       
       using (XmlFileScope xf = new XmlFileScope(CommandLineOptions.Clo.XmlSink, fileNames[fileNames.Count-1])) {
         Dafny.Program dafnyProgram;
+        ErrorReporter reporter = new ConsoleErrorReporter();
         string programName = fileNames.Count == 1 ? fileNames[0] : "the program";
-        string err = Dafny.Main.ParseCheck(fileNames, programName, out dafnyProgram);
+        string err = Dafny.Main.ParseCheck(fileNames, programName, reporter, out dafnyProgram);
         if (err != null) {
           exitValue = ExitValue.DAFNY_ERROR;
-          printer.ErrorWriteLine(Console.Out, err);
+          ExecutionEngine.printer.ErrorWriteLine(Console.Out, err);
         } else if (dafnyProgram != null && !CommandLineOptions.Clo.NoResolve && !CommandLineOptions.Clo.NoTypecheck
             && DafnyOptions.O.DafnyVerify) {
-          Dafny.Translator translator = new Dafny.Translator();
+          Dafny.Translator translator = new Dafny.Translator(dafnyProgram.reporter);
           Bpl.Program boogieProgram = translator.Translate(dafnyProgram);
           if (CommandLineOptions.Clo.PrintFile != null)
           {
@@ -184,12 +182,12 @@ namespace Microsoft.Dafny
           var allOk = stats.ErrorCount == 0 && stats.InconclusiveCount == 0 && stats.TimeoutCount == 0 && stats.OutOfMemoryCount == 0;
           switch (oc) {
             case PipelineOutcome.VerificationCompleted:
-              printer.WriteTrailer(stats);
+              ExecutionEngine.printer.WriteTrailer(stats);
               if ((DafnyOptions.O.Compile && allOk && CommandLineOptions.Clo.ProcsToCheck == null) || DafnyOptions.O.ForceCompile)
                 CompileDafnyProgram(dafnyProgram, fileNames[0]);
               break;
             case PipelineOutcome.Done:
-              printer.WriteTrailer(stats);
+              ExecutionEngine.printer.WriteTrailer(stats);
               if (DafnyOptions.O.ForceCompile)
                 CompileDafnyProgram(dafnyProgram, fileNames[0]);
               break;
@@ -265,10 +263,7 @@ namespace Microsoft.Dafny
 
 
     #region Output
-
-    static OutputPrinter printer;
-
-
+    
     class DafnyConsolePrinter : ConsolePrinter
     {
       public override void ReportBplError(IToken tok, string message, bool error, TextWriter tw, string category = null)
diff --git a/Source/DafnyExtension/DafnyDriver.cs b/Source/DafnyExtension/DafnyDriver.cs
index 50d8c2e3..36664a9b 100644
--- a/Source/DafnyExtension/DafnyDriver.cs
+++ b/Source/DafnyExtension/DafnyDriver.cs
@@ -115,19 +115,21 @@ namespace DafnyLanguage
     bool ParseAndTypeCheck() {
       Dafny.ModuleDecl module = new Dafny.LiteralModuleDecl(new Dafny.DefaultModuleDecl(), null);
       Dafny.BuiltIns builtIns = new Dafny.BuiltIns();
-      Dafny.Errors parseErrors = new VSErrors(this);
+
+      var errorReporter = new VSErrorReporter(this);
+      var parseErrors = new Dafny.Errors(errorReporter);
+
       int errorCount = Dafny.Parser.Parse(_snapshot.GetText(), _filename, _filename, module, builtIns, parseErrors);
       string errString = Dafny.Main.ParseIncludes(module, builtIns, new List<string>(), parseErrors);
       if (errorCount != 0 || errString != null)
         return false;
-      Dafny.Program program = new Dafny.Program(_filename, module, builtIns);
+      Dafny.Program program = new Dafny.Program(_filename, module, builtIns, errorReporter);
 
-      var r = new VSResolver(program, this);
+      var r = new Resolver(program);
       r.ResolveProgram(program);
-      if (r.ErrorCount != 0)
+      if (errorReporter.Count(ErrorLevel.Error) != 0)
         return false;
 
-      program.AdditionalInformation.AddRange(r.AdditionalInformation);
       _program = program;
       return true;  // success
     }
@@ -137,56 +139,31 @@ namespace DafnyLanguage
       _errors.Add(new DafnyError(filename, line - 1, col - 1, cat, msg, _snapshot, isRecycled, null, System.IO.Path.GetFullPath(this._filename) == filename));
     }
 
-    class VSErrors : Dafny.Errors
-    {
-      DafnyDriver dd;
-      public VSErrors(DafnyDriver dd) {
-        this.dd = dd;
-      }
-      public override void SynErr(string filename, int line, int col, string msg) {
-        dd.RecordError(filename, line, col, ErrorCategory.ParseError, msg);
-        count++;
-      }
-      public override void SemErr(string filename, int line, int col, string msg) {
-        dd.RecordError(filename, line, col, ErrorCategory.ResolveError, msg);
-        count++;
-      }
-      public override void Warning(IToken tok, string msg) {
-        dd.RecordError(tok.filename, tok.line, tok.col, ErrorCategory.ParseWarning, msg);
-      }
-    }
-
-    class VSResolver : Dafny.Resolver
+    class VSErrorReporter : Dafny.ErrorReporter
     {
       DafnyDriver dd;
-      Dictionary<IToken, HashSet<AdditionalInformation>> _additionalInformation = new Dictionary<IToken, HashSet<AdditionalInformation>>();
-      public List<AdditionalInformation> AdditionalInformation { get { return _additionalInformation.Values.SelectMany(i => i).ToList(); } }
 
-      public VSResolver(Dafny.Program program, DafnyDriver dd)
-        : base(program) {
+      public VSErrorReporter(DafnyDriver dd) {
         this.dd = dd;
-
-        AdditionalInformationReporter =
-          (addinfo)
-            =>
-            {
-              if (!_additionalInformation.ContainsKey(addinfo.Token)) {
-                _additionalInformation.Add(addinfo.Token, new HashSet<AdditionalInformation>());
-              }
-              _additionalInformation[addinfo.Token].Add(addinfo);
-            };
-      }
-
-      public override void Error(Bpl.IToken tok, string msg, params object[] args) {
-        string s = string.Format(msg, args);
-        dd.RecordError(tok.filename, tok.line, tok.col, ErrorCategory.ResolveError, s);
-        ErrorCount++;
       }
 
-      public override void Warning(IToken tok, string msg, params object[] args) {
-        if (reportWarnings) {
-          string s = string.Format(msg, args);
-          dd.RecordError(tok.filename, tok.line, tok.col, ErrorCategory.ResolveWarning, s);
+      // TODO: The error tracking could be made better to track the full information returned by Dafny
+      public override bool Message(MessageSource source, ErrorLevel level, IToken tok, string msg) {
+        if (base.Message(source, level, tok, msg)) {
+          switch (level) {
+            case ErrorLevel.Error:
+              dd.RecordError(tok.filename, tok.line, tok.col, source == MessageSource.Parser ? ErrorCategory.ParseError : ErrorCategory.ResolveError, msg);
+              break;
+            case ErrorLevel.Warning:
+              dd.RecordError(tok.filename, tok.line, tok.col, source == MessageSource.Parser ? ErrorCategory.ParseWarning : ErrorCategory.ResolveWarning, msg);
+              break;
+            case ErrorLevel.Info:
+              // The AllMessages variable already keeps track of this
+              break;
+          }
+          return true;
+        } else {
+          return false;
         }
       }
     }
@@ -273,7 +250,7 @@ namespace DafnyLanguage
     }
 
     public static bool Verify(Dafny.Program dafnyProgram, ResolverTagger resolver, string uniqueIdPrefix, string requestId, ErrorReporterDelegate er) {
-      Dafny.Translator translator = new Dafny.Translator();
+      Dafny.Translator translator = new Dafny.Translator(dafnyProgram.reporter);
       translator.InsertChecksums = true;
       translator.UniqueIdPrefix = uniqueIdPrefix;
       Bpl.Program boogieProgram = translator.Translate(dafnyProgram);
diff --git a/Source/DafnyExtension/IdentifierTagger.cs b/Source/DafnyExtension/IdentifierTagger.cs
index 262dddcd..13991496 100644
--- a/Source/DafnyExtension/IdentifierTagger.cs
+++ b/Source/DafnyExtension/IdentifierTagger.cs
@@ -136,9 +136,9 @@ namespace DafnyLanguage
 
       List<IdRegion> newRegions = new List<IdRegion>();
 
-      foreach (var addInfo in program.AdditionalInformation)
+      foreach (var info in program.reporter.AllMessages[ErrorLevel.Info])
       {
-        IdRegion.Add(newRegions, addInfo.Token, addInfo.Text, addInfo.Length);
+        IdRegion.Add(newRegions, info.token, info.message, info.token.val.Length);
       }
 
       foreach (var module in program.Modules) {
diff --git a/Source/DafnyExtension/ResolverTagger.cs b/Source/DafnyExtension/ResolverTagger.cs
index 6eaec5a6..0ce68809 100644
--- a/Source/DafnyExtension/ResolverTagger.cs
+++ b/Source/DafnyExtension/ResolverTagger.cs
@@ -74,10 +74,10 @@ namespace DafnyLanguage
       switch (err.Category) {
         case ErrorCategory.ProcessError:
         case ErrorCategory.ParseError:
-        case ErrorCategory.ParseWarning:
           return "syntax error";  // COLOR: red
         case ErrorCategory.ResolveError:
           return "compiler error";  // COLOR: blue
+        case ErrorCategory.ParseWarning:
         case ErrorCategory.ResolveWarning:
           return "compiler warning";  // COLOR: blue
         case ErrorCategory.InternalError:
@@ -403,7 +403,7 @@ namespace DafnyLanguage
         chng(this, new SnapshotSpanEventArgs(new SnapshotSpan(snapshot, 0, snapshot.Length)));
     }
 
-    static TaskErrorCategory CategoryConversion(ErrorCategory cat)
+    static TaskErrorCategory CategoryConversion(ErrorCategory cat) //CLEMENT: We've lost that info
     {
       switch (cat)
       {
diff --git a/Source/DafnyServer/DafnyHelper.cs b/Source/DafnyServer/DafnyHelper.cs
index 10d98677..d6c3f5c7 100644
--- a/Source/DafnyServer/DafnyHelper.cs
+++ b/Source/DafnyServer/DafnyHelper.cs
@@ -30,14 +30,14 @@ namespace Microsoft.Dafny {
     private string fname;
     private string source;
 
-    private Dafny.Errors errors;
+    private readonly Dafny.ErrorReporter reporter;
     private Dafny.Program dafnyProgram;
     private Bpl.Program boogieProgram;
 
     public DafnyHelper(string fname, string source) {
       this.fname = fname;
       this.source = source;
-      this.errors = new Dafny.Errors();
+      this.reporter = new Dafny.ConsoleErrorReporter();
     }
 
     public bool Verify() {
@@ -47,10 +47,10 @@ namespace Microsoft.Dafny {
     private bool Parse() {
       Dafny.ModuleDecl module = new Dafny.LiteralModuleDecl(new Dafny.DefaultModuleDecl(), null);
       Dafny.BuiltIns builtIns = new Dafny.BuiltIns();
-      var success = (Dafny.Parser.Parse(source, fname, fname, module, builtIns, errors) == 0 &&
-                     Dafny.Main.ParseIncludes(module, builtIns, new List<string>(), errors) == null);
+      var success = (Dafny.Parser.Parse(source, fname, fname, module, builtIns, new Dafny.Errors(reporter)) == 0 &&
+                     Dafny.Main.ParseIncludes(module, builtIns, new List<string>(), new Dafny.Errors(reporter)) == null);
       if (success) {
-        dafnyProgram = new Dafny.Program(fname, module, builtIns);
+        dafnyProgram = new Dafny.Program(fname, module, builtIns, reporter);
       }
       return success;
     }
@@ -58,11 +58,11 @@ namespace Microsoft.Dafny {
     private bool Resolve() {
       var resolver = new Dafny.Resolver(dafnyProgram);
       resolver.ResolveProgram(dafnyProgram);
-      return resolver.ErrorCount == 0;
+      return reporter.Count(ErrorLevel.Error) == 0;
     }
 
     private bool Translate() {
-      var translator = new Dafny.Translator() { InsertChecksums = true, UniqueIdPrefix = null }; //FIXME check if null is OK for UniqueIdPrefix
+      var translator = new Dafny.Translator(reporter) { InsertChecksums = true, UniqueIdPrefix = null }; //FIXME check if null is OK for UniqueIdPrefix
       boogieProgram = translator.Translate(dafnyProgram); // FIXME how are translation errors reported?
       return true;
     }
@@ -74,7 +74,8 @@ namespace Microsoft.Dafny {
         ExecutionEngine.CoalesceBlocks(boogieProgram);
         ExecutionEngine.Inline(boogieProgram);
 
-        switch (ExecutionEngine.InferAndVerify(boogieProgram, new PipelineStatistics(), "ServerProgram", null, DateTime.UtcNow.Ticks.ToString())) { // FIXME check if null is ok for error delegate
+        //FIXME Could capture errors instead of printing them (pass a delegate instead of null)
+        switch (ExecutionEngine.InferAndVerify(boogieProgram, new PipelineStatistics(), "ServerProgram", null, DateTime.UtcNow.Ticks.ToString())) {
           case PipelineOutcome.Done:
           case PipelineOutcome.VerificationCompleted:
             return true;
-- 
cgit v1.2.3


From 674e30357980e1192ac532f4bd16c529cedc7fdc Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Wed, 19 Aug 2015 10:51:44 -0700
Subject: Draft out a more advanced version of trigger generation

This new version will include a cleaner pipeline, and trigger splitting.
---
 Source/Dafny/DafnyPipeline.csproj              |    7 +-
 Source/Dafny/Rewriter.cs                       |   46 +-
 Source/Dafny/Translator.cs                     |    4 +-
 Source/Dafny/TriggerGenerator.cs               | 1064 ------------------------
 Source/Dafny/Triggers/QuantifierSplitter.cs    |   66 ++
 Source/Dafny/Triggers/QuantifiersCollection.cs |  104 +++
 Source/Dafny/Triggers/TriggerExtensions.cs     |  489 +++++++++++
 Source/Dafny/Triggers/TriggerGenerator.cs      |   28 +
 Source/Dafny/Triggers/TriggerUtils.cs          |   94 +++
 Source/Dafny/Triggers/TriggersCollector.cs     |  256 ++++++
 Test/dafny0/SeqFromArray.dfy.expect            |    3 +
 11 files changed, 1089 insertions(+), 1072 deletions(-)
 delete mode 100644 Source/Dafny/TriggerGenerator.cs
 create mode 100644 Source/Dafny/Triggers/QuantifierSplitter.cs
 create mode 100644 Source/Dafny/Triggers/QuantifiersCollection.cs
 create mode 100644 Source/Dafny/Triggers/TriggerExtensions.cs
 create mode 100644 Source/Dafny/Triggers/TriggerGenerator.cs
 create mode 100644 Source/Dafny/Triggers/TriggerUtils.cs
 create mode 100644 Source/Dafny/Triggers/TriggersCollector.cs

(limited to 'Source')

diff --git a/Source/Dafny/DafnyPipeline.csproj b/Source/Dafny/DafnyPipeline.csproj
index 626bb26a..5a824c36 100644
--- a/Source/Dafny/DafnyPipeline.csproj
+++ b/Source/Dafny/DafnyPipeline.csproj
@@ -144,7 +144,12 @@
   <ItemGroup>
     <Compile Include="Cloner.cs" />
     <Compile Include="Reporting.cs" />
-    <Compile Include="TriggerGenerator.cs" />
+    <Compile Include="Triggers\QuantifiersCollection.cs" />
+    <Compile Include="Triggers\QuantifierSplitter.cs" />
+    <Compile Include="Triggers\TriggerExtensions.cs" />
+    <Compile Include="Triggers\TriggerGenerator.cs" />
+    <Compile Include="Triggers\TriggersCollector.cs" />
+    <Compile Include="Triggers\TriggerUtils.cs" />
     <Compile Include="Util.cs" />
     <Compile Include="Compiler.cs" />
     <Compile Include="BigIntegerParser.cs" />
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index cb71b80d..4e274189 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -39,22 +39,56 @@ namespace Microsoft.Dafny
   }
 
   public class TriggerGeneratingRewriter : IRewriter {
+    Triggers.QuantifierCollectionsFinder finder;
+
     internal TriggerGeneratingRewriter(ErrorReporter reporter) : base(reporter) {
       Contract.Requires(reporter != null);
+      this.finder = new Triggers.QuantifierCollectionsFinder(reporter);
+    }
+
+    internal override void PostResolve(ModuleDefinition m) {
+      foreach (var decl in ModuleDefinition.AllCallables(m.TopLevelDecls)) { //CLEMENT
+        if (decl is Function) {
+          var function = (Function)decl;
+          finder.Visit(function.Ens, null);
+          finder.Visit(function.Req, null);
+          if (function.Body != null) {
+            finder.Visit(function.Body, null);
+          }
+        } else if (decl is Method) {
+          var method = (Method)decl;
+          finder.Visit(method.Ens, null);
+          finder.Visit(method.Req, null);
+          if (method.Body != null) {
+            finder.Visit(method.Body, null);
+          }
+        }
+      }
+    }
+  }
+
+  internal class QuantifierSplittingRewriter : IRewriter {
+    internal QuantifierSplittingRewriter(ErrorReporter reporter) : base(reporter) {
+      Contract.Requires(reporter != null);
     }
 
     internal override void PostResolve(ModuleDefinition m) {
+      var splitter = new Triggers.QuantifierSplitter();
       foreach (var decl in ModuleDefinition.AllCallables(m.TopLevelDecls)) {
         if (decl is Function) {
           var function = (Function)decl;
-          //TriggerGenerator.AddTriggers(function.Ens, Resolver);
-          //TriggerGenerator.AddTriggers(function.Req, Resolver);
-          //TriggerGenerator.AddTriggers(function.Body, Resolver);
+          splitter.Visit(function.Ens);
+          splitter.Visit(function.Req);
+          if (function.Body != null) {
+            splitter.Visit(function.Body);
+          }
         } else if (decl is Method) {
           var method = (Method)decl;
-          //TriggerGenerator.AddTriggers(method.Ens, Resolver);
-          //TriggerGenerator.AddTriggers(method.Req, Resolver);
-          //TriggerGenerator.AddTriggers(method.Body, Resolver);
+          splitter.Visit(method.Ens);
+          splitter.Visit(method.Req);
+          if (method.Body != null) {
+            splitter.Visit(method.Body);
+          }
         }
       }
     }
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 039aa56f..b5d89abd 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -12895,6 +12895,8 @@ namespace Microsoft.Dafny {
             // that needed to be proved about the function was proved already in the previous module, even without the body definition).
           } else if (!FunctionBodyIsAvailable(f, currentModule)) {
             // Don't inline opaque functions or foreign protected functions
+          } else if (Attributes.Contains(f.Attributes, "no_inline")) {
+            // User manually prevented inlining
           } else if (CanSafelyInline(fexp, f)) {
             // inline this body
             var body = GetSubstitutedBody(fexp, f, false);
@@ -13106,7 +13108,7 @@ namespace Microsoft.Dafny {
     }
 
     private bool CanSafelySubstitute(ISet<IVariable> protectedVariables, IVariable variable, Expression substitution) {
-      return !(protectedVariables.Contains(variable) && TriggerGenerator.IsTriggerKiller(substitution));
+      return !(protectedVariables.Contains(variable) && Dafny.Triggers.TriggersCollector.IsTriggerKiller(substitution));
     }
 
     private class VariablesCollector: BottomUpVisitor {
diff --git a/Source/Dafny/TriggerGenerator.cs b/Source/Dafny/TriggerGenerator.cs
deleted file mode 100644
index 04d96b01..00000000
--- a/Source/Dafny/TriggerGenerator.cs
+++ /dev/null
@@ -1,1064 +0,0 @@
-// #define DEBUG_AUTO_TRIGGERS
-#define THROW_UNSUPPORTED_COMPARISONS
-
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using Microsoft.Boogie;
-using System.Diagnostics.Contracts;
-using System.Text;
-using System.Diagnostics;
-
-//FIXME Generated triggers should be _triggers
-//FIXME: When scoring, do not consider old(x) to be higher than x.
-
-/* High level note: There are really two processes going on here. One is finding quantifiers; 
- * the other is walking the subtree corresponding to each quantifier, and finding trigger candidates.
- * These two processes are interleaved, because we can look for trigger candidates as we look for 
- * quantifiers. Since the visitor starts from the bottom of the tree, the recursive annotation 
- * procedure never causes deep recursion; every call it makes hits the cache that has been built 
- * during the visiting of lower level nodes.
- * 
- * Note also that it wouldn't be enough to just use the recursive procedure: it doesn't visit 
- * statements, for example.
- */
-
-namespace Microsoft.Dafny {
-  class TriggerCandidate {
-    internal Expression Expr;
-    internal ISet<IVariable> Variables;
-    internal List<ExprExtensions.TriggerMatch> MatchesInQuantifierBody;
-
-    public override string ToString() {
-      return Printer.ExprToString(Expr);
-    }
-  }
-
-  class MultiTriggerCandidate {
-    internal List<TriggerCandidate> Candidates;
-    internal List<string> Tags;
-    internal double Score;
-
-    private List<ExprExtensions.TriggerMatch> potentialMatchingLoops;
-    internal List<ExprExtensions.TriggerMatch> PotentialMatchingLoops {
-      get {
-        if (potentialMatchingLoops == null) {
-          //FIXME could be optimized by looking at the bindings instead of doing full equality
-          var candidates = Candidates.Deduplicate((x, y) => ExprExtensions.ExpressionEq(x.Expr, y.Expr));
-          potentialMatchingLoops = candidates.SelectMany(candidate => candidate.MatchesInQuantifierBody)
-            .Deduplicate((x, y) => ExprExtensions.ExpressionEq(x.Expr, y.Expr)).Where(tm => tm.CouldCauseLoops(candidates)).ToList();
-        }
-        
-        return potentialMatchingLoops;
-      }
-    }
-
-    internal MultiTriggerCandidate(List<TriggerCandidate> candidates) {
-      Candidates = candidates;
-      Tags = new List<string>();
-    }
-
-    internal bool MentionsAll(List<BoundVar> vars) {
-      var candidates = Candidates;
-      return vars.All(x => candidates.Any(candidate => candidate.Variables.Contains(x))); //TODO Perfs?
-    }
-
-    public override string ToString() {
-      return String.Format("[{0:G2}] {1}", Score, String.Join(", ", Candidates));
-    }
-
-    public String AsDafnyAttributeString(bool wrap = true, bool includeTags = false) {
-      var repr = Candidates.MapConcat(t => Printer.ExprToString(t.Expr), ", ");
-      if (wrap) {
-        repr = "{:trigger " + repr + "}";
-      }
-      if (includeTags && Tags != null) {
-        repr += " (" + String.Join("; ", Tags) + ")";
-      }
-      return repr;
-    }
-  }
-  
-
-  class TriggerAnnotation {
-    internal bool IsTriggerKiller;
-    internal ISet<IVariable> Variables;
-    internal readonly List<TriggerCandidate> PrivateCandidates;
-    internal readonly List<TriggerCandidate> ExportedCandidates;
-
-    internal TriggerAnnotation(bool IsTriggerKiller, IEnumerable<IVariable> Variables, 
-                               IEnumerable<TriggerCandidate> AllCandidates, IEnumerable<TriggerCandidate> PrivateCandidates = null) {
-      this.IsTriggerKiller = IsTriggerKiller;
-      this.Variables = new HashSet<IVariable>(Variables);
-
-      this.PrivateCandidates = new List<TriggerCandidate>(PrivateCandidates == null ? Enumerable.Empty<TriggerCandidate>() : PrivateCandidates);
-      this.ExportedCandidates = new List<TriggerCandidate>(AllCandidates == null ? Enumerable.Empty<TriggerCandidate>() : AllCandidates.Except(this.PrivateCandidates));
-    }
-
-    public override string ToString() {
-      StringBuilder sb = new StringBuilder();
-      string indent = "  {0}", nindent = "\n  - {0}", subindent = "\n    * {0}";
-
-      sb.AppendFormat(indent, IsTriggerKiller);
-
-      sb.AppendFormat(nindent, "Variables:");
-      foreach (var bv in Variables) {
-        sb.AppendFormat(subindent, bv.Name);
-      }
-
-      sb.AppendFormat(nindent, "Exported candidates:");
-      foreach (var candidate in ExportedCandidates) {
-        sb.AppendFormat(subindent, candidate);
-      }
-
-      if (PrivateCandidates.Any()) {
-        sb.AppendFormat(nindent, "Private candidates:");
-        foreach (var candidate in PrivateCandidates) {
-          sb.AppendFormat(subindent, candidate);
-        }
-      }
-
-      return sb.ToString();
-    }
-  }
-
-  public class TriggerGenerator : BottomUpVisitor {
-    List<QuantifierExpr> quantifiers;
-    Dictionary<Expression, TriggerAnnotation> annotations;
-
-    Action<IToken, string, int> AdditionalInformationReporter;
-
-    private TriggerGenerator(Action<IToken, string, int> additionalInformationReporter) {
-      Contract.Requires(additionalInformationReporter != null);
-      this.quantifiers = new List<QuantifierExpr>();
-      this.annotations = new Dictionary<Expression, TriggerAnnotation>();
-      this.AdditionalInformationReporter = additionalInformationReporter;
-    }
-
-    private List<T> MergeAlterFirst<T>(List<T> a, List<T> b) {
-      Contract.Requires(a != null);
-      Contract.Requires(b != null);
-      a.AddRange(b);
-      return a;
-    }
-
-    private ISet<T> MergeAlterFirst<T>(ISet<T> a, ISet<T> b) {
-      Contract.Requires(a != null);
-      Contract.Requires(b != null);
-      a.UnionWith(b);
-      return a;
-    }
-
-    private T ReduceAnnotatedSubExpressions<T>(Expression expr, T seed, Func<TriggerAnnotation, T> map, Func<T, T, T> reduce) {
-      return expr.SubExpressions.Select(e => map(Annotate(e)))
-                                .Aggregate(seed, (acc, e) => reduce(acc, e));
-    }
-
-    private List<TriggerCandidate> CollectExportedCandidates(Expression expr) {
-      return ReduceAnnotatedSubExpressions<List<TriggerCandidate>>(expr, new List<TriggerCandidate>(), a => a.ExportedCandidates, MergeAlterFirst);
-    }
-
-    private ISet<IVariable> CollectVariables(Expression expr) {
-      return ReduceAnnotatedSubExpressions(expr, new HashSet<IVariable>(), a => a.Variables, MergeAlterFirst);
-    }
-
-    private bool CollectIsKiller(Expression expr) {
-      return ReduceAnnotatedSubExpressions(expr, false, a => a.IsTriggerKiller, (a, b) => a || b);
-    }
-
-    private IEnumerable<TriggerCandidate> OnlyPrivateCandidates(List<TriggerCandidate> candidates, IEnumerable<IVariable> privateVars) {
-      return candidates.Where(c => privateVars.Intersect(c.Variables).Any()); //TODO Check perf
-    }
-
-    private TriggerAnnotation Annotate(Expression expr) {
-      TriggerAnnotation cached;
-      if (annotations.TryGetValue(expr, out cached)) {
-        return cached;
-      }
-
-      expr.SubExpressions.Iter(e => Annotate(e)); //NOTE: These values are all cached
-
-      TriggerAnnotation annotation; // TODO: Using ApplySuffix fixes the unresolved members problem in GenericSort
-      if (expr is FunctionCallExpr || expr is SeqSelectExpr || expr is MemberSelectExpr || expr is OldExpr ||
-          (expr is UnaryOpExpr && (((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Cardinality)) || // FIXME || ((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Fresh oesn't work, as fresh is a pretty tricky predicate when it's not about datatypes. See translator.cs:10944
-          (expr is BinaryExpr  && (((BinaryExpr)expr).Op == BinaryExpr.Opcode.NotIn || ((BinaryExpr)expr).Op == BinaryExpr.Opcode.In))) {
-        annotation = AnnotatePotentialCandidate(expr);
-      } else if (expr is QuantifierExpr) {
-        annotation = AnnotateQuantifier((QuantifierExpr)expr);
-      } else if (expr is LetExpr) {
-        annotation = AnnotateLetExpr((LetExpr)expr);
-      } else if (expr is IdentifierExpr) {
-        annotation = AnnotateIdentifier((IdentifierExpr)expr);
-      } else if (expr is ApplySuffix) {
-        annotation = AnnotateApplySuffix((ApplySuffix)expr);
-      } else if (expr is ConcreteSyntaxExpression ||
-                 expr is LiteralExpr ||
-                 expr is OldExpr ||
-                 expr is ThisExpr ||
-                 expr is BoxingCastExpr ||
-                 expr is DatatypeValue) {
-        annotation = AnnotateOther(expr, false);
-      } else {
-        annotation = AnnotateOther(expr, true);
-      }
-
-      DebugTriggers("{0} ({1})\n{2}", Printer.ExprToString(expr), expr.GetType(), annotation);
-      annotations[expr] = annotation;
-      return annotation;
-    }
-
-    [Conditional("DEBUG_AUTO_TRIGGERS")]
-    private static void DebugTriggers(string format, params object[] more) {
-      Console.Error.WriteLine(format, more);
-    }
-
-    private BinaryExpr.ResolvedOpcode RemoveNotInBinaryExprIn(BinaryExpr.ResolvedOpcode opcode) {
-      switch(opcode) {
-        case BinaryExpr.ResolvedOpcode.NotInMap:
-          return BinaryExpr.ResolvedOpcode.InMap;
-        case BinaryExpr.ResolvedOpcode.NotInSet:
-          return BinaryExpr.ResolvedOpcode.InSet;
-        case BinaryExpr.ResolvedOpcode.NotInSeq:
-          return BinaryExpr.ResolvedOpcode.InSeq;
-        case BinaryExpr.ResolvedOpcode.NotInMultiSet:
-          return BinaryExpr.ResolvedOpcode.InMultiSet;  
-      }
-
-      Contract.Assert(false);
-      throw new ArgumentException();
-    }
-
-    private Expression CleanupExpr(Expression expr, out bool isKiller) {
-      isKiller = false;
-
-      if (!(expr is BinaryExpr)) {
-        return expr;
-      }
-
-      var bexpr = expr as BinaryExpr;
-
-      BinaryExpr new_expr = bexpr;
-      if (bexpr.Op == BinaryExpr.Opcode.NotIn) {
-        new_expr = new BinaryExpr(bexpr.tok, BinaryExpr.Opcode.In, bexpr.E0, bexpr.E1);
-        new_expr.ResolvedOp = RemoveNotInBinaryExprIn(bexpr.ResolvedOp);
-        new_expr.Type = bexpr.Type;
-      }
-
-      Expression returned_expr = new_expr;
-      if (new_expr.ResolvedOp == BinaryExpr.ResolvedOpcode.InMultiSet) {
-        returned_expr = new SeqSelectExpr(new_expr.tok, true, new_expr.E1, new_expr.E0, null);
-        returned_expr.Type = bexpr.Type;
-        isKiller = true; // [a in s] becomes [s[a] > 0], which is a trigger killer
-      }
-
-      return returned_expr;
-    }
-
-    private TriggerAnnotation AnnotatePotentialCandidate(Expression expr) {
-      bool expr_is_killer = false;
-      var new_expr = CleanupExpr(expr, out expr_is_killer);
-      var new_candidate = new TriggerCandidate { Expr = new_expr, Variables = CollectVariables(expr) }; 
-
-      List<TriggerCandidate> collected_candidates = CollectExportedCandidates(expr);
-      var children_contain_killers = CollectIsKiller(expr);
-
-      if (!children_contain_killers) {
-        // Add only if the children are not killers; the head has been cleaned up into non-killer form
-        collected_candidates.Add(new_candidate);
-      }
-
-      // This new node is a killer if its children were killers, or if it's non-cleaned-up head is a killer
-      return new TriggerAnnotation(children_contain_killers || expr_is_killer, new_candidate.Variables, collected_candidates);
-    }
-
-    private TriggerAnnotation AnnotateApplySuffix(ApplySuffix expr) {
-      // This is a bit tricky. A funcall node is generally meaningful as a trigger candidate, 
-      // but when it's part of an ApplySuffix the function call itself may not resolve properly
-      // when the second round of resolving is done after modules are duplicated.
-      // Thus first we annotate expr and create a trigger candidate, and then we remove the 
-      // candidate matching its direct subexpression if needed. Not that function calls are not the 
-      // only possible child here; there can be DatatypeValue nodes, for example (see vstte2012/Combinators.dfy).
-      var annotation = AnnotatePotentialCandidate(expr);
-      // Comparing by reference is fine here. Using sets could yield a small speedup
-      annotation.ExportedCandidates.RemoveAll(candidate => expr.SubExpressions.Contains(candidate.Expr));
-      return annotation;
-    }
-
-    private TriggerAnnotation AnnotateQuantifierOrLetExpr(Expression expr, IEnumerable<BoundVar> boundVars) {
-      var candidates = CollectExportedCandidates(expr);
-      return new TriggerAnnotation(true, CollectVariables(expr), candidates, OnlyPrivateCandidates(candidates, boundVars));
-    }
-
-    private TriggerAnnotation AnnotateQuantifier(QuantifierExpr expr) {
-      quantifiers.Add(expr);
-      return AnnotateQuantifierOrLetExpr(expr, expr.BoundVars);
-    }
-
-    private TriggerAnnotation AnnotateLetExpr(LetExpr expr) {
-       return AnnotateQuantifierOrLetExpr(expr, expr.BoundVars);
-    }
-
-    private TriggerAnnotation AnnotateIdentifier(IdentifierExpr expr) {
-      return new TriggerAnnotation(false, Enumerable.Repeat(expr.Var, 1), null);
-    }
-
-    private TriggerAnnotation AnnotateOther(Expression expr, bool isTriggerKiller) {
-      return new TriggerAnnotation(isTriggerKiller || CollectIsKiller(expr), CollectVariables(expr), CollectExportedCandidates(expr));
-    }
-
-    private static List<T> CopyAndAdd<T>(List<T> seq, T elem) {
-      var copy = new List<T>(seq);
-      copy.Add(elem);
-      return copy;
-    }
-
-    private static IEnumerable<List<T>> AllSubsets<T>(IList<T> source, int offset) {
-      if (offset >= source.Count) {
-        yield return new List<T>();
-        yield break;
-      }
-
-      foreach (var subset in AllSubsets<T>(source, offset + 1)) {
-        yield return CopyAndAdd(subset, source[offset]);
-        yield return new List<T>(subset);
-      }
-    }
-
-    private static IEnumerable<List<T>> AllNonEmptySubsets<T>(IEnumerable<T> source) {
-      List<T> all = new List<T>(source);
-      foreach (var subset in AllSubsets(all, 0)) {
-        if (subset.Count > 0) {
-          yield return subset;
-        }
-      }
-    }
-
-    private static bool DefaultCandidateFilteringFunction(TriggerCandidate candidate, QuantifierExpr quantifier) {
-      //FIXME this will miss rewritten expressions (CleanupExpr). Should introduce an OriginalExpr to compare.
-      candidate.MatchesInQuantifierBody = quantifier.SubexpressionsMatchingTrigger(candidate.Expr).ToList();
-      return true;
-    }
-
-    private static bool DefaultMultiCandidateFilteringFunction(MultiTriggerCandidate multiCandidate, QuantifierExpr quantifier) {
-      var allowsLoops = quantifier.Attributes.AsEnumerable().Any(a => a.Name == "loop");
-
-      if (!allowsLoops && multiCandidate.PotentialMatchingLoops.Any()) {
-        multiCandidate.Tags.Add(String.Format("matching loop with {0}", multiCandidate.PotentialMatchingLoops.MapConcat(tm => Printer.ExprToString(tm.Expr), ", ")));
-      }
-      return multiCandidate.MentionsAll(quantifier.BoundVars) && (allowsLoops || !multiCandidate.PotentialMatchingLoops.Any());
-    }
-
-    private static double DefaultMultiCandidateScoringFunction(MultiTriggerCandidate multi_candidate) {
-      return 1.0;
-    }
-
-    private static IEnumerable<MultiTriggerCandidate> DefaultMultiCandidateSelectionFunction(List<MultiTriggerCandidate> multi_candidates) {
-      return multi_candidates;
-    }
-
-    // CLEMENT: Make these customizable
-    internal Func<TriggerCandidate, QuantifierExpr, bool> CandidateFilteringFunction = DefaultCandidateFilteringFunction;
-    internal Func<MultiTriggerCandidate, QuantifierExpr, bool> MultiCandidateFilteringFunction = DefaultMultiCandidateFilteringFunction;
-    internal Func<MultiTriggerCandidate, double> MultiCandidateScoringFunction = DefaultMultiCandidateScoringFunction;
-    internal Func<List<MultiTriggerCandidate>, IEnumerable<MultiTriggerCandidate>> MultiCandidateSelectionFunction = DefaultMultiCandidateSelectionFunction;
-
-    struct MultiCandidatesCollection {
-      internal List<TriggerCandidate> AllCandidates;
-      internal List<TriggerCandidate> SelectedCandidates;
-      internal List<TriggerCandidate> RejectedCandidates;
-      internal List<MultiTriggerCandidate> SelectedMultiCandidates;
-      internal List<MultiTriggerCandidate> RejectedMultiCandidates;
-      internal List<MultiTriggerCandidate> FinalMultiCandidates;
-
-      public MultiCandidatesCollection(QuantifierExpr quantifier,
-        TriggerAnnotation annotation,
-        Func<TriggerCandidate, QuantifierExpr, bool> CandidateFilteringFunction,
-        Func<MultiTriggerCandidate, QuantifierExpr, bool> MultiCandidateFilteringFunction,
-        Func<MultiTriggerCandidate, double> MultiCandidateScoringFunction,
-        Func<List<MultiTriggerCandidate>, IEnumerable<MultiTriggerCandidate>> MultiCandidateSelectionFunction) {
-
-        Contract.Requires(annotation != null);
-        Contract.Requires(quantifier != null);
-        Contract.Requires(CandidateFilteringFunction != null);
-        Contract.Requires(MultiCandidateFilteringFunction != null);
-        Contract.Requires(MultiCandidateScoringFunction != null);
-        Contract.Requires(MultiCandidateSelectionFunction != null);
-
-        AllCandidates = annotation.PrivateCandidates.Deduplicate((x, y) => ExprExtensions.ExpressionEq(x.Expr, y.Expr));
-        Partition(AllCandidates, 
-          x => CandidateFilteringFunction(x, quantifier), out SelectedCandidates, out RejectedCandidates);
-        Partition(AllNonEmptySubsets(SelectedCandidates).Select(s => new MultiTriggerCandidate(s)), 
-          x => MultiCandidateFilteringFunction(x, quantifier), out SelectedMultiCandidates, out RejectedMultiCandidates);
-        SelectedMultiCandidates.Iter(x => x.Score = MultiCandidateScoringFunction(x));
-        FinalMultiCandidates = MultiCandidateSelectionFunction(SelectedMultiCandidates).ToList();
-      }
-
-      private static void Partition<T>(IEnumerable<T> elements, Func<T, bool> predicate, out List<T> positive, out List<T> negative) {
-        positive = new List<T>();
-        negative = new List<T>();
-        foreach (var c in elements) {
-          (predicate(c) ? positive : negative).Add(c);
-        }
-      }
-
-      internal string Warning() {
-        if (AllCandidates.Count == 0) {
-          return "No triggers found in the body of this quantifier.";
-        } else if (SelectedCandidates.Count == 0) {
-          return String.Format("No suitable triggers found. Candidate building blocks for a good trigger where [{0}], but none these terms passed the initial selection stage.", String.Join(", ", AllCandidates));
-        } else if (SelectedMultiCandidates.Count == 0) {
-          return String.Format("No suitable set of triggers found. Candidate building blocks for a good trigger where [{0}], but no subset of these terms passed the subset selection stage.", String.Join(", ", SelectedCandidates));
-        } else if (FinalMultiCandidates.Count == 0) {
-          return String.Format("No suitable set of triggers found. Candidates where [{0}], but none passed the final selection stage.", String.Join(", ", SelectedMultiCandidates));
-        } else {
-          return null;
-        }
-      }
-
-      private void WriteIndented<T>(StringBuilder builder, string indent, IEnumerable<T> elements) {
-        foreach (var element in elements) {
-          builder.Append(indent).AppendLine(element.ToString());
-        }
-      }
-
-      private void WriteListOfCandidates<T>(StringBuilder builder, string indent, IEnumerable<T> elements) {
-        if (elements.Any()) {
-          builder.AppendLine();
-          WriteIndented(builder, indent, elements);
-        } else {
-          builder.AppendLine(" (None)");
-        }
-      }
-
-      public override string ToString() {
-        var repr = new StringBuilder();
-        var indent = "      ";
-        repr.Append("    All:");
-        WriteListOfCandidates(repr, indent, AllCandidates);
-        repr.Append("    Selected1:");
-        WriteListOfCandidates(repr, indent, SelectedCandidates);
-        repr.Append("    PreFilter:");
-        WriteListOfCandidates(repr, indent, AllNonEmptySubsets(AllCandidates).Select(c => String.Join(", ", c)));
-        repr.Append("    SelectedMulti:");
-        WriteListOfCandidates(repr, indent, SelectedMultiCandidates.Select(c => String.Join(", ", c)));
-        repr.Append("    Final:");
-        WriteListOfCandidates(repr, indent, FinalMultiCandidates);
-        return repr.ToString();
-      }
-    }
-
-    private MultiCandidatesCollection PickMultiTriggers(QuantifierExpr quantifier) {
-      var annotation = Annotate(quantifier);
-      DebugTriggers("Quantifier {0}:\n{1}", Printer.ExprToString(quantifier), annotation);
-      return new MultiCandidatesCollection(quantifier, annotation, CandidateFilteringFunction, MultiCandidateFilteringFunction, MultiCandidateScoringFunction, MultiCandidateSelectionFunction);
-    }
-
-    private void AddTrigger(QuantifierExpr quantifier) {
-      DebugTriggers("  Final results:\n{0}", PickMultiTriggers(quantifier));
-
-      if (quantifier.Attributes.AsEnumerable().Any(aa => aa.Name == "trigger" || aa.Name == "no_trigger")) {
-        DebugTriggers("Not generating triggers for {0}", Printer.ExprToString(quantifier)); //FIXME: no_trigger is passed down to Boogie
-        return;
-      }
-
-      var multi_candidates = PickMultiTriggers(quantifier);
-      foreach (var multi_candidate in multi_candidates.FinalMultiCandidates) { //TODO: error message for when no triggers found
-        quantifier.Attributes = new Attributes("trigger", multi_candidate.Candidates.Select(t => t.Expr).ToList(), quantifier.Attributes);
-      }
-
-      if (multi_candidates.RejectedMultiCandidates.Any()) {
-        var tooltip = JoinStringsWithHeader("Rejected: ", multi_candidates.RejectedMultiCandidates.Where(candidate => candidate.Tags != null)
-          .Select(candidate => candidate.AsDafnyAttributeString(true, true)));
-        AdditionalInformationReporter(quantifier.tok, tooltip, quantifier.tok.val.Length);
-      }
-
-      if (multi_candidates.FinalMultiCandidates.Any()) {
-        var tooltip = JoinStringsWithHeader("Triggers: ", multi_candidates.FinalMultiCandidates.Select(multi_candidate => multi_candidate.AsDafnyAttributeString()));
-        AdditionalInformationReporter(quantifier.tok, tooltip, quantifier.tok.val.Length);
-      }
-
-      string warning = multi_candidates.Warning();
-      if (warning != null) {
-        // FIXME reenable Resolver.Warning(quantifier.tok, warning);
-      }
-    }
-
-    internal static bool IsTriggerKiller(Expression expr) {
-      var annotation = new TriggerGenerator((x, y, z) => { }).Annotate(expr);
-      return annotation.IsTriggerKiller;
-    }
-
-    private string JoinStringsWithHeader(string header, IEnumerable<string> lines) {
-      return header + String.Join(Environment.NewLine + new String(' ', header.Length), lines);
-    }
-
-    private void AddTriggers_Internal() {
-      foreach (var quantifier in quantifiers) {
-        AddTrigger(quantifier);
-      }
-    }
-
-    private void AddTriggers_Internal(Expression root) {
-      Visit(root);
-      AddTriggers_Internal();
-    }
-
-    private void AddTriggers_Internal(Statement root) {
-      Visit(root);
-      AddTriggers_Internal();
-    }
-
-    internal static void AddTriggers(Expression root, Resolver resolver) {
-      if (root == null)
-        return;
-
-      DebugTriggers("== From {0} visiting expr: {1}", new StackFrame(1).GetMethod().Name, Printer.ExprToString(root));
-      TriggerGenerator generator = new TriggerGenerator(null);
-      generator.AddTriggers_Internal(root);
-    }
-
-    internal static void AddTriggers(Statement root, Resolver resolver) {
-      if (root == null)
-        return;
-
-      DebugTriggers("== From {0} visiting statement: {1}", new StackFrame(1).GetMethod().Name, Printer.StatementToString(root));
-      TriggerGenerator generator = new TriggerGenerator(null);
-      generator.AddTriggers_Internal(root);
-    }
-
-    internal static void AddTriggers(IEnumerable<Expression> roots, Resolver resolver) {
-      DebugTriggers("== From {0} visiting expressions: {1}", new StackFrame(1).GetMethod().Name, 
-        roots.MapConcat(Printer.ExprToString, ", "));
-      foreach (var expr in roots) {
-        AddTriggers(expr, resolver);
-      }
-    }
-
-    internal static void AddTriggers(IEnumerable<MaybeFreeExpression> roots, Resolver resolver) {
-      DebugTriggers("== From {0} visiting expressions: {1}", new StackFrame(1).GetMethod().Name,
-        roots.MapConcat(root => Printer.ExprToString(root.E), ", "));
-      foreach (var expr in roots) {
-        AddTriggers(expr.E, resolver);
-      }
-    }
-
-    protected override void VisitOneExpr(Expression expr) {
-      Annotate(expr);
-    }
-  }
-
-  internal static class DeduplicateExtension {
-    public static List<T> Deduplicate<T>(this IEnumerable<T> seq, Func<T, T, bool> eq) {
-      List<T> deduplicated = new List<T>();
-
-      foreach (var elem in seq) {
-        if (!deduplicated.Any(other => eq(elem, other))) {
-          deduplicated.Add(elem);
-        }
-      }
-
-      return deduplicated;
-    }
-  }
-
-  static class ExprExtensions {
-    static IEnumerable<Expression> AllSubExpressions(this Expression expr, bool strict = false) {
-      foreach (var subexpr in expr.SubExpressions) {
-        foreach (var r_subexpr in AllSubExpressions(subexpr, false)) {
-          yield return r_subexpr;
-        }
-        yield return subexpr;
-      }
-
-      if (expr is StmtExpr) {
-        foreach (var r_subexpr in AllSubExpressions(((StmtExpr)expr).S, false)) {
-          yield return r_subexpr;
-        }
-      }
-
-      if (!strict) {
-        yield return expr;
-      }
-    }
-
-    private static IEnumerable<Expression> AllSubExpressions(this Statement stmt, bool strict = false) {
-      foreach (var subexpr in stmt.SubExpressions) {
-        foreach (var r_subexpr in AllSubExpressions(subexpr, false)) {
-          yield return r_subexpr;
-        }
-        yield return subexpr;
-      }
-
-      foreach (var substmt in stmt.SubStatements) {
-        foreach (var r_subexpr in AllSubExpressions(substmt, false)) {
-          yield return r_subexpr;
-        }
-      }
-    }
-
-    internal static bool ExpressionEq(this Expression expr1, Expression expr2) {
-      expr1 = GetResolved(expr1);
-      expr2 = GetResolved(expr2);
-
-      return ShallowEq_Top(expr1, expr2) && SameLists(expr1.SubExpressions, expr2.SubExpressions, (e1, e2) => ExpressionEq(e1, e2));
-    }
-
-    internal static bool ExpressionEqModuloVariableNames(this Expression expr1, Expression expr2) {
-      expr1 = GetResolved(expr1);
-      expr2 = GetResolved(expr2);
-
-      if (expr1 is IdentifierExpr) {
-        return expr2 is IdentifierExpr;
-      }
-
-      return ShallowEq_Top(expr1, expr2) && SameLists(expr1.SubExpressions, expr2.SubExpressions, (e1, e2) => ExpressionEqModuloVariableNames(e1, e2));
-    }
-
-    private static bool MatchesTrigger(this Expression expr, Expression trigger, ISet<BoundVar> holes, Dictionary<IVariable, Expression> bindings) {
-      expr = GetResolved(expr);
-      trigger = GetResolved(trigger);
-      
-      if (trigger is IdentifierExpr) {
-        var var = ((IdentifierExpr)trigger).Var;
-
-        if (holes.Contains(var)) {
-          Expression existing_binding = null;
-          if (bindings.TryGetValue(var, out existing_binding)) {
-            return ExpressionEq(expr, existing_binding);
-          } else {
-            bindings[var] = expr;
-            return true;
-          }
-        }
-      }
-
-      return ShallowEq_Top(expr, trigger) && SameLists(expr.SubExpressions, trigger.SubExpressions, (e1, e2) => MatchesTrigger(e1, e2, holes, bindings));
-    }
-
-    internal struct TriggerMatch {
-      internal Expression Expr;
-      internal Dictionary<IVariable, Expression> Bindings;
-
-      internal bool CouldCauseLoops(IEnumerable<TriggerCandidate> candidates) {
-        // A match for a trigger in the body of a quantifier can be a problem if 
-        // it yields to a matching loop: for example, f(x) is a bad trigger in 
-        //   forall x, y :: f(x) = f(f(x))
-        // In general, any such match can lead to a loop, but two special cases 
-        // will only lead to a finite number of instantiations:
-        // 1. The match equals one of the triggers in the set of triggers under
-        //    consideration. For example, { f(x) } a bad trigger above, but the
-        //    pair { f(x), f(f(x)) } is fine (instantiating won't yield new 
-        //    matches)
-        // 2. The match only differs from one of these triggers by variable 
-        //    names. This is a superset of the previous case.
-        var expr = Expr;
-        return !candidates.Any(c => c.Expr.ExpressionEqModuloVariableNames(expr));
-      }
-    }
-
-    private static TriggerMatch? MatchAgainst(this Expression expr, Expression trigger, ISet<BoundVar> holes) {
-      var bindings = new Dictionary<IVariable, Expression>();
-      return expr.MatchesTrigger(trigger, holes, bindings) ? new TriggerMatch { Expr = expr, Bindings = bindings } : (TriggerMatch?)null;
-    }
-
-    internal static IEnumerable<TriggerMatch> SubexpressionsMatchingTrigger(this QuantifierExpr quantifier, Expression trigger) {
-      return quantifier.Term.AllSubExpressions()
-        .Select(e => e.MatchAgainst(trigger, new HashSet<BoundVar>(quantifier.BoundVars)))
-        .Where(e => e.HasValue).Select(e => e.Value);
-    }
-
-    private static bool SameLists<T>(IEnumerable<T> list1, IEnumerable<T> list2, Func<T, T, bool> comparer) {
-      if (ReferenceEquals(list1, list2)) {
-        return true;
-      } else if ((list1 == null) != (list2 == null)) {
-        return false;
-      }
-
-      var it1 = list1.GetEnumerator();
-      var it2 = list2.GetEnumerator();
-      bool it1_has, it2_has;
-      bool acc = true;
-
-      do {
-        it1_has = it1.MoveNext();
-        it2_has = it2.MoveNext();
-
-        if (it1_has == true && it2_has == true) {
-          acc = acc && comparer(it1.Current, it2.Current);
-        }
-      } while (it1_has && it2_has);
-
-      return it1_has == it2_has && acc;
-    }
-
-    private static bool SameNullity<T>(T x1, T x2) where T : class {
-      return (x1 == null) == (x2 == null);
-    }
-
-    private static bool ShallowSameAttributes(Attributes attributes1, Attributes attributes2) {
-      return SameLists(attributes1.AsEnumerable(), attributes2.AsEnumerable(), ShallowSameSingleAttribute);
-    }
-
-    private static bool ShallowSameSingleAttribute(Attributes arg1, Attributes arg2) {
-      return arg1.Name == arg2.Name;
-    }
-
-    private static bool SameBoundVar(IVariable arg1, IVariable arg2) {
-      return arg1 == arg2 || 
-             (arg1.Name == arg2.Name &&
-              arg1.CompileName == arg2.CompileName &&
-              arg1.DisplayName == arg2.DisplayName &&
-              arg1.UniqueName == arg2.UniqueName &&
-              arg1.IsGhost == arg2.IsGhost &&
-              arg1.IsMutable == arg2.IsMutable); //FIXME compare types?
-    }
-
-    private static Expression GetResolved(Expression expr) {
-      if (expr is ConcreteSyntaxExpression) {
-        return ((ConcreteSyntaxExpression)expr).ResolvedExpression;
-      }
-      return expr;
-    }
-
-    /// <summary>
-    /// Compares two abstract syntax expressions, looking only at their direct members. Subexpressions and substatements are not compared.
-    /// </summary>
-    /// <returns></returns>
-    internal static bool ShallowEq_Top(Expression expr1, Expression expr2) {
-      Contract.Requires(expr1 != null);
-      Contract.Requires(expr2 != null);
-
-      // We never compare concrete expressions
-      Contract.Requires(!(expr1 is ConcreteSyntaxExpression));
-      Contract.Requires(!(expr2 is ConcreteSyntaxExpression));
-
-      // CPC: Hey future editor: the following block of code is auto-generated. Just add your own cases at the end.
-      //      This could be a visitor pattern, except I need to visit a pair of nodes. 
-      //      It could also be implemented in each individual class. I'd have a slight preference for that.
-      //      This really just wants to use double dispatch.
-      if (expr1 is UnboxingCastExpr && expr2 is UnboxingCastExpr) {
-        return ShallowEq((UnboxingCastExpr)expr1, (UnboxingCastExpr)expr2);
-      } else if (expr1 is BoxingCastExpr && expr2 is BoxingCastExpr) {
-        return ShallowEq((BoxingCastExpr)expr1, (BoxingCastExpr)expr2);
-      } else if (expr1 is MatchExpr && expr2 is MatchExpr) {
-        return ShallowEq((MatchExpr)expr1, (MatchExpr)expr2);
-      } else if (expr1 is ITEExpr && expr2 is ITEExpr) {
-        return ShallowEq((ITEExpr)expr1, (ITEExpr)expr2);
-      } else if (expr1 is StmtExpr && expr2 is StmtExpr) {
-        return ShallowEq((StmtExpr)expr1, (StmtExpr)expr2);
-      } else if (expr1 is WildcardExpr && expr2 is WildcardExpr) {
-        return ShallowEq((WildcardExpr)expr1, (WildcardExpr)expr2);
-      } else if (expr1 is ComprehensionExpr && expr2 is ComprehensionExpr) {
-        return ShallowEq((ComprehensionExpr)expr1, (ComprehensionExpr)expr2);
-      } else if (expr1 is NamedExpr && expr2 is NamedExpr) {
-        return ShallowEq((NamedExpr)expr1, (NamedExpr)expr2);
-      } else if (expr1 is LetExpr && expr2 is LetExpr) {
-        return ShallowEq((LetExpr)expr1, (LetExpr)expr2);
-      } else if (expr1 is TernaryExpr && expr2 is TernaryExpr) {
-        return ShallowEq((TernaryExpr)expr1, (TernaryExpr)expr2);
-      } else if (expr1 is BinaryExpr && expr2 is BinaryExpr) {
-        return ShallowEq((BinaryExpr)expr1, (BinaryExpr)expr2);
-      } else if (expr1 is UnaryExpr && expr2 is UnaryExpr) {
-        return ShallowEq((UnaryExpr)expr1, (UnaryExpr)expr2);
-      } else if (expr1 is MultiSetFormingExpr && expr2 is MultiSetFormingExpr) {
-        return ShallowEq((MultiSetFormingExpr)expr1, (MultiSetFormingExpr)expr2);
-      } else if (expr1 is OldExpr && expr2 is OldExpr) {
-        return ShallowEq((OldExpr)expr1, (OldExpr)expr2);
-      } else if (expr1 is FunctionCallExpr && expr2 is FunctionCallExpr) {
-        return ShallowEq((FunctionCallExpr)expr1, (FunctionCallExpr)expr2);
-      } else if (expr1 is ApplyExpr && expr2 is ApplyExpr) {
-        return ShallowEq((ApplyExpr)expr1, (ApplyExpr)expr2);
-      } else if (expr1 is SeqUpdateExpr && expr2 is SeqUpdateExpr) {
-        return ShallowEq((SeqUpdateExpr)expr1, (SeqUpdateExpr)expr2);
-      } else if (expr1 is MultiSelectExpr && expr2 is MultiSelectExpr) {
-        return ShallowEq((MultiSelectExpr)expr1, (MultiSelectExpr)expr2);
-      } else if (expr1 is SeqSelectExpr && expr2 is SeqSelectExpr) {
-        return ShallowEq((SeqSelectExpr)expr1, (SeqSelectExpr)expr2);
-      } else if (expr1 is MemberSelectExpr && expr2 is MemberSelectExpr) {
-        return ShallowEq((MemberSelectExpr)expr1, (MemberSelectExpr)expr2);
-      } else if (expr1 is MapDisplayExpr && expr2 is MapDisplayExpr) { //Note: MapDisplayExpr is not a DisplayExpression
-        return ShallowEq((MapDisplayExpr)expr1, (MapDisplayExpr)expr2);
-      } else if (expr1 is DisplayExpression && expr2 is DisplayExpression) {
-        return ShallowEq((DisplayExpression)expr1, (DisplayExpression)expr2);
-      } else if (expr1 is IdentifierExpr && expr2 is IdentifierExpr) {
-        return ShallowEq((IdentifierExpr)expr1, (IdentifierExpr)expr2);
-      } else if (expr1 is ThisExpr && expr2 is ThisExpr) {
-        return ShallowEq((ThisExpr)expr1, (ThisExpr)expr2);
-      } else if (expr1 is DatatypeValue && expr2 is DatatypeValue) {
-        return ShallowEq((DatatypeValue)expr1, (DatatypeValue)expr2);
-      } else if (expr1 is LiteralExpr && expr2 is LiteralExpr) {
-        return ShallowEq((LiteralExpr)expr1, (LiteralExpr)expr2);
-      } else {
-        // If this assertion fail, then a new abstract AST node was probably introduced but not registered here.
-        Contract.Assert(expr1.GetType() != expr2.GetType());
-        return false;
-      }
-    }
-
-    private static bool ShallowEq(UnboxingCastExpr expr1, UnboxingCastExpr expr2) {
-      Contract.Requires(false);
-      throw new InvalidOperationException();
-    }
-
-    private static bool ShallowEq(BoxingCastExpr expr1, BoxingCastExpr expr2) {
-      return expr1.FromType == expr2.FromType &&
-             expr1.ToType == expr2.ToType;
-    }
-
-    private static bool ShallowEq(MatchExpr expr1, MatchExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(ITEExpr expr1, ITEExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(StmtExpr expr1, StmtExpr expr2) {
-#if THROW_UNSUPPORTED_COMPARISONS
-      Contract.Assume(false); // This kind of expression never appears in a trigger
-      throw new NotImplementedException();
-#else
-      return expr1.S == expr2.S;
-#endif
-    }
-
-    private static bool ShallowEq(WildcardExpr expr1, WildcardExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(LambdaExpr expr1, LambdaExpr expr2) {
-#if THROW_UNSUPPORTED_COMPARISONS
-      Contract.Assume(false); // This kind of expression never appears in a trigger
-      throw new NotImplementedException();
-#else
-      return expr1.OneShot == expr2.OneShot &&
-             SameLists(expr1.Reads, expr2.Reads, SameFrameExpression);
-#endif
-    }
-
-    private static bool ShallowEq(MapComprehension expr1, MapComprehension expr2) {
-      return expr1.Finite == expr2.Finite;
-    }
-
-    private static bool ShallowEq(SetComprehension expr1, SetComprehension expr2) {
-      return expr1.TermIsImplicit == expr2.TermIsImplicit && //TODO
-             expr1.Finite == expr2.Finite;
-    }
-
-    private static bool ShallowEq(ExistsExpr expr1, ExistsExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(ForallExpr expr1, ForallExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(QuantifierExpr expr1, QuantifierExpr expr2) { //FIXME are these TypeArgs still useful?
-      if (expr1.TypeArgs.Count != expr2.TypeArgs.Count ||
-          !SameNullity(expr1.Range, expr2.Range)) {
-        return false;
-      }
-
-      if (expr1 is ExistsExpr && expr2 is ExistsExpr) {
-        return ShallowEq((ExistsExpr)expr1, (ExistsExpr)expr2);
-      } else if (expr1 is ForallExpr && expr2 is ForallExpr) {
-        return ShallowEq((ForallExpr)expr1, (ForallExpr)expr2);
-      } else {
-        return false;
-      }
-    }
-
-    private static bool ShallowEq(ComprehensionExpr expr1, ComprehensionExpr expr2) {
-      if (!SameLists(expr1.BoundVars, expr2.BoundVars, SameBoundVar) ||
-          !ShallowSameAttributes(expr1.Attributes, expr2.Attributes) ||
-          // Filled in during resolution: !SameLists(expr1.Bounds, expr2.Bounds, ReferenceCompare) ||
-          //                              !SameLists(expr1.MissingBounds, expr2.MissingBounds, SameBoundVar) ||
-          !SameNullity(expr1.Range, expr2.Range)) { //TODO Check
-        return false;
-      }
-
-      if (expr1 is LambdaExpr && expr2 is LambdaExpr) {
-        return ShallowEq((LambdaExpr)expr1, (LambdaExpr)expr2);
-      } else if (expr1 is MapComprehension && expr2 is MapComprehension) {
-        return ShallowEq((MapComprehension)expr1, (MapComprehension)expr2);
-      } else if (expr1 is SetComprehension && expr2 is SetComprehension) {
-        return ShallowEq((SetComprehension)expr1, (SetComprehension)expr2);
-      } else if (expr1 is QuantifierExpr && expr2 is QuantifierExpr) {
-        return ShallowEq((QuantifierExpr)expr1, (QuantifierExpr)expr2);
-      } else {
-        return false; // ComprehensionExpr is abstract
-      }
-    }
-
-    private static bool ShallowEq(NamedExpr expr1, NamedExpr expr2) {
-      return expr1.Name == expr2.Name &&
-             SameNullity(expr1.Contract, expr2.Contract);
-    }
-
-    private static bool ShallowEq(LetExpr expr1, LetExpr expr2) {
-      return expr1.Exact == expr2.Exact &&
-             ShallowSameAttributes(expr1.Attributes, expr2.Attributes);
-    }
-
-    private static bool ShallowEq(TernaryExpr expr1, TernaryExpr expr2) {
-      return expr1.Op == expr2.Op;
-    }
-
-    private static bool ShallowEq(BinaryExpr expr1, BinaryExpr expr2) {
-      Contract.Requires(expr1.ResolvedOp != BinaryExpr.ResolvedOpcode.YetUndetermined);
-      Contract.Requires(expr2.ResolvedOp != BinaryExpr.ResolvedOpcode.YetUndetermined);
-      return expr1.ResolvedOp == expr2.ResolvedOp;
-    }
-
-    private static bool ShallowEq(ConversionExpr expr1, ConversionExpr expr2) {
-      return expr1.Type == expr2.Type; //TODO equality on types?
-    }
-
-    private static bool ShallowEq(UnaryOpExpr expr1, UnaryOpExpr expr2) {
-      return expr1.Op == expr2.Op;
-    }
-
-    private static bool ShallowEq(UnaryExpr expr1, UnaryExpr expr2) {
-      if (expr1 is ConversionExpr && expr2 is ConversionExpr) {
-        return ShallowEq((ConversionExpr)expr1, (ConversionExpr)expr2);
-      } else if (expr1 is UnaryOpExpr && expr2 is UnaryOpExpr) {
-        return ShallowEq((UnaryOpExpr)expr1, (UnaryOpExpr)expr2);
-      } else {
-        return false; // UnaryExpr is abstract
-      }
-    }
-
-    private static bool ShallowEq(MultiSetFormingExpr expr1, MultiSetFormingExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(OldExpr expr1, OldExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(FunctionCallExpr expr1, FunctionCallExpr expr2) {
-      return expr1.Name == expr2.Name &&
-             expr1.CoCall == expr2.CoCall && //TODO
-             expr1.Function == expr2.Function; // TODO TypeArgumentSubstitutions?
-    }
-
-    private static bool ShallowEq(ApplyExpr expr1, ApplyExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(SeqUpdateExpr expr1, SeqUpdateExpr expr2) {
-      Contract.Requires(expr1.ResolvedUpdateExpr != null && expr2.ResolvedUpdateExpr != null);
-      return true;
-    }
-
-    private static bool ShallowEq(MultiSelectExpr expr1, MultiSelectExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(SeqSelectExpr expr1, SeqSelectExpr expr2) {
-      return expr1.SelectOne == expr2.SelectOne &&
-             SameNullity(expr1.Seq, expr2.Seq) &&
-             SameNullity(expr1.E0, expr2.E0) &&
-             SameNullity(expr1.E1, expr2.E1);
-    }
-
-    private static bool ShallowEq(MemberSelectExpr expr1, MemberSelectExpr expr2) {
-      return expr1.MemberName == expr2.MemberName &&
-             expr1.Member == expr2.Member &&
-             SameLists(expr1.TypeApplication, expr2.TypeApplication, Type.Equals);
-    }
-
-    private static bool ShallowEq(SeqDisplayExpr expr1, SeqDisplayExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(MapDisplayExpr expr1, MapDisplayExpr expr2) {
-      return expr1.Finite == expr2.Finite;
-    }
-
-    private static bool ShallowEq(MultiSetDisplayExpr expr1, MultiSetDisplayExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(SetDisplayExpr expr1, SetDisplayExpr expr2) {
-      return expr1.Finite == expr2.Finite;
-    }
-
-    private static bool ShallowEq(DisplayExpression expr1, DisplayExpression expr2) {
-      if (expr1 is SeqDisplayExpr && expr2 is SeqDisplayExpr) {
-        return ShallowEq((SeqDisplayExpr)expr1, (SeqDisplayExpr)expr2);
-      } else if (expr1 is MultiSetDisplayExpr && expr2 is MultiSetDisplayExpr) {
-        return ShallowEq((MultiSetDisplayExpr)expr1, (MultiSetDisplayExpr)expr2);
-      } else if (expr1 is SetDisplayExpr && expr2 is SetDisplayExpr) {
-        return ShallowEq((SetDisplayExpr)expr1, (SetDisplayExpr)expr2);
-      } else {
-        return false;
-      }
-    }
-
-    private static bool ShallowEq(AutoGhostIdentifierExpr expr1, AutoGhostIdentifierExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(IdentifierExpr expr1, IdentifierExpr expr2) {
-      if (expr1.Name != expr2.Name ||
-          expr1.Var != expr2.Var) {
-            return false;
-      }
-
-      if (expr1 is AutoGhostIdentifierExpr && expr2 is AutoGhostIdentifierExpr) {
-        return ShallowEq((AutoGhostIdentifierExpr)expr1, (AutoGhostIdentifierExpr)expr2);
-      } else {
-        return true;
-      }
-    }
-
-    private static bool ShallowEq(ImplicitThisExpr expr1, ImplicitThisExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(ThisExpr expr1, ThisExpr expr2) {
-      if (expr1 is ImplicitThisExpr && expr2 is ImplicitThisExpr) {
-        return ShallowEq((ImplicitThisExpr)expr1, (ImplicitThisExpr)expr2);
-      } else {
-        return (expr1.GetType() == expr2.GetType()); // LiteralExpr is not abstract
-      }
-    }
-
-    private static bool ShallowEq(DatatypeValue expr1, DatatypeValue expr2) {
-      return // Implied by Ctor equality: expr1.DatatypeName == expr2.DatatypeName &&
-             // Implied by Ctor equality: expr1.MemberName == expr2.MemberName &&
-             expr1.Ctor == expr2.Ctor &&
-             // Contextual information: expr1.IsCoCall == expr2.IsCoCall &&
-             SameLists(expr1.InferredTypeArgs, expr2.InferredTypeArgs, Type.Equals);
-    }
-
-    private static bool ShallowEq(StringLiteralExpr expr1, StringLiteralExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(CharLiteralExpr expr1, CharLiteralExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(StaticReceiverExpr expr1, StaticReceiverExpr expr2) {
-      return true;
-    }
-
-    private static bool ShallowEq(LiteralExpr expr1, LiteralExpr expr2) {
-      if (expr1.Value != expr2.Value) {
-        return false;
-      }
-
-      if (expr1 is StringLiteralExpr && expr2 is StringLiteralExpr) {
-        return ShallowEq((StringLiteralExpr)expr1, (StringLiteralExpr)expr2);
-      } else if (expr1 is CharLiteralExpr && expr2 is CharLiteralExpr) {
-        return ShallowEq((CharLiteralExpr)expr1, (CharLiteralExpr)expr2);
-      } else if (expr1 is StaticReceiverExpr && expr2 is StaticReceiverExpr) {
-        return ShallowEq((StaticReceiverExpr)expr1, (StaticReceiverExpr)expr2);
-      } else {
-        return (expr1.GetType() == expr2.GetType()); // LiteralExpr is not abstract
-      }
-    }
-  }
-}
diff --git a/Source/Dafny/Triggers/QuantifierSplitter.cs b/Source/Dafny/Triggers/QuantifierSplitter.cs
new file mode 100644
index 00000000..e83feebb
--- /dev/null
+++ b/Source/Dafny/Triggers/QuantifierSplitter.cs
@@ -0,0 +1,66 @@
+using Microsoft.Boogie;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+
+namespace Microsoft.Dafny.Triggers {
+  class QuantifierSplitter : BottomUpVisitor {
+    internal enum Quantifier { Forall, Exists }
+
+    internal static IEnumerable<Expression> BreakQuantifier(Expression expr, Quantifier quantifier) {
+      expr = expr.Resolved;
+      var binary = expr as BinaryExpr;
+
+      if (binary == null) {
+        yield return expr;
+        yield break;
+      }
+
+      var e0 = binary.E0;
+      var e1 = binary.E1;
+
+      if ((quantifier == Quantifier.Forall && binary.Op == BinaryExpr.Opcode.And) ||
+          (quantifier == Quantifier.Exists && binary.Op == BinaryExpr.Opcode.Or)) {
+        foreach (var e in BreakQuantifier(e0, quantifier)) { yield return e; }
+        foreach (var e in BreakQuantifier(e1, quantifier)) { yield return e; }
+      } else if (binary.Op == BinaryExpr.Opcode.Imp) {
+        if (quantifier == Quantifier.Forall) {
+          foreach (var e in BreakImplication(e0, e1, quantifier, expr.tok)) { yield return e; }
+        } else {
+          yield return new UnaryOpExpr(e1.tok, UnaryOpExpr.Opcode.Not, e1); // FIXME should be broken further
+          foreach (var e in BreakQuantifier(e1, quantifier)) { yield return e; }
+        }
+      } else {
+        yield return expr;
+      }
+    }
+
+    internal static IEnumerable<Expression> BreakImplication(Expression ante, Expression post, Quantifier quantifier, IToken tok) { // FIXME: should work for exists and &&
+      foreach (var small_post in BreakQuantifier(post, quantifier)) {
+        var bin_post = small_post as BinaryExpr;
+        if (bin_post == null || bin_post.Op != BinaryExpr.Opcode.Imp) {
+          yield return new BinaryExpr(tok, BinaryExpr.Opcode.Imp, ante, small_post);
+        } else { // bin_post is an implication
+          var large_ante = new BinaryExpr(ante.tok, BinaryExpr.Opcode.And, ante, bin_post.E0);
+          foreach (var imp in BreakImplication(large_ante, bin_post.E1, quantifier, tok)) {
+            yield return imp;
+          }
+        }
+      }
+    }
+    
+    protected override void VisitOneExpr(Expression expr) { //FIXME: This doesn't save the rewritten quantifier
+      var forall = expr as ForallExpr;
+      var exists = expr as ExistsExpr;
+
+      if (forall != null && TriggerUtils.NeedsAutoTriggers(forall)) {
+        var rew = BreakQuantifier(forall.LogicalBody(), Quantifier.Forall);
+        //Console.WriteLine("!!! {0} => {1}", Printer.ExprToString(expr), rew.MapConcat(Printer.ExprToString, " ||| "));
+      } else if (exists != null && TriggerUtils.NeedsAutoTriggers(exists)) {
+        var rew = BreakQuantifier(exists.LogicalBody(), Quantifier.Exists);
+        //Console.WriteLine("!!! {0} => {1}", Printer.ExprToString(expr), rew.MapConcat(Printer.ExprToString, " ||| "));
+      }
+    }
+  }
+}
diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
new file mode 100644
index 00000000..3cbe3bd9
--- /dev/null
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -0,0 +1,104 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+
+//FIXME Generated triggers should be _triggers
+//FIXME: When scoring, do not consider old(x) to be higher than x.
+
+namespace Microsoft.Dafny.Triggers {
+  class QuantifierWithTriggers {
+    internal QuantifierExpr quantifier;
+    internal List<MultiTriggerCandidate> triggers;
+
+    internal QuantifierWithTriggers(QuantifierExpr quantifier) {
+      this.quantifier = quantifier;
+      this.triggers = null;
+    }
+
+    internal void TrimInvalidTriggers() {
+      triggers = triggers.Where(tr => tr.MentionsAll(quantifier.BoundVars)).ToList();
+    }
+
+    public bool QuantifierAlreadyHadTriggers { get { return !TriggerUtils.NeedsAutoTriggers(quantifier); } }
+  }
+
+  class QuantifiersCollection {
+    readonly ErrorReporter reporter;
+    readonly List<QuantifierWithTriggers> quantifiers;
+   
+    internal QuantifiersCollection(IEnumerable<QuantifierExpr> quantifiers, ErrorReporter reporter) {
+      this.reporter = reporter;
+      this.quantifiers = quantifiers.Select(q => new QuantifierWithTriggers(q)).ToList();
+    }
+
+    void ComputeTriggers() {
+      CollectAndShareTriggers();
+      TrimInvalidTriggers();
+      BuildDependenciesGraph();
+      SuppressMatchingLoops();
+      SelectTriggers();
+    }
+
+    void CollectAndShareTriggers() {
+      var pool = quantifiers.SelectMany(q => TriggersCollector.CollectTriggers(q.quantifier));
+      var distinctPool = pool.Deduplicate((x, y) => ExprExtensions.ExpressionEq(x.Expr, y.Expr));
+      var multiPool = TriggerUtils.AllNonEmptySubsets(distinctPool).Select(candidates => new MultiTriggerCandidate(candidates)).ToList();
+
+      foreach (var q in quantifiers) {
+        if (q.QuantifierAlreadyHadTriggers) {
+          reporter.Info(MessageSource.Resolver, q.quantifier.tok, "Not generating triggers for this quantifier."); //FIXME: no_trigger is passed down to Boogie
+          return;
+        } else {
+          q.triggers = multiPool;
+        }
+      }
+    }
+
+    private void TrimInvalidTriggers() {
+      foreach (var q in quantifiers) {
+        q.TrimInvalidTriggers();
+      }
+    }
+
+    void BuildDependenciesGraph() {
+      //FIXME
+    }
+
+    void SuppressMatchingLoops() {
+      //FIXME
+    }
+
+    void SelectTriggers() {
+      //FIXME
+    }
+
+    private void CommitOne(QuantifierWithTriggers q) {
+      foreach (var multiCandidate in q.triggers) { //TODO: error message for when no triggers found
+        q.quantifier.Attributes = new Attributes("trigger", multiCandidate.terms.Select(t => t.Expr).ToList(), q.quantifier.Attributes);
+      }
+
+
+      //TriggerUtils.DebugTriggers("  Final results:\n{0}", PickMultiTriggers(quantifier));
+
+      //var multi_candidates = PickMultiTriggers(quantifier);
+
+      //if (multi_candidates.RejectedMultiCandidates.Any()) {
+      //  var tooltip = TriggerUtils.JoinStringsWithHeader("Rejected: ", multi_candidates.RejectedMultiCandidates.Where(candidate => candidate.Tags != null)
+      //    .Select(candidate => candidate.AsDafnyAttributeString(true, true)));
+      //  reporter.Info(ErrorSource.Resolver, quantifier.tok, tooltip, quantifier.tok.val.Length);
+      //}
+
+      //if (multi_candidates.FinalMultiCandidates.Any()) {
+      //  var tooltip = JoinStringsWithHeader("Triggers: ", multi_candidates.FinalMultiCandidates.Select(multi_candidate => multi_candidate.AsDafnyAttributeString()));
+      //  reporter.Info(ErrorSource.Resolver, quantifier.tok, tooltip, quantifier.tok.val.Length);
+      //}
+
+      //string warning = multi_candidates.Warning();
+      //if (warning != null) {
+      //  // FIXME reenable Resolver.Warning(quantifier.tok, warning);
+      //}
+    }
+
+  }
+}
diff --git a/Source/Dafny/Triggers/TriggerExtensions.cs b/Source/Dafny/Triggers/TriggerExtensions.cs
new file mode 100644
index 00000000..7bebe1ac
--- /dev/null
+++ b/Source/Dafny/Triggers/TriggerExtensions.cs
@@ -0,0 +1,489 @@
+#define THROW_UNSUPPORTED_COMPARISONS
+
+using Microsoft.Dafny;
+using System;
+using System.Collections.Generic;
+using System.Diagnostics.Contracts;
+using System.Linq;
+using System.Text;
+
+namespace Microsoft.Dafny.Triggers {
+  internal static class DeduplicateExtension {
+    public static List<T> Deduplicate<T>(this IEnumerable<T> seq, Func<T, T, bool> eq) {
+      List<T> deduplicated = new List<T>();
+
+      foreach (var elem in seq) {
+        if (!deduplicated.Any(other => eq(elem, other))) {
+          deduplicated.Add(elem);
+        }
+      }
+
+      return deduplicated;
+    }
+  }
+
+  internal static class ExprExtensions {
+    internal static IEnumerable<Expression> AllSubExpressions(this Expression expr, bool strict = false) {
+      foreach (var subexpr in expr.SubExpressions) {
+        foreach (var r_subexpr in AllSubExpressions(subexpr, false)) {
+          yield return r_subexpr;
+        }
+        yield return subexpr;
+      }
+
+      if (expr is StmtExpr) {
+        foreach (var r_subexpr in AllSubExpressions(((StmtExpr)expr).S, false)) {
+          yield return r_subexpr;
+        }
+      }
+
+      if (!strict) {
+        yield return expr;
+      }
+    }
+
+    internal static IEnumerable<Expression> AllSubExpressions(this Statement stmt, bool strict = false) {
+      foreach (var subexpr in stmt.SubExpressions) {
+        foreach (var r_subexpr in AllSubExpressions(subexpr, false)) {
+          yield return r_subexpr;
+        }
+        yield return subexpr;
+      }
+
+      foreach (var substmt in stmt.SubStatements) {
+        foreach (var r_subexpr in AllSubExpressions(substmt, false)) {
+          yield return r_subexpr;
+        }
+      }
+    }
+
+    internal static bool ExpressionEq(this Expression expr1, Expression expr2) {
+      expr1 = expr1.Resolved;
+      expr2 = expr2.Resolved;
+
+      return ShallowEq_Top(expr1, expr2) && TriggerUtils.SameLists(expr1.SubExpressions, expr2.SubExpressions, (e1, e2) => ExpressionEq(e1, e2));
+    }
+
+    internal static bool ExpressionEqModuloVariableNames(this Expression expr1, Expression expr2) {
+      expr1 = expr1.Resolved;
+      expr2 = expr2.Resolved;
+
+      if (expr1 is IdentifierExpr) {
+        return expr2 is IdentifierExpr;
+      }
+
+      return ShallowEq_Top(expr1, expr2) && TriggerUtils.SameLists(expr1.SubExpressions, expr2.SubExpressions, (e1, e2) => ExpressionEqModuloVariableNames(e1, e2));
+    }
+
+    private static bool MatchesTrigger(this Expression expr, Expression trigger, ISet<BoundVar> holes, Dictionary<IVariable, Expression> bindings) {
+      expr = expr.Resolved;
+      trigger = trigger.Resolved;
+
+      if (trigger is IdentifierExpr) {
+        var var = ((IdentifierExpr)trigger).Var;
+
+        if (holes.Contains(var)) {
+          Expression existing_binding = null;
+          if (bindings.TryGetValue(var, out existing_binding)) {
+            return ExpressionEq(expr, existing_binding);
+          } else {
+            bindings[var] = expr;
+            return true;
+          }
+        }
+      }
+
+      return ShallowEq_Top(expr, trigger) && TriggerUtils.SameLists(expr.SubExpressions, trigger.SubExpressions, (e1, e2) => MatchesTrigger(e1, e2, holes, bindings));
+    }
+
+    internal struct TriggerMatch {
+      internal Expression Expr;
+      internal Dictionary<IVariable, Expression> Bindings;
+
+      internal bool CouldCauseLoops(IEnumerable<TriggerCandidate> candidates) {
+        // A match for a trigger in the body of a quantifier can be a problem if 
+        // it yields to a matching loop: for example, f(x) is a bad trigger in 
+        //   forall x, y :: f(x) = f(f(x))
+        // In general, any such match can lead to a loop, but two special cases 
+        // will only lead to a finite number of instantiations:
+        // 1. The match equals one of the triggers in the set of triggers under
+        //    consideration. For example, { f(x) } a bad trigger above, but the
+        //    pair { f(x), f(f(x)) } is fine (instantiating won't yield new 
+        //    matches)
+        // 2. The match only differs from one of these triggers by variable 
+        //    names. This is a superset of the previous case.
+        var expr = Expr;
+        return !candidates.Any(c => c.Expr.ExpressionEqModuloVariableNames(expr));
+      }
+    }
+
+    private static TriggerMatch? MatchAgainst(this Expression expr, Expression trigger, ISet<BoundVar> holes) {
+      var bindings = new Dictionary<IVariable, Expression>();
+      return expr.MatchesTrigger(trigger, holes, bindings) ? new TriggerMatch { Expr = expr, Bindings = bindings } : (TriggerMatch?)null;
+    }
+
+    internal static IEnumerable<TriggerMatch> SubexpressionsMatchingTrigger(this QuantifierExpr quantifier, Expression trigger) {
+      return quantifier.Term.AllSubExpressions()
+        .Select(e => e.MatchAgainst(trigger, new HashSet<BoundVar>(quantifier.BoundVars)))
+        .Where(e => e.HasValue).Select(e => e.Value);
+    }
+
+    private static bool ShallowSameAttributes(Attributes attributes1, Attributes attributes2) {
+      return TriggerUtils.SameLists(attributes1.AsEnumerable(), attributes2.AsEnumerable(), ShallowSameSingleAttribute);
+    }
+
+    private static bool ShallowSameSingleAttribute(Attributes arg1, Attributes arg2) {
+      return arg1.Name == arg2.Name;
+    }
+
+    private static bool SameBoundVar(IVariable arg1, IVariable arg2) {
+      return arg1 == arg2 ||
+             (arg1.Name == arg2.Name &&
+              arg1.CompileName == arg2.CompileName &&
+              arg1.DisplayName == arg2.DisplayName &&
+              arg1.UniqueName == arg2.UniqueName &&
+              arg1.IsGhost == arg2.IsGhost &&
+              arg1.IsMutable == arg2.IsMutable); //FIXME compare types?
+    }
+
+    /// <summary>
+    /// Compares two abstract syntax expressions, looking only at their direct members. Subexpressions and substatements are not compared.
+    /// </summary>
+    /// <returns></returns>
+    internal static bool ShallowEq_Top(Expression expr1, Expression expr2) {
+      Contract.Requires(expr1 != null);
+      Contract.Requires(expr2 != null);
+
+      // We never compare concrete expressions
+      Contract.Requires(!(expr1 is ConcreteSyntaxExpression));
+      Contract.Requires(!(expr2 is ConcreteSyntaxExpression));
+
+      // CPC: Hey future editor: the following block of code is auto-generated. Just add your own cases at the end.
+      //      This could be a visitor pattern, except I need to visit a pair of nodes. 
+      //      It could also be implemented in each individual class. I'd have a slight preference for that.
+      //      This really just wants to use double dispatch.
+      if (expr1 is UnboxingCastExpr && expr2 is UnboxingCastExpr) {
+        return ShallowEq((UnboxingCastExpr)expr1, (UnboxingCastExpr)expr2);
+      } else if (expr1 is BoxingCastExpr && expr2 is BoxingCastExpr) {
+        return ShallowEq((BoxingCastExpr)expr1, (BoxingCastExpr)expr2);
+      } else if (expr1 is MatchExpr && expr2 is MatchExpr) {
+        return ShallowEq((MatchExpr)expr1, (MatchExpr)expr2);
+      } else if (expr1 is ITEExpr && expr2 is ITEExpr) {
+        return ShallowEq((ITEExpr)expr1, (ITEExpr)expr2);
+      } else if (expr1 is StmtExpr && expr2 is StmtExpr) {
+        return ShallowEq((StmtExpr)expr1, (StmtExpr)expr2);
+      } else if (expr1 is WildcardExpr && expr2 is WildcardExpr) {
+        return ShallowEq((WildcardExpr)expr1, (WildcardExpr)expr2);
+      } else if (expr1 is ComprehensionExpr && expr2 is ComprehensionExpr) {
+        return ShallowEq((ComprehensionExpr)expr1, (ComprehensionExpr)expr2);
+      } else if (expr1 is NamedExpr && expr2 is NamedExpr) {
+        return ShallowEq((NamedExpr)expr1, (NamedExpr)expr2);
+      } else if (expr1 is LetExpr && expr2 is LetExpr) {
+        return ShallowEq((LetExpr)expr1, (LetExpr)expr2);
+      } else if (expr1 is TernaryExpr && expr2 is TernaryExpr) {
+        return ShallowEq((TernaryExpr)expr1, (TernaryExpr)expr2);
+      } else if (expr1 is BinaryExpr && expr2 is BinaryExpr) {
+        return ShallowEq((BinaryExpr)expr1, (BinaryExpr)expr2);
+      } else if (expr1 is UnaryExpr && expr2 is UnaryExpr) {
+        return ShallowEq((UnaryExpr)expr1, (UnaryExpr)expr2);
+      } else if (expr1 is MultiSetFormingExpr && expr2 is MultiSetFormingExpr) {
+        return ShallowEq((MultiSetFormingExpr)expr1, (MultiSetFormingExpr)expr2);
+      } else if (expr1 is OldExpr && expr2 is OldExpr) {
+        return ShallowEq((OldExpr)expr1, (OldExpr)expr2);
+      } else if (expr1 is FunctionCallExpr && expr2 is FunctionCallExpr) {
+        return ShallowEq((FunctionCallExpr)expr1, (FunctionCallExpr)expr2);
+      } else if (expr1 is ApplyExpr && expr2 is ApplyExpr) {
+        return ShallowEq((ApplyExpr)expr1, (ApplyExpr)expr2);
+      } else if (expr1 is SeqUpdateExpr && expr2 is SeqUpdateExpr) {
+        return ShallowEq((SeqUpdateExpr)expr1, (SeqUpdateExpr)expr2);
+      } else if (expr1 is MultiSelectExpr && expr2 is MultiSelectExpr) {
+        return ShallowEq((MultiSelectExpr)expr1, (MultiSelectExpr)expr2);
+      } else if (expr1 is SeqSelectExpr && expr2 is SeqSelectExpr) {
+        return ShallowEq((SeqSelectExpr)expr1, (SeqSelectExpr)expr2);
+      } else if (expr1 is MemberSelectExpr && expr2 is MemberSelectExpr) {
+        return ShallowEq((MemberSelectExpr)expr1, (MemberSelectExpr)expr2);
+      } else if (expr1 is MapDisplayExpr && expr2 is MapDisplayExpr) { //Note: MapDisplayExpr is not a DisplayExpression
+        return ShallowEq((MapDisplayExpr)expr1, (MapDisplayExpr)expr2);
+      } else if (expr1 is DisplayExpression && expr2 is DisplayExpression) {
+        return ShallowEq((DisplayExpression)expr1, (DisplayExpression)expr2);
+      } else if (expr1 is IdentifierExpr && expr2 is IdentifierExpr) {
+        return ShallowEq((IdentifierExpr)expr1, (IdentifierExpr)expr2);
+      } else if (expr1 is ThisExpr && expr2 is ThisExpr) {
+        return ShallowEq((ThisExpr)expr1, (ThisExpr)expr2);
+      } else if (expr1 is DatatypeValue && expr2 is DatatypeValue) {
+        return ShallowEq((DatatypeValue)expr1, (DatatypeValue)expr2);
+      } else if (expr1 is LiteralExpr && expr2 is LiteralExpr) {
+        return ShallowEq((LiteralExpr)expr1, (LiteralExpr)expr2);
+      } else {
+        // If this assertion fail, then a new abstract AST node was probably introduced but not registered here.
+        Contract.Assert(expr1.GetType() != expr2.GetType());
+        return false;
+      }
+    }
+
+    private static bool ShallowEq(UnboxingCastExpr expr1, UnboxingCastExpr expr2) {
+      Contract.Requires(false);
+      throw new InvalidOperationException();
+    }
+
+    private static bool ShallowEq(BoxingCastExpr expr1, BoxingCastExpr expr2) {
+      return expr1.FromType == expr2.FromType &&
+             expr1.ToType == expr2.ToType;
+    }
+
+    private static bool ShallowEq(MatchExpr expr1, MatchExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(ITEExpr expr1, ITEExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(StmtExpr expr1, StmtExpr expr2) {
+#if THROW_UNSUPPORTED_COMPARISONS
+      Contract.Assume(false); // This kind of expression never appears in a trigger
+      throw new NotImplementedException();
+#else
+      return expr1.S == expr2.S;
+#endif
+    }
+
+    private static bool ShallowEq(WildcardExpr expr1, WildcardExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(LambdaExpr expr1, LambdaExpr expr2) {
+#if THROW_UNSUPPORTED_COMPARISONS
+      Contract.Assume(false); // This kind of expression never appears in a trigger
+      throw new NotImplementedException();
+#else
+      return false;
+#endif
+    }
+
+    private static bool ShallowEq(MapComprehension expr1, MapComprehension expr2) {
+      return expr1.Finite == expr2.Finite;
+    }
+
+    private static bool ShallowEq(SetComprehension expr1, SetComprehension expr2) {
+      return expr1.TermIsImplicit == expr2.TermIsImplicit && //TODO
+             expr1.Finite == expr2.Finite;
+    }
+
+    private static bool ShallowEq(ExistsExpr expr1, ExistsExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(ForallExpr expr1, ForallExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(QuantifierExpr expr1, QuantifierExpr expr2) { //FIXME are these TypeArgs still useful?
+      if (expr1.TypeArgs.Count != expr2.TypeArgs.Count ||
+          !TriggerUtils.SameNullity(expr1.Range, expr2.Range)) {
+        return false;
+      }
+
+      if (expr1 is ExistsExpr && expr2 is ExistsExpr) {
+        return ShallowEq((ExistsExpr)expr1, (ExistsExpr)expr2);
+      } else if (expr1 is ForallExpr && expr2 is ForallExpr) {
+        return ShallowEq((ForallExpr)expr1, (ForallExpr)expr2);
+      } else {
+        return false;
+      }
+    }
+
+    private static bool ShallowEq(ComprehensionExpr expr1, ComprehensionExpr expr2) {
+      if (!TriggerUtils.SameLists(expr1.BoundVars, expr2.BoundVars, SameBoundVar) ||
+          !ShallowSameAttributes(expr1.Attributes, expr2.Attributes) ||
+        // Filled in during resolution: !SameLists(expr1.Bounds, expr2.Bounds, ReferenceCompare) ||
+        //                              !SameLists(expr1.MissingBounds, expr2.MissingBounds, SameBoundVar) ||
+          !TriggerUtils.SameNullity(expr1.Range, expr2.Range)) { //TODO Check
+        return false;
+      }
+
+      if (expr1 is LambdaExpr && expr2 is LambdaExpr) {
+        return ShallowEq((LambdaExpr)expr1, (LambdaExpr)expr2);
+      } else if (expr1 is MapComprehension && expr2 is MapComprehension) {
+        return ShallowEq((MapComprehension)expr1, (MapComprehension)expr2);
+      } else if (expr1 is SetComprehension && expr2 is SetComprehension) {
+        return ShallowEq((SetComprehension)expr1, (SetComprehension)expr2);
+      } else if (expr1 is QuantifierExpr && expr2 is QuantifierExpr) {
+        return ShallowEq((QuantifierExpr)expr1, (QuantifierExpr)expr2);
+      } else {
+        return false; // ComprehensionExpr is abstract
+      }
+    }
+
+    private static bool ShallowEq(NamedExpr expr1, NamedExpr expr2) {
+      return expr1.Name == expr2.Name &&
+             TriggerUtils.SameNullity(expr1.Contract, expr2.Contract);
+    }
+
+    private static bool ShallowEq(LetExpr expr1, LetExpr expr2) {
+      return expr1.Exact == expr2.Exact &&
+             ShallowSameAttributes(expr1.Attributes, expr2.Attributes);
+    }
+
+    private static bool ShallowEq(TernaryExpr expr1, TernaryExpr expr2) {
+      return expr1.Op == expr2.Op;
+    }
+
+    private static bool ShallowEq(BinaryExpr expr1, BinaryExpr expr2) {
+      Contract.Requires(expr1.ResolvedOp != BinaryExpr.ResolvedOpcode.YetUndetermined);
+      Contract.Requires(expr2.ResolvedOp != BinaryExpr.ResolvedOpcode.YetUndetermined);
+      return expr1.ResolvedOp == expr2.ResolvedOp;
+    }
+
+    private static bool ShallowEq(ConversionExpr expr1, ConversionExpr expr2) {
+      return expr1.Type == expr2.Type; //TODO equality on types?
+    }
+
+    private static bool ShallowEq(UnaryOpExpr expr1, UnaryOpExpr expr2) {
+      return expr1.Op == expr2.Op;
+    }
+
+    private static bool ShallowEq(UnaryExpr expr1, UnaryExpr expr2) {
+      if (expr1 is ConversionExpr && expr2 is ConversionExpr) {
+        return ShallowEq((ConversionExpr)expr1, (ConversionExpr)expr2);
+      } else if (expr1 is UnaryOpExpr && expr2 is UnaryOpExpr) {
+        return ShallowEq((UnaryOpExpr)expr1, (UnaryOpExpr)expr2);
+      } else {
+        return false; // UnaryExpr is abstract
+      }
+    }
+
+    private static bool ShallowEq(MultiSetFormingExpr expr1, MultiSetFormingExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(OldExpr expr1, OldExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(FunctionCallExpr expr1, FunctionCallExpr expr2) {
+      return expr1.Name == expr2.Name &&
+             expr1.CoCall == expr2.CoCall && //TODO
+             expr1.Function == expr2.Function; // TODO TypeArgumentSubstitutions?
+    }
+
+    private static bool ShallowEq(ApplyExpr expr1, ApplyExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(SeqUpdateExpr expr1, SeqUpdateExpr expr2) {
+      Contract.Requires(expr1.ResolvedUpdateExpr != null && expr2.ResolvedUpdateExpr != null);
+      return true;
+    }
+
+    private static bool ShallowEq(MultiSelectExpr expr1, MultiSelectExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(SeqSelectExpr expr1, SeqSelectExpr expr2) {
+      return expr1.SelectOne == expr2.SelectOne &&
+             TriggerUtils.SameNullity(expr1.Seq, expr2.Seq) &&
+             TriggerUtils.SameNullity(expr1.E0, expr2.E0) &&
+             TriggerUtils.SameNullity(expr1.E1, expr2.E1);
+    }
+
+    private static bool ShallowEq(MemberSelectExpr expr1, MemberSelectExpr expr2) {
+      return expr1.MemberName == expr2.MemberName &&
+             expr1.Member == expr2.Member &&
+             TriggerUtils.SameLists(expr1.TypeApplication, expr2.TypeApplication, Microsoft.Dafny.Type.Equals);
+    }
+
+    private static bool ShallowEq(SeqDisplayExpr expr1, SeqDisplayExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(MapDisplayExpr expr1, MapDisplayExpr expr2) {
+      return expr1.Finite == expr2.Finite;
+    }
+
+    private static bool ShallowEq(MultiSetDisplayExpr expr1, MultiSetDisplayExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(SetDisplayExpr expr1, SetDisplayExpr expr2) {
+      return expr1.Finite == expr2.Finite;
+    }
+
+    private static bool ShallowEq(DisplayExpression expr1, DisplayExpression expr2) {
+      if (expr1 is SeqDisplayExpr && expr2 is SeqDisplayExpr) {
+        return ShallowEq((SeqDisplayExpr)expr1, (SeqDisplayExpr)expr2);
+      } else if (expr1 is MultiSetDisplayExpr && expr2 is MultiSetDisplayExpr) {
+        return ShallowEq((MultiSetDisplayExpr)expr1, (MultiSetDisplayExpr)expr2);
+      } else if (expr1 is SetDisplayExpr && expr2 is SetDisplayExpr) {
+        return ShallowEq((SetDisplayExpr)expr1, (SetDisplayExpr)expr2);
+      } else {
+        return false;
+      }
+    }
+
+    private static bool ShallowEq(AutoGhostIdentifierExpr expr1, AutoGhostIdentifierExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(IdentifierExpr expr1, IdentifierExpr expr2) {
+      if (expr1.Name != expr2.Name ||
+          expr1.Var != expr2.Var) {
+        return false;
+      }
+
+      if (expr1 is AutoGhostIdentifierExpr && expr2 is AutoGhostIdentifierExpr) {
+        return ShallowEq((AutoGhostIdentifierExpr)expr1, (AutoGhostIdentifierExpr)expr2);
+      } else {
+        return true;
+      }
+    }
+
+    private static bool ShallowEq(ImplicitThisExpr expr1, ImplicitThisExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(ThisExpr expr1, ThisExpr expr2) {
+      if (expr1 is ImplicitThisExpr && expr2 is ImplicitThisExpr) {
+        return ShallowEq((ImplicitThisExpr)expr1, (ImplicitThisExpr)expr2);
+      } else {
+        return (expr1.GetType() == expr2.GetType()); // LiteralExpr is not abstract
+      }
+    }
+
+    private static bool ShallowEq(DatatypeValue expr1, DatatypeValue expr2) {
+      return // Implied by Ctor equality: expr1.DatatypeName == expr2.DatatypeName &&
+        // Implied by Ctor equality: expr1.MemberName == expr2.MemberName &&
+             expr1.Ctor == expr2.Ctor &&
+        // Contextual information: expr1.IsCoCall == expr2.IsCoCall &&
+             TriggerUtils.SameLists(expr1.InferredTypeArgs, expr2.InferredTypeArgs, Microsoft.Dafny.Type.Equals);
+    }
+
+    private static bool ShallowEq(StringLiteralExpr expr1, StringLiteralExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(CharLiteralExpr expr1, CharLiteralExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(StaticReceiverExpr expr1, StaticReceiverExpr expr2) {
+      return true;
+    }
+
+    private static bool ShallowEq(LiteralExpr expr1, LiteralExpr expr2) {
+      if (expr1.Value != expr2.Value) {
+        return false;
+      }
+
+      if (expr1 is StringLiteralExpr && expr2 is StringLiteralExpr) {
+        return ShallowEq((StringLiteralExpr)expr1, (StringLiteralExpr)expr2);
+      } else if (expr1 is CharLiteralExpr && expr2 is CharLiteralExpr) {
+        return ShallowEq((CharLiteralExpr)expr1, (CharLiteralExpr)expr2);
+      } else if (expr1 is StaticReceiverExpr && expr2 is StaticReceiverExpr) {
+        return ShallowEq((StaticReceiverExpr)expr1, (StaticReceiverExpr)expr2);
+      } else {
+        return (expr1.GetType() == expr2.GetType()); // LiteralExpr is not abstract
+      }
+    }
+  }
+}
diff --git a/Source/Dafny/Triggers/TriggerGenerator.cs b/Source/Dafny/Triggers/TriggerGenerator.cs
new file mode 100644
index 00000000..de4b212b
--- /dev/null
+++ b/Source/Dafny/Triggers/TriggerGenerator.cs
@@ -0,0 +1,28 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using Microsoft.Boogie;
+using System.Collections.ObjectModel;
+using System.Diagnostics.Contracts;
+
+namespace Microsoft.Dafny.Triggers { //FIXME rename this file
+  internal class QuantifierCollectionsFinder : TopDownVisitor<object> {
+    readonly ErrorReporter reporter;
+    internal List<QuantifiersCollection> quantifierCollections = new List<QuantifiersCollection>();
+
+    public QuantifierCollectionsFinder(ErrorReporter reporter) {
+      Contract.Requires(reporter != null);
+      this.reporter = reporter;
+    }
+
+    protected override bool VisitOneExpr(Expression expr, ref object st) {
+      var quantifier = expr as QuantifierExpr;
+      if (quantifier != null) {
+        quantifierCollections.Add(new QuantifiersCollection(Enumerable.Repeat(quantifier, 1), reporter));
+      } //FIXME handle the case of groups of quantifiers resulting from a split
+
+      return true;
+    }
+  }
+}
diff --git a/Source/Dafny/Triggers/TriggerUtils.cs b/Source/Dafny/Triggers/TriggerUtils.cs
new file mode 100644
index 00000000..5a118a2f
--- /dev/null
+++ b/Source/Dafny/Triggers/TriggerUtils.cs
@@ -0,0 +1,94 @@
+#define DEBUG_AUTO_TRIGGERS
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Diagnostics.Contracts;
+using System.Linq;
+using System.Text;
+
+namespace Microsoft.Dafny.Triggers {
+  class TriggerUtils {
+    internal static List<T> CopyAndAdd<T>(List<T> seq, T elem) {
+      var copy = new List<T>(seq);
+      copy.Add(elem);
+      return copy;
+    }
+
+    internal static IEnumerable<List<T>> AllSubsets<T>(IList<T> source, int offset) {
+      if (offset >= source.Count) {
+        yield return new List<T>();
+        yield break;
+      }
+
+      foreach (var subset in AllSubsets<T>(source, offset + 1)) {
+        yield return CopyAndAdd(subset, source[offset]);
+        yield return new List<T>(subset);
+      }
+    }
+
+    internal static IEnumerable<List<T>> AllNonEmptySubsets<T>(IEnumerable<T> source) {
+      List<T> all = new List<T>(source);
+      foreach (var subset in AllSubsets(all, 0)) {
+        if (subset.Count > 0) {
+          yield return subset;
+        }
+      }
+    }
+
+    internal static List<T> MergeAlterFirst<T>(List<T> a, List<T> b) {
+      Contract.Requires(a != null);
+      Contract.Requires(b != null);
+      a.AddRange(b);
+      return a;
+    }
+
+    internal static ISet<T> MergeAlterFirst<T>(ISet<T> a, ISet<T> b) {
+      Contract.Requires(a != null);
+      Contract.Requires(b != null);
+      a.UnionWith(b);
+      return a;
+    }
+
+    internal static bool SameLists<T>(IEnumerable<T> list1, IEnumerable<T> list2, Func<T, T, bool> comparer) {
+      if (ReferenceEquals(list1, list2)) {
+        return true;
+      } else if ((list1 == null) != (list2 == null)) {
+        return false;
+      }
+
+      var it1 = list1.GetEnumerator();
+      var it2 = list2.GetEnumerator();
+      bool it1_has, it2_has;
+      bool acc = true;
+
+      do {
+        it1_has = it1.MoveNext();
+        it2_has = it2.MoveNext();
+
+        if (it1_has == true && it2_has == true) {
+          acc = acc && comparer(it1.Current, it2.Current);
+        }
+      } while (it1_has && it2_has);
+
+      return it1_has == it2_has && acc;
+    }
+
+    internal static bool SameNullity<T>(T x1, T x2) where T : class {
+      return (x1 == null) == (x2 == null);
+    }
+
+    internal string JoinStringsWithHeader(string header, IEnumerable<string> lines) {
+      return header + String.Join(Environment.NewLine + new String(' ', header.Length), lines);
+    }
+
+    [Conditional("DEBUG_AUTO_TRIGGERS")]
+    internal static void DebugTriggers(string format, params object[] more) {
+      Console.Error.WriteLine(format, more);
+    }
+
+    internal static bool NeedsAutoTriggers(QuantifierExpr quantifier) {
+      return quantifier.Attributes.AsEnumerable().All(aa => aa.Name != "trigger" && aa.Name != "no_trigger");
+    }
+  }
+}
diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
new file mode 100644
index 00000000..912a661c
--- /dev/null
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -0,0 +1,256 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using Microsoft.Boogie;
+using System.Diagnostics.Contracts;
+using System.Diagnostics;
+
+namespace Microsoft.Dafny.Triggers {
+  struct TriggerCandidate {
+    internal Expression Expr { get; set; }
+    internal ISet<IVariable> Variables { get; set; }
+
+    public override string ToString() {
+      return Printer.ExprToString(Expr);
+    }
+  }
+
+  class MultiTriggerCandidate {
+    internal List<TriggerCandidate> terms { get; set; }
+
+    internal MultiTriggerCandidate(List<TriggerCandidate> candidates) {
+      this.terms = candidates;
+    }
+
+    internal bool MentionsAll(List<BoundVar> vars) {
+      return vars.All(x => terms.Any(candidate => candidate.Variables.Contains(x)));
+    }
+
+    public override string ToString() {
+      return String.Join(", ", terms);
+    }
+
+    public String AsDafnyAttributeString(bool wrap = true, bool includeTags = false) {
+      var repr = terms.MapConcat(t => Printer.ExprToString(t.Expr), ", ");
+      if (wrap) {
+        repr = "{:trigger " + repr + "}";
+      }
+      return repr;
+    }
+  }
+
+  class TriggerAnnotation {
+    internal bool IsTriggerKiller;
+    internal ISet<IVariable> Variables;
+    internal readonly List<TriggerCandidate> PrivateTerms;
+    internal readonly List<TriggerCandidate> ExportedTerms;
+
+    internal TriggerAnnotation(bool IsTriggerKiller, IEnumerable<IVariable> Variables,
+                                IEnumerable<TriggerCandidate> AllCandidates, IEnumerable<TriggerCandidate> PrivateCandidates = null) {
+      this.IsTriggerKiller = IsTriggerKiller;
+      this.Variables = new HashSet<IVariable>(Variables);
+
+      this.PrivateTerms = new List<TriggerCandidate>(PrivateCandidates == null ? Enumerable.Empty<TriggerCandidate>() : PrivateCandidates);
+      this.ExportedTerms = new List<TriggerCandidate>(AllCandidates == null ? Enumerable.Empty<TriggerCandidate>() : AllCandidates.Except(this.PrivateTerms));
+    }
+
+    public override string ToString() {
+      StringBuilder sb = new StringBuilder();
+      string indent = "  {0}", nindent = "\n  - {0}", subindent = "\n    * {0}";
+
+      sb.AppendFormat(indent, IsTriggerKiller);
+
+      sb.AppendFormat(nindent, "Variables:");
+      foreach (var bv in Variables) {
+        sb.AppendFormat(subindent, bv.Name);
+      }
+
+      sb.AppendFormat(nindent, "Exported candidates:");
+      foreach (var candidate in ExportedTerms) {
+        sb.AppendFormat(subindent, candidate);
+      }
+
+      if (PrivateTerms.Any()) {
+        sb.AppendFormat(nindent, "Private candidates:");
+        foreach (var candidate in PrivateTerms) {
+          sb.AppendFormat(subindent, candidate);
+        }
+      }
+
+      return sb.ToString();
+    }
+  }
+
+  public class TriggersCollector {
+    Dictionary<Expression, TriggerAnnotation> cache;
+
+    private static TriggersCollector instance = new TriggersCollector();
+
+    private TriggersCollector() {
+      this.cache = new Dictionary<Expression, TriggerAnnotation>();
+    }
+
+    private T ReduceAnnotatedSubExpressions<T>(Expression expr, T seed, Func<TriggerAnnotation, T> map, Func<T, T, T> reduce) {
+      return expr.SubExpressions.Select(e => map(Annotate(e)))
+                                .Aggregate(seed, (acc, e) => reduce(acc, e));
+    }
+
+    private List<TriggerCandidate> CollectExportedCandidates(Expression expr) {
+      return ReduceAnnotatedSubExpressions<List<TriggerCandidate>>(expr, new List<TriggerCandidate>(), a => a.ExportedTerms, TriggerUtils.MergeAlterFirst);
+    }
+
+    private ISet<IVariable> CollectVariables(Expression expr) {
+      return ReduceAnnotatedSubExpressions(expr, new HashSet<IVariable>(), a => a.Variables, TriggerUtils.MergeAlterFirst);
+    }
+
+    private bool CollectIsKiller(Expression expr) {
+      return ReduceAnnotatedSubExpressions(expr, false, a => a.IsTriggerKiller, (a, b) => a || b);
+    }
+
+    private IEnumerable<TriggerCandidate> OnlyPrivateCandidates(List<TriggerCandidate> candidates, IEnumerable<IVariable> privateVars) {
+      return candidates.Where(c => privateVars.Intersect(c.Variables).Any()); //TODO Check perf
+    }
+
+    private TriggerAnnotation Annotate(Expression expr) {
+      TriggerAnnotation cached;
+      if (cache.TryGetValue(expr, out cached)) {
+        return cached;
+      }
+
+      expr.SubExpressions.Iter(e => Annotate(e));
+
+      TriggerAnnotation annotation; // TODO: Using ApplySuffix fixes the unresolved members problem in GenericSort
+      if (expr is FunctionCallExpr || expr is SeqSelectExpr || expr is MemberSelectExpr || expr is OldExpr ||
+          (expr is UnaryOpExpr && (((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Cardinality)) || // FIXME || ((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Fresh doesn't work, as fresh is a pretty tricky predicate when it's not about datatypes. See translator.cs:10944
+          (expr is BinaryExpr && (((BinaryExpr)expr).Op == BinaryExpr.Opcode.NotIn || ((BinaryExpr)expr).Op == BinaryExpr.Opcode.In))) {
+        annotation = AnnotatePotentialCandidate(expr);
+      } else if (expr is QuantifierExpr) {
+        annotation = AnnotateQuantifier((QuantifierExpr)expr);
+      } else if (expr is LetExpr) {
+        annotation = AnnotateLetExpr((LetExpr)expr);
+      } else if (expr is IdentifierExpr) {
+        annotation = AnnotateIdentifier((IdentifierExpr)expr);
+      } else if (expr is ApplySuffix) {
+        annotation = AnnotateApplySuffix((ApplySuffix)expr);
+      } else if (expr is ConcreteSyntaxExpression ||
+                 expr is LiteralExpr ||
+                 expr is OldExpr ||
+                 expr is ThisExpr ||
+                 expr is BoxingCastExpr ||
+                 expr is DatatypeValue ||
+                 expr is SeqDisplayExpr) { //FIXME what abvout other display expressions?
+        annotation = AnnotateOther(expr, false);
+      } else {
+        annotation = AnnotateOther(expr, true);
+      }
+
+      TriggerUtils.DebugTriggers("{0} ({1})\n{2}", Printer.ExprToString(expr), expr.GetType(), annotation);
+      cache[expr] = annotation;
+      return annotation;
+    }
+
+    private BinaryExpr.ResolvedOpcode RemoveNotInBinaryExprIn(BinaryExpr.ResolvedOpcode opcode) {
+      switch (opcode) {
+        case BinaryExpr.ResolvedOpcode.NotInMap:
+          return BinaryExpr.ResolvedOpcode.InMap;
+        case BinaryExpr.ResolvedOpcode.NotInSet:
+          return BinaryExpr.ResolvedOpcode.InSet;
+        case BinaryExpr.ResolvedOpcode.NotInSeq:
+          return BinaryExpr.ResolvedOpcode.InSeq;
+        case BinaryExpr.ResolvedOpcode.NotInMultiSet:
+          return BinaryExpr.ResolvedOpcode.InMultiSet;
+      }
+
+      Contract.Assert(false);
+      throw new ArgumentException();
+    }
+
+    private Expression CleanupExpr(Expression expr, out bool isKiller) {
+      isKiller = false;
+
+      if (!(expr is BinaryExpr)) {
+        return expr;
+      }
+
+      var bexpr = expr as BinaryExpr;
+
+      BinaryExpr new_expr = bexpr;
+      if (bexpr.Op == BinaryExpr.Opcode.NotIn) {
+        new_expr = new BinaryExpr(bexpr.tok, BinaryExpr.Opcode.In, bexpr.E0, bexpr.E1);
+        new_expr.ResolvedOp = RemoveNotInBinaryExprIn(bexpr.ResolvedOp);
+        new_expr.Type = bexpr.Type;
+      }
+
+      Expression returned_expr = new_expr;
+      if (new_expr.ResolvedOp == BinaryExpr.ResolvedOpcode.InMultiSet) {
+        returned_expr = new SeqSelectExpr(new_expr.tok, true, new_expr.E1, new_expr.E0, null);
+        returned_expr.Type = bexpr.Type;
+        isKiller = true; // [a in s] becomes [s[a] > 0], which is a trigger killer
+      }
+
+      return returned_expr;
+    }
+
+    private TriggerAnnotation AnnotatePotentialCandidate(Expression expr) {
+      bool expr_is_killer = false;
+      var new_expr = CleanupExpr(expr, out expr_is_killer);
+      var new_candidate = new TriggerCandidate { Expr = new_expr, Variables = CollectVariables(expr) };
+
+      List<TriggerCandidate> collected_candidates = CollectExportedCandidates(expr);
+      var children_contain_killers = CollectIsKiller(expr);
+
+      if (!children_contain_killers) {
+        // Add only if the children are not killers; the head has been cleaned up into non-killer form
+        collected_candidates.Add(new_candidate);
+      }
+
+      // This new node is a killer if its children were killers, or if it's non-cleaned-up head is a killer
+      return new TriggerAnnotation(children_contain_killers || expr_is_killer, new_candidate.Variables, collected_candidates);
+    }
+
+    private TriggerAnnotation AnnotateApplySuffix(ApplySuffix expr) {
+      // This is a bit tricky. A funcall node is generally meaningful as a trigger candidate, 
+      // but when it's part of an ApplySuffix the function call itself may not resolve properly
+      // when the second round of resolving is done after modules are duplicated.
+      // Thus first we annotate expr and create a trigger candidate, and then we remove the 
+      // candidate matching its direct subexpression if needed. Note that function calls are not the 
+      // only possible child here; there can be DatatypeValue nodes, for example (see vstte2012/Combinators.dfy).
+      var annotation = AnnotatePotentialCandidate(expr);
+      // Comparing by reference is fine here. Using sets could yield a small speedup
+      annotation.ExportedTerms.RemoveAll(candidate => expr.SubExpressions.Contains(candidate.Expr));
+      return annotation;
+    }
+
+    private TriggerAnnotation AnnotateQuantifierOrLetExpr(Expression expr, IEnumerable<BoundVar> boundVars) {
+      var candidates = CollectExportedCandidates(expr);
+      return new TriggerAnnotation(true, CollectVariables(expr), candidates, OnlyPrivateCandidates(candidates, boundVars));
+    }
+
+    private TriggerAnnotation AnnotateQuantifier(QuantifierExpr expr) {
+      return AnnotateQuantifierOrLetExpr(expr, expr.BoundVars);
+    }
+
+    private TriggerAnnotation AnnotateLetExpr(LetExpr expr) {
+      return AnnotateQuantifierOrLetExpr(expr, expr.BoundVars);
+    }
+
+    private TriggerAnnotation AnnotateIdentifier(IdentifierExpr expr) {
+      return new TriggerAnnotation(false, Enumerable.Repeat(expr.Var, 1), null);
+    }
+
+    private TriggerAnnotation AnnotateOther(Expression expr, bool isTriggerKiller) {
+      return new TriggerAnnotation(isTriggerKiller || CollectIsKiller(expr), CollectVariables(expr), CollectExportedCandidates(expr));
+    }
+
+    // FIXME document that this will contain duplicates
+    internal static List<TriggerCandidate> CollectTriggers(QuantifierExpr quantifier) {
+      // TODO could check for existing triggers and return that instead, but that require a bit of work to extract the expressions
+      return instance.Annotate(quantifier).PrivateTerms;
+    }
+
+    internal static bool IsTriggerKiller(Expression expr) {
+      return instance.Annotate(expr).IsTriggerKiller;
+    }
+  }
+}
diff --git a/Test/dafny0/SeqFromArray.dfy.expect b/Test/dafny0/SeqFromArray.dfy.expect
index af845d3e..5395e298 100644
--- a/Test/dafny0/SeqFromArray.dfy.expect
+++ b/Test/dafny0/SeqFromArray.dfy.expect
@@ -1,3 +1,6 @@
+SeqFromArray.dfy(56,13): Warning: (!) No terms found to trigger on.
+SeqFromArray.dfy(76,17): Warning: (!) No terms found to trigger on.
+SeqFromArray.dfy(82,17): Warning: (!) No terms found to trigger on.
 
 Dafny program verifier finished with 10 verified, 0 errors
 Program compiled successfully
-- 
cgit v1.2.3


From 5d78c0a9a7165e1a646c92c602b5f7d145c4c399 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 14 Aug 2015 10:04:18 -0700
Subject: Run the trigger rewriter after the quantifier splitter

---
 Source/Dafny/Resolver.cs | 1 +
 1 file changed, 1 insertion(+)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index db087109..7bf085f9 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -237,6 +237,7 @@ namespace Microsoft.Dafny
       rewriters.Add(new TimeLimitRewriter(reporter));
 
       if (DafnyOptions.O.AutoTriggers) {
+        rewriters.Add(new QuantifierSplittingRewriter(this.reporter));
         rewriters.Add(new TriggerGeneratingRewriter(this.reporter));
       }
 
-- 
cgit v1.2.3


From 47a2b369096bb316914983c08e473cb3fddc0c25 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 14 Aug 2015 10:04:41 -0700
Subject: Start committing generated triggers when /autoTriggers is 1

---
 Source/Dafny/Rewriter.cs | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 4e274189..0798510a 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -39,15 +39,14 @@ namespace Microsoft.Dafny
   }
 
   public class TriggerGeneratingRewriter : IRewriter {
-    Triggers.QuantifierCollectionsFinder finder;
-
     internal TriggerGeneratingRewriter(ErrorReporter reporter) : base(reporter) {
       Contract.Requires(reporter != null);
-      this.finder = new Triggers.QuantifierCollectionsFinder(reporter);
     }
 
     internal override void PostResolve(ModuleDefinition m) {
-      foreach (var decl in ModuleDefinition.AllCallables(m.TopLevelDecls)) { //CLEMENT
+      var finder = new Triggers.QuantifierCollectionsFinder(reporter);
+
+      foreach (var decl in ModuleDefinition.AllCallables(m.TopLevelDecls)) {
         if (decl is Function) {
           var function = (Function)decl;
           finder.Visit(function.Ens, null);
@@ -64,6 +63,12 @@ namespace Microsoft.Dafny
           }
         }
       }
+      
+      var triggersCollector = new Triggers.TriggersCollector();
+      foreach (var quantifierCollection in finder.quantifierCollections) {
+        quantifierCollection.ComputeTriggers(triggersCollector);
+        quantifierCollection.CommitTriggers();
+      }
     }
   }
 
-- 
cgit v1.2.3


From 22a997192baf246bd86031f319aac154c2ec05cb Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 14 Aug 2015 10:05:37 -0700
Subject: Implement self-loop detection

Implementing loop detection between multiple triggers is much harder, as it
seems to require walking an exponentially sized graph. Self-loop detection is
still a net gain compared to the current situation: we used to not detect loops
in large quantifiers; not we break these apart, suppress the loops where we can
in the smaller parts, and report the ones that we can't suppress. It could be
that the broken-up quantifiers are mutually recursive, but these cases would
have already led to a loop in the past.
---
 Source/Dafny/Translator.cs                     |   4 +-
 Source/Dafny/Triggers/QuantifierSplitter.cs    |  97 +++++++++------
 Source/Dafny/Triggers/QuantifiersCollection.cs | 165 +++++++++++++++++++------
 Source/Dafny/Triggers/TriggerExtensions.cs     |  37 +++---
 Source/Dafny/Triggers/TriggerUtils.cs          |  23 +++-
 Source/Dafny/Triggers/TriggersCollector.cs     | 102 ++++++++-------
 6 files changed, 275 insertions(+), 153 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index b5d89abd..14fca463 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -13107,8 +13107,10 @@ namespace Microsoft.Dafny {
       return f.Formals.Zip(fexp.Args).All(formal_concrete => CanSafelySubstitute(visitor.TriggerVariables, formal_concrete.Item1, formal_concrete.Item2));
     }
 
+    Triggers.TriggersCollector triggersCollector = new Triggers.TriggersCollector();
+
     private bool CanSafelySubstitute(ISet<IVariable> protectedVariables, IVariable variable, Expression substitution) {
-      return !(protectedVariables.Contains(variable) && Dafny.Triggers.TriggersCollector.IsTriggerKiller(substitution));
+      return !(protectedVariables.Contains(variable) && triggersCollector.IsTriggerKiller(substitution));
     }
 
     private class VariablesCollector: BottomUpVisitor {
diff --git a/Source/Dafny/Triggers/QuantifierSplitter.cs b/Source/Dafny/Triggers/QuantifierSplitter.cs
index e83feebb..33be0da2 100644
--- a/Source/Dafny/Triggers/QuantifierSplitter.cs
+++ b/Source/Dafny/Triggers/QuantifierSplitter.cs
@@ -6,59 +6,76 @@ using System.Text;
 
 namespace Microsoft.Dafny.Triggers {
   class QuantifierSplitter : BottomUpVisitor {
-    internal enum Quantifier { Forall, Exists }
+    private static BinaryExpr.Opcode FlipOpcode(BinaryExpr.Opcode opCode) {
+      if (opCode == BinaryExpr.Opcode.And) {
+        return BinaryExpr.Opcode.Or;
+      } else if (opCode == BinaryExpr.Opcode.Or) {
+        return BinaryExpr.Opcode.And;
+      } else {
+        throw new ArgumentException();
+      } 
+    }
+
+    // NOTE: If we wanted to split quantifiers as far as possible, it would be
+    // enough to put the formulas in DNF (for foralls) or CNF (for exists).
+    // Unfortunately, this would cause ill-behaved quantifiers to produce
+    // exponentially many smaller quantifiers.
 
-    internal static IEnumerable<Expression> BreakQuantifier(Expression expr, Quantifier quantifier) {
+    internal static IEnumerable<Expression> SplitExpr(Expression expr, BinaryExpr.Opcode separator) {
       expr = expr.Resolved;
+      var unary = expr as UnaryOpExpr;
       var binary = expr as BinaryExpr;
 
-      if (binary == null) {
-        yield return expr;
-        yield break;
+      if (unary != null && unary.Op == UnaryOpExpr.Opcode.Not) {
+        foreach (var e in SplitExpr(unary.E, FlipOpcode(separator))) { yield return new UnaryOpExpr(unary.tok, UnaryOpExpr.Opcode.Not, e); }
+      } else if (binary != null && binary.Op == separator) {
+        foreach (var e in SplitExpr(binary.E0, separator)) { yield return e; }
+        foreach (var e in SplitExpr(binary.E1, separator)) { yield return e; }
+      } else if (binary != null && binary.Op == BinaryExpr.Opcode.Imp && separator == BinaryExpr.Opcode.Or) {
+        foreach (var e in SplitExpr(new UnaryOpExpr(unary.tok, UnaryOpExpr.Opcode.Not, binary.E0), separator)) { yield return e; }
+        foreach (var e in SplitExpr(binary.E1, separator)) { yield return e; }
       }
+    }
 
-      var e0 = binary.E0;
-      var e1 = binary.E1;
-
-      if ((quantifier == Quantifier.Forall && binary.Op == BinaryExpr.Opcode.And) ||
-          (quantifier == Quantifier.Exists && binary.Op == BinaryExpr.Opcode.Or)) {
-        foreach (var e in BreakQuantifier(e0, quantifier)) { yield return e; }
-        foreach (var e in BreakQuantifier(e1, quantifier)) { yield return e; }
-      } else if (binary.Op == BinaryExpr.Opcode.Imp) {
-        if (quantifier == Quantifier.Forall) {
-          foreach (var e in BreakImplication(e0, e1, quantifier, expr.tok)) { yield return e; }
-        } else {
-          yield return new UnaryOpExpr(e1.tok, UnaryOpExpr.Opcode.Not, e1); // FIXME should be broken further
-          foreach (var e in BreakQuantifier(e1, quantifier)) { yield return e; }
-        }
-      } else {
-        yield return expr;
+    internal static IEnumerable<Expression> SplitAndStich(BinaryExpr pair, BinaryExpr.Opcode separator) {
+      foreach (var e1 in SplitExpr(pair.E1, separator)) { 
+        yield return new BinaryExpr(pair.tok, pair.Op, pair.E0, e1);
       }
     }
 
-    internal static IEnumerable<Expression> BreakImplication(Expression ante, Expression post, Quantifier quantifier, IToken tok) { // FIXME: should work for exists and &&
-      foreach (var small_post in BreakQuantifier(post, quantifier)) {
-        var bin_post = small_post as BinaryExpr;
-        if (bin_post == null || bin_post.Op != BinaryExpr.Opcode.Imp) {
-          yield return new BinaryExpr(tok, BinaryExpr.Opcode.Imp, ante, small_post);
-        } else { // bin_post is an implication
-          var large_ante = new BinaryExpr(ante.tok, BinaryExpr.Opcode.And, ante, bin_post.E0);
-          foreach (var imp in BreakImplication(large_ante, bin_post.E1, quantifier, tok)) {
-            yield return imp;
-          }
+    internal static IEnumerable<Expression> SplitQuantifier(QuantifierExpr quantifier) {
+      var body = quantifier.LogicalBody();
+      var binary = body as BinaryExpr;
+
+      if (quantifier is ForallExpr) {
+        IEnumerable<Expression> stream;
+        if (binary != null && (binary.Op == BinaryExpr.Opcode.Imp || binary.Op == BinaryExpr.Opcode.Or)) {
+          stream = SplitAndStich(binary, BinaryExpr.Opcode.And);
+        } else {
+          stream = SplitExpr(body, BinaryExpr.Opcode.And);
+        }
+        foreach (var e in stream) {
+          yield return new ForallExpr(quantifier.tok, quantifier.BoundVars, quantifier.Range, quantifier.Term, quantifier.Attributes);
+        }
+      } else if (quantifier is ExistsExpr) {
+        IEnumerable<Expression> stream;
+        if (binary != null && binary.Op == BinaryExpr.Opcode.And) {
+          stream = SplitAndStich(binary, BinaryExpr.Opcode.Or);
+        } else {
+          stream = SplitExpr(body, BinaryExpr.Opcode.Or);
         }
+        foreach (var e in stream) {
+          yield return new ExistsExpr(quantifier.tok, quantifier.BoundVars, quantifier.Range, quantifier.Term, quantifier.Attributes);
+        }
+      } else {
+        yield return quantifier;
       }
     }
-    
+        
     protected override void VisitOneExpr(Expression expr) { //FIXME: This doesn't save the rewritten quantifier
-      var forall = expr as ForallExpr;
-      var exists = expr as ExistsExpr;
-
-      if (forall != null && TriggerUtils.NeedsAutoTriggers(forall)) {
-        var rew = BreakQuantifier(forall.LogicalBody(), Quantifier.Forall);
-        //Console.WriteLine("!!! {0} => {1}", Printer.ExprToString(expr), rew.MapConcat(Printer.ExprToString, " ||| "));
-      } else if (exists != null && TriggerUtils.NeedsAutoTriggers(exists)) {
-        var rew = BreakQuantifier(exists.LogicalBody(), Quantifier.Exists);
+      var quantifier = expr as QuantifierExpr;
+      if (quantifier != null) {
+        var rew = SplitQuantifier(quantifier);
         //Console.WriteLine("!!! {0} => {1}", Printer.ExprToString(expr), rew.MapConcat(Printer.ExprToString, " ||| "));
       }
     }
diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index 3cbe3bd9..828e0e18 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -1,7 +1,11 @@
-using System;
+#define QUANTIFIER_WARNINGS
+
+using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Text;
+using Microsoft.Boogie;
+using System.Diagnostics.Contracts;
 
 //FIXME Generated triggers should be _triggers
 //FIXME: When scoring, do not consider old(x) to be higher than x.
@@ -9,18 +13,23 @@ using System.Text;
 namespace Microsoft.Dafny.Triggers {
   class QuantifierWithTriggers {
     internal QuantifierExpr quantifier;
-    internal List<MultiTriggerCandidate> triggers;
+    internal List<TriggerTerm> CandidateTerms;
+    internal List<TriggerCandidate> Candidates;
+    internal List<TriggerCandidate> RejectedCandidates;
+
+    internal bool AllowsLoops { get { return quantifier.Attributes.AsEnumerable().Any(a => a.Name == "loop"); } }
+    internal bool CouldSuppressLoops { get; set; }
 
     internal QuantifierWithTriggers(QuantifierExpr quantifier) {
       this.quantifier = quantifier;
-      this.triggers = null;
+      this.RejectedCandidates = new List<TriggerCandidate>();
     }
 
     internal void TrimInvalidTriggers() {
-      triggers = triggers.Where(tr => tr.MentionsAll(quantifier.BoundVars)).ToList();
+      Contract.Requires(CandidateTerms != null);
+      Contract.Requires(Candidates != null);
+      Candidates = TriggerUtils.Filter(Candidates, tr => tr.MentionsAll(quantifier.BoundVars), tr => { }).ToList();
     }
-
-    public bool QuantifierAlreadyHadTriggers { get { return !TriggerUtils.NeedsAutoTriggers(quantifier); } }
   }
 
   class QuantifiersCollection {
@@ -32,26 +41,32 @@ namespace Microsoft.Dafny.Triggers {
       this.quantifiers = quantifiers.Select(q => new QuantifierWithTriggers(q)).ToList();
     }
 
-    void ComputeTriggers() {
-      CollectAndShareTriggers();
+    internal void ComputeTriggers(TriggersCollector triggersCollector) {
+      CollectAndShareTriggers(triggersCollector);
       TrimInvalidTriggers();
       BuildDependenciesGraph();
       SuppressMatchingLoops();
       SelectTriggers();
     }
+    
+    private bool SubsetGenerationPredicate(List<TriggerTerm> terms, TriggerTerm additionalTerm) {
+      // Simple formulas like [P0(i) && P1(i) && P2(i) && P3(i) && P4(i)] yield very
+      // large numbers of multi-triggers, most of which are useless. This filter
+      // restricts subsets of terms so that we only generate sets of terms where each
+      // element contributes at least one variable. In the example above, we'll only
+      // get 5 triggers.
+      return additionalTerm.Variables.Where(v => !terms.Any(t => t.Variables.Contains(v))).Any();
+    }
 
-    void CollectAndShareTriggers() {
-      var pool = quantifiers.SelectMany(q => TriggersCollector.CollectTriggers(q.quantifier));
-      var distinctPool = pool.Deduplicate((x, y) => ExprExtensions.ExpressionEq(x.Expr, y.Expr));
-      var multiPool = TriggerUtils.AllNonEmptySubsets(distinctPool).Select(candidates => new MultiTriggerCandidate(candidates)).ToList();
+    //FIXME document that this assumes that the quantifiers live in the same context and share the same variables
+    void CollectAndShareTriggers(TriggersCollector triggersCollector) {
+      var pool = quantifiers.SelectMany(q => triggersCollector.CollectTriggers(q.quantifier));
+      var distinctPool = pool.Deduplicate(TriggerTerm.Eq);
+      var multiPool = TriggerUtils.AllNonEmptySubsets(distinctPool, SubsetGenerationPredicate).Select(candidates => new TriggerCandidate(candidates)).ToList();
 
       foreach (var q in quantifiers) {
-        if (q.QuantifierAlreadyHadTriggers) {
-          reporter.Info(MessageSource.Resolver, q.quantifier.tok, "Not generating triggers for this quantifier."); //FIXME: no_trigger is passed down to Boogie
-          return;
-        } else {
-          q.triggers = multiPool;
-        }
+        q.CandidateTerms = distinctPool;
+        q.Candidates = multiPool;
       }
     }
 
@@ -62,43 +77,111 @@ namespace Microsoft.Dafny.Triggers {
     }
 
     void BuildDependenciesGraph() {
-      //FIXME
+      // FIXME: Think more about multi-quantifier dependencies
+      //class QuantifierDependency {
+      //  QuantifierWithTriggers Cause;
+      //  QuantifierWithTriggers Consequence;
+      //  List<TriggerCandidate> Triggers;
+      //  List<Expression> MatchingTerm;
+      //}
     }
 
     void SuppressMatchingLoops() {
-      //FIXME
+      // NOTE: This only looks for self-loops; that is, loops involving a single
+      // quantifier.
+
+      // For a given quantifier q, we introduce a triggering relation between trigger
+      // candidates by writing t1 → t2 if instantiating q from t1 introduces a ground
+      // term that matches t2. Then, we notice that this relation is transitive, since
+      // all triggers yield the same set of terms. This means that any matching loop
+      // t1 → ... → t1 can be reduced to a self-loop t1 → t1. Detecting such
+      // self-loops is then only a matter of finding terms in the body of the
+      // quantifier that match a given trigger.
+
+      // Of course, each trigger that actually appears in the body of the quantifier
+      // yields a trivial self-loop (e.g. P(i) in [∀ i {P(i)} ⋅ P(i)]), so we
+      // ignore this type of loops. In fact, we ignore any term in the body of the
+      // quantifier that matches one of the terms of the trigger (this ensures that
+      // [∀ x {f(x), f(f(x))} ⋅ f(x) = f(f(x))] is not a loop). And we even
+      // ignore terms that almost match a trigger term, modulo a single variable
+      // (this ensures that [∀ x y {a(x, y)} ⋅ a(x, y) == a(y, x)] is not a loop).
+      // This ignoring logic is implemented by the CouldCauseLoops method.
+
+      foreach (var q in quantifiers) {
+        var looping = new List<TriggerCandidate>();
+        var loopingSubterms = q.Candidates.ToDictionary(candidate => candidate, candidate => candidate.LoopingSubterms(q.quantifier).ToList());
+
+        var safe = TriggerUtils.Filter(
+          q.Candidates,
+          c => !loopingSubterms[c].Any(),
+          c => {
+            looping.Add(c);
+            c.Annotation = "loop with " + loopingSubterms[c].MapConcat(t => Printer.ExprToString(t.Expr), ", ");
+          }).ToList();
+
+        q.CouldSuppressLoops = safe.Count > 0;
+
+        if (!q.AllowsLoops && q.CouldSuppressLoops) {
+          q.Candidates = safe;
+          q.RejectedCandidates.AddRange(looping);
+        }
+      }
     }
 
     void SelectTriggers() {
       //FIXME
     }
 
-    private void CommitOne(QuantifierWithTriggers q) {
-      foreach (var multiCandidate in q.triggers) { //TODO: error message for when no triggers found
-        q.quantifier.Attributes = new Attributes("trigger", multiCandidate.terms.Select(t => t.Expr).ToList(), q.quantifier.Attributes);
-      }
-
-
-      //TriggerUtils.DebugTriggers("  Final results:\n{0}", PickMultiTriggers(quantifier));
+    private void CommitOne(QuantifierWithTriggers q, object conjunctId) {
+      var errorLevel = ErrorLevel.Info;
+      var msg = new StringBuilder();
+      var indent = conjunctId != null ? "    " : "  ";
+      var header = conjunctId != null ? String.Format("  For conjunct {0}:{1}", conjunctId, Environment.NewLine) : "";
+
+      if (!TriggerUtils.NeedsAutoTriggers(q.quantifier)) { //FIXME: no_trigger is passed down to Boogie
+        msg.Append(indent).AppendLine("Not generating triggers for this quantifier.");
+      } else {
+        foreach (var candidate in q.Candidates) {
+          q.quantifier.Attributes = new Attributes("trigger", candidate.Terms.Select(t => t.Expr).ToList(), q.quantifier.Attributes);
+        }
 
-      //var multi_candidates = PickMultiTriggers(quantifier);
+        if (q.Candidates.Any()) {
+          msg.Append(indent).AppendLine("Selected triggers:");
+          foreach (var mc in q.Candidates) {
+            msg.Append(indent).Append("  ").AppendLine(mc.ToString());
+          }
+        }
 
-      //if (multi_candidates.RejectedMultiCandidates.Any()) {
-      //  var tooltip = TriggerUtils.JoinStringsWithHeader("Rejected: ", multi_candidates.RejectedMultiCandidates.Where(candidate => candidate.Tags != null)
-      //    .Select(candidate => candidate.AsDafnyAttributeString(true, true)));
-      //  reporter.Info(ErrorSource.Resolver, quantifier.tok, tooltip, quantifier.tok.val.Length);
-      //}
+        if (q.RejectedCandidates.Any()) {
+          msg.Append(indent).AppendLine("Rejected triggers:");
+          foreach (var mc in q.RejectedCandidates) {
+            msg.Append(indent).Append("  ").AppendLine(mc.ToString());
+          }
+        }
 
-      //if (multi_candidates.FinalMultiCandidates.Any()) {
-      //  var tooltip = JoinStringsWithHeader("Triggers: ", multi_candidates.FinalMultiCandidates.Select(multi_candidate => multi_candidate.AsDafnyAttributeString()));
-      //  reporter.Info(ErrorSource.Resolver, quantifier.tok, tooltip, quantifier.tok.val.Length);
-      //}
+#if QUANTIFIER_WARNINGS
+        if (!q.CandidateTerms.Any()) {
+          errorLevel = ErrorLevel.Warning;
+          msg.Append(indent).AppendLine("No terms found to trigger on.");
+        } else if (!q.Candidates.Any()) {
+          errorLevel = ErrorLevel.Warning;
+          msg.Append(indent).AppendLine("No trigger covering all quantified variables found.");
+        } else if (!q.CouldSuppressLoops) {
+          errorLevel = ErrorLevel.Warning;
+          msg.Append(indent).AppendLine("Suppressing loops would leave this quantifier without triggers.");
+        }
+#endif
+      }
 
-      //string warning = multi_candidates.Warning();
-      //if (warning != null) {
-      //  // FIXME reenable Resolver.Warning(quantifier.tok, warning);
-      //}
+      if (msg.Length > 0) {
+        reporter.Message(MessageSource.Rewriter, errorLevel, q.quantifier.tok, header + msg.ToString());
+      }
     }
 
+    internal void CommitTriggers() {
+      foreach (var q in quantifiers) {
+        CommitOne(q, quantifiers.Count > 1 ? q.quantifier : null);
+      }
+    }
   }
 }
diff --git a/Source/Dafny/Triggers/TriggerExtensions.cs b/Source/Dafny/Triggers/TriggerExtensions.cs
index 7bebe1ac..da43abcc 100644
--- a/Source/Dafny/Triggers/TriggerExtensions.cs
+++ b/Source/Dafny/Triggers/TriggerExtensions.cs
@@ -22,6 +22,20 @@ namespace Microsoft.Dafny.Triggers {
     }
   }
 
+  internal struct TriggerMatch {
+    internal Expression Expr;
+    internal Dictionary<IVariable, Expression> Bindings;
+
+    internal static bool Eq(TriggerMatch t1, TriggerMatch t2) {
+      return ExprExtensions.ExpressionEq(t1.Expr, t2.Expr);
+    }
+
+    internal bool CouldCauseLoops(List<TriggerTerm> terms) {
+      var expr = Expr;
+      return !terms.Any(term => term.Expr.ExpressionEqModuloVariableNames(expr));
+    }
+  }
+
   internal static class ExprExtensions {
     internal static IEnumerable<Expression> AllSubExpressions(this Expression expr, bool strict = false) {
       foreach (var subexpr in expr.SubExpressions) {
@@ -75,7 +89,7 @@ namespace Microsoft.Dafny.Triggers {
       return ShallowEq_Top(expr1, expr2) && TriggerUtils.SameLists(expr1.SubExpressions, expr2.SubExpressions, (e1, e2) => ExpressionEqModuloVariableNames(e1, e2));
     }
 
-    private static bool MatchesTrigger(this Expression expr, Expression trigger, ISet<BoundVar> holes, Dictionary<IVariable, Expression> bindings) {
+    internal static bool MatchesTrigger(this Expression expr, Expression trigger, ISet<BoundVar> holes, Dictionary<IVariable, Expression> bindings) {
       expr = expr.Resolved;
       trigger = trigger.Resolved;
 
@@ -96,27 +110,6 @@ namespace Microsoft.Dafny.Triggers {
       return ShallowEq_Top(expr, trigger) && TriggerUtils.SameLists(expr.SubExpressions, trigger.SubExpressions, (e1, e2) => MatchesTrigger(e1, e2, holes, bindings));
     }
 
-    internal struct TriggerMatch {
-      internal Expression Expr;
-      internal Dictionary<IVariable, Expression> Bindings;
-
-      internal bool CouldCauseLoops(IEnumerable<TriggerCandidate> candidates) {
-        // A match for a trigger in the body of a quantifier can be a problem if 
-        // it yields to a matching loop: for example, f(x) is a bad trigger in 
-        //   forall x, y :: f(x) = f(f(x))
-        // In general, any such match can lead to a loop, but two special cases 
-        // will only lead to a finite number of instantiations:
-        // 1. The match equals one of the triggers in the set of triggers under
-        //    consideration. For example, { f(x) } a bad trigger above, but the
-        //    pair { f(x), f(f(x)) } is fine (instantiating won't yield new 
-        //    matches)
-        // 2. The match only differs from one of these triggers by variable 
-        //    names. This is a superset of the previous case.
-        var expr = Expr;
-        return !candidates.Any(c => c.Expr.ExpressionEqModuloVariableNames(expr));
-      }
-    }
-
     private static TriggerMatch? MatchAgainst(this Expression expr, Expression trigger, ISet<BoundVar> holes) {
       var bindings = new Dictionary<IVariable, Expression>();
       return expr.MatchesTrigger(trigger, holes, bindings) ? new TriggerMatch { Expr = expr, Bindings = bindings } : (TriggerMatch?)null;
diff --git a/Source/Dafny/Triggers/TriggerUtils.cs b/Source/Dafny/Triggers/TriggerUtils.cs
index 5a118a2f..dedbcbb1 100644
--- a/Source/Dafny/Triggers/TriggerUtils.cs
+++ b/Source/Dafny/Triggers/TriggerUtils.cs
@@ -15,21 +15,23 @@ namespace Microsoft.Dafny.Triggers {
       return copy;
     }
 
-    internal static IEnumerable<List<T>> AllSubsets<T>(IList<T> source, int offset) {
+    internal static IEnumerable<List<T>> AllSubsets<T>(IList<T> source, Func<List<T>, T, bool> predicate, int offset) {
       if (offset >= source.Count) {
         yield return new List<T>();
         yield break;
       }
 
-      foreach (var subset in AllSubsets<T>(source, offset + 1)) {
-        yield return CopyAndAdd(subset, source[offset]);
+      foreach (var subset in AllSubsets<T>(source, predicate, offset + 1)) {
+        if (predicate(subset, source[offset])) {
+          yield return CopyAndAdd(subset, source[offset]);
+        }
         yield return new List<T>(subset);
       }
     }
 
-    internal static IEnumerable<List<T>> AllNonEmptySubsets<T>(IEnumerable<T> source) {
+    internal static IEnumerable<List<T>> AllNonEmptySubsets<T>(IEnumerable<T> source, Func<List<T>, T, bool> predicate) {
       List<T> all = new List<T>(source);
-      foreach (var subset in AllSubsets(all, 0)) {
+      foreach (var subset in AllSubsets(all, predicate, 0)) {
         if (subset.Count > 0) {
           yield return subset;
         }
@@ -74,6 +76,17 @@ namespace Microsoft.Dafny.Triggers {
       return it1_has == it2_has && acc;
     }
 
+    internal static IEnumerable<T> Filter<T>(IEnumerable<T> elements, Func<T, bool> predicate, Action<T> reject) {
+      var positive = new List<T>();
+      foreach (var c in elements) {
+        if (predicate(c)) {
+          yield return c;
+        } else {
+          reject(c);
+        }
+      }
+    }
+
     internal static bool SameNullity<T>(T x1, T x2) where T : class {
       return (x1 == null) == (x2 == null);
     }
diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index 912a661c..e1f8a013 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -7,52 +7,68 @@ using System.Diagnostics.Contracts;
 using System.Diagnostics;
 
 namespace Microsoft.Dafny.Triggers {
-  struct TriggerCandidate {
+  class TriggerTerm {
     internal Expression Expr { get; set; }
     internal ISet<IVariable> Variables { get; set; }
 
     public override string ToString() {
       return Printer.ExprToString(Expr);
     }
+
+    internal static bool Eq(TriggerTerm t1, TriggerTerm t2) {
+      return ExprExtensions.ExpressionEq(t1.Expr, t2.Expr);
+    }
   }
 
-  class MultiTriggerCandidate {
-    internal List<TriggerCandidate> terms { get; set; }
+  class TriggerCandidate {
+    internal List<TriggerTerm> Terms { get; set; }
+    internal string Annotation { get; set; }
+
+    internal TriggerCandidate(List<TriggerTerm> terms) {
+      this.Terms = terms;
+    }
 
-    internal MultiTriggerCandidate(List<TriggerCandidate> candidates) {
-      this.terms = candidates;
+    public TriggerCandidate(TriggerCandidate mc, string annotation) {
+      this.Terms = mc.Terms;
+      this.Annotation = annotation;
     }
 
     internal bool MentionsAll(List<BoundVar> vars) {
-      return vars.All(x => terms.Any(candidate => candidate.Variables.Contains(x)));
+      return vars.All(x => Terms.Any(term => term.Variables.Contains(x)));
     }
 
+    private string Repr { get { return Terms.MapConcat(t => Printer.ExprToString(t.Expr), ", "); } }
+
     public override string ToString() {
-      return String.Join(", ", terms);
+      return "{" + Repr + "}" + (String.IsNullOrWhiteSpace(Annotation) ? "" : " (" + Annotation + ")");
     }
 
-    public String AsDafnyAttributeString(bool wrap = true, bool includeTags = false) {
-      var repr = terms.MapConcat(t => Printer.ExprToString(t.Expr), ", ");
-      if (wrap) {
-        repr = "{:trigger " + repr + "}";
-      }
-      return repr;
+    internal IEnumerable<TriggerMatch> LoopingSubterms(QuantifierExpr quantifier) {
+      var matchingSubterms = MatchingSubterms(quantifier);
+      return matchingSubterms.Where(tm => tm.CouldCauseLoops(Terms));
+    }
+
+    internal List<TriggerMatch> MatchingSubterms(QuantifierExpr quantifier) {
+      //FIXME this will miss rewritten expressions (CleanupExpr). Should introduce an OriginalExpr to compare against.
+      return Terms.SelectMany(term => quantifier.SubexpressionsMatchingTrigger(term.Expr)).Deduplicate(TriggerMatch.Eq);
+    }
+
+    public String AsDafnyAttributeString() {
+      return "{:trigger " + Repr + "}";
     }
   }
 
   class TriggerAnnotation {
     internal bool IsTriggerKiller;
     internal ISet<IVariable> Variables;
-    internal readonly List<TriggerCandidate> PrivateTerms;
-    internal readonly List<TriggerCandidate> ExportedTerms;
+    internal readonly List<TriggerTerm> PrivateTerms;
+    internal readonly List<TriggerTerm> ExportedTerms;
 
-    internal TriggerAnnotation(bool IsTriggerKiller, IEnumerable<IVariable> Variables,
-                                IEnumerable<TriggerCandidate> AllCandidates, IEnumerable<TriggerCandidate> PrivateCandidates = null) {
+    internal TriggerAnnotation(bool IsTriggerKiller, IEnumerable<IVariable> Variables, IEnumerable<TriggerTerm> AllTerms, IEnumerable<TriggerTerm> PrivateTerms = null) {
       this.IsTriggerKiller = IsTriggerKiller;
       this.Variables = new HashSet<IVariable>(Variables);
-
-      this.PrivateTerms = new List<TriggerCandidate>(PrivateCandidates == null ? Enumerable.Empty<TriggerCandidate>() : PrivateCandidates);
-      this.ExportedTerms = new List<TriggerCandidate>(AllCandidates == null ? Enumerable.Empty<TriggerCandidate>() : AllCandidates.Except(this.PrivateTerms));
+      this.PrivateTerms = new List<TriggerTerm>(PrivateTerms == null ? Enumerable.Empty<TriggerTerm>() : PrivateTerms);
+      this.ExportedTerms = new List<TriggerTerm>(AllTerms == null ? Enumerable.Empty<TriggerTerm>() : AllTerms.Except(this.PrivateTerms));
     }
 
     public override string ToString() {
@@ -66,15 +82,15 @@ namespace Microsoft.Dafny.Triggers {
         sb.AppendFormat(subindent, bv.Name);
       }
 
-      sb.AppendFormat(nindent, "Exported candidates:");
-      foreach (var candidate in ExportedTerms) {
-        sb.AppendFormat(subindent, candidate);
+      sb.AppendFormat(nindent, "Exported terms:");
+      foreach (var term in ExportedTerms) {
+        sb.AppendFormat(subindent, term);
       }
 
       if (PrivateTerms.Any()) {
-        sb.AppendFormat(nindent, "Private candidates:");
-        foreach (var candidate in PrivateTerms) {
-          sb.AppendFormat(subindent, candidate);
+        sb.AppendFormat(nindent, "Private terms:");
+        foreach (var term in PrivateTerms) {
+          sb.AppendFormat(subindent, term);
         }
       }
 
@@ -85,9 +101,7 @@ namespace Microsoft.Dafny.Triggers {
   public class TriggersCollector {
     Dictionary<Expression, TriggerAnnotation> cache;
 
-    private static TriggersCollector instance = new TriggersCollector();
-
-    private TriggersCollector() {
+    internal TriggersCollector() {
       this.cache = new Dictionary<Expression, TriggerAnnotation>();
     }
 
@@ -96,8 +110,8 @@ namespace Microsoft.Dafny.Triggers {
                                 .Aggregate(seed, (acc, e) => reduce(acc, e));
     }
 
-    private List<TriggerCandidate> CollectExportedCandidates(Expression expr) {
-      return ReduceAnnotatedSubExpressions<List<TriggerCandidate>>(expr, new List<TriggerCandidate>(), a => a.ExportedTerms, TriggerUtils.MergeAlterFirst);
+    private List<TriggerTerm> CollectExportedCandidates(Expression expr) {
+      return ReduceAnnotatedSubExpressions<List<TriggerTerm>>(expr, new List<TriggerTerm>(), a => a.ExportedTerms, TriggerUtils.MergeAlterFirst);
     }
 
     private ISet<IVariable> CollectVariables(Expression expr) {
@@ -108,8 +122,8 @@ namespace Microsoft.Dafny.Triggers {
       return ReduceAnnotatedSubExpressions(expr, false, a => a.IsTriggerKiller, (a, b) => a || b);
     }
 
-    private IEnumerable<TriggerCandidate> OnlyPrivateCandidates(List<TriggerCandidate> candidates, IEnumerable<IVariable> privateVars) {
-      return candidates.Where(c => privateVars.Intersect(c.Variables).Any()); //TODO Check perf
+    private IEnumerable<TriggerTerm> OnlyPrivateCandidates(List<TriggerTerm> terms, IEnumerable<IVariable> privateVars) {
+      return terms.Where(c => privateVars.Intersect(c.Variables).Any()); //TODO Check perf
     }
 
     private TriggerAnnotation Annotate(Expression expr) {
@@ -195,18 +209,18 @@ namespace Microsoft.Dafny.Triggers {
     private TriggerAnnotation AnnotatePotentialCandidate(Expression expr) {
       bool expr_is_killer = false;
       var new_expr = CleanupExpr(expr, out expr_is_killer);
-      var new_candidate = new TriggerCandidate { Expr = new_expr, Variables = CollectVariables(expr) };
+      var new_term = new TriggerTerm { Expr = new_expr, Variables = CollectVariables(expr) };
 
-      List<TriggerCandidate> collected_candidates = CollectExportedCandidates(expr);
+      List<TriggerTerm> collected_terms = CollectExportedCandidates(expr);
       var children_contain_killers = CollectIsKiller(expr);
 
       if (!children_contain_killers) {
         // Add only if the children are not killers; the head has been cleaned up into non-killer form
-        collected_candidates.Add(new_candidate);
+        collected_terms.Add(new_term);
       }
 
       // This new node is a killer if its children were killers, or if it's non-cleaned-up head is a killer
-      return new TriggerAnnotation(children_contain_killers || expr_is_killer, new_candidate.Variables, collected_candidates);
+      return new TriggerAnnotation(children_contain_killers || expr_is_killer, new_term.Variables, collected_terms);
     }
 
     private TriggerAnnotation AnnotateApplySuffix(ApplySuffix expr) {
@@ -218,13 +232,13 @@ namespace Microsoft.Dafny.Triggers {
       // only possible child here; there can be DatatypeValue nodes, for example (see vstte2012/Combinators.dfy).
       var annotation = AnnotatePotentialCandidate(expr);
       // Comparing by reference is fine here. Using sets could yield a small speedup
-      annotation.ExportedTerms.RemoveAll(candidate => expr.SubExpressions.Contains(candidate.Expr));
+      annotation.ExportedTerms.RemoveAll(term => expr.SubExpressions.Contains(term.Expr));
       return annotation;
     }
 
     private TriggerAnnotation AnnotateQuantifierOrLetExpr(Expression expr, IEnumerable<BoundVar> boundVars) {
-      var candidates = CollectExportedCandidates(expr);
-      return new TriggerAnnotation(true, CollectVariables(expr), candidates, OnlyPrivateCandidates(candidates, boundVars));
+      var terms = CollectExportedCandidates(expr);
+      return new TriggerAnnotation(true, CollectVariables(expr), terms, OnlyPrivateCandidates(terms, boundVars));
     }
 
     private TriggerAnnotation AnnotateQuantifier(QuantifierExpr expr) {
@@ -244,13 +258,13 @@ namespace Microsoft.Dafny.Triggers {
     }
 
     // FIXME document that this will contain duplicates
-    internal static List<TriggerCandidate> CollectTriggers(QuantifierExpr quantifier) {
+    internal List<TriggerTerm> CollectTriggers(QuantifierExpr quantifier) {
       // TODO could check for existing triggers and return that instead, but that require a bit of work to extract the expressions
-      return instance.Annotate(quantifier).PrivateTerms;
+      return Annotate(quantifier).PrivateTerms;
     }
 
-    internal static bool IsTriggerKiller(Expression expr) {
-      return instance.Annotate(expr).IsTriggerKiller;
+    internal bool IsTriggerKiller(Expression expr) {
+      return Annotate(expr).IsTriggerKiller;
     }
   }
 }
-- 
cgit v1.2.3


From a07b43ac03b38d4af575d1a1df48339ad228751a Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 14 Aug 2015 17:38:08 -0700
Subject: Start committing split quantifiers

This requires rewriting the parts of the AST that contain these quantifiers. We
unfortunately don't have facilities to do such rewrites at the moment (and there
are loops in the AST, so it would be hard to write such a facility). As a
workaround, this commit introduces a field in quantifier expressions,
SplitQuantifiers. Code that manipulate triggers is expected to look for this
field, and ignore the other fields if that one is found.
---
 Source/Dafny/Cloner.cs                      |  10 ++-
 Source/Dafny/Compiler.cs                    |   6 ++
 Source/Dafny/DafnyAst.cs                    |  54 +++++++++++-
 Source/Dafny/Printer.cs                     |   7 ++
 Source/Dafny/Resolver.cs                    |  16 +++-
 Source/Dafny/Rewriter.cs                    |   4 +-
 Source/Dafny/Translator.cs                  | 125 +++++++++++++++++-----------
 Source/Dafny/Triggers/QuantifierSplitter.cs |  26 ++++--
 Source/Dafny/Triggers/TriggerExtensions.cs  |   8 ++
 Source/Dafny/Triggers/TriggerGenerator.cs   |  10 ++-
 Source/Dafny/Triggers/TriggerUtils.cs       |   1 +
 Source/Dafny/Triggers/TriggersCollector.cs  |   5 +-
 12 files changed, 203 insertions(+), 69 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index 323abc70..961d4d14 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -4,6 +4,7 @@ using System.Collections.Generic;
 using System.Numerics;
 using System.Diagnostics.Contracts;
 using IToken = Microsoft.Boogie.IToken;
+using System.Linq;
 
 namespace Microsoft.Dafny
 {
@@ -373,13 +374,18 @@ namespace Microsoft.Dafny
         if (e is QuantifierExpr) {
           var q = (QuantifierExpr)e;
           var tvs = q.TypeArgs.ConvertAll(CloneTypeParam);
+          QuantifierExpr cloned;
           if (e is ForallExpr) {
-            return new ForallExpr(tk, tvs, bvs, range, term, CloneAttributes(e.Attributes));
+            cloned = new ForallExpr(tk, tvs, bvs, range, term, CloneAttributes(e.Attributes));
           } else if (e is ExistsExpr) {
-            return new ExistsExpr(tk, tvs, bvs, range, term, CloneAttributes(e.Attributes));
+            cloned = new ExistsExpr(tk, tvs, bvs, range, term, CloneAttributes(e.Attributes));
           } else {
             Contract.Assert(false); throw new cce.UnreachableException();  // unexpected quantifier expression
           }
+          if (q.SplitQuantifier != null) { //TODO CLEMENT TRIGGERS: Should we clone the quantifier as a quantifier in this case? Or should we just replace entirely?
+            cloned.SplitQuantifier = q.SplitQuantifier.Select(CloneExpr).ToList();
+          }
+          return cloned;
         } else if (e is MapComprehension) {
           return new MapComprehension(tk, ((MapComprehension)e).Finite, bvs, range, term, CloneAttributes(e.Attributes));
         } else if (e is LambdaExpr) {
diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 4fdd34f6..d19d2bed 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -2816,6 +2816,12 @@ namespace Microsoft.Dafny {
 
       } else if (expr is QuantifierExpr) {
         var e = (QuantifierExpr)expr;
+
+        if (e.SplitQuantifier != null) { //TODO CLEMENT TRIGGERS: Do we compile a split quantifier in its original form, or in its split form?
+          TrExpr(e.SplitQuantifierExpression);
+          return;
+        }
+        
         Contract.Assert(e.Bounds != null);  // for non-ghost quantifiers, the resolver would have insisted on finding bounds
         var n = e.BoundVars.Count;
         Contract.Assert(e.Bounds.Count == n);
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index efe94c66..05548f38 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -1555,7 +1555,7 @@ namespace Microsoft.Dafny {
         // BUGBUG:  The following line is a workaround to tell the verifier that 'value' is not of an Immutable type.
         // A proper solution would be to be able to express that in the program (in a specification or attribute) or
         // to be able to declare 'parent' as [PeerOrImmutable].
-        Contract.Requires(value is TopLevelDecl || value is Function || value is Method || value is DatatypeCtor || value is QuantifierExpr);
+        Contract.Requires(value is TopLevelDecl || value is Function || value is Method || value is DatatypeCtor || (value is QuantifierExpr && ((QuantifierExpr)value).SplitQuantifier == null));
         //modifies parent;
         parent = value;
       }
@@ -6552,6 +6552,15 @@ namespace Microsoft.Dafny {
       }
     }
 
+    /// <summary>
+    /// Returns a resolved binary expression
+    /// </summary>
+    public BinaryExpr(Boogie.IToken tok, BinaryExpr.ResolvedOpcode rop, Expression e0, Expression e1)
+    : this(tok, BinaryExpr.ResolvedOp2SyntacticOp(rop), e0, e1) {
+      ResolvedOp = rop;
+      Type = Type.Bool;
+    }
+
     public override IEnumerable<Expression> SubExpressions {
       get {
         yield return E0;
@@ -6770,6 +6779,8 @@ namespace Microsoft.Dafny {
     public List<TypeParameter> TypeArgs;
     private static int currentQuantId = -1;
 
+    protected abstract BinaryExpr.ResolvedOpcode SplitResolvedOp { get; }
+
     static int FreshQuantId() {
       return System.Threading.Interlocked.Increment(ref currentQuantId);
     }
@@ -6800,10 +6811,47 @@ namespace Microsoft.Dafny {
       this.TypeArgs = tvars;
       this.UniqueId = FreshQuantId();
     }
+
+    private Expression SplitQuantifierToExpression() {
+      Contract.Requires(SplitQuantifier != null && SplitQuantifier.Any());
+      Expression accumulator = SplitQuantifier[0];
+      for (int tid = 1; tid < SplitQuantifier.Count; tid++) {
+        var newAcc = new BinaryExpr(Term.tok, SplitResolvedOp, accumulator, SplitQuantifier[tid]);
+        accumulator = newAcc;
+      }
+      return accumulator;
+    }
+
+    private List<Expression> _SplitQuantifier;
+    public List<Expression> SplitQuantifier {
+      get {
+        return _SplitQuantifier;
+      }
+      set {
+        _SplitQuantifier = value;
+        SplitQuantifierExpression = SplitQuantifierToExpression();
+      }
+    }
+
+    internal Expression SplitQuantifierExpression { get; private set; }
+
     public abstract Expression LogicalBody();
+
+    public override IEnumerable<Expression> SubExpressions {
+      get {
+        if (SplitQuantifier == null) {
+          return base.SubExpressions;
+        } else {
+          return SplitQuantifier;
+        }
+      }
+    }
   }
 
   public class ForallExpr : QuantifierExpr {
+    protected override BinaryExpr.Opcode SplitOp { get { return BinaryExpr.Opcode.And; } }
+    protected override BinaryExpr.ResolvedOpcode SplitResolvedOp { get { return BinaryExpr.ResolvedOpcode.And; } }
+
     public ForallExpr(IToken tok, List<BoundVar> bvars, Expression range, Expression term, Attributes attrs)
       : this(tok, new List<TypeParameter>(), bvars, range, term, attrs) {
       Contract.Requires(cce.NonNullElements(bvars));
@@ -6817,6 +6865,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(term != null);
     }
     public override Expression LogicalBody() {
+      Contract.Assert(SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
       if (Range == null) {
         return Term;
       }
@@ -6828,6 +6877,9 @@ namespace Microsoft.Dafny {
   }
 
   public class ExistsExpr : QuantifierExpr {
+    protected override BinaryExpr.Opcode SplitOp { get { return BinaryExpr.Opcode.Or; } }
+    protected override BinaryExpr.ResolvedOpcode SplitResolvedOp { get { return BinaryExpr.ResolvedOpcode.Or; } }
+
     public ExistsExpr(IToken tok, List<BoundVar> bvars, Expression range, Expression term, Attributes attrs)
       : this(tok, new List<TypeParameter>(), bvars, range, term, attrs) {
       Contract.Requires(cce.NonNullElements(bvars));
diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index 1c7508eb..43b69bbb 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -1729,6 +1729,13 @@ namespace Microsoft.Dafny {
 
       } else if (expr is QuantifierExpr) {
         QuantifierExpr e = (QuantifierExpr)expr;
+
+        if (e.SplitQuantifier != null) {
+          // CLEMENT TODO TRIGGERS: Should (do) we have a setting to print the original forms instead of rewritten forms?
+          PrintExpr(e.SplitQuantifierExpression, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent, resolv_count);
+          return;
+        }
+
         bool parensNeeded = !isRightmost;
         if (parensNeeded) { wr.Write("("); }
         wr.Write(e is ForallExpr ? "forall" : "exists");
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 7bf085f9..e1c3c63b 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -305,7 +305,7 @@ namespace Microsoft.Dafny
             Contract.Assert(!useCompileSignatures);
             useCompileSignatures = true;  // set Resolver-global flag to indicate that Signatures should be followed to their CompiledSignature
             var oldErrorsOnly = reporter.ErrorsOnly;
-            reporter.ErrorsOnly = true; // turn off warning reporting for the clone
+            reporter.ErrorsOnly = true; // turn off warning reporter for the clone
             var nw = new Cloner().CloneModuleDefinition(m, m.CompileName + "_Compile");
             var compileSig = RegisterTopLevelDecls(nw, true);
             compileSig.Refines = refinementTransformer.RefinedSig;
@@ -338,7 +338,7 @@ namespace Microsoft.Dafny
                   if (refinementTransformer.CheckIsRefinement(compileSig, p)) {
                     abs.Signature.CompileSignature = compileSig;
                   } else {
-                    reporter.Error(MessageSource.Resolver,
+                    reporter.Error(MessageSource.Resolver, 
                       abs.CompilePath[0],
                       "module " + Util.Comma(".", abs.CompilePath, x => x.val) + " must be a refinement of "
                       + Util.Comma(".", abs.Path, x => x.val));
@@ -2438,6 +2438,7 @@ namespace Microsoft.Dafny
           return false;
         } else if (expr is QuantifierExpr) {
           var e = (QuantifierExpr)expr;
+          Contract.Assert(e.SplitQuantifier == null); // No split quantifiers during resolution
           var cpos = IsCoContext ? cp : Invert(cp);
           if ((cpos == CallingPosition.Positive && e is ExistsExpr) || (cpos == CallingPosition.Negative && e is ForallExpr)) {
             if (e.MissingBounds != null && e.MissingBounds.Count != 0) {
@@ -6962,7 +6963,7 @@ namespace Microsoft.Dafny
           reporter.Error(MessageSource.Resolver, expr, "'this' is not allowed in a 'static' context");
         }
         if (currentClass != null) {
-          expr.Type = GetThisType(expr.tok, currentClass);  // do this regardless of scope.AllowInstance, for better error reporting
+          expr.Type = GetThisType(expr.tok, currentClass);  // do this regardless of scope.AllowInstance, for better error reporter
         }
 
       } else if (expr is IdentifierExpr) {
@@ -7605,6 +7606,7 @@ namespace Microsoft.Dafny
         e.Type = e.Body.Type;
       } else if (expr is QuantifierExpr) {
         QuantifierExpr e = (QuantifierExpr)expr;
+        Contract.Assert(e.SplitQuantifier == null); // No split quantifiers during resolution
         int prevErrorCount = reporter.Count(ErrorLevel.Error);
         bool _val = true;
         bool typeQuantifier = Attributes.ContainsBool(e.Attributes, "typeQuantifier", ref _val) && _val;
@@ -9177,6 +9179,7 @@ namespace Microsoft.Dafny
         return;
       } else if (expr is QuantifierExpr) {
         var e = (QuantifierExpr)expr;
+        Contract.Assert(e.SplitQuantifier == null); // No split quantifiers during resolution
         if (e.MissingBounds != null) {
           foreach (var bv in e.MissingBounds) {
             reporter.Error(MessageSource.Resolver, expr, "quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
@@ -9774,10 +9777,13 @@ namespace Microsoft.Dafny
 
       if (expr is IdentifierExpr) {
         var e = (IdentifierExpr)expr;
+
         return new HashSet<IVariable>() { e.Var };
 
       } else if (expr is QuantifierExpr) {
         var e = (QuantifierExpr)expr;
+        Contract.Assert(e.SplitQuantifier == null); // No split quantifiers during resolution
+
         var s = FreeVariables(e.LogicalBody());
         foreach (var bv in e.BoundVars) {
           s.Remove(bv);
@@ -10139,7 +10145,9 @@ namespace Microsoft.Dafny
       } else if (expr is NamedExpr) {
         return moduleInfo.IsGhost ? false : UsesSpecFeatures(((NamedExpr)expr).Body);
       } else if (expr is ComprehensionExpr) {
-        if (expr is QuantifierExpr && ((QuantifierExpr)expr).Bounds == null) {
+        var q = expr as QuantifierExpr;
+        Contract.Assert(q == null || q.SplitQuantifier == null); // No split quantifiers during resolution
+        if (q != null && q.Bounds == null) {
           return true;  // the quantifier cannot be compiled if the resolver found no bounds
         }
         return Contract.Exists(expr.SubExpressions, se => UsesSpecFeatures(se));
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 0798510a..2c00e203 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -43,9 +43,9 @@ namespace Microsoft.Dafny
       Contract.Requires(reporter != null);
     }
 
-    internal override void PostResolve(ModuleDefinition m) {
+    internal override void PostCyclicityResolve(ModuleDefinition m) {
       var finder = new Triggers.QuantifierCollectionsFinder(reporter);
-
+        
       foreach (var decl in ModuleDefinition.AllCallables(m.TopLevelDecls)) {
         if (decl is Function) {
           var function = (Function)decl;
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 14fca463..f0b7f276 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -4465,6 +4465,11 @@ namespace Microsoft.Dafny {
         var e = (ComprehensionExpr)expr;
         var canCall = CanCallAssumption(e.Term, etran);
         var q = e as QuantifierExpr;
+
+        if (q != null && q.SplitQuantifier != null) {
+          return CanCallAssumption(q.SplitQuantifierExpression, etran);
+        }
+
         var tyvars = MkTyParamBinders(q != null ? q.TypeArgs : new List<TypeParameter>());
         if (e.Range != null) {
           canCall = BplAnd(CanCallAssumption(e.Range, etran), BplImp(etran.TrExpr(e.Range), canCall));
@@ -4758,6 +4763,12 @@ namespace Microsoft.Dafny {
         // If the quantifier is universal, then continue as:
         //   assume (\forall x :: body(x));
         // Create local variables corresponding to the type arguments:
+
+        if (e.SplitQuantifier != null) {
+          CheckWellformedAndAssume(e.SplitQuantifierExpression, options, locals, builder, etran);
+          return;
+        }
+
         var typeArgumentCopies = Map(e.TypeArgs, tp => e.Refresh(tp, CurrentIdGenerator));
         var typeMap = Util.Dict(e.TypeArgs, Map(typeArgumentCopies, tp => (Type)new UserDefinedType(tp)));
         var newLocals = Map(typeArgumentCopies, tp => new Bpl.LocalVariable(tp.tok, new TypedIdent(tp.tok, nameTypeParam(tp), predef.Ty)));
@@ -5293,6 +5304,10 @@ namespace Microsoft.Dafny {
         var q = e as QuantifierExpr;
         var lam = e as LambdaExpr;
 
+        if (q != null && q.SplitQuantifier != null) {
+          CheckWellformedWithResult(q.SplitQuantifierExpression, options, result, resultType, locals, builder, etran);
+        }
+
         var typeMap = new Dictionary<TypeParameter, Type>();
         var copies = new List<TypeParameter>();
         if (q != null) {
@@ -11534,56 +11549,60 @@ namespace Microsoft.Dafny {
           return TrExpr(((NamedExpr)expr).Body);
         } else if (expr is QuantifierExpr) {
           QuantifierExpr e = (QuantifierExpr)expr;
-          List<Variable> tyvars = translator.MkTyParamBinders(e.TypeArgs);
-          List<Variable> bvars = new List<Variable>();
-
-          var initEtran = this;
-          var bodyEtran = this;
-          bool _scratch = true;
 
-          Bpl.Expr antecedent = Bpl.Expr.True;
-
-          if (Attributes.ContainsBool(e.Attributes, "layerQuantifier", ref _scratch)) {
-            // If this is a layer quantifier, quantify over layers here, and use $LS(ly) layers in the translation of the body
-            var ly = BplBoundVar(e.Refresh("q$ly#", translator.CurrentIdGenerator), predef.LayerType, bvars);
-            bodyEtran = new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, new FuelSetting(translator, 1, ly), new FuelSetting(translator, 1, ly), modifiesFrame, stripLits);
-          }
-          if (Attributes.ContainsBool(e.Attributes, "heapQuantifier", ref _scratch)) {
-            var h = BplBoundVar(e.Refresh("q$heap#", translator.CurrentIdGenerator), predef.HeapType, bvars);
-            bodyEtran = new ExpressionTranslator(bodyEtran, h);
-            antecedent = BplAnd(new List<Bpl.Expr> {
-              antecedent,
-              translator.FunctionCall(e.tok, BuiltinFunction.IsGoodHeap, null, h),
-              translator.HeapSameOrSucc(initEtran.HeapExpr, h)
-            });
-          }
+          if (e.SplitQuantifier != null) {
+            return TrExpr(e.SplitQuantifierExpression);
+          } else {
+            List<Variable> tyvars = translator.MkTyParamBinders(e.TypeArgs);
+            List<Variable> bvars = new List<Variable>();
+
+            var initEtran = this;
+            var bodyEtran = this;
+            bool _scratch = true;
+
+            Bpl.Expr antecedent = Bpl.Expr.True;
+
+            if (Attributes.ContainsBool(e.Attributes, "layerQuantifier", ref _scratch)) {
+              // If this is a layer quantifier, quantify over layers here, and use $LS(ly) layers in the translation of the body
+              var ly = BplBoundVar(e.Refresh("q$ly#", translator.CurrentIdGenerator), predef.LayerType, bvars);
+              bodyEtran = new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, new FuelSetting(translator, 1, ly), new FuelSetting(translator, 1, ly), modifiesFrame, stripLits);
+            }
+            if (Attributes.ContainsBool(e.Attributes, "heapQuantifier", ref _scratch)) {
+              var h = BplBoundVar(e.Refresh("q$heap#", translator.CurrentIdGenerator), predef.HeapType, bvars);
+              bodyEtran = new ExpressionTranslator(bodyEtran, h);
+              antecedent = BplAnd(new List<Bpl.Expr> {
+                antecedent,
+                translator.FunctionCall(e.tok, BuiltinFunction.IsGoodHeap, null, h),
+                translator.HeapSameOrSucc(initEtran.HeapExpr, h)
+              });
+            }
 
-          antecedent = BplAnd(antecedent, bodyEtran.TrBoundVariables(e.BoundVars, bvars));
+            antecedent = BplAnd(antecedent, bodyEtran.TrBoundVariables(e.BoundVars, bvars));
 
-          Bpl.QKeyValue kv = TrAttributes(e.Attributes, "trigger");
-          Bpl.Trigger tr = null;
-          var argsEtran = bodyEtran.WithNoLits();
-          foreach (var aa in e.Attributes.AsEnumerable()) {
-            if (aa.Name == "trigger") {
-              List<Bpl.Expr> tt = new List<Bpl.Expr>();
-              foreach (var arg in aa.Args) {
-                tt.Add(argsEtran.TrExpr(arg));
+            Bpl.QKeyValue kv = TrAttributes(e.Attributes, "trigger");
+            Bpl.Trigger tr = null;
+            var argsEtran = bodyEtran.WithNoLits();
+            foreach (var aa in e.Attributes.AsEnumerable()) {
+              if (aa.Name == "trigger") {
+                List<Bpl.Expr> tt = new List<Bpl.Expr>();
+                foreach (var arg in aa.Args) {
+                  tt.Add(argsEtran.TrExpr(arg));
+                }
+                tr = new Bpl.Trigger(expr.tok, true, tt, tr);
               }
-              tr = new Bpl.Trigger(expr.tok, true, tt, tr);
             }
-          }
-          if (e.Range != null) {
-            antecedent = BplAnd(antecedent, bodyEtran.TrExpr(e.Range));
-          }
-          Bpl.Expr body = bodyEtran.TrExpr(e.Term);
+            if (e.Range != null) {
+              antecedent = BplAnd(antecedent, bodyEtran.TrExpr(e.Range));
+            }
+            Bpl.Expr body = bodyEtran.TrExpr(e.Term);
           
-          if (e is ForallExpr) {
-            return new Bpl.ForallExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars, bvars), kv, tr, Bpl.Expr.Imp(antecedent, body));
-          } else {
-            Contract.Assert(e is ExistsExpr);
-            return new Bpl.ExistsExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars, bvars), kv, tr, Bpl.Expr.And(antecedent, body));
+            if (e is ForallExpr) {
+              return new Bpl.ForallExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars, bvars), kv, tr, Bpl.Expr.Imp(antecedent, body));
+            } else {
+              Contract.Assert(e is ExistsExpr);
+              return new Bpl.ExistsExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars, bvars), kv, tr, Bpl.Expr.And(antecedent, body));
+            }
           }
-
         } else if (expr is SetComprehension) {
           var e = (SetComprehension)expr;
           // Translate "set xs | R :: T" into "lambda y: BoxType :: (exists xs :: CorrectType(xs) && R && y==Box(T))".
@@ -12966,9 +12985,11 @@ namespace Microsoft.Dafny {
           }
         }
 
+      } else if (expr is QuantifierExpr && ((QuantifierExpr)expr).SplitQuantifier != null) {
+        return TrSplitExpr(((QuantifierExpr)expr).SplitQuantifierExpression, splits, position, heightLimit, apply_induction, etran);
       } else if (((position && expr is ForallExpr) || (!position && expr is ExistsExpr))
-          /* NB: only for type arg less quantifiers for now: */
-             && ((QuantifierExpr)expr).TypeArgs.Count == 0) {
+        /* NB: only for type arg less quantifiers for now: */
+            && ((QuantifierExpr)expr).TypeArgs.Count == 0) {
         var e = (QuantifierExpr)expr;
         var inductionVariables = ApplyInduction(e);
         if (apply_induction && 2 <= DafnyOptions.O.Induction && inductionVariables.Count != 0) {
@@ -13138,8 +13159,11 @@ namespace Microsoft.Dafny {
 
       protected override void VisitOneExpr(Expression expr) {
         if (expr is QuantifierExpr) {
-          foreach (var trigger in (expr as QuantifierExpr).Attributes.AsEnumerable().Where(a => a.Name == "trigger").SelectMany(a => a.Args)) {
-            collector.Visit(trigger);
+          var e = (QuantifierExpr)expr;
+          if (e.SplitQuantifier == null) {
+            foreach (var trigger in (expr as QuantifierExpr).Attributes.AsEnumerable().Where(a => a.Name == "trigger").SelectMany(a => a.Args)) {
+              collector.Visit(trigger);
+            }
           }
         }
       }
@@ -13173,6 +13197,7 @@ namespace Microsoft.Dafny {
     }
 
     List<BoundVar> ApplyInduction(QuantifierExpr e) {
+      Contract.Requires(e.SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
       Contract.Requires(e.TypeArgs.Count == 0);
       return ApplyInduction(e.BoundVars, e.Attributes, new List<Expression>() { e.LogicalBody() },
         delegate(System.IO.TextWriter wr) { new Printer(wr).PrintExpression(e, true); });
@@ -13946,6 +13971,12 @@ namespace Microsoft.Dafny {
           var e = (ComprehensionExpr)expr;
           // For quantifiers and setComprehesion we want to make sure that we don't introduce name clashes with
           // the enclosing scopes.
+
+          var q = e as QuantifierExpr;
+          if (q != null && q.SplitQuantifier != null) {
+            return Substitute(q.SplitQuantifierExpression);
+          }
+
           var newBoundVars = CreateBoundVarSubstitutions(e.BoundVars, expr is ForallExpr || expr is ExistsExpr || expr is SetComprehension);
           Expression newRange = e.Range == null ? null : Substitute(e.Range);
           Expression newTerm = Substitute(e.Term);
diff --git a/Source/Dafny/Triggers/QuantifierSplitter.cs b/Source/Dafny/Triggers/QuantifierSplitter.cs
index 33be0da2..80381f0a 100644
--- a/Source/Dafny/Triggers/QuantifierSplitter.cs
+++ b/Source/Dafny/Triggers/QuantifierSplitter.cs
@@ -21,30 +21,37 @@ namespace Microsoft.Dafny.Triggers {
     // Unfortunately, this would cause ill-behaved quantifiers to produce
     // exponentially many smaller quantifiers.
 
+    private static UnaryOpExpr Not(Expression expr) {
+      var not = new UnaryOpExpr(expr.tok, UnaryOpExpr.Opcode.Not, expr) { Type = expr.Type };
+      return not;
+    }
+
     internal static IEnumerable<Expression> SplitExpr(Expression expr, BinaryExpr.Opcode separator) {
       expr = expr.Resolved;
       var unary = expr as UnaryOpExpr;
       var binary = expr as BinaryExpr;
 
       if (unary != null && unary.Op == UnaryOpExpr.Opcode.Not) {
-        foreach (var e in SplitExpr(unary.E, FlipOpcode(separator))) { yield return new UnaryOpExpr(unary.tok, UnaryOpExpr.Opcode.Not, e); }
+        foreach (var e in SplitExpr(unary.E, FlipOpcode(separator))) { yield return Not(e); }
       } else if (binary != null && binary.Op == separator) {
         foreach (var e in SplitExpr(binary.E0, separator)) { yield return e; }
         foreach (var e in SplitExpr(binary.E1, separator)) { yield return e; }
       } else if (binary != null && binary.Op == BinaryExpr.Opcode.Imp && separator == BinaryExpr.Opcode.Or) {
-        foreach (var e in SplitExpr(new UnaryOpExpr(unary.tok, UnaryOpExpr.Opcode.Not, binary.E0), separator)) { yield return e; }
+        foreach (var e in SplitExpr(Not(binary.E0), separator)) { yield return e; }
         foreach (var e in SplitExpr(binary.E1, separator)) { yield return e; }
+      } else {
+        yield return expr;
       }
     }
 
     internal static IEnumerable<Expression> SplitAndStich(BinaryExpr pair, BinaryExpr.Opcode separator) {
-      foreach (var e1 in SplitExpr(pair.E1, separator)) { 
-        yield return new BinaryExpr(pair.tok, pair.Op, pair.E0, e1);
+      foreach (var e1 in SplitExpr(pair.E1, separator)) {
+        yield return new BinaryExpr(pair.tok, pair.Op, pair.E0, e1) { ResolvedOp = pair.ResolvedOp, Type = pair.Type };
       }
     }
 
     internal static IEnumerable<Expression> SplitQuantifier(QuantifierExpr quantifier) {
-      var body = quantifier.LogicalBody();
+      var body = quantifier.Term;
       var binary = body as BinaryExpr;
 
       if (quantifier is ForallExpr) {
@@ -55,7 +62,7 @@ namespace Microsoft.Dafny.Triggers {
           stream = SplitExpr(body, BinaryExpr.Opcode.And);
         }
         foreach (var e in stream) {
-          yield return new ForallExpr(quantifier.tok, quantifier.BoundVars, quantifier.Range, quantifier.Term, quantifier.Attributes);
+          yield return new ForallExpr(quantifier.tok, quantifier.BoundVars, quantifier.Range, e, quantifier.Attributes) { Type = quantifier.Type };
         }
       } else if (quantifier is ExistsExpr) {
         IEnumerable<Expression> stream;
@@ -65,17 +72,18 @@ namespace Microsoft.Dafny.Triggers {
           stream = SplitExpr(body, BinaryExpr.Opcode.Or);
         }
         foreach (var e in stream) {
-          yield return new ExistsExpr(quantifier.tok, quantifier.BoundVars, quantifier.Range, quantifier.Term, quantifier.Attributes);
+          yield return new ExistsExpr(quantifier.tok, quantifier.BoundVars, quantifier.Range, e, quantifier.Attributes) { Type = quantifier.Type };
         }
       } else {
         yield return quantifier;
       }
     }
         
-    protected override void VisitOneExpr(Expression expr) { //FIXME: This doesn't save the rewritten quantifier
+    protected override void VisitOneExpr(Expression expr) {
       var quantifier = expr as QuantifierExpr;
       if (quantifier != null) {
-        var rew = SplitQuantifier(quantifier);
+        var split = SplitQuantifier(quantifier).ToList();
+        quantifier.SplitQuantifier = split;
         //Console.WriteLine("!!! {0} => {1}", Printer.ExprToString(expr), rew.MapConcat(Printer.ExprToString, " ||| "));
       }
     }
diff --git a/Source/Dafny/Triggers/TriggerExtensions.cs b/Source/Dafny/Triggers/TriggerExtensions.cs
index da43abcc..9fbc8a8a 100644
--- a/Source/Dafny/Triggers/TriggerExtensions.cs
+++ b/Source/Dafny/Triggers/TriggerExtensions.cs
@@ -272,6 +272,14 @@ namespace Microsoft.Dafny.Triggers {
     }
 
     private static bool ShallowEq(QuantifierExpr expr1, QuantifierExpr expr2) { //FIXME are these TypeArgs still useful?
+      if (!TriggerUtils.SameNullity(expr1.SplitQuantifier, expr2.SplitQuantifier)) {
+        return false;
+      }
+
+      if (expr1.SplitQuantifier != null && expr2.SplitQuantifier != null) {
+        return ShallowEq_Top(expr1.SplitQuantifierExpression, expr2.SplitQuantifierExpression);
+      }
+
       if (expr1.TypeArgs.Count != expr2.TypeArgs.Count ||
           !TriggerUtils.SameNullity(expr1.Range, expr2.Range)) {
         return false;
diff --git a/Source/Dafny/Triggers/TriggerGenerator.cs b/Source/Dafny/Triggers/TriggerGenerator.cs
index de4b212b..e218ad7b 100644
--- a/Source/Dafny/Triggers/TriggerGenerator.cs
+++ b/Source/Dafny/Triggers/TriggerGenerator.cs
@@ -19,9 +19,13 @@ namespace Microsoft.Dafny.Triggers { //FIXME rename this file
     protected override bool VisitOneExpr(Expression expr, ref object st) {
       var quantifier = expr as QuantifierExpr;
       if (quantifier != null) {
-        quantifierCollections.Add(new QuantifiersCollection(Enumerable.Repeat(quantifier, 1), reporter));
-      } //FIXME handle the case of groups of quantifiers resulting from a split
-
+        if (quantifier.SplitQuantifier != null) {
+          var collection = quantifier.SplitQuantifier.Select(q => q as QuantifierExpr).Where(q => q != null);
+          quantifierCollections.Add(new QuantifiersCollection(collection, reporter));
+        } else {
+          quantifierCollections.Add(new QuantifiersCollection(Enumerable.Repeat(quantifier, 1), reporter));
+        }
+      }
       return true;
     }
   }
diff --git a/Source/Dafny/Triggers/TriggerUtils.cs b/Source/Dafny/Triggers/TriggerUtils.cs
index dedbcbb1..6c6eede2 100644
--- a/Source/Dafny/Triggers/TriggerUtils.cs
+++ b/Source/Dafny/Triggers/TriggerUtils.cs
@@ -101,6 +101,7 @@ namespace Microsoft.Dafny.Triggers {
     }
 
     internal static bool NeedsAutoTriggers(QuantifierExpr quantifier) {
+      Contract.Requires(quantifier.SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
       return quantifier.Attributes.AsEnumerable().All(aa => aa.Name != "trigger" && aa.Name != "no_trigger");
     }
   }
diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index e1f8a013..9f721d9a 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -44,11 +44,13 @@ namespace Microsoft.Dafny.Triggers {
     }
 
     internal IEnumerable<TriggerMatch> LoopingSubterms(QuantifierExpr quantifier) {
+      Contract.Requires(quantifier.SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
       var matchingSubterms = MatchingSubterms(quantifier);
       return matchingSubterms.Where(tm => tm.CouldCauseLoops(Terms));
     }
 
     internal List<TriggerMatch> MatchingSubterms(QuantifierExpr quantifier) {
+      Contract.Requires(quantifier.SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
       //FIXME this will miss rewritten expressions (CleanupExpr). Should introduce an OriginalExpr to compare against.
       return Terms.SelectMany(term => quantifier.SubexpressionsMatchingTrigger(term.Expr)).Deduplicate(TriggerMatch.Eq);
     }
@@ -139,7 +141,7 @@ namespace Microsoft.Dafny.Triggers {
           (expr is UnaryOpExpr && (((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Cardinality)) || // FIXME || ((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Fresh doesn't work, as fresh is a pretty tricky predicate when it's not about datatypes. See translator.cs:10944
           (expr is BinaryExpr && (((BinaryExpr)expr).Op == BinaryExpr.Opcode.NotIn || ((BinaryExpr)expr).Op == BinaryExpr.Opcode.In))) {
         annotation = AnnotatePotentialCandidate(expr);
-      } else if (expr is QuantifierExpr) {
+      } else if (expr is QuantifierExpr && ((QuantifierExpr)expr).SplitQuantifier == null) {
         annotation = AnnotateQuantifier((QuantifierExpr)expr);
       } else if (expr is LetExpr) {
         annotation = AnnotateLetExpr((LetExpr)expr);
@@ -259,6 +261,7 @@ namespace Microsoft.Dafny.Triggers {
 
     // FIXME document that this will contain duplicates
     internal List<TriggerTerm> CollectTriggers(QuantifierExpr quantifier) {
+      Contract.Requires(quantifier.SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
       // TODO could check for existing triggers and return that instead, but that require a bit of work to extract the expressions
       return Annotate(quantifier).PrivateTerms;
     }
-- 
cgit v1.2.3


From db9821ac440cdfa817049ab83c2e94f861ff429d Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Mon, 17 Aug 2015 09:37:47 -0700
Subject: Review preceding commit with Rustan

---
 Source/Dafny/Cloner.cs     |  9 ++-------
 Source/Dafny/Compiler.cs   |  7 ++-----
 Source/Dafny/DafnyAst.cs   | 23 +++++++++--------------
 Source/Dafny/Printer.cs    |  3 +--
 Source/Dafny/Translator.cs |  1 +
 5 files changed, 15 insertions(+), 28 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index 961d4d14..e89a385f 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -374,18 +374,13 @@ namespace Microsoft.Dafny
         if (e is QuantifierExpr) {
           var q = (QuantifierExpr)e;
           var tvs = q.TypeArgs.ConvertAll(CloneTypeParam);
-          QuantifierExpr cloned;
           if (e is ForallExpr) {
-            cloned = new ForallExpr(tk, tvs, bvs, range, term, CloneAttributes(e.Attributes));
+            return new ForallExpr(tk, tvs, bvs, range, term, CloneAttributes(e.Attributes));
           } else if (e is ExistsExpr) {
-            cloned = new ExistsExpr(tk, tvs, bvs, range, term, CloneAttributes(e.Attributes));
+            return new ExistsExpr(tk, tvs, bvs, range, term, CloneAttributes(e.Attributes));
           } else {
             Contract.Assert(false); throw new cce.UnreachableException();  // unexpected quantifier expression
           }
-          if (q.SplitQuantifier != null) { //TODO CLEMENT TRIGGERS: Should we clone the quantifier as a quantifier in this case? Or should we just replace entirely?
-            cloned.SplitQuantifier = q.SplitQuantifier.Select(CloneExpr).ToList();
-          }
-          return cloned;
         } else if (e is MapComprehension) {
           return new MapComprehension(tk, ((MapComprehension)e).Finite, bvs, range, term, CloneAttributes(e.Attributes));
         } else if (e is LambdaExpr) {
diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index d19d2bed..c969ac1f 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -2817,10 +2817,7 @@ namespace Microsoft.Dafny {
       } else if (expr is QuantifierExpr) {
         var e = (QuantifierExpr)expr;
 
-        if (e.SplitQuantifier != null) { //TODO CLEMENT TRIGGERS: Do we compile a split quantifier in its original form, or in its split form?
-          TrExpr(e.SplitQuantifierExpression);
-          return;
-        }
+        // Compilation does not check whether a quantifier was split.
         
         Contract.Assert(e.Bounds != null);  // for non-ghost quantifiers, the resolver would have insisted on finding bounds
         var n = e.BoundVars.Count;
@@ -2864,7 +2861,7 @@ namespace Microsoft.Dafny {
           wr.Write("{0}, ", expr is ForallExpr ? "true" : "false");
           wr.Write("@{0} => ", bv.CompileName);
         }
-        TrExpr(e.LogicalBody());
+        TrExpr(e.LogicalBody(true));
         for (int i = 0; i < n; i++) {
           wr.Write(")");
         }
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 05548f38..a902a18c 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -1552,11 +1552,6 @@ namespace Microsoft.Dafny {
       set {
         Contract.Requires(Parent == null);  // set it only once
         Contract.Requires(value != null);
-        // BUGBUG:  The following line is a workaround to tell the verifier that 'value' is not of an Immutable type.
-        // A proper solution would be to be able to express that in the program (in a specification or attribute) or
-        // to be able to declare 'parent' as [PeerOrImmutable].
-        Contract.Requires(value is TopLevelDecl || value is Function || value is Method || value is DatatypeCtor || (value is QuantifierExpr && ((QuantifierExpr)value).SplitQuantifier == null));
-        //modifies parent;
         parent = value;
       }
     }
@@ -6816,8 +6811,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(SplitQuantifier != null && SplitQuantifier.Any());
       Expression accumulator = SplitQuantifier[0];
       for (int tid = 1; tid < SplitQuantifier.Count; tid++) {
-        var newAcc = new BinaryExpr(Term.tok, SplitResolvedOp, accumulator, SplitQuantifier[tid]);
-        accumulator = newAcc;
+        accumulator = new BinaryExpr(Term.tok, SplitResolvedOp, accumulator, SplitQuantifier[tid]);
       }
       return accumulator;
     }
@@ -6835,7 +6829,11 @@ namespace Microsoft.Dafny {
 
     internal Expression SplitQuantifierExpression { get; private set; }
 
-    public abstract Expression LogicalBody();
+    public virtual Expression LogicalBody(bool bypassSplitQuantifier = false) {
+      // Don't call this on a quantifier with a Split clause: it's not a real quantifier. The only exception is the Compiler.
+      Contract.Requires(bypassSplitQuantifier || SplitQuantifier == null);
+      throw new cce.UnreachableException(); // This body is just here for the "Requires" clause
+    }
 
     public override IEnumerable<Expression> SubExpressions {
       get {
@@ -6847,9 +6845,8 @@ namespace Microsoft.Dafny {
       }
     }
   }
-
+  
   public class ForallExpr : QuantifierExpr {
-    protected override BinaryExpr.Opcode SplitOp { get { return BinaryExpr.Opcode.And; } }
     protected override BinaryExpr.ResolvedOpcode SplitResolvedOp { get { return BinaryExpr.ResolvedOpcode.And; } }
 
     public ForallExpr(IToken tok, List<BoundVar> bvars, Expression range, Expression term, Attributes attrs)
@@ -6864,8 +6861,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(tok != null);
       Contract.Requires(term != null);
     }
-    public override Expression LogicalBody() {
-      Contract.Assert(SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
+    public override Expression LogicalBody(bool bypassSplitQuantifier = false) {
       if (Range == null) {
         return Term;
       }
@@ -6877,7 +6873,6 @@ namespace Microsoft.Dafny {
   }
 
   public class ExistsExpr : QuantifierExpr {
-    protected override BinaryExpr.Opcode SplitOp { get { return BinaryExpr.Opcode.Or; } }
     protected override BinaryExpr.ResolvedOpcode SplitResolvedOp { get { return BinaryExpr.ResolvedOpcode.Or; } }
 
     public ExistsExpr(IToken tok, List<BoundVar> bvars, Expression range, Expression term, Attributes attrs)
@@ -6892,7 +6887,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(tok != null);
       Contract.Requires(term != null);
     }
-    public override Expression LogicalBody() {
+    public override Expression LogicalBody(bool bypassSplitQuantifier = false) {
       if (Range == null) {
         return Term;
       }
diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index 43b69bbb..7c684fde 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -1730,8 +1730,7 @@ namespace Microsoft.Dafny {
       } else if (expr is QuantifierExpr) {
         QuantifierExpr e = (QuantifierExpr)expr;
 
-        if (e.SplitQuantifier != null) {
-          // CLEMENT TODO TRIGGERS: Should (do) we have a setting to print the original forms instead of rewritten forms?
+        if (DafnyOptions.O.DafnyPrintResolvedFile != null && e.SplitQuantifier != null) {
           PrintExpr(e.SplitQuantifierExpression, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent, resolv_count);
           return;
         }
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index f0b7f276..df816b6d 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -5306,6 +5306,7 @@ namespace Microsoft.Dafny {
 
         if (q != null && q.SplitQuantifier != null) {
           CheckWellformedWithResult(q.SplitQuantifierExpression, options, result, resultType, locals, builder, etran);
+          return;
         }
 
         var typeMap = new Dictionary<TypeParameter, Type>();
-- 
cgit v1.2.3


From 5b155d0270984f7e92565e5b329bfed05991d01b Mon Sep 17 00:00:00 2001
From: Bryan Parno <parno@microsoft.com>
Date: Mon, 17 Aug 2015 10:45:55 -0700
Subject: Update the way bounds are discovered to try to choose "better"
 bounds.

---
 Source/Dafny/DafnyAst.cs |  48 +++++++++
 Source/Dafny/Resolver.cs | 261 ++++++++++++++++++++++++-----------------------
 2 files changed, 184 insertions(+), 125 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index fe6ebfc1..1b2af648 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -3937,6 +3937,9 @@ namespace Microsoft.Dafny {
       public override bool IsFinite {
         get { return false; }
       }
+      public override int Preference() {
+        return 0;
+      }
     }
 
     /// <summary>
@@ -6683,9 +6686,33 @@ namespace Microsoft.Dafny {
       public virtual bool IsFinite {
         get { return true; }  // most bounds are finite
       }
+      public abstract int Preference(); // higher is better
+      
+      public static BoundedPool GetBest(List<BoundedPool> bounds) {
+        Contract.Requires(bounds != null && bounds.Count > 0);
+        var ret = bounds[0];
+        foreach (var bound in bounds) {
+          if (bound.Preference() > ret.Preference()) {
+            ret = bound;
+          } else {            
+            var retInt = ret as ComprehensionExpr.IntBoundedPool;
+            if (retInt != null && (retInt.LowerBound == null || retInt.UpperBound == null)) {
+              var boundInt = bound as ComprehensionExpr.IntBoundedPool;
+              if (boundInt != null) {
+                ret = new ComprehensionExpr.IntBoundedPool(retInt.LowerBound ?? boundInt.LowerBound, 
+                                                           retInt.UpperBound ?? boundInt.UpperBound);
+              }
+            }         
+          }
+        }
+        return ret;
+      }
     }
     public class BoolBoundedPool : BoundedPool
     {
+      public override int Preference() {
+        return 5;
+      }
     }
     public class IntBoundedPool : BoundedPool
     {
@@ -6700,36 +6727,57 @@ namespace Microsoft.Dafny {
           return LowerBound != null && UpperBound != null;
         }
       }
+      public override int Preference() {
+        return 1;
+      }
     }
     public class SetBoundedPool : BoundedPool
     {
       public readonly Expression Set;
       public SetBoundedPool(Expression set) { Set = set; }
+      public override int Preference() {
+        return 10;
+      }
     }
     public class SubSetBoundedPool : BoundedPool
     {
       public readonly Expression UpperBound;
       public SubSetBoundedPool(Expression set) { UpperBound = set; }
+      public override int Preference() {
+        return 1;
+      }
     }
     public class SuperSetBoundedPool : BoundedPool
     {
       public readonly Expression LowerBound;
       public SuperSetBoundedPool(Expression set) { LowerBound = set; }
+      public override int Preference() {
+        return 0;
+      }
     }
     public class MapBoundedPool : BoundedPool
     {
       public readonly Expression Map;
       public MapBoundedPool(Expression map) { Map = map; }
+      public override int Preference() {
+        return 10;
+      }
     }
     public class SeqBoundedPool : BoundedPool
     {
       public readonly Expression Seq;
       public SeqBoundedPool(Expression seq) { Seq = seq; }
+      public override int Preference() {
+        return 10;
+      }
     }
     public class DatatypeBoundedPool : BoundedPool
     {
       public readonly DatatypeDecl Decl;
       public DatatypeBoundedPool(DatatypeDecl d) { Decl = d; }
+      public override int Preference() {
+        return 5;
+      }
     }
 
     public List<BoundedPool> Bounds;  // initialized and filled in by resolver
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 2da365a9..1bf96d7d 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -6091,9 +6091,8 @@ namespace Microsoft.Dafny
           Contract.Assert(allBounds != null);
           s.Bounds = new List<ComprehensionExpr.BoundedPool>();
           foreach (var pair in allBounds) {
-            Contract.Assert(1 <= pair.Item2.Count);
-            // TODO: The following could be improved by picking the bound that is most likely to give rise to an efficient compiled program
-            s.Bounds.Add(pair.Item2[0]);
+            Contract.Assert(1 <= pair.Item2.Count);                                             
+            s.Bounds.Add(ComprehensionExpr.BoundedPool.GetBest(pair.Item2));
           }
         }
       }
@@ -9463,136 +9462,148 @@ namespace Microsoft.Dafny
         expr = polarity ? Expression.CreateAnd(c, expr) : Expression.CreateImplies(c, expr);
       }
       for (int j = 0; j < bvars.Count; j++) {
-        var bv = bvars[j];
-        var bounds = new List<ComprehensionExpr.BoundedPool>();
-        if (bv.Type.IsBoolType) {
-          // easy
-          bounds.Add(new ComprehensionExpr.BoolBoundedPool());
-        } else {
-          bool foundBoundsForBv = false;
-          if (bv.Type.IsIndDatatype && bv.Type.AsIndDatatype.HasFinitePossibleValues) {
-            bounds.Add(new ComprehensionExpr.DatatypeBoundedPool(bv.Type.AsIndDatatype));
-            foundBoundsForBv = true;
+        VT bv;
+        List<ComprehensionExpr.BoundedPool> bounds;
+        foundError = DiscoverAuxSingle<VT>(bvars, expr, polarity, returnAllBounds, true, allowAnyIntegers, missingBounds, foundError, j, out bv, out bounds);
+        if (!returnAllBounds && bounds.Count > 1) {
+          var best = ComprehensionExpr.BoundedPool.GetBest(bounds);
+          bounds = new List<ComprehensionExpr.BoundedPool>() { best };
+        }
+
+        allBounds.Add(new Tuple<VT, List<ComprehensionExpr.BoundedPool>>(bv, bounds));
+      }
+      return foundError ? null : allBounds;
+    }
+
+    private static bool DiscoverAuxSingle<VT>(List<VT> bvars, Expression expr, bool polarity, bool allowPartialBounds, bool returnAllBounds, bool allowAnyIntegers, List<VT> missingBounds, bool foundError, int j, out VT bv, out List<ComprehensionExpr.BoundedPool> bounds) where VT : IVariable {
+      bv = bvars[j];
+      bounds = new List<ComprehensionExpr.BoundedPool>();
+      if (bv.Type.IsBoolType) {
+        // easy
+        bounds.Add(new ComprehensionExpr.BoolBoundedPool());
+      } else {
+        bool foundBoundsForBv = false;
+        if (bv.Type.IsIndDatatype && bv.Type.AsIndDatatype.HasFinitePossibleValues) {
+          bounds.Add(new ComprehensionExpr.DatatypeBoundedPool(bv.Type.AsIndDatatype));
+          foundBoundsForBv = true;
+        }
+        // Go through the conjuncts of the range expression to look for bounds.
+        Expression lowerBound = null;
+        Expression upperBound = null;
+        if ((allowPartialBounds || returnAllBounds) && lowerBound != null) {
+          bounds.Add(new ComprehensionExpr.IntBoundedPool(lowerBound, upperBound));
+          lowerBound = null;
+          foundBoundsForBv = true;
+        }
+        foreach (var conjunct in NormalizedConjuncts(expr, polarity)) {
+          var c = conjunct as BinaryExpr;
+          if (c == null) {
+            goto CHECK_NEXT_CONJUNCT;
+          }
+          var e0 = c.E0;
+          var e1 = c.E1;
+          int whereIsBv = SanitizeForBoundDiscovery(bvars, j, c.ResolvedOp, ref e0, ref e1);
+          if (whereIsBv < 0) {
+            goto CHECK_NEXT_CONJUNCT;
+          }
+          switch (c.ResolvedOp) {
+            case BinaryExpr.ResolvedOpcode.InSet:
+              if (whereIsBv == 0) {
+                bounds.Add(new ComprehensionExpr.SetBoundedPool(e1));
+                foundBoundsForBv = true;
+                if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
+              }
+              break;
+            case BinaryExpr.ResolvedOpcode.Subset:
+              if (returnAllBounds) {
+                if (whereIsBv == 0) {
+                  bounds.Add(new ComprehensionExpr.SubSetBoundedPool(e1));
+                } else {
+                  bounds.Add(new ComprehensionExpr.SuperSetBoundedPool(e0));
+                }
+                foundBoundsForBv = true;
+              }
+              break;
+            case BinaryExpr.ResolvedOpcode.InMultiSet:
+              if (whereIsBv == 0) {
+                bounds.Add(new ComprehensionExpr.SetBoundedPool(e1));
+                foundBoundsForBv = true;
+                if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
+              }
+              break;
+            case BinaryExpr.ResolvedOpcode.InSeq:
+              if (whereIsBv == 0) {
+                bounds.Add(new ComprehensionExpr.SeqBoundedPool(e1));
+                foundBoundsForBv = true;
+                if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
+              }
+              break;
+            case BinaryExpr.ResolvedOpcode.InMap:
+              if (whereIsBv == 0 && e1.Type.AsMapType.Finite) {
+                bounds.Add(new ComprehensionExpr.MapBoundedPool(e1));
+                foundBoundsForBv = true;
+                if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
+              }
+              break;
+            case BinaryExpr.ResolvedOpcode.EqCommon:
+              if (bv.Type is IntType) {
+                var otherOperand = whereIsBv == 0 ? e1 : e0;
+                bounds.Add(new ComprehensionExpr.IntBoundedPool(otherOperand, Expression.CreateIncrement(otherOperand, 1)));
+                foundBoundsForBv = true;
+                if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
+              } else if (returnAllBounds && bv.Type is SetType) {
+                var otherOperand = whereIsBv == 0 ? e1 : e0;
+                bounds.Add(new ComprehensionExpr.SubSetBoundedPool(otherOperand));
+                foundBoundsForBv = true;
+              }
+              break;
+            case BinaryExpr.ResolvedOpcode.Gt:
+            case BinaryExpr.ResolvedOpcode.Ge:
+              Contract.Assert(false); throw new cce.UnreachableException();  // promised by postconditions of NormalizedConjunct
+            case BinaryExpr.ResolvedOpcode.Lt:
+              if (e0.Type.IsNumericBased(Type.NumericPersuation.Int)) {
+                if (whereIsBv == 0 && upperBound == null) {
+                  upperBound = e1;  // bv < E
+                } else if (whereIsBv == 1 && lowerBound == null) {
+                  lowerBound = Expression.CreateIncrement(e0, 1);  // E < bv
+                }
+              }
+              break;
+            case BinaryExpr.ResolvedOpcode.Le:
+              if (e0.Type.IsNumericBased(Type.NumericPersuation.Int)) {
+                if (whereIsBv == 0 && upperBound == null) {
+                  upperBound = Expression.CreateIncrement(e1, 1);  // bv <= E
+                } else if (whereIsBv == 1 && lowerBound == null) {
+                  lowerBound = e0;  // E <= bv
+                }
+              }
+              break;
+            default:
+              break;
           }
-          // Go through the conjuncts of the range expression to look for bounds.
-          Expression lowerBound = null;
-          Expression upperBound = null;
-          if (returnAllBounds && lowerBound != null) {
+          if ((lowerBound != null && upperBound != null) ||
+              (allowPartialBounds && (lowerBound != null || upperBound != null))) {
+            // we have found two halves (or, in the case of returnAllBounds, we have found some bound)
             bounds.Add(new ComprehensionExpr.IntBoundedPool(lowerBound, upperBound));
             lowerBound = null;
+            upperBound = null;
             foundBoundsForBv = true;
+            if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
           }
-          foreach (var conjunct in NormalizedConjuncts(expr, polarity)) {
-            var c = conjunct as BinaryExpr;
-            if (c == null) {
-              goto CHECK_NEXT_CONJUNCT;
-            }
-            var e0 = c.E0;
-            var e1 = c.E1;
-            int whereIsBv = SanitizeForBoundDiscovery(bvars, j, c.ResolvedOp, ref e0, ref e1);
-            if (whereIsBv < 0) {
-              goto CHECK_NEXT_CONJUNCT;
-            }
-            switch (c.ResolvedOp) {
-              case BinaryExpr.ResolvedOpcode.InSet:
-                if (whereIsBv == 0) {
-                  bounds.Add(new ComprehensionExpr.SetBoundedPool(e1));
-                  foundBoundsForBv = true;
-                  if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
-                }
-                break;
-              case BinaryExpr.ResolvedOpcode.Subset:
-                if (returnAllBounds) {
-                  if (whereIsBv == 0) {
-                    bounds.Add(new ComprehensionExpr.SubSetBoundedPool(e1));
-                  } else {
-                    bounds.Add(new ComprehensionExpr.SuperSetBoundedPool(e0));
-                  }
-                  foundBoundsForBv = true;
-                }
-                break;
-              case BinaryExpr.ResolvedOpcode.InMultiSet:
-                if (whereIsBv == 0) {
-                  bounds.Add(new ComprehensionExpr.SetBoundedPool(e1));
-                  foundBoundsForBv = true;
-                  if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
-                }
-                break;
-              case BinaryExpr.ResolvedOpcode.InSeq:
-                if (whereIsBv == 0) {
-                  bounds.Add(new ComprehensionExpr.SeqBoundedPool(e1));
-                  foundBoundsForBv = true;
-                  if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
-                }
-                break;
-              case BinaryExpr.ResolvedOpcode.InMap:
-                if (whereIsBv == 0 && e1.Type.AsMapType.Finite) {
-                  bounds.Add(new ComprehensionExpr.MapBoundedPool(e1));
-                  foundBoundsForBv = true;
-                  if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
-                }
-                break;
-              case BinaryExpr.ResolvedOpcode.EqCommon:
-                if (bv.Type is IntType) {
-                  var otherOperand = whereIsBv == 0 ? e1 : e0;
-                  bounds.Add(new ComprehensionExpr.IntBoundedPool(otherOperand, Expression.CreateIncrement(otherOperand, 1)));
-                  foundBoundsForBv = true;
-                  if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
-                } else if (returnAllBounds && bv.Type is SetType) {
-                  var otherOperand = whereIsBv == 0 ? e1 : e0;
-                  bounds.Add(new ComprehensionExpr.SubSetBoundedPool(otherOperand));
-                  foundBoundsForBv = true;
-                }
-                break;
-              case BinaryExpr.ResolvedOpcode.Gt:
-              case BinaryExpr.ResolvedOpcode.Ge:
-                Contract.Assert(false); throw new cce.UnreachableException();  // promised by postconditions of NormalizedConjunct
-              case BinaryExpr.ResolvedOpcode.Lt:
-                if (e0.Type.IsNumericBased(Type.NumericPersuation.Int)) {
-                  if (whereIsBv == 0 && upperBound == null) {
-                    upperBound = e1;  // bv < E
-                  } else if (whereIsBv == 1 && lowerBound == null) {
-                    lowerBound = Expression.CreateIncrement(e0, 1);  // E < bv
-                  }
-                }
-                break;
-              case BinaryExpr.ResolvedOpcode.Le:
-                if (e0.Type.IsNumericBased(Type.NumericPersuation.Int)) {
-                  if (whereIsBv == 0 && upperBound == null) {
-                    upperBound = Expression.CreateIncrement(e1, 1);  // bv <= E
-                  } else if (whereIsBv == 1 && lowerBound == null) {
-                    lowerBound = e0;  // E <= bv
-                  }
-                }
-                break;
-              default:
-                break;
-            }
-            if ((lowerBound != null && upperBound != null) ||
-                (returnAllBounds && (lowerBound != null || upperBound != null))) {
-              // we have found two halves (or, in the case of returnAllBounds, we have found some bound)
-              bounds.Add(new ComprehensionExpr.IntBoundedPool(lowerBound, upperBound));
-              lowerBound = null;
-              upperBound = null;
-              foundBoundsForBv = true;
-              if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
-            }
-          CHECK_NEXT_CONJUNCT: ;
-          }
-          if (!foundBoundsForBv) {
-            // we have checked every conjunct in the range expression and still have not discovered good bounds
-            if (allowAnyIntegers && bv.Type is IntType) {
-              bounds.Add(new AssignSuchThatStmt.WiggleWaggleBound());
-            } else {
-              missingBounds.Add(bv);  // record failing bound variable
-              foundError = true;
-            }
+        CHECK_NEXT_CONJUNCT: ;
+        }
+        if (!foundBoundsForBv) {
+          // we have checked every conjunct in the range expression and still have not discovered good bounds
+          if (allowAnyIntegers && bv.Type is IntType) {
+            bounds.Add(new AssignSuchThatStmt.WiggleWaggleBound());
+          } else {
+            missingBounds.Add(bv);  // record failing bound variable
+            foundError = true;
           }
         }
-      CHECK_NEXT_BOUND_VARIABLE: ;  // should goto here only if the bound for the current variable has been discovered (otherwise, return with null from this method)
-      allBounds.Add(new Tuple<VT, List<ComprehensionExpr.BoundedPool>>(bv, bounds));
       }
-      return foundError ? null : allBounds;
+    CHECK_NEXT_BOUND_VARIABLE: ;  // should goto here only if the bound for the current variable has been discovered (otherwise, return with null from this method)
+      return foundError;
     }
 
     static Expression TypeConstraint(IVariable bv, Type ty) {
-- 
cgit v1.2.3


From 747e2d218f49683605d52f70dbb372f37d9f304b Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Mon, 17 Aug 2015 16:04:31 -0700
Subject: Changed hover-text location for recursive ind/co-lemma calls

---
 Source/Dafny/Cloner.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index 0a5ca245..e85eeaca 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -837,7 +837,7 @@ namespace Microsoft.Dafny
           apply.Args.ForEach(arg => args.Add(CloneExpr(arg)));
           var applyClone = new ApplySuffix(Tok(apply.tok), lhsClone, args);
           var c = new ExprRhs(applyClone);
-          ReportAdditionalInformation(apply.tok, mse.Member.Name);
+          ReportAdditionalInformation(apply.Lhs.tok, mse.Member.Name);
           return c;
         }
       }
-- 
cgit v1.2.3


From 4b3fc0e7413424e27131dd8dd919423711f097ad Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Tue, 18 Aug 2015 08:46:35 -0700
Subject: Use a nice warning symbol in some warning messages

This is useful because trigger-related messages can contain quite a bit of
information, especially if they include info about multiple split quantifiers.
---
 Source/Dafny/DafnyOptions.cs                   |  1 +
 Source/Dafny/Triggers/QuantifiersCollection.cs | 58 +++++++++++++++-----------
 Source/DafnyServer/Server.cs                   |  4 +-
 Source/DafnyServer/Utilities.cs                |  5 ++-
 4 files changed, 40 insertions(+), 28 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index 66cf639f..245632ad 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -40,6 +40,7 @@ namespace Microsoft.Dafny
       Bpl.CommandLineOptions.Install(options);
     }
 
+    public bool UnicodeOutput = false;
     public bool DisallowSoundnessCheating = false;
     public bool Dafnycc = false;
     public int Induction = 3;
diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index 828e0e18..cbc212d2 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -132,55 +132,63 @@ namespace Microsoft.Dafny.Triggers {
       //FIXME
     }
 
-    private void CommitOne(QuantifierWithTriggers q, object conjunctId) {
+    private void CommitOne(QuantifierWithTriggers q, bool addHeader) {
       var errorLevel = ErrorLevel.Info;
       var msg = new StringBuilder();
-      var indent = conjunctId != null ? "    " : "  ";
-      var header = conjunctId != null ? String.Format("  For conjunct {0}:{1}", conjunctId, Environment.NewLine) : "";
+      var indent = addHeader ? "   " : " "; //FIXME if multiline messages were properly supported, this indentation wouldn't be needed
 
-      if (!TriggerUtils.NeedsAutoTriggers(q.quantifier)) { //FIXME: no_trigger is passed down to Boogie
-        msg.Append(indent).AppendLine("Not generating triggers for this quantifier.");
+      if (!TriggerUtils.NeedsAutoTriggers(q.quantifier)) { //FIXME: matchingloop and autotriggers attributes are passed down to Boogie
+        msg.AppendFormat("  Not generating triggers for {{{0}}}.", Printer.ExprToString(q.quantifier.Term)).AppendLine(); 
+        // FIXME This shouldn't be printed for autoReqs. (see autoReq.dfy)
+        // FIXME typeQuantifier?
       } else {
-        foreach (var candidate in q.Candidates) {
-          q.quantifier.Attributes = new Attributes("trigger", candidate.Terms.Select(t => t.Expr).ToList(), q.quantifier.Attributes);
+        if (addHeader) {
+          msg.AppendFormat("  For expression {{{0}}}:", Printer.ExprToString(q.quantifier.Term)).AppendLine();
         }
 
-        if (q.Candidates.Any()) {
-          msg.Append(indent).AppendLine("Selected triggers:");
-          foreach (var mc in q.Candidates) {
-            msg.Append(indent).Append("  ").AppendLine(mc.ToString());
-          }
+        foreach (var candidate in q.Candidates) { //FIXME make this _trigger instead of trigger
+          q.quantifier.Attributes = new Attributes("trigger", candidate.Terms.Select(t => t.Expr).ToList(), q.quantifier.Attributes);
         }
 
-        if (q.RejectedCandidates.Any()) {
-          msg.Append(indent).AppendLine("Rejected triggers:");
-          foreach (var mc in q.RejectedCandidates) {
-            msg.Append(indent).Append("  ").AppendLine(mc.ToString());
-          }
-        }
+        AddTriggersToMessage("Selected triggers:", q.Candidates, msg, indent);
+        AddTriggersToMessage("Rejected triggers:", q.RejectedCandidates, msg, indent, true);
 
 #if QUANTIFIER_WARNINGS
+        string WARN = DafnyOptions.O.UnicodeOutput ? "⚠ " : "(!) "; //FIXME set unicodeoutput in extension
         if (!q.CandidateTerms.Any()) {
           errorLevel = ErrorLevel.Warning;
-          msg.Append(indent).AppendLine("No terms found to trigger on.");
+          msg.Append(indent).Append(WARN).AppendLine("No terms found to trigger on.");
         } else if (!q.Candidates.Any()) {
           errorLevel = ErrorLevel.Warning;
-          msg.Append(indent).AppendLine("No trigger covering all quantified variables found.");
-        } else if (!q.CouldSuppressLoops) {
+          msg.Append(indent).Append(WARN).AppendLine("No trigger covering all quantified variables found.");
+        } else if (!q.CouldSuppressLoops && !q.AllowsLoops) {
           errorLevel = ErrorLevel.Warning;
-          msg.Append(indent).AppendLine("Suppressing loops would leave this quantifier without triggers.");
+          msg.Append(indent).Append(WARN).AppendLine("Suppressing loops would leave this expression without triggers.");
         }
 #endif
       }
-
+      
       if (msg.Length > 0) {
-        reporter.Message(MessageSource.Rewriter, errorLevel, q.quantifier.tok, header + msg.ToString());
+        reporter.Message(MessageSource.Rewriter, errorLevel, q.quantifier.tok, msg.ToString().TrimEnd("\r\n".ToCharArray()));
+      }
+    }
+
+    private static void AddTriggersToMessage<T>(string header, List<T> triggers, StringBuilder msg, string indent, bool newlines = false) {
+      if (triggers.Any()) {
+        msg.Append(indent).Append(header);
+        if (triggers.Count == 1) {
+          msg.Append(" ");
+        } else if (triggers.Count > 1) {
+          msg.AppendLine().Append(indent).Append("  ");
+        }
+        var separator = newlines && triggers.Count > 1 ? Environment.NewLine + indent + "  " : ", ";
+        msg.AppendLine(String.Join(separator, triggers));
       }
     }
 
     internal void CommitTriggers() {
       foreach (var q in quantifiers) {
-        CommitOne(q, quantifiers.Count > 1 ? q.quantifier : null);
+        CommitOne(q, quantifiers.Count > 1);
       }
     }
   }
diff --git a/Source/DafnyServer/Server.cs b/Source/DafnyServer/Server.cs
index 74cdd8c2..bdfd66b4 100644
--- a/Source/DafnyServer/Server.cs
+++ b/Source/DafnyServer/Server.cs
@@ -33,11 +33,13 @@ namespace Microsoft.Dafny {
     public Server() {
       this.running = true;
       Console.CancelKeyPress += this.CancelKeyPress;
+      Console.InputEncoding = System.Text.Encoding.UTF8;
+      Console.OutputEncoding = System.Text.Encoding.UTF8;
       ExecutionEngine.printer = new DafnyConsolePrinter();
     }
 
     void CancelKeyPress(object sender, ConsoleCancelEventArgs e) {
-      e.Cancel = true;
+      // e.Cancel = true;
       // FIXME TerminateProver and RunningProverFromCommandLine
       // Cancel the current verification? TerminateProver() ? Or kill entirely?
     }
diff --git a/Source/DafnyServer/Utilities.cs b/Source/DafnyServer/Utilities.cs
index 8fb03b05..4b06e9f5 100644
--- a/Source/DafnyServer/Utilities.cs
+++ b/Source/DafnyServer/Utilities.cs
@@ -45,13 +45,14 @@ namespace Microsoft.Dafny {
 
     internal static void ApplyArgs(string[] args) {
       Dafny.DafnyOptions.Install(new Dafny.DafnyOptions());
+      Dafny.DafnyOptions.O.ProverKillTime = 10;
 
       if (CommandLineOptions.Clo.Parse(args)) {
         // Dafny.DafnyOptions.O.ErrorTrace = 0; //FIXME
         // Dafny.DafnyOptions.O.ModelViewFile = "-";
-        Dafny.DafnyOptions.O.ProverKillTime = 10;
-        Dafny.DafnyOptions.O.VcsCores = Math.Max(1, System.Environment.ProcessorCount - 1);
+        Dafny.DafnyOptions.O.UnicodeOutput = true;
         Dafny.DafnyOptions.O.VerifySnapshots = 2;
+        Dafny.DafnyOptions.O.VcsCores = Math.Max(1, System.Environment.ProcessorCount - 1);
       } else {
         throw new ServerException("Invalid command line options");
       }
-- 
cgit v1.2.3


From 108e634af783601c60555c2e8e75775c3b4041ed Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Tue, 18 Aug 2015 08:47:40 -0700
Subject: Small cleanups, fixes, and refactorings

In particular, start detecting loops between terms that don't look like each
other at the Dafny level, such as {a[x]} and {x in a} (when a is a multiset)
---
 Source/Dafny/DafnyPipeline.csproj              |  2 +-
 Source/Dafny/Rewriter.cs                       |  2 +-
 Source/Dafny/Triggers/QuantifiersCollection.cs |  8 ++--
 Source/Dafny/Triggers/QuantifiersCollector.cs  | 33 +++++++++++++++
 Source/Dafny/Triggers/TriggerExtensions.cs     | 15 ++++---
 Source/Dafny/Triggers/TriggerGenerator.cs      | 32 ---------------
 Source/Dafny/Triggers/TriggerUtils.cs          | 56 ++++++++++++++++++++++++-
 Source/Dafny/Triggers/TriggersCollector.cs     | 57 ++++----------------------
 8 files changed, 111 insertions(+), 94 deletions(-)
 create mode 100644 Source/Dafny/Triggers/QuantifiersCollector.cs
 delete mode 100644 Source/Dafny/Triggers/TriggerGenerator.cs

(limited to 'Source')

diff --git a/Source/Dafny/DafnyPipeline.csproj b/Source/Dafny/DafnyPipeline.csproj
index 5a824c36..13a1e53e 100644
--- a/Source/Dafny/DafnyPipeline.csproj
+++ b/Source/Dafny/DafnyPipeline.csproj
@@ -147,7 +147,7 @@
     <Compile Include="Triggers\QuantifiersCollection.cs" />
     <Compile Include="Triggers\QuantifierSplitter.cs" />
     <Compile Include="Triggers\TriggerExtensions.cs" />
-    <Compile Include="Triggers\TriggerGenerator.cs" />
+    <Compile Include="Triggers\QuantifiersCollector.cs" />
     <Compile Include="Triggers\TriggersCollector.cs" />
     <Compile Include="Triggers\TriggerUtils.cs" />
     <Compile Include="Util.cs" />
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 2c00e203..b6409b96 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -44,7 +44,7 @@ namespace Microsoft.Dafny
     }
 
     internal override void PostCyclicityResolve(ModuleDefinition m) {
-      var finder = new Triggers.QuantifierCollectionsFinder(reporter);
+      var finder = new Triggers.QuantifierCollector(reporter);
         
       foreach (var decl in ModuleDefinition.AllCallables(m.TopLevelDecls)) {
         if (decl is Function) {
diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index cbc212d2..01bceeb7 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -17,7 +17,7 @@ namespace Microsoft.Dafny.Triggers {
     internal List<TriggerCandidate> Candidates;
     internal List<TriggerCandidate> RejectedCandidates;
 
-    internal bool AllowsLoops { get { return quantifier.Attributes.AsEnumerable().Any(a => a.Name == "loop"); } }
+    internal bool AllowsLoops { get { return TriggerUtils.AllowsMatchingLoops(quantifier); } }
     internal bool CouldSuppressLoops { get; set; }
 
     internal QuantifierWithTriggers(QuantifierExpr quantifier) {
@@ -65,8 +65,8 @@ namespace Microsoft.Dafny.Triggers {
       var multiPool = TriggerUtils.AllNonEmptySubsets(distinctPool, SubsetGenerationPredicate).Select(candidates => new TriggerCandidate(candidates)).ToList();
 
       foreach (var q in quantifiers) {
-        q.CandidateTerms = distinctPool;
-        q.Candidates = multiPool;
+        q.CandidateTerms = distinctPool; //Candidate terms are immutable: no copy needed
+        q.Candidates = multiPool.Select(candidate => new TriggerCandidate(candidate)).ToList();
       }
     }
 
@@ -116,7 +116,7 @@ namespace Microsoft.Dafny.Triggers {
           c => !loopingSubterms[c].Any(),
           c => {
             looping.Add(c);
-            c.Annotation = "loop with " + loopingSubterms[c].MapConcat(t => Printer.ExprToString(t.Expr), ", ");
+            c.Annotation = "loops with " + loopingSubterms[c].MapConcat(t => Printer.ExprToString(t.Expr), ", ");
           }).ToList();
 
         q.CouldSuppressLoops = safe.Count > 0;
diff --git a/Source/Dafny/Triggers/QuantifiersCollector.cs b/Source/Dafny/Triggers/QuantifiersCollector.cs
new file mode 100644
index 00000000..a43aae7a
--- /dev/null
+++ b/Source/Dafny/Triggers/QuantifiersCollector.cs
@@ -0,0 +1,33 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using Microsoft.Boogie;
+using System.Collections.ObjectModel;
+using System.Diagnostics.Contracts;
+
+namespace Microsoft.Dafny.Triggers { //FIXME rename this file
+  internal class QuantifierCollector : TopDownVisitor<object> {
+    readonly ErrorReporter reporter;
+    internal List<QuantifiersCollection> quantifierCollections = new List<QuantifiersCollection>();
+
+    public QuantifierCollector(ErrorReporter reporter) {
+      Contract.Requires(reporter != null);
+      this.reporter = reporter;
+    }
+
+    protected override bool VisitOneExpr(Expression expr, ref object st) {
+      var quantifier = expr as QuantifierExpr;
+      if (quantifier != null) {
+        if (quantifier.SplitQuantifier != null) {
+          var collection = quantifier.SplitQuantifier.Select(q => q as QuantifierExpr).Where(q => q != null);
+          quantifierCollections.Add(new QuantifiersCollection(collection, reporter));
+          return false;
+        } else {
+          quantifierCollections.Add(new QuantifiersCollection(Enumerable.Repeat(quantifier, 1), reporter));
+        }
+      }
+      return true;
+    }
+  }
+}
diff --git a/Source/Dafny/Triggers/TriggerExtensions.cs b/Source/Dafny/Triggers/TriggerExtensions.cs
index 9fbc8a8a..0a0ad547 100644
--- a/Source/Dafny/Triggers/TriggerExtensions.cs
+++ b/Source/Dafny/Triggers/TriggerExtensions.cs
@@ -110,14 +110,18 @@ namespace Microsoft.Dafny.Triggers {
       return ShallowEq_Top(expr, trigger) && TriggerUtils.SameLists(expr.SubExpressions, trigger.SubExpressions, (e1, e2) => MatchesTrigger(e1, e2, holes, bindings));
     }
 
-    private static TriggerMatch? MatchAgainst(this Expression expr, Expression trigger, ISet<BoundVar> holes) {
+    private static TriggerMatch? MatchAgainst(this Expression expr, Expression trigger, IEnumerable<BoundVar> holes) {
       var bindings = new Dictionary<IVariable, Expression>();
-      return expr.MatchesTrigger(trigger, holes, bindings) ? new TriggerMatch { Expr = expr, Bindings = bindings } : (TriggerMatch?)null;
+      if (expr.MatchesTrigger(trigger, new HashSet<BoundVar>(holes), bindings)) {
+        return new TriggerMatch { Expr = expr, Bindings = bindings };
+      } else {
+        return null;
+      }
     }
 
     internal static IEnumerable<TriggerMatch> SubexpressionsMatchingTrigger(this QuantifierExpr quantifier, Expression trigger) {
       return quantifier.Term.AllSubExpressions()
-        .Select(e => e.MatchAgainst(trigger, new HashSet<BoundVar>(quantifier.BoundVars)))
+        .Select(e => TriggerUtils.CleanupExprForInclusionInTrigger(e).MatchAgainst(trigger, quantifier.BoundVars))
         .Where(e => e.HasValue).Select(e => e.Value);
     }
 
@@ -136,7 +140,8 @@ namespace Microsoft.Dafny.Triggers {
               arg1.DisplayName == arg2.DisplayName &&
               arg1.UniqueName == arg2.UniqueName &&
               arg1.IsGhost == arg2.IsGhost &&
-              arg1.IsMutable == arg2.IsMutable); //FIXME compare types?
+              arg1.IsMutable == arg2.IsMutable &&
+              ((arg1.Type == null && arg2.Type == null) || arg1.Type.Equals(arg2.Type))); 
     }
 
     /// <summary>
@@ -271,7 +276,7 @@ namespace Microsoft.Dafny.Triggers {
       return true;
     }
 
-    private static bool ShallowEq(QuantifierExpr expr1, QuantifierExpr expr2) { //FIXME are these TypeArgs still useful?
+    private static bool ShallowEq(QuantifierExpr expr1, QuantifierExpr expr2) {
       if (!TriggerUtils.SameNullity(expr1.SplitQuantifier, expr2.SplitQuantifier)) {
         return false;
       }
diff --git a/Source/Dafny/Triggers/TriggerGenerator.cs b/Source/Dafny/Triggers/TriggerGenerator.cs
deleted file mode 100644
index e218ad7b..00000000
--- a/Source/Dafny/Triggers/TriggerGenerator.cs
+++ /dev/null
@@ -1,32 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Text;
-using Microsoft.Boogie;
-using System.Collections.ObjectModel;
-using System.Diagnostics.Contracts;
-
-namespace Microsoft.Dafny.Triggers { //FIXME rename this file
-  internal class QuantifierCollectionsFinder : TopDownVisitor<object> {
-    readonly ErrorReporter reporter;
-    internal List<QuantifiersCollection> quantifierCollections = new List<QuantifiersCollection>();
-
-    public QuantifierCollectionsFinder(ErrorReporter reporter) {
-      Contract.Requires(reporter != null);
-      this.reporter = reporter;
-    }
-
-    protected override bool VisitOneExpr(Expression expr, ref object st) {
-      var quantifier = expr as QuantifierExpr;
-      if (quantifier != null) {
-        if (quantifier.SplitQuantifier != null) {
-          var collection = quantifier.SplitQuantifier.Select(q => q as QuantifierExpr).Where(q => q != null);
-          quantifierCollections.Add(new QuantifiersCollection(collection, reporter));
-        } else {
-          quantifierCollections.Add(new QuantifiersCollection(Enumerable.Repeat(quantifier, 1), reporter));
-        }
-      }
-      return true;
-    }
-  }
-}
diff --git a/Source/Dafny/Triggers/TriggerUtils.cs b/Source/Dafny/Triggers/TriggerUtils.cs
index 6c6eede2..9ebcf846 100644
--- a/Source/Dafny/Triggers/TriggerUtils.cs
+++ b/Source/Dafny/Triggers/TriggerUtils.cs
@@ -100,9 +100,63 @@ namespace Microsoft.Dafny.Triggers {
       Console.Error.WriteLine(format, more);
     }
 
+    internal static bool AllowsMatchingLoops(QuantifierExpr quantifier) {
+      Contract.Requires(quantifier.SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
+      return Attributes.Contains(quantifier.Attributes, "matchingloop");
+    }
+
     internal static bool NeedsAutoTriggers(QuantifierExpr quantifier) {
       Contract.Requires(quantifier.SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
-      return quantifier.Attributes.AsEnumerable().All(aa => aa.Name != "trigger" && aa.Name != "no_trigger");
+      bool wantsAutoTriggers = true;
+      return !Attributes.Contains(quantifier.Attributes, "trigger") && 
+        (!Attributes.ContainsBool(quantifier.Attributes, "autotriggers", ref wantsAutoTriggers) || wantsAutoTriggers);
+    }
+
+    internal static BinaryExpr.ResolvedOpcode RemoveNotInBinaryExprIn(BinaryExpr.ResolvedOpcode opcode) {
+      switch (opcode) {
+        case BinaryExpr.ResolvedOpcode.NotInMap:
+          return BinaryExpr.ResolvedOpcode.InMap;
+        case BinaryExpr.ResolvedOpcode.NotInSet:
+          return BinaryExpr.ResolvedOpcode.InSet;
+        case BinaryExpr.ResolvedOpcode.NotInSeq:
+          return BinaryExpr.ResolvedOpcode.InSeq;
+        case BinaryExpr.ResolvedOpcode.NotInMultiSet:
+          return BinaryExpr.ResolvedOpcode.InMultiSet;
+      }
+
+      Contract.Assert(false);
+      throw new ArgumentException();
+    }
+
+    internal static Expression CleanupExprForInclusionInTrigger(Expression expr, out bool isKiller) {
+      isKiller = false;
+
+      if (!(expr is BinaryExpr)) {
+        return expr;
+      }
+
+      var bexpr = expr as BinaryExpr;
+
+      BinaryExpr new_expr = bexpr;
+      if (bexpr.Op == BinaryExpr.Opcode.NotIn) {
+        new_expr = new BinaryExpr(bexpr.tok, BinaryExpr.Opcode.In, bexpr.E0, bexpr.E1);
+        new_expr.ResolvedOp = RemoveNotInBinaryExprIn(bexpr.ResolvedOp);
+        new_expr.Type = bexpr.Type;
+      }
+
+      Expression returned_expr = new_expr;
+      if (new_expr.ResolvedOp == BinaryExpr.ResolvedOpcode.InMultiSet) {
+        returned_expr = new SeqSelectExpr(new_expr.tok, true, new_expr.E1, new_expr.E0, null);
+        returned_expr.Type = bexpr.Type;
+        isKiller = true; // [a in s] becomes [s[a] > 0], which is a trigger killer
+      }
+
+      return returned_expr;
+    }
+
+    internal static Expression CleanupExprForInclusionInTrigger(Expression expr) {
+      bool _;
+      return CleanupExprForInclusionInTrigger(expr, out _);
     }
   }
 }
diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index 9f721d9a..221a4255 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -9,10 +9,11 @@ using System.Diagnostics;
 namespace Microsoft.Dafny.Triggers {
   class TriggerTerm {
     internal Expression Expr { get; set; }
+    internal Expression OriginalExpr { get; set; }
     internal ISet<IVariable> Variables { get; set; }
 
     public override string ToString() {
-      return Printer.ExprToString(Expr);
+      return Printer.ExprToString(OriginalExpr);
     }
 
     internal static bool Eq(TriggerTerm t1, TriggerTerm t2) {
@@ -28,16 +29,15 @@ namespace Microsoft.Dafny.Triggers {
       this.Terms = terms;
     }
 
-    public TriggerCandidate(TriggerCandidate mc, string annotation) {
-      this.Terms = mc.Terms;
-      this.Annotation = annotation;
+    public TriggerCandidate(TriggerCandidate candidate) {
+      this.Terms = candidate.Terms;
     }
 
     internal bool MentionsAll(List<BoundVar> vars) {
       return vars.All(x => Terms.Any(term => term.Variables.Contains(x)));
     }
 
-    private string Repr { get { return Terms.MapConcat(t => Printer.ExprToString(t.Expr), ", "); } }
+    private string Repr { get { return String.Join(", ", Terms); } }
 
     public override string ToString() {
       return "{" + Repr + "}" + (String.IsNullOrWhiteSpace(Annotation) ? "" : " (" + Annotation + ")");
@@ -51,7 +51,6 @@ namespace Microsoft.Dafny.Triggers {
 
     internal List<TriggerMatch> MatchingSubterms(QuantifierExpr quantifier) {
       Contract.Requires(quantifier.SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
-      //FIXME this will miss rewritten expressions (CleanupExpr). Should introduce an OriginalExpr to compare against.
       return Terms.SelectMany(term => quantifier.SubexpressionsMatchingTrigger(term.Expr)).Deduplicate(TriggerMatch.Eq);
     }
 
@@ -166,52 +165,10 @@ namespace Microsoft.Dafny.Triggers {
       return annotation;
     }
 
-    private BinaryExpr.ResolvedOpcode RemoveNotInBinaryExprIn(BinaryExpr.ResolvedOpcode opcode) {
-      switch (opcode) {
-        case BinaryExpr.ResolvedOpcode.NotInMap:
-          return BinaryExpr.ResolvedOpcode.InMap;
-        case BinaryExpr.ResolvedOpcode.NotInSet:
-          return BinaryExpr.ResolvedOpcode.InSet;
-        case BinaryExpr.ResolvedOpcode.NotInSeq:
-          return BinaryExpr.ResolvedOpcode.InSeq;
-        case BinaryExpr.ResolvedOpcode.NotInMultiSet:
-          return BinaryExpr.ResolvedOpcode.InMultiSet;
-      }
-
-      Contract.Assert(false);
-      throw new ArgumentException();
-    }
-
-    private Expression CleanupExpr(Expression expr, out bool isKiller) {
-      isKiller = false;
-
-      if (!(expr is BinaryExpr)) {
-        return expr;
-      }
-
-      var bexpr = expr as BinaryExpr;
-
-      BinaryExpr new_expr = bexpr;
-      if (bexpr.Op == BinaryExpr.Opcode.NotIn) {
-        new_expr = new BinaryExpr(bexpr.tok, BinaryExpr.Opcode.In, bexpr.E0, bexpr.E1);
-        new_expr.ResolvedOp = RemoveNotInBinaryExprIn(bexpr.ResolvedOp);
-        new_expr.Type = bexpr.Type;
-      }
-
-      Expression returned_expr = new_expr;
-      if (new_expr.ResolvedOp == BinaryExpr.ResolvedOpcode.InMultiSet) {
-        returned_expr = new SeqSelectExpr(new_expr.tok, true, new_expr.E1, new_expr.E0, null);
-        returned_expr.Type = bexpr.Type;
-        isKiller = true; // [a in s] becomes [s[a] > 0], which is a trigger killer
-      }
-
-      return returned_expr;
-    }
-
     private TriggerAnnotation AnnotatePotentialCandidate(Expression expr) {
       bool expr_is_killer = false;
-      var new_expr = CleanupExpr(expr, out expr_is_killer);
-      var new_term = new TriggerTerm { Expr = new_expr, Variables = CollectVariables(expr) };
+      var new_expr = TriggerUtils.CleanupExprForInclusionInTrigger(expr, out expr_is_killer);
+      var new_term = new TriggerTerm { Expr = new_expr, OriginalExpr = expr, Variables = CollectVariables(expr) };
 
       List<TriggerTerm> collected_terms = CollectExportedCandidates(expr);
       var children_contain_killers = CollectIsKiller(expr);
-- 
cgit v1.2.3


From b4f926f38536d30b7d12c35cbf8f45fa7ef71c27 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Wed, 19 Aug 2015 10:37:49 -0700
Subject: Cleanup indentation of trigger warnings

---
 Source/Dafny/Triggers/QuantifiersCollection.cs | 12 ++++++------
 Test/dafny0/TriggerInPredicate.dfy             |  2 +-
 Test/dafny0/TriggerInPredicate.dfy.expect      |  2 ++
 3 files changed, 9 insertions(+), 7 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index 01bceeb7..aa008e36 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -138,12 +138,12 @@ namespace Microsoft.Dafny.Triggers {
       var indent = addHeader ? "   " : " "; //FIXME if multiline messages were properly supported, this indentation wouldn't be needed
 
       if (!TriggerUtils.NeedsAutoTriggers(q.quantifier)) { //FIXME: matchingloop and autotriggers attributes are passed down to Boogie
-        msg.AppendFormat("  Not generating triggers for {{{0}}}.", Printer.ExprToString(q.quantifier.Term)).AppendLine(); 
+        msg.AppendFormat("Not generating triggers for {{{0}}}.", Printer.ExprToString(q.quantifier.Term)).AppendLine(); 
         // FIXME This shouldn't be printed for autoReqs. (see autoReq.dfy)
         // FIXME typeQuantifier?
       } else {
         if (addHeader) {
-          msg.AppendFormat("  For expression {{{0}}}:", Printer.ExprToString(q.quantifier.Term)).AppendLine();
+          msg.AppendFormat("For expression {{{0}}}:", Printer.ExprToString(q.quantifier.Term)).AppendLine();
         }
 
         foreach (var candidate in q.Candidates) { //FIXME make this _trigger instead of trigger
@@ -154,16 +154,16 @@ namespace Microsoft.Dafny.Triggers {
         AddTriggersToMessage("Rejected triggers:", q.RejectedCandidates, msg, indent, true);
 
 #if QUANTIFIER_WARNINGS
-        string WARN = DafnyOptions.O.UnicodeOutput ? "⚠ " : "(!) "; //FIXME set unicodeoutput in extension
+        string WARN = (msg.Length > 0 ? indent : "") + (DafnyOptions.O.UnicodeOutput ? "⚠ " : "(!) "); //FIXME set unicodeoutput in extension
         if (!q.CandidateTerms.Any()) {
           errorLevel = ErrorLevel.Warning;
-          msg.Append(indent).Append(WARN).AppendLine("No terms found to trigger on.");
+          msg.Append(WARN).AppendLine("No terms found to trigger on.");
         } else if (!q.Candidates.Any()) {
           errorLevel = ErrorLevel.Warning;
-          msg.Append(indent).Append(WARN).AppendLine("No trigger covering all quantified variables found.");
+          msg.Append(WARN).AppendLine("No trigger covering all quantified variables found.");
         } else if (!q.CouldSuppressLoops && !q.AllowsLoops) {
           errorLevel = ErrorLevel.Warning;
-          msg.Append(indent).Append(WARN).AppendLine("Suppressing loops would leave this expression without triggers.");
+          msg.Append(WARN).AppendLine("Suppressing loops would leave this expression without triggers.");
         }
 #endif
       }
diff --git a/Test/dafny0/TriggerInPredicate.dfy b/Test/dafny0/TriggerInPredicate.dfy
index 3f2eac2c..b9c372dc 100644
--- a/Test/dafny0/TriggerInPredicate.dfy
+++ b/Test/dafny0/TriggerInPredicate.dfy
@@ -3,7 +3,7 @@
 
 predicate A(x: bool, y: bool) { x }
 
-predicate B(x: bool, z: bool) { forall y {:trigger A(x, y) } :: A(x, y) && z }
+predicate B(x: bool, z: bool) { forall y {:trigger A(x, y)} :: A(x, y) && z }
 
 // Inlining is disabled here to prevent pollution of the trigger in B
 method C() requires B(true || false, true) {}
diff --git a/Test/dafny0/TriggerInPredicate.dfy.expect b/Test/dafny0/TriggerInPredicate.dfy.expect
index 7f6e0268..1cbd4034 100644
--- a/Test/dafny0/TriggerInPredicate.dfy.expect
+++ b/Test/dafny0/TriggerInPredicate.dfy.expect
@@ -1,3 +1,5 @@
+TriggerInPredicate.dfy(6,32): Info: Not generating triggers for {A(x, y)}.
+TriggerInPredicate.dfy(6,32): Info: Not generating triggers for {z}.
 TriggerInPredicate.dfy(9,20): Info: Some instances of this call cannot safely be inlined.
 TriggerInPredicate.dfy(9,20): Info: Some instances of this call cannot safely be inlined.
 
-- 
cgit v1.2.3


From 6891a07f8213448bb483e434f66f552370fe9d66 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Tue, 18 Aug 2015 08:49:19 -0700
Subject: Use nested tokens in the quantifier splitter

This allows it to report the source of the error, giving better feedback to the
user about which precondition to a function failed to hold, for example.
---
 Source/Dafny/Triggers/QuantifierSplitter.cs | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifierSplitter.cs b/Source/Dafny/Triggers/QuantifierSplitter.cs
index 80381f0a..4b223856 100644
--- a/Source/Dafny/Triggers/QuantifierSplitter.cs
+++ b/Source/Dafny/Triggers/QuantifierSplitter.cs
@@ -19,7 +19,9 @@ namespace Microsoft.Dafny.Triggers {
     // NOTE: If we wanted to split quantifiers as far as possible, it would be
     // enough to put the formulas in DNF (for foralls) or CNF (for exists).
     // Unfortunately, this would cause ill-behaved quantifiers to produce
-    // exponentially many smaller quantifiers.
+    // exponentially many smaller quantifiers. Thus we only do one step of 
+    // distributing, which takes care of the usual precondition case:
+    //   forall x :: P(x) ==> (Q(x) && R(x))
 
     private static UnaryOpExpr Not(Expression expr) {
       var not = new UnaryOpExpr(expr.tok, UnaryOpExpr.Opcode.Not, expr) { Type = expr.Type };
@@ -62,7 +64,8 @@ namespace Microsoft.Dafny.Triggers {
           stream = SplitExpr(body, BinaryExpr.Opcode.And);
         }
         foreach (var e in stream) {
-          yield return new ForallExpr(quantifier.tok, quantifier.BoundVars, quantifier.Range, e, quantifier.Attributes) { Type = quantifier.Type };
+          var tok = new NestedToken(quantifier.tok, e.tok);
+          yield return new ForallExpr(tok, quantifier.TypeArgs, quantifier.BoundVars, quantifier.Range, e, quantifier.Attributes) { Type = quantifier.Type };
         }
       } else if (quantifier is ExistsExpr) {
         IEnumerable<Expression> stream;
@@ -72,13 +75,14 @@ namespace Microsoft.Dafny.Triggers {
           stream = SplitExpr(body, BinaryExpr.Opcode.Or);
         }
         foreach (var e in stream) {
-          yield return new ExistsExpr(quantifier.tok, quantifier.BoundVars, quantifier.Range, e, quantifier.Attributes) { Type = quantifier.Type };
+          var tok = new NestedToken(quantifier.tok, e.tok);
+          yield return new ExistsExpr(tok, quantifier.TypeArgs, quantifier.BoundVars, quantifier.Range, e, quantifier.Attributes) { Type = quantifier.Type };
         }
       } else {
         yield return quantifier;
       }
     }
-        
+
     protected override void VisitOneExpr(Expression expr) {
       var quantifier = expr as QuantifierExpr;
       if (quantifier != null) {
-- 
cgit v1.2.3


From 6ed47f5d08cc266afab92795599290d029a39c86 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Tue, 18 Aug 2015 09:09:45 -0700
Subject: Refactor calls to 'new CallCmd' and clear a few FIXMEs

---
 Source/Dafny/Printer.cs    |  2 +-
 Source/Dafny/Resolver.cs   |  6 +++---
 Source/Dafny/Translator.cs | 47 +++++++++++++++++++++++-----------------------
 3 files changed, 28 insertions(+), 27 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index 7c684fde..971fe867 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -1373,7 +1373,7 @@ namespace Microsoft.Dafny {
         PrintTypeInstantiation(e.OptTypeArguments);
 
       } else if (expr is ExprDotName) {
-        var e = (ExprDotName)expr; //CLEMENT: Check the newly added Implicit parameter to make sure that we don't print "_default." DONE in FunctionCall. Where else?
+        var e = (ExprDotName)expr;
         // determine if parens are needed
         int opBindingStrength = 0x70;
         bool parensNeeded = !e.Lhs.IsImplicit && // KRML: I think that this never holds
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index e1c3c63b..34d4e5c7 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -305,7 +305,7 @@ namespace Microsoft.Dafny
             Contract.Assert(!useCompileSignatures);
             useCompileSignatures = true;  // set Resolver-global flag to indicate that Signatures should be followed to their CompiledSignature
             var oldErrorsOnly = reporter.ErrorsOnly;
-            reporter.ErrorsOnly = true; // turn off warning reporter for the clone
+            reporter.ErrorsOnly = true; // turn off warning reporting for the clone
             var nw = new Cloner().CloneModuleDefinition(m, m.CompileName + "_Compile");
             var compileSig = RegisterTopLevelDecls(nw, true);
             compileSig.Refines = refinementTransformer.RefinedSig;
@@ -2026,7 +2026,7 @@ namespace Microsoft.Dafny
           foreach (var p in e.TypeArgumentSubstitutions) {
             if (!IsDetermined(p.Value.Normalize())) {
               resolver.reporter.Error(MessageSource.Resolver, e.tok, "type variable '{0}' in the function call to '{1}' could not be determined{2}", p.Key.Name, e.Name,
-                (e.Name.Contains("reveal_") || e.Name.Contains("_FULL")) //CLEMENT should this be StartsWith and EndsWith?
+                (e.Name.StartsWith("reveal_") || e.Name.EndsWith("_FULL"))
                 ? ". If you are making an opaque function, make sure that the function can be called."
                 : ""
               );
@@ -6963,7 +6963,7 @@ namespace Microsoft.Dafny
           reporter.Error(MessageSource.Resolver, expr, "'this' is not allowed in a 'static' context");
         }
         if (currentClass != null) {
-          expr.Type = GetThisType(expr.tok, currentClass);  // do this regardless of scope.AllowInstance, for better error reporter
+          expr.Type = GetThisType(expr.tok, currentClass);  // do this regardless of scope.AllowInstance, for better error reporting
         }
 
       } else if (expr is IdentifierExpr) {
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index df816b6d..55dd637c 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -6453,7 +6453,7 @@ namespace Microsoft.Dafny {
       }
 
       // Make the call
-      builder.Add(new Bpl.CallCmd(method.tok, method.FullSanitizedName, ins, outs));
+      builder.Add(Call(method.tok, method.FullSanitizedName, ins, outs));
 
       for (int i = 0; i < m.Outs.Count; i++) {
         var bLhs = m.Outs[i];
@@ -6484,6 +6484,18 @@ namespace Microsoft.Dafny {
       Reset();
     }
 
+    private static CallCmd Call(IToken tok, string methodName, List<Expr> ins, List<Bpl.IdentifierExpr> outs) {
+      Contract.Requires(tok != null);
+      Contract.Requires(methodName != null);
+      Contract.Requires(ins != null);
+      Contract.Requires(outs != null);
+
+      CallCmd call;
+      call = new CallCmd(tok, methodName, ins, outs);
+      // CLEMENT enable this: call.ErrorData = "possible violation of function precondition";
+      return call;
+    }
+
     private static QKeyValue ErrorMessageAttribute(IToken t, string error) {
       var l = new List<object>(1);
       l.Add(error);
@@ -7977,13 +7989,6 @@ namespace Microsoft.Dafny {
       }
     }
 
-    //CLEMENT: Remove
-    //public static Expr PrintAndDie(Expr expr, [System.Runtime.CompilerServices.CallerMemberName] string caller = "", [System.Runtime.CompilerServices.CallerLineNumber] int linum = 0) {
-    //  Console.Error.WriteLine("In {0} at line {1}: {2}", caller, linum, expr.ToString());
-    //  Environment.Exit(1);
-    //  return expr;
-    //}
-
     /// <summary>
     /// Generate:
     ///   assume (forall x,y :: Range(x,y)[$Heap:=oldHeap] ==>
@@ -8854,7 +8859,7 @@ namespace Microsoft.Dafny {
 
       builder.Add(new CommentCmd("ProcessCallStmt: Make the call"));
       // Make the call
-      Bpl.CallCmd call = new Bpl.CallCmd(tok, MethodName(callee, kind), ins, outs);
+      Bpl.CallCmd call = Call(tok, MethodName(callee, kind), ins, outs);
       if (module != currentModule && RefinementToken.IsInherited(tok, currentModule) && (codeContext == null || !codeContext.MustReverify)) {
         // The call statement is inherited, so the refined module already checked that the precondition holds.  Note,
         // preconditions are not allowed to be strengthened, except if they use a predicate whose body has been strengthened.
@@ -10524,7 +10529,6 @@ namespace Microsoft.Dafny {
       public readonly FuelSetting layerInterCluster;
       public readonly FuelSetting layerIntraCluster = null;  // a value of null says to do the same as for inter-cluster calls
       public int Statistics_CustomLayerFunctionCount = 0;
-      public readonly bool ProducingCoCertificates = false; // CLEMENT Where is this used?
       public readonly bool stripLits = false;
       [ContractInvariantMethod]
       void ObjectInvariant()
@@ -11212,7 +11216,7 @@ namespace Microsoft.Dafny {
           bool liftLit = lit0 != null && lit1 != null;
           // NOTE(namin): We usually avoid keeping literals, because their presence might mess up triggers that do not expect them.
           //              Still for equality-related operations, it's useful to keep them instead of lifting them, so that they can be propagated.
-          bool keepLits = false; // CLEMENT: I don't really understand this
+          bool keepLits = false;
           if (lit0 != null) {
             e0 = lit0;
           }
@@ -11583,14 +11587,12 @@ namespace Microsoft.Dafny {
             Bpl.QKeyValue kv = TrAttributes(e.Attributes, "trigger");
             Bpl.Trigger tr = null;
             var argsEtran = bodyEtran.WithNoLits();
-            foreach (var aa in e.Attributes.AsEnumerable()) {
-              if (aa.Name == "trigger") {
-                List<Bpl.Expr> tt = new List<Bpl.Expr>();
-                foreach (var arg in aa.Args) {
-                  tt.Add(argsEtran.TrExpr(arg));
-                }
-                tr = new Bpl.Trigger(expr.tok, true, tt, tr);
+            foreach (var aa in e.Attributes.AsEnumerable().Where(aa => aa.Name == "trigger")) {
+              List<Bpl.Expr> tt = new List<Bpl.Expr>();
+              foreach (var arg in aa.Args) {
+                tt.Add(argsEtran.TrExpr(arg));
               }
+              tr = new Bpl.Trigger(expr.tok, true, tt, tr);
             }
             if (e.Range != null) {
               antecedent = BplAnd(antecedent, bodyEtran.TrExpr(e.Range));
@@ -12035,7 +12037,7 @@ namespace Microsoft.Dafny {
               parms.Add(s);
             } else {
               var e = TrExpr(arg);
-              e = translator.RemoveLit(e); // CLEMENT: Why?
+              e = translator.RemoveLit(e);
               parms.Add(e);
             }
           }
@@ -12981,7 +12983,7 @@ namespace Microsoft.Dafny {
             return true;
           } else {
             // Skip inlining, as it would cause arbitrary expressions to pop up in the trigger
-            // CLEMENT this should appear at the outmost call site, not at the innermost. See SnapshotableTrees.dfy
+            // TODO this should appear at the outmost call site, not at the innermost. See SnapshotableTrees.dfy
             reporter.Info(MessageSource.Translator, fexp.tok, "Some instances of this call cannot safely be inlined.");
           }
         }
@@ -13124,7 +13126,6 @@ namespace Microsoft.Dafny {
       visitor.Visit(f.Body);
       foreach (var expr in f.Ens) { visitor.Visit(expr); }
       foreach (var expr in f.Req) { visitor.Visit(expr); }
-      // CLEMENT: Anything else?
 
       return f.Formals.Zip(fexp.Args).All(formal_concrete => CanSafelySubstitute(visitor.TriggerVariables, formal_concrete.Item1, formal_concrete.Item2));
     }
@@ -14452,12 +14453,12 @@ namespace Microsoft.Dafny {
 
     // Bpl-making-utilities
 
-    static Bpl.Expr BplForall(IEnumerable<Bpl.Variable> args_in, Bpl.Expr body) {  // NO_TRIGGER
+    static Bpl.Expr BplForall(IEnumerable<Bpl.Variable> args_in, Bpl.Expr body) {
       Contract.Requires(args_in != null);
       Contract.Requires(body != null);
       Contract.Ensures(Contract.Result<Bpl.Expr>() != null);
       var args = new List<Bpl.Variable>(args_in);
-      if (args.Count == 0) { // CLEMENT don't add quantifiers if the body is trivial
+      if (args.Count == 0) {
         return body;
       } else {
         return new Bpl.ForallExpr(body.tok, args, body); // NO_TRIGGER
-- 
cgit v1.2.3


From 8a1ae35f1f4282573fa8b67e1151b0cbbabeb136 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Tue, 18 Aug 2015 09:35:23 -0700
Subject: Check Reads and Decreases clauses for expressions that could prevent
 inlining

---
 Source/Dafny/DafnyAst.cs   | 6 ++++++
 Source/Dafny/Translator.cs | 2 ++
 2 files changed, 8 insertions(+)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index a902a18c..e5d8250b 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -7674,6 +7674,9 @@ namespace Microsoft.Dafny {
     public void Visit(MaybeFreeExpression expr) {
       Visit(expr.E);
     }
+    public void Visit(FrameExpression expr) {
+      Visit(expr.E);
+    }
     public void Visit(IEnumerable<MaybeFreeExpression> exprs) {
       exprs.Iter(Visit);
     }
@@ -7717,6 +7720,9 @@ namespace Microsoft.Dafny {
     public void Visit(MaybeFreeExpression expr, State st) {
       Visit(expr.E, st);
     }
+    public void Visit(FrameExpression expr, State st) {
+      Visit(expr.E, st);
+    }
     public void Visit(IEnumerable<MaybeFreeExpression> exprs, State st) {
       exprs.Iter(e => Visit(e, st));
     }
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 55dd637c..50324002 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -13126,6 +13126,8 @@ namespace Microsoft.Dafny {
       visitor.Visit(f.Body);
       foreach (var expr in f.Ens) { visitor.Visit(expr); }
       foreach (var expr in f.Req) { visitor.Visit(expr); }
+      foreach (var expr in f.Reads) { visitor.Visit(expr); }
+      foreach (var expr in f.Decreases.Expressions) { visitor.Visit(expr); }
 
       return f.Formals.Zip(fexp.Args).All(formal_concrete => CanSafelySubstitute(visitor.TriggerVariables, formal_concrete.Item1, formal_concrete.Item2));
     }
-- 
cgit v1.2.3


From ac137091eac412d2ea8a79ac1c05d161db3365f2 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Tue, 18 Aug 2015 09:36:17 -0700
Subject: Slightly improve the condition used to filter out trigger sets

---
 Source/Dafny/Triggers/QuantifiersCollection.cs | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index aa008e36..ecc193fc 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -55,7 +55,9 @@ namespace Microsoft.Dafny.Triggers {
       // restricts subsets of terms so that we only generate sets of terms where each
       // element contributes at least one variable. In the example above, we'll only
       // get 5 triggers.
-      return additionalTerm.Variables.Where(v => !terms.Any(t => t.Variables.Contains(v))).Any();
+      // Note that this may still be an over-approximation, as in the following example:
+      // forall a, b :: forall x :: a[x] || b[x] > 0.
+      return additionalTerm.Variables.Where(v => v is BoundVar && !terms.Any(t => t.Variables.Contains(v))).Any();
     }
 
     //FIXME document that this assumes that the quantifiers live in the same context and share the same variables
-- 
cgit v1.2.3


From a019d797bd42866242e48ef00850f74e3bdc9241 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Tue, 18 Aug 2015 16:41:10 -0700
Subject: Server: disable tracing when running tests, and fix an encoding
 issue.

z3 doesn't support byte-order marks; thus using the default UTF8Encoding object
(to allow printing nice warning signs) causes issues, as it sends a BOM before
anything else.
---
 Source/DafnyServer/Server.cs           | 24 ++++++++++++++++--------
 Source/DafnyServer/Utilities.cs        |  3 ++-
 Source/DafnyServer/VerificationTask.cs |  6 +++---
 3 files changed, 21 insertions(+), 12 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyServer/Server.cs b/Source/DafnyServer/Server.cs
index bdfd66b4..0a9ce599 100644
--- a/Source/DafnyServer/Server.cs
+++ b/Source/DafnyServer/Server.cs
@@ -11,6 +11,7 @@ using Microsoft.Boogie;
 
 namespace Microsoft.Dafny {
   class Server {
+    private bool trace;
     private bool running;
 
     static void Main(string[] args) {
@@ -23,33 +24,40 @@ namespace Microsoft.Dafny {
         VerificationTask.SelfTest();
       } else if (hasArg && File.Exists(arg)) {
         Console.WriteLine("# Reading from {0}", Path.GetFileName(arg));
-        Console.SetIn(new StreamReader(arg));
+        Console.SetIn(new StreamReader(arg, Encoding.UTF8));
+        server.trace = false;
         server.Loop();
       } else {
         server.Loop();
       }
     }
 
+    private void SetupConsole() {
+      var utf8 = new UTF8Encoding(false, true);
+      Console.OutputEncoding = utf8;
+      Console.OutputEncoding = utf8;
+      Console.CancelKeyPress += CancelKeyPress;
+    }
+
     public Server() {
+      this.trace = true;
       this.running = true;
-      Console.CancelKeyPress += this.CancelKeyPress;
-      Console.InputEncoding = System.Text.Encoding.UTF8;
-      Console.OutputEncoding = System.Text.Encoding.UTF8;
       ExecutionEngine.printer = new DafnyConsolePrinter();
+      SetupConsole();
     }
 
     void CancelKeyPress(object sender, ConsoleCancelEventArgs e) {
       // e.Cancel = true;
       // FIXME TerminateProver and RunningProverFromCommandLine
-      // Cancel the current verification? TerminateProver() ? Or kill entirely?
+      // Cancel the current verification? TerminateProver()? Or kill entirely?
     }
 
-    static bool EndOfPayload(out string line) {
+    bool EndOfPayload(out string line) {
       line = Console.ReadLine();
       return line == null || line == Interaction.CLIENT_EOM_TAG;
     }
 
-    static string ReadPayload() {
+    string ReadPayload() {
       StringBuilder buffer = new StringBuilder();
       string line = null;
       while (!EndOfPayload(out line)) {
@@ -78,7 +86,7 @@ namespace Microsoft.Dafny {
         if (verb == "verify") {
           ServerUtils.checkArgs(command, 0);
           var payload = ReadPayload();
-          VerificationTask.ReadTask(payload).Run();
+          VerificationTask.ReadTask(payload).Run(trace);
         } else if (verb == "quit") {
           ServerUtils.checkArgs(command, 0);
           Exit();
diff --git a/Source/DafnyServer/Utilities.cs b/Source/DafnyServer/Utilities.cs
index 4b06e9f5..96254a3d 100644
--- a/Source/DafnyServer/Utilities.cs
+++ b/Source/DafnyServer/Utilities.cs
@@ -43,7 +43,7 @@ namespace Microsoft.Dafny {
       }
     }
 
-    internal static void ApplyArgs(string[] args) {
+    internal static void ApplyArgs(string[] args, bool trace) {
       Dafny.DafnyOptions.Install(new Dafny.DafnyOptions());
       Dafny.DafnyOptions.O.ProverKillTime = 10;
 
@@ -53,6 +53,7 @@ namespace Microsoft.Dafny {
         Dafny.DafnyOptions.O.UnicodeOutput = true;
         Dafny.DafnyOptions.O.VerifySnapshots = 2;
         Dafny.DafnyOptions.O.VcsCores = Math.Max(1, System.Environment.ProcessorCount - 1);
+        Dafny.DafnyOptions.Clo.Trace = trace;
       } else {
         throw new ServerException("Invalid command line options");
       }
diff --git a/Source/DafnyServer/VerificationTask.cs b/Source/DafnyServer/VerificationTask.cs
index a00688b1..dbafc781 100644
--- a/Source/DafnyServer/VerificationTask.cs
+++ b/Source/DafnyServer/VerificationTask.cs
@@ -44,15 +44,15 @@ namespace Microsoft.Dafny {
         source = "method selftest() { assert true; }"
       };
       try {
-        task.Run();
+        task.Run(false);
         Interaction.EOM(Interaction.SUCCESS, null);
       } catch (Exception ex) {
         Interaction.EOM(Interaction.FAILURE, ex);
       }
     }
 
-    internal void Run() {
-      ServerUtils.ApplyArgs(args);
+    internal void Run(bool trace = true) {
+      ServerUtils.ApplyArgs(args, trace);
       new DafnyHelper(filename, ProgramSource).Verify();
     }
   }
-- 
cgit v1.2.3


From 165aa64949e964a24ac07b32fbe114e96975c5f6 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Wed, 19 Aug 2015 15:47:57 -0700
Subject: Generate triggers for nested quantifiers as well

The new 'quantifiers' list keeps track of the quantifiers that have already been
seen, so that they are not added both as a member of a collection and as a
single quantifier.
---
 Source/Dafny/Triggers/QuantifiersCollector.cs | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifiersCollector.cs b/Source/Dafny/Triggers/QuantifiersCollector.cs
index a43aae7a..b30cb6b1 100644
--- a/Source/Dafny/Triggers/QuantifiersCollector.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollector.cs
@@ -9,6 +9,7 @@ using System.Diagnostics.Contracts;
 namespace Microsoft.Dafny.Triggers { //FIXME rename this file
   internal class QuantifierCollector : TopDownVisitor<object> {
     readonly ErrorReporter reporter;
+    private HashSet<Expression> quantifiers = new HashSet<Expression>();
     internal List<QuantifiersCollection> quantifierCollections = new List<QuantifiersCollection>();
 
     public QuantifierCollector(ErrorReporter reporter) {
@@ -16,17 +17,20 @@ namespace Microsoft.Dafny.Triggers { //FIXME rename this file
       this.reporter = reporter;
     }
 
-    protected override bool VisitOneExpr(Expression expr, ref object st) {
+    protected override bool VisitOneExpr(Expression expr, ref object _) {
       var quantifier = expr as QuantifierExpr;
-      if (quantifier != null) {
+
+      if (quantifier != null && !quantifiers.Contains(quantifier)) {
+        quantifiers.Add(quantifier);
         if (quantifier.SplitQuantifier != null) {
           var collection = quantifier.SplitQuantifier.Select(q => q as QuantifierExpr).Where(q => q != null);
           quantifierCollections.Add(new QuantifiersCollection(collection, reporter));
-          return false;
+          foreach (var q in quantifier.SplitQuantifier) { quantifiers.Add(q); }
         } else {
           quantifierCollections.Add(new QuantifiersCollection(Enumerable.Repeat(quantifier, 1), reporter));
         }
       }
+
       return true;
     }
   }
-- 
cgit v1.2.3


From c311617de4641a4eef54a0ce1bc51574effa2756 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Wed, 19 Aug 2015 15:58:36 -0700
Subject: Fix the equality test for literal expressions

(compare by value, not by reference to boxed value)
---
 Source/Dafny/Triggers/TriggerExtensions.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/TriggerExtensions.cs b/Source/Dafny/Triggers/TriggerExtensions.cs
index 0a0ad547..a49ed13a 100644
--- a/Source/Dafny/Triggers/TriggerExtensions.cs
+++ b/Source/Dafny/Triggers/TriggerExtensions.cs
@@ -477,7 +477,7 @@ namespace Microsoft.Dafny.Triggers {
     }
 
     private static bool ShallowEq(LiteralExpr expr1, LiteralExpr expr2) {
-      if (expr1.Value != expr2.Value) {
+      if (!TriggerUtils.SameNullity(expr1.Value, expr2.Value) || (expr1.Value != null && !expr1.Value.Equals(expr2.Value))) {
         return false;
       }
 
-- 
cgit v1.2.3


From 8b40a61b3e0dd5c8154cd2095a2fa813e0d7c9c5 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Wed, 19 Aug 2015 15:48:32 -0700
Subject: Collect ApplyExpr nodes when looking for trigger candidates

---
 Source/Dafny/Triggers/TriggersCollector.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index 221a4255..08d33af6 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -136,7 +136,7 @@ namespace Microsoft.Dafny.Triggers {
       expr.SubExpressions.Iter(e => Annotate(e));
 
       TriggerAnnotation annotation; // TODO: Using ApplySuffix fixes the unresolved members problem in GenericSort
-      if (expr is FunctionCallExpr || expr is SeqSelectExpr || expr is MemberSelectExpr || expr is OldExpr ||
+      if (expr is FunctionCallExpr || expr is SeqSelectExpr || expr is MemberSelectExpr || expr is OldExpr || expr is ApplyExpr ||
           (expr is UnaryOpExpr && (((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Cardinality)) || // FIXME || ((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Fresh doesn't work, as fresh is a pretty tricky predicate when it's not about datatypes. See translator.cs:10944
           (expr is BinaryExpr && (((BinaryExpr)expr).Op == BinaryExpr.Opcode.NotIn || ((BinaryExpr)expr).Op == BinaryExpr.Opcode.In))) {
         annotation = AnnotatePotentialCandidate(expr);
-- 
cgit v1.2.3


From 8823b0e75fbf0460ddea5e10f9ee61f5fa171b44 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Wed, 19 Aug 2015 15:58:20 -0700
Subject: server: always print tooltips

---
 Source/DafnyServer/Utilities.cs | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyServer/Utilities.cs b/Source/DafnyServer/Utilities.cs
index 5bd6e7d5..3bc334b3 100644
--- a/Source/DafnyServer/Utilities.cs
+++ b/Source/DafnyServer/Utilities.cs
@@ -50,10 +50,11 @@ namespace Microsoft.Dafny {
       if (CommandLineOptions.Clo.Parse(args)) {
         // Dafny.DafnyOptions.O.ErrorTrace = 0; //FIXME
         // Dafny.DafnyOptions.O.ModelViewFile = "-";
-        Dafny.DafnyOptions.O.UnicodeOutput = true;
-        Dafny.DafnyOptions.O.VerifySnapshots = 2;
-        Dafny.DafnyOptions.O.VcsCores = Math.Max(1, System.Environment.ProcessorCount - 1);
-        Dafny.DafnyOptions.O.Trace = trace;
+        DafnyOptions.O.PrintTooltips = true;
+        DafnyOptions.O.UnicodeOutput = true;
+        DafnyOptions.O.VerifySnapshots = 2;
+        DafnyOptions.O.VcsCores = Math.Max(1, System.Environment.ProcessorCount - 1);
+        DafnyOptions.O.Trace = trace;
       } else {
         throw new ServerException("Invalid command line options");
       }
-- 
cgit v1.2.3


From 2f5d59592c5930c32039855824cc49983f643641 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Wed, 19 Aug 2015 16:00:35 -0700
Subject: Enable unicode output in the VS extension

---
 Source/Dafny/Triggers/QuantifiersCollection.cs | 2 +-
 Source/DafnyExtension/DafnyDriver.cs           | 1 +
 Source/DafnyExtension/ResolverTagger.cs        | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index ecc193fc..a6340f10 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -156,7 +156,7 @@ namespace Microsoft.Dafny.Triggers {
         AddTriggersToMessage("Rejected triggers:", q.RejectedCandidates, msg, indent, true);
 
 #if QUANTIFIER_WARNINGS
-        string WARN = (msg.Length > 0 ? indent : "") + (DafnyOptions.O.UnicodeOutput ? "⚠ " : "(!) "); //FIXME set unicodeoutput in extension
+        string WARN = (msg.Length > 0 ? indent : "") + (DafnyOptions.O.UnicodeOutput ? "⚠ " : "(!) ");
         if (!q.CandidateTerms.Any()) {
           errorLevel = ErrorLevel.Warning;
           msg.Append(WARN).AppendLine("No terms found to trigger on.");
diff --git a/Source/DafnyExtension/DafnyDriver.cs b/Source/DafnyExtension/DafnyDriver.cs
index 36664a9b..30b0bd52 100644
--- a/Source/DafnyExtension/DafnyDriver.cs
+++ b/Source/DafnyExtension/DafnyDriver.cs
@@ -40,6 +40,7 @@ namespace DafnyLanguage
         options.ErrorTrace = 0;
         options.VcsCores = Math.Max(1, System.Environment.ProcessorCount - 1);
         options.ModelViewFile = "-";
+        options.UnicodeOutput = true;
         Dafny.DafnyOptions.Install(options);
 
         // Read additional options from DafnyOptions.txt
diff --git a/Source/DafnyExtension/ResolverTagger.cs b/Source/DafnyExtension/ResolverTagger.cs
index 0ce68809..22706338 100644
--- a/Source/DafnyExtension/ResolverTagger.cs
+++ b/Source/DafnyExtension/ResolverTagger.cs
@@ -403,7 +403,7 @@ namespace DafnyLanguage
         chng(this, new SnapshotSpanEventArgs(new SnapshotSpan(snapshot, 0, snapshot.Length)));
     }
 
-    static TaskErrorCategory CategoryConversion(ErrorCategory cat) //CLEMENT: We've lost that info
+    static TaskErrorCategory CategoryConversion(ErrorCategory cat)
     {
       switch (cat)
       {
-- 
cgit v1.2.3


From 43cbd76e07262d05434e36dff99f8d10eb59a773 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Wed, 19 Aug 2015 16:15:26 -0700
Subject: Use /tracePO instead of /trace in the server

This removes the need for special treatment of test input (/trace includes
timings in the output, which are not suitable for tests. /tracePO does not)
---
 Source/DafnyServer/Server.cs                 |   5 +-
 Source/DafnyServer/Utilities.cs              |  12 +-
 Source/DafnyServer/VerificationTask.cs       |   6 +-
 Test/server/minimal.transcript               |   8 +
 Test/server/minimal.transcript.expect        |  14 +
 Test/server/simple-session.transcript.expect | 694 ++++++++++++++++++++++++++-
 6 files changed, 705 insertions(+), 34 deletions(-)
 create mode 100644 Test/server/minimal.transcript
 create mode 100644 Test/server/minimal.transcript.expect

(limited to 'Source')

diff --git a/Source/DafnyServer/Server.cs b/Source/DafnyServer/Server.cs
index 0a9ce599..e524a9a3 100644
--- a/Source/DafnyServer/Server.cs
+++ b/Source/DafnyServer/Server.cs
@@ -11,7 +11,6 @@ using Microsoft.Boogie;
 
 namespace Microsoft.Dafny {
   class Server {
-    private bool trace;
     private bool running;
 
     static void Main(string[] args) {
@@ -25,7 +24,6 @@ namespace Microsoft.Dafny {
       } else if (hasArg && File.Exists(arg)) {
         Console.WriteLine("# Reading from {0}", Path.GetFileName(arg));
         Console.SetIn(new StreamReader(arg, Encoding.UTF8));
-        server.trace = false;
         server.Loop();
       } else {
         server.Loop();
@@ -40,7 +38,6 @@ namespace Microsoft.Dafny {
     }
 
     public Server() {
-      this.trace = true;
       this.running = true;
       ExecutionEngine.printer = new DafnyConsolePrinter();
       SetupConsole();
@@ -86,7 +83,7 @@ namespace Microsoft.Dafny {
         if (verb == "verify") {
           ServerUtils.checkArgs(command, 0);
           var payload = ReadPayload();
-          VerificationTask.ReadTask(payload).Run(trace);
+          VerificationTask.ReadTask(payload).Run();
         } else if (verb == "quit") {
           ServerUtils.checkArgs(command, 0);
           Exit();
diff --git a/Source/DafnyServer/Utilities.cs b/Source/DafnyServer/Utilities.cs
index 3bc334b3..d6654ac1 100644
--- a/Source/DafnyServer/Utilities.cs
+++ b/Source/DafnyServer/Utilities.cs
@@ -43,18 +43,18 @@ namespace Microsoft.Dafny {
       }
     }
 
-    internal static void ApplyArgs(string[] args, bool trace) {
+    internal static void ApplyArgs(string[] args) {
       Dafny.DafnyOptions.Install(new Dafny.DafnyOptions());
       Dafny.DafnyOptions.O.ProverKillTime = 10;
 
       if (CommandLineOptions.Clo.Parse(args)) {
         // Dafny.DafnyOptions.O.ErrorTrace = 0; //FIXME
         // Dafny.DafnyOptions.O.ModelViewFile = "-";
-        DafnyOptions.O.PrintTooltips = true;
-        DafnyOptions.O.UnicodeOutput = true;
-        DafnyOptions.O.VerifySnapshots = 2;
-        DafnyOptions.O.VcsCores = Math.Max(1, System.Environment.ProcessorCount - 1);
-        DafnyOptions.O.Trace = trace;
+        DafnyOptions.O.VerifySnapshots = 2; // Use caching
+        DafnyOptions.O.VcsCores = Math.Max(1, System.Environment.ProcessorCount - 1); //FIXME
+        DafnyOptions.O.PrintTooltips = true; // Dump tooptips (ErrorLevel.Info) to stdout
+        DafnyOptions.O.UnicodeOutput = true; // Use pretty warning signs
+        DafnyOptions.O.TraceProofObligations = true; // Show which method is being verified, but don't show duration of verification
       } else {
         throw new ServerException("Invalid command line options");
       }
diff --git a/Source/DafnyServer/VerificationTask.cs b/Source/DafnyServer/VerificationTask.cs
index dbafc781..a00688b1 100644
--- a/Source/DafnyServer/VerificationTask.cs
+++ b/Source/DafnyServer/VerificationTask.cs
@@ -44,15 +44,15 @@ namespace Microsoft.Dafny {
         source = "method selftest() { assert true; }"
       };
       try {
-        task.Run(false);
+        task.Run();
         Interaction.EOM(Interaction.SUCCESS, null);
       } catch (Exception ex) {
         Interaction.EOM(Interaction.FAILURE, ex);
       }
     }
 
-    internal void Run(bool trace = true) {
-      ServerUtils.ApplyArgs(args, trace);
+    internal void Run() {
+      ServerUtils.ApplyArgs(args);
       new DafnyHelper(filename, ProgramSource).Verify();
     }
   }
diff --git a/Test/server/minimal.transcript b/Test/server/minimal.transcript
new file mode 100644
index 00000000..9625fb00
--- /dev/null
+++ b/Test/server/minimal.transcript
@@ -0,0 +1,8 @@
+# RUN: %server "%s" > "%t"
+# RUN: %diff "%s.expect" "%t"
+verify
+eyJhcmdzIjpbIi9jb21waWxlOjAiLCIvbm9sb2dvIiwiL3ByaW50VG9vbHRpcHMiLCIvdGltZUxp
+bWl0OjIwIl0sImZpbGVuYW1lIjoidHJhbnNjcmlwdCIsInNvdXJjZSI6Im1ldGhvZCBBKGE6aW50
+KSByZXR1cm5zIChiOiBpbnQpIHtcbiAgYiA6PSBhO1xuICBhc3NlcnQgZmFsc2U7XG59XG4iLCJz
+b3VyY2VJc0ZpbGUiOmZhbHNlfQ==
+[[DAFNY-CLIENT: EOM]]
diff --git a/Test/server/minimal.transcript.expect b/Test/server/minimal.transcript.expect
new file mode 100644
index 00000000..bf3f9dfb
--- /dev/null
+++ b/Test/server/minimal.transcript.expect
@@ -0,0 +1,14 @@
+# Reading from minimal.transcript
+
+Verifying CheckWellformed$$_module.__default.A ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+  [2 proof obligations]  error
+transcript(3,9): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
diff --git a/Test/server/simple-session.transcript.expect b/Test/server/simple-session.transcript.expect
index 89c3351d..91429d8e 100644
--- a/Test/server/simple-session.transcript.expect
+++ b/Test/server/simple-session.transcript.expect
@@ -1,24 +1,60 @@
 # Reading from simple-session.transcript
+
+Verifying CheckWellformed$$_module.__default.A ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+  [2 proof obligations]  error
 transcript(3,9): Error: assertion violation
 Execution trace:
     (0,0): anon0
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [2 proof obligations]  error
 transcript(3,9): Error: assertion violation
 Execution trace:
     (0,0): anon0
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [2 proof obligations]  error
 transcript(3,9): Error: assertion violation
 Execution trace:
     (0,0): anon0
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [2 proof obligations]  error
 transcript(3,9): Error: assertion violation
 Execution trace:
     (0,0): anon0
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
+
+Verifying CheckWellformed$$_module.__default.A ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+  [0 proof obligations]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,13): Error: rbrace expected
@@ -27,22 +63,114 @@ Verification completed successfully!
 transcript(6,2): Error: rbrace expected
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
-Verification completed successfully!
-[SUCCESS] [[DAFNY-SERVER: EOM]]
-Verification completed successfully!
-[SUCCESS] [[DAFNY-SERVER: EOM]]
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+  [0 proof obligations]  verified
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [0 proof obligations]  verified
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [0 proof obligations]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(7,0): Error: invalid UpdateStmt
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [0 proof obligations]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(7,0): Error: ident expected
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
-Verification completed successfully!
-[SUCCESS] [[DAFNY-SERVER: EOM]]
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+  [1 proof obligation]  verified
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [1 proof obligation]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(7,11): Error: the number of left-hand sides (2) and right-hand sides (1) must match for a multi-assignment
@@ -51,21 +179,113 @@ Verification completed successfully!
 transcript(7,11): Error: the number of left-hand sides (2) and right-hand sides (1) must match for a multi-assignment
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
-Verification completed successfully!
-[SUCCESS] [[DAFNY-SERVER: EOM]]
-transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
-Verification completed successfully!
-[SUCCESS] [[DAFNY-SERVER: EOM]]
-transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
-Verification completed successfully!
-[SUCCESS] [[DAFNY-SERVER: EOM]]
-transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
-Verification completed successfully!
-[SUCCESS] [[DAFNY-SERVER: EOM]]
-transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
-Verification completed successfully!
-[SUCCESS] [[DAFNY-SERVER: EOM]]
-transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+  [2 proof obligations]  verified
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [2 proof obligations]  verified
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [2 proof obligations]  verified
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+  [3 proof obligations]  verified
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [3 proof obligations]  verified
+Verification completed successfully!
+[SUCCESS] [[DAFNY-SERVER: EOM]]
+transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [3 proof obligations]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
@@ -77,6 +297,20 @@ transcript(6,2): Error: EOF expected
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+  [3 proof obligations]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
@@ -112,15 +346,59 @@ transcript(10,27): Error: invalid UnaryExpression
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+  [1 proof obligation]  error
 transcript(10,9): Error: assertion violation
 Execution trace:
     (0,0): anon0
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+  [1 proof obligation]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [1 proof obligation]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
@@ -128,9 +406,39 @@ transcript(12,0): Error: invalid UpdateStmt
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+  [1 proof obligation]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [1 proof obligation]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
@@ -190,18 +498,130 @@ transcript(5,0): Warning: module-level methods are always non-instance, so the '
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [1 proof obligation]  verified
+
+Verifying CheckWellformed$$_module.__default.M0 ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M0 ...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M1 ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M1 ...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M2 ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M2 ...
+  [5 proof obligations]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [1 proof obligation]  verified
+
+Verifying CheckWellformed$$_module.__default.M0 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M0...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M0 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M0...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M1 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M1...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M1 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M1...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M2 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M2...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M2 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M2...
+  [5 proof obligations]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [1 proof obligation]  verified
+
+Verifying CheckWellformed$$_module.__default.M0 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M0...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M0 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M0...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M1 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M1...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M1 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M1...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M2 ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M2 ...
+  [2 proof obligations]  error
 transcript(38,9): Error: assertion violation
 Execution trace:
     (0,0): anon0
@@ -218,6 +638,44 @@ transcript(5,0): Warning: module-level methods are always non-instance, so the '
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [1 proof obligation]  verified
+
+Verifying CheckWellformed$$_module.__default.M0 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M0...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M0 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M0...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M1 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M1...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M1 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M1...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M2 ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M2 ...
+  [2 proof obligations]  error
 transcript(38,9): Error: assertion violation
 Execution trace:
     (0,0): anon0
@@ -227,12 +685,90 @@ transcript(5,0): Warning: module-level methods are always non-instance, so the '
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [1 proof obligation]  verified
+
+Verifying CheckWellformed$$_module.__default.M0 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M0...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M0 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M0...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M1 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M1...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M1 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M1...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M2 ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M2 ...
+  [2 proof obligations]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [1 proof obligation]  verified
+
+Verifying CheckWellformed$$_module.__default.M0 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M0...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M0 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M0...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M1 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M1...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M1 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M1...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M2 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M2...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M2 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M2...
+  [2 proof obligations]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
@@ -260,6 +796,44 @@ transcript(5,0): Warning: module-level methods are always non-instance, so the '
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [1 proof obligation]  verified
+
+Verifying CheckWellformed$$_module.__default.M0 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M0...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M0 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M0...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M1 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M1...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M1 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M1...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M2 ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M2 ...
+  [1 proof obligation]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
@@ -287,12 +861,90 @@ transcript(5,0): Warning: module-level methods are always non-instance, so the '
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [1 proof obligation]  verified
+
+Verifying CheckWellformed$$_module.__default.M0 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M0...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M0 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M0...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M1 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M1...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M1 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M1...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M2 ...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M2 ...
+  [1 proof obligation]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+
+Verifying CheckWellformed$$_module.__default.A ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.A ...
+Retrieving cached verification result for implementation Impl$$_module.__default.A...
+  [0 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M_k ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M_k...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M_k ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M_k...
+  [1 proof obligation]  verified
+
+Verifying CheckWellformed$$_module.__default.M0 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M0...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M0 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M0...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M1 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M1...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M1 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M1...
+  [5 proof obligations]  verified
+
+Verifying CheckWellformed$$_module.__default.M2 ...
+Retrieving cached verification result for implementation CheckWellformed$$_module.__default.M2...
+  [0 proof obligations]  verified
+
+Verifying Impl$$_module.__default.M2 ...
+Retrieving cached verification result for implementation Impl$$_module.__default.M2...
+  [1 proof obligation]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 Verification completed successfully!
-- 
cgit v1.2.3


From 69c320b225825eb2adf2ae899f88588a10fd27fe Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Wed, 19 Aug 2015 20:05:47 -0700
Subject: Refactored and improved bounds discovery

---
 Source/Dafny/Compiler.cs   |   1 +
 Source/Dafny/DafnyAst.cs   |  65 ++++++--
 Source/Dafny/Resolver.cs   | 386 ++++++++++++++++++---------------------------
 Source/Dafny/Translator.cs |  64 ++++----
 Test/dafny0/ISets.dfy      |   5 +-
 5 files changed, 242 insertions(+), 279 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index f02f7861..619638ac 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -2978,6 +2978,7 @@ namespace Microsoft.Dafny {
           TrExpr(b.Seq);
           wr.Write(").Elements) { ");
         } else {
+          // TODO: handle ComprehensionExpr.SubSetBoundedPool
           Contract.Assert(false); throw new cce.UnreachableException();  // unexpected BoundedPool type
         }
         wr.Write("if (");
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 1b2af648..b998aa47 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -6688,24 +6688,56 @@ namespace Microsoft.Dafny {
       }
       public abstract int Preference(); // higher is better
       
-      public static BoundedPool GetBest(List<BoundedPool> bounds) {
-        Contract.Requires(bounds != null && bounds.Count > 0);
-        var ret = bounds[0];
+      public static BoundedPool GetBest(List<BoundedPool> bounds, bool onlyFiniteBounds) {
+        Contract.Requires(bounds != null);
+        bounds = CombineIntegerBounds(bounds);
+        BoundedPool best = null;
         foreach (var bound in bounds) {
-          if (bound.Preference() > ret.Preference()) {
-            ret = bound;
-          } else {            
-            var retInt = ret as ComprehensionExpr.IntBoundedPool;
-            if (retInt != null && (retInt.LowerBound == null || retInt.UpperBound == null)) {
-              var boundInt = bound as ComprehensionExpr.IntBoundedPool;
-              if (boundInt != null) {
-                ret = new ComprehensionExpr.IntBoundedPool(retInt.LowerBound ?? boundInt.LowerBound, 
-                                                           retInt.UpperBound ?? boundInt.UpperBound);
-              }
-            }         
+          if (!onlyFiniteBounds || bound.IsFinite) {
+            if (best == null || bound.Preference() > best.Preference()) {
+              best = bound;
+            }
+          }
+        }
+        return best;
+      }
+      static List<BoundedPool> CombineIntegerBounds(List<BoundedPool> bounds) {
+        var lowerBounds = new List<IntBoundedPool>();
+        var upperBounds = new List<IntBoundedPool>();
+        var others = new List<BoundedPool>();
+        foreach (var b in bounds) {
+          var ib = b as IntBoundedPool;
+          if (ib != null && ib.UpperBound == null) {
+            lowerBounds.Add(ib);
+          } else if (ib != null && ib.LowerBound == null) {
+            upperBounds.Add(ib);
+          } else {
+            others.Add(b);
           }
         }
-        return ret;
+        // pair up the bounds
+        var n = Math.Min(lowerBounds.Count, upperBounds.Count);
+        for (var i = 0; i < n; i++) {
+          others.Add(new IntBoundedPool(lowerBounds[i].LowerBound, upperBounds[i].UpperBound));
+        }
+        for (var i = n; i < lowerBounds.Count; i++) {
+          others.Add(lowerBounds[i]);
+        }
+        for (var i = n; i < upperBounds.Count; i++) {
+          others.Add(upperBounds[i]);
+        }
+        return others;
+      }
+    }
+    public class ExactBoundedPool : BoundedPool
+    {
+      public readonly Expression E;
+      public ExactBoundedPool(Expression e) {
+        Contract.Requires(e != null);
+        E = e;
+      }
+      public override int Preference() {
+        return 20;  // the best of all bounds
       }
     }
     public class BoolBoundedPool : BoundedPool
@@ -6754,6 +6786,9 @@ namespace Microsoft.Dafny {
       public override int Preference() {
         return 0;
       }
+      public override bool IsFinite {
+        get { return false; }
+      }
     }
     public class MapBoundedPool : BoundedPool
     {
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 1bf96d7d..cd531cf1 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -1477,13 +1477,15 @@ namespace Microsoft.Dafny
 
       if (ErrorCount == prevErrorCount) {
         foreach (var e in needFiniteBoundsChecks_SetComprehension) {
-          var missingBounds = new List<BoundVar>();
           CheckTypeInference(e.Range);  // we need to resolve operators before the call to DiscoverBounds
-          e.Bounds = DiscoverBounds(e.tok, e.BoundVars, e.Range, true, false, missingBounds);
+          List<BoundVar> missingBounds;
+          e.Bounds = DiscoverBestBounds_MultipleVars(e.BoundVars, e.Range, true, true, out missingBounds);
           if (missingBounds.Count != 0) {
             e.MissingBounds = missingBounds;
-            foreach (var bv in e.MissingBounds) {
-              Error(e, "a set comprehension must produce a finite set, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
+            if (e.Finite) {
+              foreach (var bv in e.MissingBounds) {
+                Error(e, "a set comprehension must produce a finite set, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
+              }
             }
           }
         }
@@ -1491,21 +1493,17 @@ namespace Microsoft.Dafny
           Contract.Assert(!e.Exact);  // only let-such-that expressions are ever added to the list
           Contract.Assert(e.RHSs.Count == 1);  // if we got this far, the resolver will have checked this condition successfully
           var constraint = e.RHSs[0];
-          var missingBounds = new List<IVariable>();
           CheckTypeInference(constraint);  // we need to resolve operators before the call to DiscoverBounds
-          var allBounds = DiscoverBoundsAux(e.tok, new List<IVariable>(e.BoundVars), constraint, true, true, true, missingBounds);
+          List<IVariable> missingBounds;
+          var vars = new List<IVariable>(e.BoundVars);
+          var bestBounds = DiscoverBestBounds_MultipleVars(vars, constraint, true, false, out missingBounds);
           if (missingBounds.Count != 0) {
             e.Constraint_MissingBounds = missingBounds;
             foreach (var bv in e.Constraint_MissingBounds) {
               Error(e, "a non-ghost let-such-that constraint must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
             }
           } else {
-            e.Constraint_Bounds = new List<ComprehensionExpr.BoundedPool>();
-            foreach (var pair in allBounds) {
-              Contract.Assert(1 <= pair.Item2.Count);
-              // TODO: The following could be improved by picking the bound that is most likely to give rise to an efficient compiled program
-              e.Constraint_Bounds.Add(pair.Item2[0]);
-            }
+            e.Constraint_Bounds = bestBounds;
           }
         }
       }
@@ -1578,38 +1576,34 @@ namespace Microsoft.Dafny
                 }
                 return null;
               };
-              var missingBounds = new List<BoundVar>();
-              var bounds = DiscoverBounds(dd.Constraint.tok, new List<BoundVar> { dd.Var }, dd.Constraint,
-                true, true, missingBounds);
+              var bounds = DiscoverAllBounds_SingleVar(dd.Var, dd.Constraint);
               List<NativeType> potentialNativeTypes =
                 (stringNativeType != null) ? new List<NativeType> { stringNativeType } :
                 (boolNativeType == false) ? new List<NativeType>() :
                 NativeTypes;
               foreach (var nt in potentialNativeTypes) {
-                if (missingBounds.Count == 0) {
-                  bool lowerOk = false;
-                  bool upperOk = false;
-                  foreach (var bound in bounds) {
-                    if (bound is ComprehensionExpr.IntBoundedPool) {
-                      var bnd = (ComprehensionExpr.IntBoundedPool)bound;
-                      if (bnd.LowerBound != null) {
-                        BigInteger? lower = GetConst(bnd.LowerBound);
-                        if (lower != null && nt.LowerBound <= lower) {
-                          lowerOk = true;
-                        }
+                bool lowerOk = false;
+                bool upperOk = false;
+                foreach (var bound in bounds) {
+                  if (bound is ComprehensionExpr.IntBoundedPool) {
+                    var bnd = (ComprehensionExpr.IntBoundedPool)bound;
+                    if (bnd.LowerBound != null) {
+                      BigInteger? lower = GetConst(bnd.LowerBound);
+                      if (lower != null && nt.LowerBound <= lower) {
+                        lowerOk = true;
                       }
-                      if (bnd.UpperBound != null) {
-                        BigInteger? upper = GetConst(bnd.UpperBound);
-                        if (upper != null && upper <= nt.UpperBound) {
-                          upperOk = true;
-                        }
+                    }
+                    if (bnd.UpperBound != null) {
+                      BigInteger? upper = GetConst(bnd.UpperBound);
+                      if (upper != null && upper <= nt.UpperBound) {
+                        upperOk = true;
                       }
                     }
                   }
-                  if (lowerOk && upperOk) {
-                    dd.NativeType = nt;
-                    break;
-                  }
+                }
+                if (lowerOk && upperOk) {
+                  dd.NativeType = nt;
+                  break;
                 }
               }
               if (dd.NativeType == null && (boolNativeType == true || stringNativeType != null)) {
@@ -5262,9 +5256,9 @@ namespace Microsoft.Dafny
 
         bool bodyMustBeSpecOnly = specContextOnly || (prevErrorCount == ErrorCount && UsesSpecFeatures(s.Range));
         if (!bodyMustBeSpecOnly && prevErrorCount == ErrorCount) {
-          var missingBounds = new List<BoundVar>();
           CheckTypeInference(s.Range);  // we need to resolve operators before the call to DiscoverBounds
-          s.Bounds = DiscoverBounds(s.Tok, s.BoundVars, s.Range, true, false, missingBounds);
+          List<BoundVar> missingBounds;
+          s.Bounds = DiscoverBestBounds_MultipleVars(s.BoundVars, s.Range, true, true, out missingBounds);
           if (missingBounds.Count != 0) {
             bodyMustBeSpecOnly = true;
           }
@@ -6082,18 +6076,14 @@ namespace Microsoft.Dafny
       if (ec == ErrorCount && !s.IsGhost && s.AssumeToken == null && !specContextOnly) {
         CheckIsNonGhost(s.Expr);
 
-        var missingBounds = new List<IVariable>();
         CheckTypeInference(s.Expr);  // we need to resolve operators before the call to DiscoverBoundsAux
-        var allBounds = DiscoverBoundsAux(s.Tok, varLhss, s.Expr, true, true, true, missingBounds);
+        List<IVariable> missingBounds;
+        var bestBounds = DiscoverBestBounds_MultipleVars(varLhss, s.Expr, true, false, out missingBounds);
         if (missingBounds.Count != 0) {
           s.MissingBounds = missingBounds;  // so that an error message can be produced during compilation
         } else {
-          Contract.Assert(allBounds != null);
-          s.Bounds = new List<ComprehensionExpr.BoundedPool>();
-          foreach (var pair in allBounds) {
-            Contract.Assert(1 <= pair.Item2.Count);                                             
-            s.Bounds.Add(ComprehensionExpr.BoundedPool.GetBest(pair.Item2));
-          }
+          Contract.Assert(bestBounds != null);
+          s.Bounds = bestBounds;
         }
       }
     }
@@ -7694,7 +7684,7 @@ namespace Microsoft.Dafny
         if (e.Contract != null) ResolveExpression(e.Contract, opts);
         e.Type = e.Body.Type;
       } else if (expr is QuantifierExpr) {
-        QuantifierExpr e = (QuantifierExpr)expr;
+        var e = (QuantifierExpr)expr;
         int prevErrorCount = ErrorCount;
         bool _val = true;
         bool typeQuantifier = Attributes.ContainsBool(e.Attributes, "typeQuantifier", ref _val) && _val;
@@ -7729,9 +7719,9 @@ namespace Microsoft.Dafny
         expr.Type = Type.Bool;
 
         if (prevErrorCount == ErrorCount) {
-          var missingBounds = new List<BoundVar>();
           CheckTypeInference(e.LogicalBody());  // we need to resolve operators before the call to DiscoverBounds
-          e.Bounds = DiscoverBounds(e.tok, e.BoundVars, e.LogicalBody(), e is ExistsExpr, false, missingBounds);
+          List<BoundVar> missingBounds;
+          e.Bounds = DiscoverBestBounds_MultipleVars(e.BoundVars, e.LogicalBody(), e is ExistsExpr, true, out missingBounds);
           if (missingBounds.Count != 0) {
             // Report errors here about quantifications that depend on the allocation state.
             var mb = missingBounds;
@@ -7801,9 +7791,9 @@ namespace Microsoft.Dafny
         expr.Type = new MapType(e.Finite, e.BoundVars[0].Type, e.Term.Type);
 
         if (prevErrorCount == ErrorCount) {
-          var missingBounds = new List<BoundVar>();
           CheckTypeInference(e.Range);  // we need to resolve operators before the call to DiscoverBounds
-          e.Bounds = DiscoverBounds(e.tok, e.BoundVars, e.Range, true, false, missingBounds);
+          List<BoundVar> missingBounds;
+          e.Bounds = DiscoverBestBounds_MultipleVars(e.BoundVars, e.Range, true, true, out missingBounds);
           if (missingBounds.Count != 0) {
             e.MissingBounds = missingBounds;
             if (e.Finite) {
@@ -9408,202 +9398,138 @@ namespace Microsoft.Dafny
     }
 
     /// <summary>
-    /// For a description, see DiscoverBoundsAux.
-    /// </summary>
-    public static List<ComprehensionExpr.BoundedPool> DiscoverBounds<VT>(IToken tok, List<VT> bvars, Expression expr, bool polarity, bool returnAllBounds, List<VT> missingBounds) where VT : IVariable {
-      var pairs = DiscoverBoundsAux(tok, bvars, expr, polarity, returnAllBounds, false, missingBounds);
-      if (pairs == null) {
-        return null;
-      }
-      var bounds = new List<ComprehensionExpr.BoundedPool>();
-      foreach (var pr in pairs) {
-        Contract.Assert(1 <= pr.Item2.Count);
-        bounds.AddRange(pr.Item2);
-      }
-      return bounds;
-    }
-
-    /// <summary>
-    /// Tries to find a bounded pool for each of the bound variables "bvars" of "expr".  If this process
-    /// fails, then "null" is returned and the bound variables for which the process fails are added to "missingBounds".
-    /// If "returnAllBounds" is false, then:
-    ///   -- at most one BoundedPool per variable is returned
-    ///   -- every IntBoundedPool returned has both a lower and an upper bound
-    ///   -- no SubSetBoundedPool or SuperSetBoundedPool is returned
-    /// If "returnAllBounds" is true, then:
-    ///   -- a variable may give rise to several BoundedPool's
-    ///   -- IntBoundedPool bounds may have just one component
-    ///   -- a non-null return value means that some bound were found for each variable (but, for example, perhaps one
-    ///      variable only has lower bounds, no upper bounds)
-    /// Requires "expr" to be successfully resolved.
-    /// If "allowAnyIntegers", then integer variables will always be given a bound, but this bound may be WiggleWaggle if
-    /// there is no better bound.
+    /// For a list of variables "bvars", returns a list of best bounds for each respective variable.  If no bound is found for a variable "v", then the bound for
+    /// "v" in the returned list is set to "null" and "v" is added to "missingBounds".
     /// </summary>
-    public static List<Tuple<VT, List<ComprehensionExpr.BoundedPool>>> DiscoverBoundsAux<VT>(IToken tok, List<VT> bvars, Expression expr, bool polarity, bool returnAllBounds, bool allowAnyIntegers, List<VT> missingBounds) where VT : IVariable {
-      Contract.Requires(tok != null);
-      Contract.Requires(bvars != null);
-      Contract.Requires(missingBounds != null);
-      Contract.Requires(expr != null);
-      Contract.Requires(expr.Type != null);  // a sanity check (but not a complete proof) that "expr" has been resolved
-      Contract.Ensures(
-        (returnAllBounds && Contract.OldValue(missingBounds.Count) <= missingBounds.Count) ||
-        (!returnAllBounds &&
-         Contract.Result<List<Tuple<VT, List<ComprehensionExpr.BoundedPool>>>>() != null &&
-         Contract.Result<List<Tuple<VT, List<ComprehensionExpr.BoundedPool>>>>().Count == bvars.Count &&
-         Contract.OldValue(missingBounds.Count) == missingBounds.Count) ||
-        (!returnAllBounds &&
-         Contract.Result<List<Tuple<VT, List<ComprehensionExpr.BoundedPool>>>>() == null &&
-         Contract.OldValue(missingBounds.Count) < missingBounds.Count));
-
-      var allBounds = new List<Tuple<VT, List<ComprehensionExpr.BoundedPool>>>();
-      bool foundError = false;
+    public static List<ComprehensionExpr.BoundedPool> DiscoverBestBounds_MultipleVars<VT>(List<VT> bvars, Expression expr, bool polarity, bool onlyFiniteBounds, out List<VT> missingBounds) where VT : IVariable {
       foreach (var bv in bvars) {
         var c = TypeConstraint(bv, bv.Type);
         expr = polarity ? Expression.CreateAnd(c, expr) : Expression.CreateImplies(c, expr);
       }
-      for (int j = 0; j < bvars.Count; j++) {
-        VT bv;
-        List<ComprehensionExpr.BoundedPool> bounds;
-        foundError = DiscoverAuxSingle<VT>(bvars, expr, polarity, returnAllBounds, true, allowAnyIntegers, missingBounds, foundError, j, out bv, out bounds);
-        if (!returnAllBounds && bounds.Count > 1) {
-          var best = ComprehensionExpr.BoundedPool.GetBest(bounds);
-          bounds = new List<ComprehensionExpr.BoundedPool>() { best };
+      var all = DiscoverAllBounds_Aux_MultipleVars(bvars, expr, polarity);
+      var bests = all.ConvertAll(tup => ComprehensionExpr.BoundedPool.GetBest(tup.Item2, onlyFiniteBounds));
+      missingBounds = new List<VT>();
+      for (var i = 0; i < bvars.Count; i++) {
+        if (bests[i] == null) {
+          missingBounds.Add(bvars[i]);
         }
+      }
+      return bests;
+    }
 
-        allBounds.Add(new Tuple<VT, List<ComprehensionExpr.BoundedPool>>(bv, bounds));
+    public static List<ComprehensionExpr.BoundedPool> DiscoverAllBounds_SingleVar<VT>(VT v, Expression expr) where VT : IVariable {
+      expr = Expression.CreateAnd(TypeConstraint(v, v.Type), expr);
+      return DiscoverAllBounds_Aux_SingleVar(new List<VT> { v }, 0, expr, true);
+    }
+
+    private static List<Tuple<VT, List<ComprehensionExpr.BoundedPool>>> DiscoverAllBounds_Aux_MultipleVars<VT>(List<VT> bvars, Expression expr, bool polarity) where VT : IVariable {
+      Contract.Requires(bvars != null);
+      Contract.Requires(expr != null);
+      var bb = new List<Tuple<VT, List<ComprehensionExpr.BoundedPool>>>();
+      for (var j = 0; j < bvars.Count; j++) {
+        var bounds = DiscoverAllBounds_Aux_SingleVar(bvars, j, expr, polarity);
+        bb.Add(new Tuple<VT, List<ComprehensionExpr.BoundedPool>>(bvars[j], bounds));
       }
-      return foundError ? null : allBounds;
+      return bb;
     }
 
-    private static bool DiscoverAuxSingle<VT>(List<VT> bvars, Expression expr, bool polarity, bool allowPartialBounds, bool returnAllBounds, bool allowAnyIntegers, List<VT> missingBounds, bool foundError, int j, out VT bv, out List<ComprehensionExpr.BoundedPool> bounds) where VT : IVariable {
-      bv = bvars[j];
-      bounds = new List<ComprehensionExpr.BoundedPool>();
+    /// <summary>
+    /// Returns a list of (possibly partial) bounds for "bvars[j]", each of which can be written without mentioning any variable in "bvars[j..]".
+    /// </summary>
+    private static List<ComprehensionExpr.BoundedPool> DiscoverAllBounds_Aux_SingleVar<VT>(List<VT> bvars, int j, Expression expr, bool polarity) where VT : IVariable {
+      Contract.Requires(bvars != null);
+      Contract.Requires(0 <= j && j < bvars.Count);
+      Contract.Requires(expr != null);
+      var bv = bvars[j];
+      var bounds = new List<ComprehensionExpr.BoundedPool>();
+
+      // Maybe the type itself gives a bound
       if (bv.Type.IsBoolType) {
         // easy
         bounds.Add(new ComprehensionExpr.BoolBoundedPool());
-      } else {
-        bool foundBoundsForBv = false;
-        if (bv.Type.IsIndDatatype && bv.Type.AsIndDatatype.HasFinitePossibleValues) {
-          bounds.Add(new ComprehensionExpr.DatatypeBoundedPool(bv.Type.AsIndDatatype));
-          foundBoundsForBv = true;
-        }
-        // Go through the conjuncts of the range expression to look for bounds.
-        Expression lowerBound = null;
-        Expression upperBound = null;
-        if ((allowPartialBounds || returnAllBounds) && lowerBound != null) {
-          bounds.Add(new ComprehensionExpr.IntBoundedPool(lowerBound, upperBound));
-          lowerBound = null;
-          foundBoundsForBv = true;
-        }
-        foreach (var conjunct in NormalizedConjuncts(expr, polarity)) {
-          var c = conjunct as BinaryExpr;
-          if (c == null) {
-            goto CHECK_NEXT_CONJUNCT;
-          }
-          var e0 = c.E0;
-          var e1 = c.E1;
-          int whereIsBv = SanitizeForBoundDiscovery(bvars, j, c.ResolvedOp, ref e0, ref e1);
-          if (whereIsBv < 0) {
-            goto CHECK_NEXT_CONJUNCT;
-          }
-          switch (c.ResolvedOp) {
-            case BinaryExpr.ResolvedOpcode.InSet:
-              if (whereIsBv == 0) {
-                bounds.Add(new ComprehensionExpr.SetBoundedPool(e1));
-                foundBoundsForBv = true;
-                if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
-              }
-              break;
-            case BinaryExpr.ResolvedOpcode.Subset:
-              if (returnAllBounds) {
-                if (whereIsBv == 0) {
-                  bounds.Add(new ComprehensionExpr.SubSetBoundedPool(e1));
-                } else {
-                  bounds.Add(new ComprehensionExpr.SuperSetBoundedPool(e0));
-                }
-                foundBoundsForBv = true;
-              }
-              break;
-            case BinaryExpr.ResolvedOpcode.InMultiSet:
-              if (whereIsBv == 0) {
-                bounds.Add(new ComprehensionExpr.SetBoundedPool(e1));
-                foundBoundsForBv = true;
-                if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
-              }
-              break;
-            case BinaryExpr.ResolvedOpcode.InSeq:
-              if (whereIsBv == 0) {
-                bounds.Add(new ComprehensionExpr.SeqBoundedPool(e1));
-                foundBoundsForBv = true;
-                if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
-              }
-              break;
-            case BinaryExpr.ResolvedOpcode.InMap:
-              if (whereIsBv == 0 && e1.Type.AsMapType.Finite) {
-                bounds.Add(new ComprehensionExpr.MapBoundedPool(e1));
-                foundBoundsForBv = true;
-                if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
-              }
-              break;
-            case BinaryExpr.ResolvedOpcode.EqCommon:
-              if (bv.Type is IntType) {
-                var otherOperand = whereIsBv == 0 ? e1 : e0;
-                bounds.Add(new ComprehensionExpr.IntBoundedPool(otherOperand, Expression.CreateIncrement(otherOperand, 1)));
-                foundBoundsForBv = true;
-                if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
-              } else if (returnAllBounds && bv.Type is SetType) {
-                var otherOperand = whereIsBv == 0 ? e1 : e0;
-                bounds.Add(new ComprehensionExpr.SubSetBoundedPool(otherOperand));
-                foundBoundsForBv = true;
-              }
-              break;
-            case BinaryExpr.ResolvedOpcode.Gt:
-            case BinaryExpr.ResolvedOpcode.Ge:
-              Contract.Assert(false); throw new cce.UnreachableException();  // promised by postconditions of NormalizedConjunct
-            case BinaryExpr.ResolvedOpcode.Lt:
-              if (e0.Type.IsNumericBased(Type.NumericPersuation.Int)) {
-                if (whereIsBv == 0 && upperBound == null) {
-                  upperBound = e1;  // bv < E
-                } else if (whereIsBv == 1 && lowerBound == null) {
-                  lowerBound = Expression.CreateIncrement(e0, 1);  // E < bv
-                }
+      } else if (bv.Type.IsIndDatatype && bv.Type.AsIndDatatype.HasFinitePossibleValues) {
+        bounds.Add(new ComprehensionExpr.DatatypeBoundedPool(bv.Type.AsIndDatatype));
+      } else if (bv.Type.IsNumericBased(Type.NumericPersuation.Int)) {
+        bounds.Add(new AssignSuchThatStmt.WiggleWaggleBound());
+      }
+
+      // Go through the conjuncts of the range expression to look for bounds.
+      foreach (var conjunct in NormalizedConjuncts(expr, polarity)) {
+        var c = conjunct as BinaryExpr;
+        if (c == null) {
+          // We only know what to do with binary expressions
+          continue;
+        }
+        var e0 = c.E0;
+        var e1 = c.E1;
+        int whereIsBv = SanitizeForBoundDiscovery(bvars, j, c.ResolvedOp, ref e0, ref e1);
+        if (whereIsBv < 0) {
+          continue;
+        }
+        switch (c.ResolvedOp) {
+          case BinaryExpr.ResolvedOpcode.InSet:
+            if (whereIsBv == 0 && e1.Type.AsSetType.Finite) {
+              bounds.Add(new ComprehensionExpr.SetBoundedPool(e1));
+            }
+            break;
+          case BinaryExpr.ResolvedOpcode.Subset:
+            if (whereIsBv == 0) {
+              bounds.Add(new ComprehensionExpr.SubSetBoundedPool(e1));
+            } else {
+              bounds.Add(new ComprehensionExpr.SuperSetBoundedPool(e0));
+            }
+            break;
+          case BinaryExpr.ResolvedOpcode.InMultiSet:
+            if (whereIsBv == 0) {
+              bounds.Add(new ComprehensionExpr.SetBoundedPool(e1));
+            }
+            break;
+          case BinaryExpr.ResolvedOpcode.InSeq:
+            if (whereIsBv == 0) {
+              bounds.Add(new ComprehensionExpr.SeqBoundedPool(e1));
+            }
+            break;
+          case BinaryExpr.ResolvedOpcode.InMap:
+            if (whereIsBv == 0 && e1.Type.AsMapType.Finite) {
+              bounds.Add(new ComprehensionExpr.MapBoundedPool(e1));
+            }
+            break;
+          case BinaryExpr.ResolvedOpcode.EqCommon:
+            // TODO: Use the new ComprehensionExpr.ExactBoundedPool
+            if (bv.Type.IsNumericBased(Type.NumericPersuation.Int)) {
+              var otherOperand = whereIsBv == 0 ? e1 : e0;
+              bounds.Add(new ComprehensionExpr.IntBoundedPool(otherOperand, Expression.CreateIncrement(otherOperand, 1)));
+            } else if (bv.Type is SetType) {
+              var otherOperand = whereIsBv == 0 ? e1 : e0;
+              bounds.Add(new ComprehensionExpr.SubSetBoundedPool(otherOperand));
+            }
+            break;
+          case BinaryExpr.ResolvedOpcode.Gt:
+          case BinaryExpr.ResolvedOpcode.Ge:
+            Contract.Assert(false); throw new cce.UnreachableException();  // promised by postconditions of NormalizedConjunct
+          case BinaryExpr.ResolvedOpcode.Lt:
+            if (e0.Type.IsNumericBased(Type.NumericPersuation.Int)) {
+              if (whereIsBv == 0) {  // bv < E
+                bounds.Add(new ComprehensionExpr.IntBoundedPool(null, e1));
+              } else {  // E < bv
+                bounds.Add(new ComprehensionExpr.IntBoundedPool(Expression.CreateIncrement(e0, 1), null));
               }
-              break;
-            case BinaryExpr.ResolvedOpcode.Le:
-              if (e0.Type.IsNumericBased(Type.NumericPersuation.Int)) {
-                if (whereIsBv == 0 && upperBound == null) {
-                  upperBound = Expression.CreateIncrement(e1, 1);  // bv <= E
-                } else if (whereIsBv == 1 && lowerBound == null) {
-                  lowerBound = e0;  // E <= bv
-                }
+            }
+            break;
+          case BinaryExpr.ResolvedOpcode.Le:
+            if (e0.Type.IsNumericBased(Type.NumericPersuation.Int)) {
+              if (whereIsBv == 0) {  // bv <= E
+                bounds.Add(new ComprehensionExpr.IntBoundedPool(null, Expression.CreateIncrement(e1, 1)));
+              } else {  // E <= bv
+                bounds.Add(new ComprehensionExpr.IntBoundedPool(e0, null));
               }
-              break;
-            default:
-              break;
-          }
-          if ((lowerBound != null && upperBound != null) ||
-              (allowPartialBounds && (lowerBound != null || upperBound != null))) {
-            // we have found two halves (or, in the case of returnAllBounds, we have found some bound)
-            bounds.Add(new ComprehensionExpr.IntBoundedPool(lowerBound, upperBound));
-            lowerBound = null;
-            upperBound = null;
-            foundBoundsForBv = true;
-            if (!returnAllBounds) goto CHECK_NEXT_BOUND_VARIABLE;
-          }
-        CHECK_NEXT_CONJUNCT: ;
-        }
-        if (!foundBoundsForBv) {
-          // we have checked every conjunct in the range expression and still have not discovered good bounds
-          if (allowAnyIntegers && bv.Type is IntType) {
-            bounds.Add(new AssignSuchThatStmt.WiggleWaggleBound());
-          } else {
-            missingBounds.Add(bv);  // record failing bound variable
-            foundError = true;
-          }
+            }
+            break;
+          default:
+            break;
         }
       }
-    CHECK_NEXT_BOUND_VARIABLE: ;  // should goto here only if the bound for the current variable has been discovered (otherwise, return with null from this method)
-      return foundError;
+      return bounds;
     }
 
     static Expression TypeConstraint(IVariable bv, Type ty) {
@@ -10241,7 +10167,7 @@ namespace Microsoft.Dafny
       } else if (expr is NamedExpr) {
         return moduleInfo.IsGhost ? false : UsesSpecFeatures(((NamedExpr)expr).Body);
       } else if (expr is ComprehensionExpr) {
-        if (expr is QuantifierExpr && ((QuantifierExpr)expr).Bounds == null) {
+        if (expr is QuantifierExpr && ((QuantifierExpr)expr).Bounds.Contains(null)) {
           return true;  // the quantifier cannot be compiled if the resolver found no bounds
         }
         return Contract.Exists(expr.SubExpressions, se => UsesSpecFeatures(se));
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 59d93347..2ae03412 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -7653,39 +7653,37 @@ namespace Microsoft.Dafny {
       }
 
       var missingBounds = new List<BoundVar>();
-      var bounds = Resolver.DiscoverBounds(x.tok, new List<BoundVar>() { x }, expr, true, true, missingBounds);
-      if (missingBounds.Count == 0) {
-        foreach (var bound in bounds) {
-          if (bound is ComprehensionExpr.IntBoundedPool) {
-            var bnd = (ComprehensionExpr.IntBoundedPool)bound;
-            if (bnd.LowerBound != null) yield return bnd.LowerBound;
-            if (bnd.UpperBound != null) yield return Expression.CreateDecrement(bnd.UpperBound, 1);
-          } else if (bound is ComprehensionExpr.SubSetBoundedPool) {
-            var bnd = (ComprehensionExpr.SubSetBoundedPool)bound;
-            yield return bnd.UpperBound;
-          } else if (bound is ComprehensionExpr.SuperSetBoundedPool) {
-            var bnd = (ComprehensionExpr.SuperSetBoundedPool)bound;
-            yield return bnd.LowerBound;
-          } else if (bound is ComprehensionExpr.SetBoundedPool) {
-            var st = ((ComprehensionExpr.SetBoundedPool)bound).Set.Resolved;
-            if (st is DisplayExpression) {
-              var display = (DisplayExpression)st;
-              foreach (var el in display.Elements) {
-                yield return el;
-              }
-            } else if (st is MapDisplayExpr) {
-              var display = (MapDisplayExpr)st;
-              foreach (var maplet in display.Elements) {
-                yield return maplet.A;
-              }
+      var bounds = Resolver.DiscoverAllBounds_SingleVar(x, expr);
+      foreach (var bound in bounds) {
+        if (bound is ComprehensionExpr.IntBoundedPool) {
+          var bnd = (ComprehensionExpr.IntBoundedPool)bound;
+          if (bnd.LowerBound != null) yield return bnd.LowerBound;
+          if (bnd.UpperBound != null) yield return Expression.CreateDecrement(bnd.UpperBound, 1);
+        } else if (bound is ComprehensionExpr.SubSetBoundedPool) {
+          var bnd = (ComprehensionExpr.SubSetBoundedPool)bound;
+          yield return bnd.UpperBound;
+        } else if (bound is ComprehensionExpr.SuperSetBoundedPool) {
+          var bnd = (ComprehensionExpr.SuperSetBoundedPool)bound;
+          yield return bnd.LowerBound;
+        } else if (bound is ComprehensionExpr.SetBoundedPool) {
+          var st = ((ComprehensionExpr.SetBoundedPool)bound).Set.Resolved;
+          if (st is DisplayExpression) {
+            var display = (DisplayExpression)st;
+            foreach (var el in display.Elements) {
+              yield return el;
             }
-          } else if (bound is ComprehensionExpr.SeqBoundedPool) {
-            var sq = ((ComprehensionExpr.SeqBoundedPool)bound).Seq.Resolved;
-            var display = sq as DisplayExpression;
-            if (display != null) {
-              foreach (var el in display.Elements) {
-                yield return el;
-              }
+          } else if (st is MapDisplayExpr) {
+            var display = (MapDisplayExpr)st;
+            foreach (var maplet in display.Elements) {
+              yield return maplet.A;
+            }
+          }
+        } else if (bound is ComprehensionExpr.SeqBoundedPool) {
+          var sq = ((ComprehensionExpr.SeqBoundedPool)bound).Seq.Resolved;
+          var display = sq as DisplayExpression;
+          if (display != null) {
+            foreach (var el in display.Elements) {
+              yield return el;
             }
           }
         }
@@ -11603,8 +11601,8 @@ namespace Microsoft.Dafny {
 
         } else if (expr is LambdaExpr) {
           var e = (LambdaExpr)expr;
-
           return TrLambdaExpr(e);
+
         } else if (expr is StmtExpr) {
           var e = (StmtExpr)expr;
           return TrExpr(e.E);
diff --git a/Test/dafny0/ISets.dfy b/Test/dafny0/ISets.dfy
index bb0230f4..703039c8 100644
--- a/Test/dafny0/ISets.dfy
+++ b/Test/dafny0/ISets.dfy
@@ -4,7 +4,7 @@
 ghost method M()
 {
    ghost var s := iset{2};
-   // test "in
+   // test "in"
    if(2 in s)
    {
    }
@@ -35,6 +35,9 @@ ghost method m1() {
  assert s2 - s3 == iset{3}; // set difference
 
  assert (iset x | x in s2 :: x+1) == iset{2,3,4}; // set comprehension
+ assert 17 in (iset x: int | true :: x); // set comprehension
+
+ assert (imap x: int | true :: x+1)[14] == 15;
 }
 
 
-- 
cgit v1.2.3


From 487c6e48d305d57994b801440d4b62f1a4bfdd06 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Wed, 19 Aug 2015 22:12:36 -0700
Subject: Factor out some AST visiting code

---
 Source/Dafny/DafnyAst.cs | 54 ++++++++++++++++++++++++++++++++++++++++++++++++
 Source/Dafny/Rewriter.cs | 32 ++--------------------------
 2 files changed, 56 insertions(+), 30 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index ffd6df63..89bba760 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -7725,6 +7725,33 @@ namespace Microsoft.Dafny {
     public void Visit(IEnumerable<MaybeFreeExpression> exprs) {
       exprs.Iter(Visit);
     }
+    public void Visit(IEnumerable<FrameExpression> exprs) {
+      exprs.Iter(Visit);
+    }
+    public void Visit(ICallable decl) {
+      if (decl is Function) {
+        Visit((Function)decl);
+      } else if (decl is Method) {
+        Visit((Method)decl);
+      }
+      //FIXME More?
+    }
+    public void Visit(Method method) {
+      Visit(method.Ens);
+      Visit(method.Req);
+      Visit(method.Mod.Expressions);
+      Visit(method.Decreases.Expressions);
+      if (method.Body != null) { Visit(method.Body); }
+      //FIXME More?
+    }
+    public void Visit(Function function) {
+      Visit(function.Ens);
+      Visit(function.Req);
+      Visit(function.Reads);
+      Visit(function.Decreases.Expressions);
+      if (function.Body != null) { Visit(function.Body); }
+      //FIXME More?
+    }
     protected virtual void VisitOneExpr(Expression expr) {
       Contract.Requires(expr != null);
       // by default, do nothing
@@ -7771,6 +7798,33 @@ namespace Microsoft.Dafny {
     public void Visit(IEnumerable<MaybeFreeExpression> exprs, State st) {
       exprs.Iter(e => Visit(e, st));
     }
+    public void Visit(IEnumerable<FrameExpression> exprs, State st) {
+      exprs.Iter(e => Visit(e, st));
+    }
+    public void Visit(ICallable decl, State st) {
+      if (decl is Function) {
+        Visit((Function)decl, st);
+      } else if (decl is Method) {
+        Visit((Method)decl, st);
+      }
+      //FIXME More?
+    }
+    public void Visit(Method method, State st) {
+      Visit(method.Ens, st);
+      Visit(method.Req, st);
+      Visit(method.Mod.Expressions, st);
+      Visit(method.Decreases.Expressions, st);
+      if (method.Body != null) { Visit(method.Body, st); }
+      //FIXME More?
+    }
+    public void Visit(Function function, State st) {
+      Visit(function.Ens, st);
+      Visit(function.Req, st);
+      Visit(function.Reads, st);
+      Visit(function.Decreases.Expressions, st);
+      if (function.Body != null) { Visit(function.Body, st); }
+      //FIXME More?
+    }
     /// <summary>
     /// Visit one expression proper.  This method is invoked before it is invoked on the
     /// sub-parts (sub-expressions and sub-statements).  A return value of "true" says to
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 83f49a12..230d9349 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -47,21 +47,7 @@ namespace Microsoft.Dafny
       var finder = new Triggers.QuantifierCollector(reporter);
         
       foreach (var decl in ModuleDefinition.AllCallables(m.TopLevelDecls)) {
-        if (decl is Function) {
-          var function = (Function)decl;
-          finder.Visit(function.Ens, null);
-          finder.Visit(function.Req, null);
-          if (function.Body != null) {
-            finder.Visit(function.Body, null);
-          }
-        } else if (decl is Method) {
-          var method = (Method)decl;
-          finder.Visit(method.Ens, null);
-          finder.Visit(method.Req, null);
-          if (method.Body != null) {
-            finder.Visit(method.Body, null);
-          }
-        }
+        finder.Visit(decl, null);
       }
       
       var triggersCollector = new Triggers.TriggersCollector();
@@ -80,21 +66,7 @@ namespace Microsoft.Dafny
     internal override void PostResolve(ModuleDefinition m) {
       var splitter = new Triggers.QuantifierSplitter();
       foreach (var decl in ModuleDefinition.AllCallables(m.TopLevelDecls)) {
-        if (decl is Function) {
-          var function = (Function)decl;
-          splitter.Visit(function.Ens);
-          splitter.Visit(function.Req);
-          if (function.Body != null) {
-            splitter.Visit(function.Body);
-          }
-        } else if (decl is Method) {
-          var method = (Method)decl;
-          splitter.Visit(method.Ens);
-          splitter.Visit(method.Req);
-          if (method.Body != null) {
-            splitter.Visit(method.Body);
-          }
-        }
+        splitter.Visit(decl);
       }
     }
   }
-- 
cgit v1.2.3


From 79679075d54060ec78a369879f7ec460d30f92f4 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Wed, 19 Aug 2015 22:13:33 -0700
Subject: Add a check for SplitQuantifiers that had been incorrectly left out
 from the merge

---
 Source/Dafny/Translator.cs | 88 ++++++++++++++++++++++------------------------
 1 file changed, 43 insertions(+), 45 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 23c0c3f6..8146d2cf 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -11526,56 +11526,60 @@ namespace Microsoft.Dafny {
           return TrExpr(((NamedExpr)expr).Body);
         } else if (expr is QuantifierExpr) {
           QuantifierExpr e = (QuantifierExpr)expr;
-          List<Variable> tyvars = translator.MkTyParamBinders(e.TypeArgs);
-          List<Variable> bvars = new List<Variable>();
 
-          var initEtran = this;
-          var bodyEtran = this;
-          bool _scratch = true;
+          if (e.SplitQuantifier != null) {
+            return TrExpr(e.SplitQuantifierExpression);
+          } else {
+            List<Variable> tyvars = translator.MkTyParamBinders(e.TypeArgs);
+            List<Variable> bvars = new List<Variable>();
 
-          Bpl.Expr antecedent = Bpl.Expr.True;
+            var initEtran = this;
+            var bodyEtran = this;
+            bool _scratch = true;
 
-          if (Attributes.ContainsBool(e.Attributes, "layerQuantifier", ref _scratch)) {
-            // If this is a layer quantifier, quantify over layers here, and use $LS(ly) layers in the translation of the body
-            var ly = BplBoundVar(e.Refresh("q$ly#", translator.CurrentIdGenerator), predef.LayerType, bvars);
-            bodyEtran = new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, new FuelSetting(translator, 1, ly), new FuelSetting(translator, 1, ly), modifiesFrame, stripLits);
-          }
-          if (Attributes.ContainsBool(e.Attributes, "heapQuantifier", ref _scratch)) {
-            var h = BplBoundVar(e.Refresh("q$heap#", translator.CurrentIdGenerator), predef.HeapType, bvars);
-            bodyEtran = new ExpressionTranslator(bodyEtran, h);
-            antecedent = BplAnd(new List<Bpl.Expr> {
+            Bpl.Expr antecedent = Bpl.Expr.True;
+
+            if (Attributes.ContainsBool(e.Attributes, "layerQuantifier", ref _scratch)) {
+              // If this is a layer quantifier, quantify over layers here, and use $LS(ly) layers in the translation of the body
+              var ly = BplBoundVar(e.Refresh("q$ly#", translator.CurrentIdGenerator), predef.LayerType, bvars);
+              bodyEtran = new ExpressionTranslator(translator, predef, HeapExpr, This, applyLimited_CurrentFunction, new FuelSetting(translator, 1, ly), new FuelSetting(translator, 1, ly), modifiesFrame, stripLits);
+            }
+            if (Attributes.ContainsBool(e.Attributes, "heapQuantifier", ref _scratch)) {
+              var h = BplBoundVar(e.Refresh("q$heap#", translator.CurrentIdGenerator), predef.HeapType, bvars);
+              bodyEtran = new ExpressionTranslator(bodyEtran, h);
+              antecedent = BplAnd(new List<Bpl.Expr> {
               antecedent,
               translator.FunctionCall(e.tok, BuiltinFunction.IsGoodHeap, null, h),
               translator.HeapSameOrSucc(initEtran.HeapExpr, h)
             });
-          }
+            }
 
-          antecedent = BplAnd(antecedent, bodyEtran.TrBoundVariables(e.BoundVars, bvars));
+            antecedent = BplAnd(antecedent, bodyEtran.TrBoundVariables(e.BoundVars, bvars));
 
-          Bpl.QKeyValue kv = TrAttributes(e.Attributes, "trigger");
-          Bpl.Trigger tr = null;
-          var argsEtran = bodyEtran.WithNoLits();
-          foreach (var aa in e.Attributes.AsEnumerable()) {
-            if (aa.Name == "trigger") {
-              List<Bpl.Expr> tt = new List<Bpl.Expr>();
-              foreach (var arg in aa.Args) {
-                tt.Add(argsEtran.TrExpr(arg));
+            Bpl.QKeyValue kv = TrAttributes(e.Attributes, "trigger");
+            Bpl.Trigger tr = null;
+            var argsEtran = bodyEtran.WithNoLits();
+            foreach (var aa in e.Attributes.AsEnumerable()) {
+              if (aa.Name == "trigger") {
+                List<Bpl.Expr> tt = new List<Bpl.Expr>();
+                foreach (var arg in aa.Args) {
+                  tt.Add(argsEtran.TrExpr(arg));
+                }
+                tr = new Bpl.Trigger(expr.tok, true, tt, tr);
               }
-              tr = new Bpl.Trigger(expr.tok, true, tt, tr);
             }
-          }
-          if (e.Range != null) {
-            antecedent = BplAnd(antecedent, bodyEtran.TrExpr(e.Range));
-          }
-          Bpl.Expr body = bodyEtran.TrExpr(e.Term);
-          
-          if (e is ForallExpr) {
-            return new Bpl.ForallExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars, bvars), kv, tr, Bpl.Expr.Imp(antecedent, body));
-          } else {
-            Contract.Assert(e is ExistsExpr);
-            return new Bpl.ExistsExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars, bvars), kv, tr, Bpl.Expr.And(antecedent, body));
-          }
+            if (e.Range != null) {
+              antecedent = BplAnd(antecedent, bodyEtran.TrExpr(e.Range));
+            }
+            Bpl.Expr body = bodyEtran.TrExpr(e.Term);
 
+            if (e is ForallExpr) {
+              return new Bpl.ForallExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars, bvars), kv, tr, Bpl.Expr.Imp(antecedent, body));
+            } else {
+              Contract.Assert(e is ExistsExpr);
+              return new Bpl.ExistsExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars, bvars), kv, tr, Bpl.Expr.And(antecedent, body));
+            }
+          }
         } else if (expr is SetComprehension) {
           var e = (SetComprehension)expr;
           // Translate "set xs | R :: T" into "lambda y: BoxType :: (exists xs :: CorrectType(xs) && R && y==Box(T))".
@@ -13092,13 +13096,7 @@ namespace Microsoft.Dafny {
 
     private bool CanSafelyInline(FunctionCallExpr fexp, Function f) {
       var visitor = new TriggersExplorer();
-
-      visitor.Visit(f.Body);
-      foreach (var expr in f.Ens) { visitor.Visit(expr); }
-      foreach (var expr in f.Req) { visitor.Visit(expr); }
-      foreach (var expr in f.Reads) { visitor.Visit(expr); }
-      foreach (var expr in f.Decreases.Expressions) { visitor.Visit(expr); }
-
+      visitor.Visit(f);
       return f.Formals.Zip(fexp.Args).All(formal_concrete => CanSafelySubstitute(visitor.TriggerVariables, formal_concrete.Item1, formal_concrete.Item2));
     }
 
-- 
cgit v1.2.3


From dd4f127f36ec24fbcedaaae0e61e0894b2bf5e83 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Wed, 19 Aug 2015 22:14:56 -0700
Subject: Print matches for triggers as they appear in the buffer

Triggers themselves, however, are printed exactly as used. For example, a term
(x !in s) yields a trigger (x in s).
---
 Source/Dafny/Triggers/QuantifiersCollection.cs | 2 +-
 Source/Dafny/Triggers/TriggerExtensions.cs     | 7 ++++---
 Source/Dafny/Triggers/TriggersCollector.cs     | 8 ++++++--
 3 files changed, 11 insertions(+), 6 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index a6340f10..49cd84df 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -118,7 +118,7 @@ namespace Microsoft.Dafny.Triggers {
           c => !loopingSubterms[c].Any(),
           c => {
             looping.Add(c);
-            c.Annotation = "loops with " + loopingSubterms[c].MapConcat(t => Printer.ExprToString(t.Expr), ", ");
+            c.Annotation = "loops with " + loopingSubterms[c].MapConcat(t => "{" + Printer.ExprToString(t.OriginalExpr) + "}", ", ");
           }).ToList();
 
         q.CouldSuppressLoops = safe.Count > 0;
diff --git a/Source/Dafny/Triggers/TriggerExtensions.cs b/Source/Dafny/Triggers/TriggerExtensions.cs
index a49ed13a..6c3f4ee7 100644
--- a/Source/Dafny/Triggers/TriggerExtensions.cs
+++ b/Source/Dafny/Triggers/TriggerExtensions.cs
@@ -24,6 +24,7 @@ namespace Microsoft.Dafny.Triggers {
 
   internal struct TriggerMatch {
     internal Expression Expr;
+    internal Expression OriginalExpr;
     internal Dictionary<IVariable, Expression> Bindings;
 
     internal static bool Eq(TriggerMatch t1, TriggerMatch t2) {
@@ -110,10 +111,10 @@ namespace Microsoft.Dafny.Triggers {
       return ShallowEq_Top(expr, trigger) && TriggerUtils.SameLists(expr.SubExpressions, trigger.SubExpressions, (e1, e2) => MatchesTrigger(e1, e2, holes, bindings));
     }
 
-    private static TriggerMatch? MatchAgainst(this Expression expr, Expression trigger, IEnumerable<BoundVar> holes) {
+    private static TriggerMatch? MatchAgainst(this Expression expr, Expression trigger, IEnumerable<BoundVar> holes, Expression originalExpr) {
       var bindings = new Dictionary<IVariable, Expression>();
       if (expr.MatchesTrigger(trigger, new HashSet<BoundVar>(holes), bindings)) {
-        return new TriggerMatch { Expr = expr, Bindings = bindings };
+        return new TriggerMatch { Expr = expr, OriginalExpr = originalExpr ?? expr, Bindings = bindings };
       } else {
         return null;
       }
@@ -121,7 +122,7 @@ namespace Microsoft.Dafny.Triggers {
 
     internal static IEnumerable<TriggerMatch> SubexpressionsMatchingTrigger(this QuantifierExpr quantifier, Expression trigger) {
       return quantifier.Term.AllSubExpressions()
-        .Select(e => TriggerUtils.CleanupExprForInclusionInTrigger(e).MatchAgainst(trigger, quantifier.BoundVars))
+        .Select(e => TriggerUtils.CleanupExprForInclusionInTrigger(e).MatchAgainst(trigger, quantifier.BoundVars, e))
         .Where(e => e.HasValue).Select(e => e.Value);
     }
 
diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index 08d33af6..735baa01 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -13,7 +13,11 @@ namespace Microsoft.Dafny.Triggers {
     internal ISet<IVariable> Variables { get; set; }
 
     public override string ToString() {
-      return Printer.ExprToString(OriginalExpr);
+      return Printer.ExprToString(Expr); 
+      // NOTE: Using OriginalExpr here could cause some confusion: 
+      // for example, {a !in b} is a binary expression, yielding 
+      // trigger {a in b}. Saying the trigger is a !in b would be 
+      // rather misleading.
     }
 
     internal static bool Eq(TriggerTerm t1, TriggerTerm t2) {
@@ -45,7 +49,7 @@ namespace Microsoft.Dafny.Triggers {
 
     internal IEnumerable<TriggerMatch> LoopingSubterms(QuantifierExpr quantifier) {
       Contract.Requires(quantifier.SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
-      var matchingSubterms = MatchingSubterms(quantifier);
+      var matchingSubterms = this.MatchingSubterms(quantifier);
       return matchingSubterms.Where(tm => tm.CouldCauseLoops(Terms));
     }
 
-- 
cgit v1.2.3


From e3fff39c37ed68cf718eab84613e3bbb02858653 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 20 Aug 2015 10:01:50 -0700
Subject: Allow users to disable quantifier splitting by with a {:split false}
 attribute

---
 Source/Dafny/Triggers/QuantifierSplitter.cs | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifierSplitter.cs b/Source/Dafny/Triggers/QuantifierSplitter.cs
index 4b223856..c50bc9c6 100644
--- a/Source/Dafny/Triggers/QuantifierSplitter.cs
+++ b/Source/Dafny/Triggers/QuantifierSplitter.cs
@@ -85,10 +85,12 @@ namespace Microsoft.Dafny.Triggers {
 
     protected override void VisitOneExpr(Expression expr) {
       var quantifier = expr as QuantifierExpr;
-      if (quantifier != null) {
-        var split = SplitQuantifier(quantifier).ToList();
-        quantifier.SplitQuantifier = split;
-        //Console.WriteLine("!!! {0} => {1}", Printer.ExprToString(expr), rew.MapConcat(Printer.ExprToString, " ||| "));
+      if (quantifier != null && quantifier.SplitQuantifier == null) {
+        bool splitAttr = true;
+        if (!Attributes.ContainsBool(quantifier.Attributes, "split", ref splitAttr) || splitAttr) {
+          var split = SplitQuantifier(quantifier).ToList();
+          quantifier.SplitQuantifier = split;
+        }
       }
     }
   }
-- 
cgit v1.2.3


From cfdaf4ccbea24636f2a94ca9d2f75b8699921d60 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 20 Aug 2015 10:28:47 -0700
Subject: Mark a few reporting functions as static

---
 Source/Dafny/Reporting.cs  | 6 +++---
 Source/Dafny/Translator.cs | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Reporting.cs b/Source/Dafny/Reporting.cs
index c3797574..77869d9f 100644
--- a/Source/Dafny/Reporting.cs
+++ b/Source/Dafny/Reporting.cs
@@ -122,15 +122,15 @@ namespace Microsoft.Dafny {
       Info(source, tok, String.Format(msg, args));
     }
 
-    public string ErrorToString(ErrorLevel header, IToken tok, string msg) {
+    public static string ErrorToString(ErrorLevel header, IToken tok, string msg) {
       return ErrorToString_Internal(": " + header.ToString(), tok.filename, tok.line, tok.col, ": " + msg);
     }
 
-    public string ErrorToString(ErrorLevel header, string filename, int oneBasedLine, int oneBasedColumn, string msg) {
+    public static string ErrorToString(ErrorLevel header, string filename, int oneBasedLine, int oneBasedColumn, string msg) {
       return ErrorToString_Internal(": " + header.ToString(), filename, oneBasedLine, oneBasedColumn, ": " + msg);
     }
 
-    public string ErrorToString_Internal(string header, string filename, int oneBasedLine, int oneBasedColumn, string msg) {
+    public static string ErrorToString_Internal(string header, string filename, int oneBasedLine, int oneBasedColumn, string msg) {
       return String.Format("{0}({1},{2}){3}{4}", filename, oneBasedLine, oneBasedColumn - 1, header, msg ?? "");
     }
   }
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 8146d2cf..e39b777d 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -3585,7 +3585,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(tok != null);
       Contract.Ensures(Contract.Result<Bpl.Cmd>() != null);
       var col = tok.col + (isEndToken ? tok.val.Length : 0);
-      string description = reporter.ErrorToString_Internal(additionalInfo == null ? "" : ": ", tok.filename, tok.line, tok.col, additionalInfo ?? "");
+      string description = ErrorReporter.ErrorToString_Internal(additionalInfo == null ? "" : ": ", tok.filename, tok.line, tok.col, additionalInfo ?? "");
       QKeyValue kv = new QKeyValue(tok, "captureState", new List<object>() { description }, null);
       return new Bpl.AssumeCmd(tok, Bpl.Expr.True, kv);
     }
-- 
cgit v1.2.3


From aeb38d63369ee5b584ef9f5574c7371aea423759 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 20 Aug 2015 10:37:11 -0700
Subject: Simplify error reporting in the trigger generator to get cleaner
 messages

---
 Source/Dafny/Triggers/QuantifiersCollection.cs                 | 10 ++++++----
 Test/triggers/loop-detection-is-not-too-strict.dfy.expect      |  2 +-
 ...e-terms-do-not-look-like-the-triggers-they-match.dfy.expect |  2 +-
 3 files changed, 8 insertions(+), 6 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index 49cd84df..ec2f1777 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -137,9 +137,9 @@ namespace Microsoft.Dafny.Triggers {
     private void CommitOne(QuantifierWithTriggers q, bool addHeader) {
       var errorLevel = ErrorLevel.Info;
       var msg = new StringBuilder();
-      var indent = addHeader ? "   " : " "; //FIXME if multiline messages were properly supported, this indentation wouldn't be needed
+      var indent = addHeader ? "  " : "";
 
-      if (!TriggerUtils.NeedsAutoTriggers(q.quantifier)) { //FIXME: matchingloop and autotriggers attributes are passed down to Boogie
+      if (!TriggerUtils.NeedsAutoTriggers(q.quantifier)) { //FIXME: matchingloop, split and autotriggers attributes are passed down to Boogie
         msg.AppendFormat("Not generating triggers for {{{0}}}.", Printer.ExprToString(q.quantifier.Term)).AppendLine(); 
         // FIXME This shouldn't be printed for autoReqs. (see autoReq.dfy)
         // FIXME typeQuantifier?
@@ -156,7 +156,7 @@ namespace Microsoft.Dafny.Triggers {
         AddTriggersToMessage("Rejected triggers:", q.RejectedCandidates, msg, indent, true);
 
 #if QUANTIFIER_WARNINGS
-        string WARN = (msg.Length > 0 ? indent : "") + (DafnyOptions.O.UnicodeOutput ? "⚠ " : "(!) ");
+        string WARN = indent + (DafnyOptions.O.UnicodeOutput ? "⚠ " : "(!) ");
         if (!q.CandidateTerms.Any()) {
           errorLevel = ErrorLevel.Warning;
           msg.Append(WARN).AppendLine("No terms found to trigger on.");
@@ -171,7 +171,9 @@ namespace Microsoft.Dafny.Triggers {
       }
       
       if (msg.Length > 0) {
-        reporter.Message(MessageSource.Rewriter, errorLevel, q.quantifier.tok, msg.ToString().TrimEnd("\r\n".ToCharArray()));
+        // Extra indent added to make it easier to distinguish multiline error messages
+        var msgStr = msg.ToString().Replace(Environment.NewLine, Environment.NewLine + " ").TrimEnd("\r\n ".ToCharArray());
+        reporter.Message(MessageSource.Rewriter, errorLevel, q.quantifier.tok, msgStr);
       }
     }
 
diff --git a/Test/triggers/loop-detection-is-not-too-strict.dfy.expect b/Test/triggers/loop-detection-is-not-too-strict.dfy.expect
index c2e5ef3a..29882da7 100644
--- a/Test/triggers/loop-detection-is-not-too-strict.dfy.expect
+++ b/Test/triggers/loop-detection-is-not-too-strict.dfy.expect
@@ -1,4 +1,4 @@
-loop-detection-is-not-too-strict.dfy(20,9): Warning:  Selected triggers: {P(x, y)} (loops with {P(x, y + 1)})
+loop-detection-is-not-too-strict.dfy(20,9): Warning: Selected triggers: {P(x, y)} (loops with {P(x, y + 1)})
  (!) Suppressing loops would leave this expression without triggers.
 
 Dafny program verifier finished with 3 verified, 0 errors
diff --git a/Test/triggers/some-terms-do-not-look-like-the-triggers-they-match.dfy.expect b/Test/triggers/some-terms-do-not-look-like-the-triggers-they-match.dfy.expect
index ef48f568..83648626 100644
--- a/Test/triggers/some-terms-do-not-look-like-the-triggers-they-match.dfy.expect
+++ b/Test/triggers/some-terms-do-not-look-like-the-triggers-they-match.dfy.expect
@@ -1,4 +1,4 @@
-some-terms-do-not-look-like-the-triggers-they-match.dfy(12,17): Warning:  Selected triggers: {s[x]} (loops with {s[x + 1]})
+some-terms-do-not-look-like-the-triggers-they-match.dfy(12,17): Warning: Selected triggers: {s[x]} (loops with {s[x + 1]})
  (!) Suppressing loops would leave this expression without triggers.
 some-terms-do-not-look-like-the-triggers-they-match.dfy(15,17): Warning: For expression {x in s ==> s[x + 1] > 0}:
    Selected triggers: {s[x]} (loops with {s[x + 1]})
-- 
cgit v1.2.3


From 270b34fc36dcfc781e8f49df5339cb2e10e69828 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Thu, 20 Aug 2015 11:49:24 -0700
Subject: Fixed bug in type unification

---
 Source/Dafny/Resolver.cs           |  7 +++++--
 Test/dafny4/Regression0.dfy        | 13 +++++++++++++
 Test/dafny4/Regression0.dfy.expect |  4 ++++
 3 files changed, 22 insertions(+), 2 deletions(-)
 create mode 100644 Test/dafny4/Regression0.dfy
 create mode 100644 Test/dafny4/Regression0.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 58984b9b..2f2b5a54 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -4574,8 +4574,11 @@ namespace Microsoft.Dafny
 
       } else if (a is CollectionTypeProxy) {
         if (b is CollectionTypeProxy) {
-          a.T = b;
-          return UnifyTypes(((CollectionTypeProxy)a).Arg, ((CollectionTypeProxy)b).Arg);
+          var argUnificationSuccess = UnifyTypes(((CollectionTypeProxy)a).Arg, ((CollectionTypeProxy)b).Arg);
+          if (argUnificationSuccess) {
+            a.T = b;
+          }
+          return argUnificationSuccess;
         } else if (b is OperationTypeProxy) {
           var proxy = (OperationTypeProxy)b;
           if (proxy.AllowSeq && proxy.AllowSetVarieties && proxy.AllowISet) {
diff --git a/Test/dafny4/Regression0.dfy b/Test/dafny4/Regression0.dfy
new file mode 100644
index 00000000..be092261
--- /dev/null
+++ b/Test/dafny4/Regression0.dfy
@@ -0,0 +1,13 @@
+// RUN: %dafny /compile:0  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// This once crashed Dafny
+
+method M() {
+  var s := [1, "2"];
+  if * {
+    assert exists n :: n in s && n != 1;
+  } else {
+    assert "2" in s;
+  }
+}
diff --git a/Test/dafny4/Regression0.dfy.expect b/Test/dafny4/Regression0.dfy.expect
new file mode 100644
index 00000000..9d1e3019
--- /dev/null
+++ b/Test/dafny4/Regression0.dfy.expect
@@ -0,0 +1,4 @@
+Regression0.dfy(7,15): Error: All elements of display must be of the same type (got string, but type of previous elements is int)
+Regression0.dfy(9,28): Error: the type of this variable is underspecified
+Regression0.dfy(11,15): Error: second argument to "in" must be a set, multiset, or sequence with elements of type string, or a map with domain string (instead got ?)
+3 resolution/type errors detected in Regression0.dfy
-- 
cgit v1.2.3


From 75e436019003604ea3118a13ccd9b6ea079c643f Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 20 Aug 2015 11:52:32 -0700
Subject: Discard error messages that refer to a non-nested TokenWrapper.

The VS extension already did that, but it also filtered out nested tokens. That
prevented info about triggers from being reported. Other interfaces (the CLI
and Emacs, in particular) should have the same ability.

Surprinsingly, this doesn't cause any tests failures.
---
 Source/Dafny/Reporting.cs                 | 13 +++----------
 Source/DafnyExtension/IdentifierTagger.cs | 21 ++++-----------------
 2 files changed, 7 insertions(+), 27 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Reporting.cs b/Source/Dafny/Reporting.cs
index 77869d9f..63ec520a 100644
--- a/Source/Dafny/Reporting.cs
+++ b/Source/Dafny/Reporting.cs
@@ -34,21 +34,14 @@ namespace Microsoft.Dafny {
       AllMessages[ErrorLevel.Info] = new List<ErrorMessage>();
     }
 
-    protected bool ShouldDiscard(MessageSource source, ErrorLevel level) {
-      return ((ErrorsOnly && level != ErrorLevel.Error) ||
-              (!DafnyOptions.O.PrintTooltips && level == ErrorLevel.Info));
-    }
-
     // This is the only thing that needs to be overriden
     public virtual bool Message(MessageSource source, ErrorLevel level, IToken tok, string msg) {
-      var discard = ShouldDiscard(source, level);
-
+      bool discard = (ErrorsOnly && level != ErrorLevel.Error) || // Discard non-errors if ErrorsOnly is set
+                     (tok is TokenWrapper && !(tok is NestedToken)); // Discard wrapped tokens, except for nested ones
       if (!discard) {
         AllMessages[level].Add(new ErrorMessage { token = tok, message = msg });
-        return true;
       }
-
-      return false;
+      return !discard;
     }
 
     public int Count(ErrorLevel level) {
diff --git a/Source/DafnyExtension/IdentifierTagger.cs b/Source/DafnyExtension/IdentifierTagger.cs
index 13991496..5b70329d 100644
--- a/Source/DafnyExtension/IdentifierTagger.cs
+++ b/Source/DafnyExtension/IdentifierTagger.cs
@@ -15,7 +15,6 @@ using Microsoft.VisualStudio.Text.Tagging;
 using Microsoft.VisualStudio.Utilities;
 using Bpl = Microsoft.Boogie;
 
-
 namespace DafnyLanguage
 {
 
@@ -136,8 +135,7 @@ namespace DafnyLanguage
 
       List<IdRegion> newRegions = new List<IdRegion>();
 
-      foreach (var info in program.reporter.AllMessages[ErrorLevel.Info])
-      {
+      foreach (var info in program.reporter.AllMessages[ErrorLevel.Info]) {
         IdRegion.Add(newRegions, info.token, info.message, info.token.val.Length);
       }
 
@@ -368,11 +366,6 @@ namespace DafnyLanguage
       public readonly OccurrenceKind Kind;
       public readonly IVariable Variable;
 
-      static bool SurfaceSyntaxToken(Bpl.IToken tok) {
-        Contract.Requires(tok != null);
-        return !(tok is TokenWrapper);
-      }
-
       public static void Add(List<IdRegion> regions, Bpl.IToken tok, IVariable v, bool isDefinition, ModuleDefinition context) {
         Contract.Requires(regions != null);
         Contract.Requires(tok != null);
@@ -383,27 +376,21 @@ namespace DafnyLanguage
         Contract.Requires(regions != null);
         Contract.Requires(tok != null);
         Contract.Requires(v != null);
-        if (SurfaceSyntaxToken(tok)) {
-          regions.Add(new IdRegion(tok, v, isDefinition, kind, context));
-        }
+        regions.Add(new IdRegion(tok, v, isDefinition, kind, context));
       }
       public static void Add(List<IdRegion> regions, Bpl.IToken tok, Field decl, Microsoft.Dafny.Type showType, string kind, bool isDefinition, ModuleDefinition context) {
         Contract.Requires(regions != null);
         Contract.Requires(tok != null);
         Contract.Requires(decl != null);
         Contract.Requires(kind != null);
-        if (SurfaceSyntaxToken(tok)) {
-          regions.Add(new IdRegion(tok, decl, showType, kind, isDefinition, context));
-        }
+        regions.Add(new IdRegion(tok, decl, showType, kind, isDefinition, context));
       }
 
       public static void Add(List<IdRegion> regions, Bpl.IToken tok, string text, int length) {
         Contract.Requires(regions != null);
         Contract.Requires(tok != null);
         Contract.Requires(text != null);
-        if (SurfaceSyntaxToken(tok)) {
-          regions.Add(new IdRegion(tok, OccurrenceKind.AdditionalInformation, text, length));
-        }
+        regions.Add(new IdRegion(tok, OccurrenceKind.AdditionalInformation, text, length));
       }
 
       private IdRegion(Bpl.IToken tok, IVariable v, bool isDefinition, string kind, ModuleDefinition context) {
-- 
cgit v1.2.3


From 4b7ef1b817fe00bc32294b75797e7e264e2edbdd Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 20 Aug 2015 11:53:00 -0700
Subject: Move indentation of error messages to the ConsoleErrorReporter

This indentation is just needed by CLI-based clients
---
 Source/Dafny/Reporting.cs                      | 5 ++++-
 Source/Dafny/Triggers/QuantifiersCollection.cs | 3 +--
 2 files changed, 5 insertions(+), 3 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Reporting.cs b/Source/Dafny/Reporting.cs
index 63ec520a..4cfbf20e 100644
--- a/Source/Dafny/Reporting.cs
+++ b/Source/Dafny/Reporting.cs
@@ -143,7 +143,10 @@ namespace Microsoft.Dafny {
     }
 
     public override bool Message(MessageSource source, ErrorLevel level, IToken tok, string msg) {
-      if (base.Message(source, level, tok, msg)) {
+      if (base.Message(source, level, tok, msg) && (DafnyOptions.O.PrintTooltips || level != ErrorLevel.Info)) {
+        // Extra indent added to make it easier to distinguish multiline error messages for clients that rely on the CLI
+        msg = msg.Replace(Environment.NewLine, Environment.NewLine + " ");
+
         ConsoleColor previousColor = Console.ForegroundColor;
         Console.ForegroundColor = ColorForLevel(level);
         Console.WriteLine(ErrorToString(level, tok, msg));
diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index ec2f1777..e2afa2ee 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -171,8 +171,7 @@ namespace Microsoft.Dafny.Triggers {
       }
       
       if (msg.Length > 0) {
-        // Extra indent added to make it easier to distinguish multiline error messages
-        var msgStr = msg.ToString().Replace(Environment.NewLine, Environment.NewLine + " ").TrimEnd("\r\n ".ToCharArray());
+        var msgStr = msg.ToString().TrimEnd("\r\n ".ToCharArray());
         reporter.Message(MessageSource.Rewriter, errorLevel, q.quantifier.tok, msgStr);
       }
     }
-- 
cgit v1.2.3


From 5176621e39435ddda9293b8ad0968cf1d7639fb6 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 20 Aug 2015 16:36:21 -0700
Subject: Implement the SelectTrigger method, removing redundant triggers.

The idea is that we define an partial order on triggers (which may contain
multiple terms), and find all the maximal elements. The algorithm as
implemented is rather inefficient; in particular, is does not look at the
structure of the graph of the relation (thus is does many redundant
comparisons). See triggers/useless-triggers-are-removed.dfy for an example
where such a filter is useful.
---
 Source/Dafny/Triggers/QuantifiersCollection.cs     | 42 +++++++++++++---------
 Source/Dafny/Triggers/TriggerUtils.cs              | 11 +++---
 Source/Dafny/Triggers/TriggersCollector.cs         | 35 ++++++++++++++++--
 Test/triggers/useless-triggers-are-removed.dfy     | 25 +++++++++++++
 .../useless-triggers-are-removed.dfy.expect        | 17 +++++++++
 5 files changed, 106 insertions(+), 24 deletions(-)
 create mode 100644 Test/triggers/useless-triggers-are-removed.dfy
 create mode 100644 Test/triggers/useless-triggers-are-removed.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index e2afa2ee..bfa90d81 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -7,7 +7,6 @@ using System.Text;
 using Microsoft.Boogie;
 using System.Diagnostics.Contracts;
 
-//FIXME Generated triggers should be _triggers
 //FIXME: When scoring, do not consider old(x) to be higher than x.
 
 namespace Microsoft.Dafny.Triggers {
@@ -28,7 +27,7 @@ namespace Microsoft.Dafny.Triggers {
     internal void TrimInvalidTriggers() {
       Contract.Requires(CandidateTerms != null);
       Contract.Requires(Candidates != null);
-      Candidates = TriggerUtils.Filter(Candidates, tr => tr.MentionsAll(quantifier.BoundVars), tr => { }).ToList();
+      Candidates = TriggerUtils.Filter(Candidates, tr => tr, (tr, _) => tr.MentionsAll(quantifier.BoundVars), (tr, _) => { }).ToList();
     }
   }
 
@@ -60,7 +59,13 @@ namespace Microsoft.Dafny.Triggers {
       return additionalTerm.Variables.Where(v => v is BoundVar && !terms.Any(t => t.Variables.Contains(v))).Any();
     }
 
-    //FIXME document that this assumes that the quantifiers live in the same context and share the same variables
+    /// <summary>
+    /// Collect triggers from the body of each quantifier, and share them
+    /// between all quantifiers. This method assumes that all quantifiers
+    /// actually come from the same context, and were the result of a split that
+    /// gave them all the same variables.
+    /// </summary>
+    /// <param name="triggersCollector"></param>
     void CollectAndShareTriggers(TriggersCollector triggersCollector) {
       var pool = quantifiers.SelectMany(q => triggersCollector.CollectTriggers(q.quantifier));
       var distinctPool = pool.Deduplicate(TriggerTerm.Eq);
@@ -79,13 +84,10 @@ namespace Microsoft.Dafny.Triggers {
     }
 
     void BuildDependenciesGraph() {
-      // FIXME: Think more about multi-quantifier dependencies
-      //class QuantifierDependency {
-      //  QuantifierWithTriggers Cause;
-      //  QuantifierWithTriggers Consequence;
-      //  List<TriggerCandidate> Triggers;
-      //  List<Expression> MatchingTerm;
-      //}
+      // The problem of finding matching loops between multiple-triggers is hard; it
+      // seems to require one to track exponentially-sized dependencies between parts
+      // of triggers and quantifiers. For now, we only do single-quantifier loop
+      // detection
     }
 
     void SuppressMatchingLoops() {
@@ -111,14 +113,14 @@ namespace Microsoft.Dafny.Triggers {
 
       foreach (var q in quantifiers) {
         var looping = new List<TriggerCandidate>();
-        var loopingSubterms = q.Candidates.ToDictionary(candidate => candidate, candidate => candidate.LoopingSubterms(q.quantifier).ToList());
 
         var safe = TriggerUtils.Filter(
           q.Candidates,
-          c => !loopingSubterms[c].Any(),
-          c => {
-            looping.Add(c);
-            c.Annotation = "loops with " + loopingSubterms[c].MapConcat(t => "{" + Printer.ExprToString(t.OriginalExpr) + "}", ", ");
+          candidate => candidate.LoopingSubterms(q.quantifier).ToList(),
+          (candidate, loopingSubterms) => !loopingSubterms.Any(),
+          (candidate, loopingSubterms) => {
+            looping.Add(candidate);
+            candidate.Annotation = "loops with " + loopingSubterms.MapConcat(t => "{" + Printer.ExprToString(t.OriginalExpr) + "}", ", ");
           }).ToList();
 
         q.CouldSuppressLoops = safe.Count > 0;
@@ -131,7 +133,15 @@ namespace Microsoft.Dafny.Triggers {
     }
 
     void SelectTriggers() {
-      //FIXME
+      foreach (var q in quantifiers) { //FIXME Check whether this makes verification faster
+        q.Candidates = TriggerUtils.Filter(q.Candidates,
+          candidate => q.Candidates.Where(candidate.IsStrongerThan).ToList(),
+          (candidate, weakerCandidates) => !weakerCandidates.Any(),
+          (candidate, weakerCandidates) => {
+            q.RejectedCandidates.Add(candidate);
+            candidate.Annotation = "stronger than " + String.Join(", ", weakerCandidates);
+          }).ToList();
+      }
     }
 
     private void CommitOne(QuantifierWithTriggers q, bool addHeader) {
diff --git a/Source/Dafny/Triggers/TriggerUtils.cs b/Source/Dafny/Triggers/TriggerUtils.cs
index 9ebcf846..6f76464b 100644
--- a/Source/Dafny/Triggers/TriggerUtils.cs
+++ b/Source/Dafny/Triggers/TriggerUtils.cs
@@ -76,13 +76,14 @@ namespace Microsoft.Dafny.Triggers {
       return it1_has == it2_has && acc;
     }
 
-    internal static IEnumerable<T> Filter<T>(IEnumerable<T> elements, Func<T, bool> predicate, Action<T> reject) {
+    internal static IEnumerable<T> Filter<T, U>(IEnumerable<T> elements, Func<T, U> Converter, Func<T, U, bool> predicate, Action<T, U> reject) {
       var positive = new List<T>();
-      foreach (var c in elements) {
-        if (predicate(c)) {
-          yield return c;
+      foreach (var elem in elements) {
+        var conv = Converter(elem);
+        if (predicate(elem, conv)) {
+          yield return elem;
         } else {
-          reject(c);
+          reject(elem, conv);
         }
       }
     }
diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index 735baa01..3b2853ed 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -20,6 +20,20 @@ namespace Microsoft.Dafny.Triggers {
       // rather misleading.
     }
 
+    internal enum TermComparison {
+      SameStrength = 0, Stronger = 1, NotStronger = -1
+    }
+
+    internal TermComparison CompareTo(TriggerTerm other) {
+      if (this == other) {
+        return TermComparison.SameStrength;
+      } else if (Expr.AllSubExpressions(true).Any(other.Expr.ExpressionEq)) {
+        return TermComparison.Stronger;
+      } else {
+        return TermComparison.NotStronger;
+      }
+    }
+
     internal static bool Eq(TriggerTerm t1, TriggerTerm t2) {
       return ExprExtensions.ExpressionEq(t1.Expr, t2.Expr);
     }
@@ -41,7 +55,7 @@ namespace Microsoft.Dafny.Triggers {
       return vars.All(x => Terms.Any(term => term.Variables.Contains(x)));
     }
 
-    private string Repr { get { return String.Join(", ", Terms); } }
+    internal string Repr { get { return String.Join(", ", Terms); } }
 
     public override string ToString() {
       return "{" + Repr + "}" + (String.IsNullOrWhiteSpace(Annotation) ? "" : " (" + Annotation + ")");
@@ -58,8 +72,23 @@ namespace Microsoft.Dafny.Triggers {
       return Terms.SelectMany(term => quantifier.SubexpressionsMatchingTrigger(term.Expr)).Deduplicate(TriggerMatch.Eq);
     }
 
-    public String AsDafnyAttributeString() {
-      return "{:trigger " + Repr + "}";
+    internal bool IsStrongerThan(TriggerCandidate that) {
+      if (this == that) {
+        return false; 
+      }
+
+      var hasStrictlyStrongerTerm = false;
+      foreach (var t in Terms) {
+        var comparison = that.Terms.Select(t.CompareTo).Max();
+
+        // All terms of `this` must be at least as strong as a term of `that`
+        if (comparison == TriggerTerm.TermComparison.NotStronger) { return false; }
+
+        // Did we find a strictly stronger term?
+        hasStrictlyStrongerTerm = hasStrictlyStrongerTerm || comparison == TriggerTerm.TermComparison.Stronger;
+      }
+
+      return hasStrictlyStrongerTerm;
     }
   }
 
diff --git a/Test/triggers/useless-triggers-are-removed.dfy b/Test/triggers/useless-triggers-are-removed.dfy
new file mode 100644
index 00000000..16458e41
--- /dev/null
+++ b/Test/triggers/useless-triggers-are-removed.dfy
@@ -0,0 +1,25 @@
+// RUN: %dafny /printTooltips /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:1 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// This file ensures that Dafny does get rid of redundant triggers before
+// annotating a quantifier, and that ths process does not interfere with cycle
+// detection.
+
+function f(x: int): int
+function g(x: int): int
+function h(x: int): int
+
+method M()
+  // In the following, only f(x) is kept. Note that the subset enumeration was
+  // already smart enough to not build any trigger with multiple terms (it only
+  // built 5 candidates)
+  requires forall x: int :: f(x) + g(f(x)) + h(f(x)) + g(h(f(x))) + h(g(f(x))) == 0
+
+  // Loop detection still works fine: in the following example, the trigger is
+  // f(f(x))
+  requires forall x: int :: f(x) == f(f(x))
+
+  // This works for multi-triggers, too:
+  requires forall x, y :: f(x) + g(f(y)) + g(y) + g(f(x)) == 0
+{
+}
diff --git a/Test/triggers/useless-triggers-are-removed.dfy.expect b/Test/triggers/useless-triggers-are-removed.dfy.expect
new file mode 100644
index 00000000..6c2c0a2b
--- /dev/null
+++ b/Test/triggers/useless-triggers-are-removed.dfy.expect
@@ -0,0 +1,17 @@
+useless-triggers-are-removed.dfy(16,11): Info: Selected triggers: {f(x)}
+ Rejected triggers:
+   {h(g(f(x)))} (stronger than {g(f(x))}, {f(x)})
+   {g(h(f(x)))} (stronger than {h(f(x))}, {f(x)})
+   {h(f(x))} (stronger than {f(x)})
+   {g(f(x))} (stronger than {f(x)})
+useless-triggers-are-removed.dfy(20,11): Info: Selected triggers: {f(f(x))}
+ Rejected triggers: {f(x)} (loops with {f(f(x))})
+useless-triggers-are-removed.dfy(23,11): Info: Selected triggers:
+   {g(f(x)), g(y)}, {f(y), f(x)}
+ Rejected triggers:
+   {g(y), f(x)} (loops with {g(f(y))}, {g(f(x))})
+   {g(f(x)), g(f(y))} (stronger than {g(f(x)), f(y)}, {g(f(y)), f(x)}, {f(y), f(x)})
+   {g(f(x)), f(y)} (stronger than {f(y), f(x)})
+   {g(f(y)), f(x)} (stronger than {f(y), f(x)})
+
+Dafny program verifier finished with 5 verified, 0 errors
-- 
cgit v1.2.3


From 24812516d64ed809d7446680a79eac492ea6a201 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 20 Aug 2015 16:44:21 -0700
Subject: Make the dependency that DafnyServer has on DafnyPipeline explicit

---
 Source/Dafny.sln | 3 +++
 1 file changed, 3 insertions(+)

(limited to 'Source')

diff --git a/Source/Dafny.sln b/Source/Dafny.sln
index db035b4a..3e71a2a4 100644
--- a/Source/Dafny.sln
+++ b/Source/Dafny.sln
@@ -6,6 +6,9 @@ EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DafnyPipeline", "Dafny\DafnyPipeline.csproj", "{FE44674A-1633-4917-99F4-57635E6FA740}"
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DafnyServer", "DafnyServer\DafnyServer.csproj", "{AC9B21AE-EBC1-4A27-AD11-ED031FC7B4A2}"
+	ProjectSection(ProjectDependencies) = postProject
+		{FE44674A-1633-4917-99F4-57635E6FA740} = {FE44674A-1633-4917-99F4-57635E6FA740}
+	EndProjectSection
 EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-- 
cgit v1.2.3


From 566fdf1676e0d7d6060767febbfa7a0378300e99 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Thu, 20 Aug 2015 17:23:24 -0700
Subject: Fixed compilation that involve enumeration over native-type newtype
 values.

---
 Binaries/DafnyRuntime.cs                |  5 +++
 Source/Dafny/Compiler.cs                | 76 +++++++++++++++++++++------------
 Source/Dafny/DafnyAst.cs                |  6 ++-
 Test/dafny0/RangeCompilation.dfy        | 25 +++++++++++
 Test/dafny0/RangeCompilation.dfy.expect |  6 +++
 5 files changed, 89 insertions(+), 29 deletions(-)
 create mode 100644 Test/dafny0/RangeCompilation.dfy
 create mode 100644 Test/dafny0/RangeCompilation.dfy.expect

(limited to 'Source')

diff --git a/Binaries/DafnyRuntime.cs b/Binaries/DafnyRuntime.cs
index 7d3799d8..dfb8cf38 100644
--- a/Binaries/DafnyRuntime.cs
+++ b/Binaries/DafnyRuntime.cs
@@ -1060,6 +1060,11 @@ namespace Dafny
         }
       }
     }
+    public static IEnumerable<BigInteger> IntegerRange(BigInteger lo, BigInteger hi) {
+      for (var j = lo; j < hi; j++) {
+        yield return j;
+      }
+    }
     // pre: b != 0
     // post: result == a/b, as defined by Euclidean Division (http://en.wikipedia.org/wiki/Modulo_operation)
     public static sbyte EuclideanDivision_sbyte(sbyte a, sbyte b) {
diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index f2cc5d23..8bfa5fa9 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -117,7 +117,19 @@ namespace Microsoft.Dafny {
           } else if (d is TypeSynonymDecl) {
             // do nothing, just bypass type synonyms in the compiler
           } else if (d is NewtypeDecl) {
-            // do nothing, just bypass newtypes in the compiler
+            var nt = (NewtypeDecl)d;
+            Indent(indent);
+            wr.WriteLine("public class @{0} {{", nt.CompileName);
+            if (nt.NativeType != null) {
+              Indent(indent + IndentAmount);
+              wr.WriteLine("public static System.Collections.Generic.IEnumerable<{0}> IntegerRange(BigInteger lo, BigInteger hi) {{", nt.NativeType.Name);
+              Indent(indent + 2 * IndentAmount);
+              wr.WriteLine("for (var j = lo; j < hi; j++) {{ yield return ({0})j; }}", nt.NativeType.Name);
+              Indent(indent + IndentAmount);
+              wr.WriteLine("}");
+            }
+            Indent(indent);
+            wr.WriteLine("}");
           } else if (d is DatatypeDecl) {
             var dt = (DatatypeDecl)d;
             Indent(indent);
@@ -676,7 +688,7 @@ namespace Microsoft.Dafny {
     }
 
     string DtName(DatatypeDecl decl) {
-      return decl.Module.IsDefaultModule ? decl.CompileName : decl.FullCompileName;
+      return decl.FullCompileName;
     }
     string DtCtorName(DatatypeCtor ctor) {
       Contract.Requires(ctor != null);
@@ -1560,11 +1572,15 @@ namespace Microsoft.Dafny {
           } else if (bound is ComprehensionExpr.IntBoundedPool) {
             var b = (ComprehensionExpr.IntBoundedPool)bound;
             Indent(ind);
-            wr.Write("for (var @{0} = ", bv.CompileName);
+            if (AsNativeType(bv.Type) != null) {
+              wr.Write("foreach (var @{0} in @{1}.IntegerRange(", bv.CompileName, bv.Type.AsNewtype.FullCompileName);
+            } else {
+              wr.Write("foreach (var @{0} in Dafny.Helpers.IntegerRange(", bv.CompileName);
+            }
             TrExpr(b.LowerBound);
-            wr.Write("; @{0} < ", bv.CompileName);
+            wr.Write(", ");
             TrExpr(b.UpperBound);
-            wr.Write("; @{0}++) {{ ", bv.CompileName);
+            wr.Write(")) { ");
           } else if (bound is ComprehensionExpr.SetBoundedPool) {
             var b = (ComprehensionExpr.SetBoundedPool)bound;
             Indent(ind);
@@ -1766,27 +1782,23 @@ namespace Microsoft.Dafny {
           wr.WriteLine("foreach (var {0} in Dafny.Helpers.AllBooleans) {{ @{1} = {0};", tmpVar, bv.CompileName);
         } else if (bound is ComprehensionExpr.IntBoundedPool) {
           var b = (ComprehensionExpr.IntBoundedPool)bound;
-          // (tmpVar is not used in this case)
-          if (b.LowerBound != null) {
-            wr.Write("@{0} = ", bv.CompileName);
+          if (AsNativeType(bv.Type) != null) {
+            wr.Write("foreach (var @{0} in @{1}.IntegerRange(", tmpVar, bv.Type.AsNewtype.FullCompileName);
+          } else {
+            wr.Write("foreach (var @{0} in Dafny.Helpers.IntegerRange(", tmpVar);
+          }
+          if (b.LowerBound == null) {
+            wr.Write("null");
+          } else {
             TrExpr(b.LowerBound);
-            wr.WriteLine(";");
-            Indent(ind);
-            if (b.UpperBound != null) {
-              wr.Write("for (; @{0} < ", bv.CompileName);
-              TrExpr(b.UpperBound);
-              wr.WriteLine("; @{0}++) {{ ", bv.CompileName);
-            } else {
-              wr.WriteLine("for (;; @{0}++) {{ ", bv.CompileName);
-            }
+          }
+          wr.Write(", ");
+          if (b.UpperBound == null) {
+            wr.Write("null");
           } else {
-            Contract.Assert(b.UpperBound != null);
-            wr.Write("@{0} = ", bv.CompileName);
             TrExpr(b.UpperBound);
-            wr.WriteLine(";");
-            Indent(ind);
-            wr.WriteLine("for (;; @{0}--) {{ ", bv.CompileName);
           }
+          wr.WriteLine(")) {{ @{1} = {0};", tmpVar, bv.CompileName);
         } else if (bound is AssignSuchThatStmt.WiggleWaggleBound) {
           wr.WriteLine("foreach (var {0} in Dafny.Helpers.AllIntegers) {{ @{1} = {0};", tmpVar, bv.CompileName);
         } else if (bound is ComprehensionExpr.SetBoundedPool) {
@@ -2891,11 +2903,15 @@ namespace Microsoft.Dafny {
             wr.Write("foreach (var @{0} in Dafny.Helpers.AllBooleans) {{ ", bv.CompileName);
           } else if (bound is ComprehensionExpr.IntBoundedPool) {
             var b = (ComprehensionExpr.IntBoundedPool)bound;
-            wr.Write("for (var @{0} = ", bv.CompileName);
+            if (AsNativeType(bv.Type) != null) {
+              wr.Write("foreach (var @{0} in @{1}.IntegerRange(", bv.CompileName, bv.Type.AsNewtype.FullCompileName);
+            } else {
+              wr.Write("foreach (var @{0} in Dafny.Helpers.IntegerRange(", bv.CompileName);
+            }
             TrExpr(b.LowerBound);
-            wr.Write("; @{0} < ", bv.CompileName);
+            wr.Write(", ");
             TrExpr(b.UpperBound);
-            wr.Write("; @{0}++) {{ ", bv.CompileName);
+            wr.Write(")) { ");
           } else if (bound is ComprehensionExpr.SetBoundedPool) {
             var b = (ComprehensionExpr.SetBoundedPool)bound;
             wr.Write("foreach (var @{0} in (", bv.CompileName);
@@ -2960,11 +2976,15 @@ namespace Microsoft.Dafny {
           wr.Write("foreach (var @{0} in Dafny.Helpers.AllBooleans) {{ ", bv.CompileName);
         } else if (bound is ComprehensionExpr.IntBoundedPool) {
           var b = (ComprehensionExpr.IntBoundedPool)bound;
-          wr.Write("for (var @{0} = ", bv.CompileName);
+          if (AsNativeType(bv.Type) != null) {
+            wr.Write("foreach (var @{0} in @{1}.IntegerRange(", bv.CompileName, bv.Type.AsNewtype.FullCompileName);
+          } else {
+            wr.Write("foreach (var @{0} in Dafny.Helpers.IntegerRange(", bv.CompileName);
+          }
           TrExpr(b.LowerBound);
-          wr.Write("; @{0} < ", bv.CompileName);
+          wr.Write(", ");
           TrExpr(b.UpperBound);
-          wr.Write("; @{0}++) {{ ", bv.CompileName);
+          wr.Write(")) { ");
         } else if (bound is ComprehensionExpr.SetBoundedPool) {
           var b = (ComprehensionExpr.SetBoundedPool)bound;
           wr.Write("foreach (var @{0} in (", bv.CompileName);
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 7328d8dd..d78ae170 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -1967,7 +1967,11 @@ namespace Microsoft.Dafny {
     }
     public string FullCompileName {
       get {
-        return Module.CompileName + ".@" + CompileName;
+        if (!Module.IsDefaultModule) {
+          return Module.CompileName + ".@" + CompileName;
+        } else {
+          return CompileName;
+        }
       }
     }
   }
diff --git a/Test/dafny0/RangeCompilation.dfy b/Test/dafny0/RangeCompilation.dfy
new file mode 100644
index 00000000..de8ca68e
--- /dev/null
+++ b/Test/dafny0/RangeCompilation.dfy
@@ -0,0 +1,25 @@
+// RUN: %dafny /compile:3 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+newtype Byte = x | 0 <= x < 256
+predicate method GoodByte(b: Byte) {
+  b % 3 == 2
+}
+predicate method GoodInteger(i: int) {
+  i % 5 == 4
+}
+
+method Main() {
+  assert GoodByte(11) && GoodInteger(24);
+  var b: Byte :| GoodByte(b);
+  var i: int :| 0 <= i < 256 && GoodInteger(i);
+  print "b=", b, "  i=", i, "\n";
+  var m0 := new MyClass;
+  var m17 := new M17.AnotherClass;
+}
+
+class MyClass { }
+
+module M17 {
+  class AnotherClass { }
+}
diff --git a/Test/dafny0/RangeCompilation.dfy.expect b/Test/dafny0/RangeCompilation.dfy.expect
new file mode 100644
index 00000000..c3275d12
--- /dev/null
+++ b/Test/dafny0/RangeCompilation.dfy.expect
@@ -0,0 +1,6 @@
+
+Dafny program verifier finished with 5 verified, 0 errors
+Program compiled successfully
+Running...
+
+b=2  i=4
-- 
cgit v1.2.3


From b8d7d6d785a29fd948e9a9740fb96ed270ac19d8 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Thu, 20 Aug 2015 17:24:58 -0700
Subject: Minor refactoring

---
 Source/Dafny/Compiler.cs | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 8bfa5fa9..477acabf 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -687,14 +687,11 @@ namespace Microsoft.Dafny {
       return formal.HasName ? formal.CompileName : "_a" + i;
     }
 
-    string DtName(DatatypeDecl decl) {
-      return decl.FullCompileName;
-    }
     string DtCtorName(DatatypeCtor ctor) {
       Contract.Requires(ctor != null);
       Contract.Ensures(Contract.Result<string>() != null);
 
-      return DtName(ctor.EnclosingDatatype) + "_" + ctor.CompileName;
+      return ctor.EnclosingDatatype.FullCompileName + "_" + ctor.CompileName;
     }
     string DtCtorDeclartionName(DatatypeCtor ctor) {
       Contract.Requires(ctor != null);
@@ -2390,7 +2387,7 @@ namespace Microsoft.Dafny {
         Contract.Assert(dtv.Ctor != null);  // since dtv has been successfully resolved
         var typeParams = dtv.InferredTypeArgs.Count == 0 ? "" : string.Format("<{0}>", TypeNames(dtv.InferredTypeArgs));
 
-        wr.Write("new {0}{1}(", DtName(dtv.Ctor.EnclosingDatatype), typeParams);
+        wr.Write("new {0}{1}(", dtv.Ctor.EnclosingDatatype.FullCompileName, typeParams);
         if (!dtv.IsCoCall) {
           // For an ordinary constructor (that is, one that does not guard any co-recursive calls), generate:
           //   new Dt_Cons<T>( args )
@@ -2860,7 +2857,7 @@ namespace Microsoft.Dafny {
             var b = (ComprehensionExpr.DatatypeBoundedPool)bound;
             wr.Write("Dafny.Helpers.QuantDatatype(");
 
-            wr.Write("{0}.AllSingletonConstructors, ", DtName(b.Decl));
+            wr.Write("{0}.AllSingletonConstructors, ", b.Decl.FullCompileName);
           } else {
             Contract.Assert(false); throw new cce.UnreachableException();  // unexpected BoundedPool type
           }
-- 
cgit v1.2.3


From efcd1e908cb7ea05e78faffd206fa5ce1e966b74 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Thu, 20 Aug 2015 17:29:15 -0700
Subject: Changed equality tests involving traits from using strings to using
 reference equality

---
 Source/Dafny/Resolver.cs | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 2f2b5a54..a1e89805 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -4342,13 +4342,12 @@ namespace Microsoft.Dafny
             successSoFar = UnifyTypes(aa.TypeArgs[i], bb.TypeArgs[i]);
           }
           return successSoFar;
-        }
-        else if ((rcb is TraitDecl) && (rca is TraitDecl)) {
-            return ((TraitDecl)rcb).FullCompileName == ((TraitDecl)rca).FullCompileName;
-        } else if ((rcb is ClassDecl) && (rca is TraitDecl)) {
-            return ((ClassDecl)rcb).TraitsObj.Any(tr => tr.FullCompileName == ((TraitDecl)rca).FullCompileName);
-        } else if ((rca is ClassDecl) && (rcb is TraitDecl)) {
-            return ((ClassDecl)rca).TraitsObj.Any(tr => tr.FullCompileName == ((TraitDecl)rcb).FullCompileName);
+        } else if (rcb is TraitDecl && rca is TraitDecl) {
+          return rca == rcb;
+        } else if (rcb is ClassDecl && rca is TraitDecl) {
+          return ((ClassDecl)rcb).TraitsObj.Contains(rca);
+        } else if (rca is ClassDecl && rcb is TraitDecl) {
+            return ((ClassDecl)rca).TraitsObj.Contains(rcb);
         } else if (aa.ResolvedParam != null && aa.ResolvedParam == bb.ResolvedParam) {
           // type parameters
           if (aa.TypeArgs.Count != bb.TypeArgs.Count) {
-- 
cgit v1.2.3


From e676ad0877d31cb73a1a6bb5aae677ac64593fd6 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 20 Aug 2015 19:58:46 -0700
Subject: Cleanup a number of FIXMEs that I had left in the code

---
 Source/Dafny/DafnyAst.cs                       | 12 ++++++------
 Source/Dafny/Resolver.cs                       |  6 +++---
 Source/Dafny/Triggers/QuantifiersCollection.cs |  8 ++------
 Source/Dafny/Triggers/TriggersCollector.cs     |  6 ++++--
 Source/DafnyServer/DafnyHelper.cs              |  2 +-
 Source/DafnyServer/Server.cs                   |  9 +--------
 Source/DafnyServer/Utilities.cs                |  6 ++----
 7 files changed, 19 insertions(+), 30 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 14a354c4..06f6d856 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -7769,7 +7769,7 @@ namespace Microsoft.Dafny {
       } else if (decl is Method) {
         Visit((Method)decl);
       }
-      //FIXME More?
+      //TODO More?
     }
     public void Visit(Method method) {
       Visit(method.Ens);
@@ -7777,7 +7777,7 @@ namespace Microsoft.Dafny {
       Visit(method.Mod.Expressions);
       Visit(method.Decreases.Expressions);
       if (method.Body != null) { Visit(method.Body); }
-      //FIXME More?
+      //TODO More?
     }
     public void Visit(Function function) {
       Visit(function.Ens);
@@ -7785,7 +7785,7 @@ namespace Microsoft.Dafny {
       Visit(function.Reads);
       Visit(function.Decreases.Expressions);
       if (function.Body != null) { Visit(function.Body); }
-      //FIXME More?
+      //TODO More?
     }
     protected virtual void VisitOneExpr(Expression expr) {
       Contract.Requires(expr != null);
@@ -7842,7 +7842,7 @@ namespace Microsoft.Dafny {
       } else if (decl is Method) {
         Visit((Method)decl, st);
       }
-      //FIXME More?
+      //TODO More?
     }
     public void Visit(Method method, State st) {
       Visit(method.Ens, st);
@@ -7850,7 +7850,7 @@ namespace Microsoft.Dafny {
       Visit(method.Mod.Expressions, st);
       Visit(method.Decreases.Expressions, st);
       if (method.Body != null) { Visit(method.Body, st); }
-      //FIXME More?
+      //TODO More?
     }
     public void Visit(Function function, State st) {
       Visit(function.Ens, st);
@@ -7858,7 +7858,7 @@ namespace Microsoft.Dafny {
       Visit(function.Reads, st);
       Visit(function.Decreases.Expressions, st);
       if (function.Body != null) { Visit(function.Body, st); }
-      //FIXME More?
+      //TODO More?
     }
     /// <summary>
     /// Visit one expression proper.  This method is invoked before it is invoked on the
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 2f2b5a54..e5fe7cf8 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -199,7 +199,7 @@ namespace Microsoft.Dafny
 
     public void ResolveProgram(Program prog) {
       Contract.Requires(prog != null);
-      var origErrorCount = reporter.Count(ErrorLevel.Error); //FIXME (Clement): This is used further below, but not in the >0 comparisons in the next few lines. Is that right?
+      var origErrorCount = reporter.Count(ErrorLevel.Error); //TODO: This is used further below, but not in the >0 comparisons in the next few lines. Is that right?
       var bindings = new ModuleBindings(null);
       var b = BindModuleNames(prog.DefaultModuleDef, bindings);
       bindings.BindName("_module", prog.DefaultModule, b);
@@ -8301,7 +8301,7 @@ namespace Microsoft.Dafny
           receiver = new StaticReceiverExpr(expr.tok, (ClassDecl)member.EnclosingClass, true);
         } else {
           if (!scope.AllowInstance) {
-            reporter.Error(MessageSource.Resolver, expr.tok, "'this' is not allowed in a 'static' context"); //FIXME: Rephrase this
+            reporter.Error(MessageSource.Resolver, expr.tok, "'this' is not allowed in a 'static' context"); //TODO: Rephrase this
             // nevertheless, set "receiver" to a value so we can continue resolution
           }
           receiver = new ImplicitThisExpr(expr.tok);
@@ -8604,7 +8604,7 @@ namespace Microsoft.Dafny
           Dictionary<string, MemberDecl> members;
           if (classMembers.TryGetValue(cd, out members) && members.TryGetValue(expr.SuffixName, out member)) {
             if (!member.IsStatic) {
-              reporter.Error(MessageSource.Resolver, expr.tok, "accessing member '{0}' requires an instance expression", expr.SuffixName); //FIXME Unify with similar error message
+              reporter.Error(MessageSource.Resolver, expr.tok, "accessing member '{0}' requires an instance expression", expr.SuffixName); //TODO Unify with similar error messages
               // nevertheless, continue creating an expression that approximates a correct one
             }
             var receiver = new StaticReceiverExpr(expr.tok, (UserDefinedType)ty.NormalizeExpand(), (ClassDecl)member.EnclosingClass, false);
diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index bfa90d81..8e4c3261 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -7,8 +7,6 @@ using System.Text;
 using Microsoft.Boogie;
 using System.Diagnostics.Contracts;
 
-//FIXME: When scoring, do not consider old(x) to be higher than x.
-
 namespace Microsoft.Dafny.Triggers {
   class QuantifierWithTriggers {
     internal QuantifierExpr quantifier;
@@ -149,16 +147,14 @@ namespace Microsoft.Dafny.Triggers {
       var msg = new StringBuilder();
       var indent = addHeader ? "  " : "";
 
-      if (!TriggerUtils.NeedsAutoTriggers(q.quantifier)) { //FIXME: matchingloop, split and autotriggers attributes are passed down to Boogie
+      if (!TriggerUtils.NeedsAutoTriggers(q.quantifier)) { // NOTE: matchingloop, split and autotriggers attributes are passed down to Boogie
         msg.AppendFormat("Not generating triggers for {{{0}}}.", Printer.ExprToString(q.quantifier.Term)).AppendLine(); 
-        // FIXME This shouldn't be printed for autoReqs. (see autoReq.dfy)
-        // FIXME typeQuantifier?
       } else {
         if (addHeader) {
           msg.AppendFormat("For expression {{{0}}}:", Printer.ExprToString(q.quantifier.Term)).AppendLine();
         }
 
-        foreach (var candidate in q.Candidates) { //FIXME make this _trigger instead of trigger
+        foreach (var candidate in q.Candidates) {
           q.quantifier.Attributes = new Attributes("trigger", candidate.Terms.Select(t => t.Expr).ToList(), q.quantifier.Attributes);
         }
 
diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index 3b2853ed..30f7b9e8 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -249,10 +249,12 @@ namespace Microsoft.Dafny.Triggers {
       return new TriggerAnnotation(isTriggerKiller || CollectIsKiller(expr), CollectVariables(expr), CollectExportedCandidates(expr));
     }
 
-    // FIXME document that this will contain duplicates
+    /// <summary>
+    /// Collect terms in the body of the subexpressions of the argument that look like quantifiers. The results of this function can contain duplicate terms.
+    /// </summary>
     internal List<TriggerTerm> CollectTriggers(QuantifierExpr quantifier) {
       Contract.Requires(quantifier.SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
-      // TODO could check for existing triggers and return that instead, but that require a bit of work to extract the expressions
+      // NOTE: We could check for existing trigger attributes and return that instead
       return Annotate(quantifier).PrivateTerms;
     }
 
diff --git a/Source/DafnyServer/DafnyHelper.cs b/Source/DafnyServer/DafnyHelper.cs
index 952f71c5..3204fdb3 100644
--- a/Source/DafnyServer/DafnyHelper.cs
+++ b/Source/DafnyServer/DafnyHelper.cs
@@ -74,7 +74,7 @@ namespace Microsoft.Dafny {
         ExecutionEngine.CoalesceBlocks(boogieProgram);
         ExecutionEngine.Inline(boogieProgram);
 
-        //FIXME Could capture errors instead of printing them (pass a delegate instead of null)
+        //NOTE: We could capture errors instead of printing them (pass a delegate instead of null)
         switch (ExecutionEngine.InferAndVerify(boogieProgram, new PipelineStatistics(), "ServerProgram", null, DateTime.UtcNow.Ticks.ToString())) {
           case PipelineOutcome.Done:
           case PipelineOutcome.VerificationCompleted:
diff --git a/Source/DafnyServer/Server.cs b/Source/DafnyServer/Server.cs
index e524a9a3..77840007 100644
--- a/Source/DafnyServer/Server.cs
+++ b/Source/DafnyServer/Server.cs
@@ -32,9 +32,8 @@ namespace Microsoft.Dafny {
 
     private void SetupConsole() {
       var utf8 = new UTF8Encoding(false, true);
+      Console.InputEncoding = utf8;
       Console.OutputEncoding = utf8;
-      Console.OutputEncoding = utf8;
-      Console.CancelKeyPress += CancelKeyPress;
     }
 
     public Server() {
@@ -43,12 +42,6 @@ namespace Microsoft.Dafny {
       SetupConsole();
     }
 
-    void CancelKeyPress(object sender, ConsoleCancelEventArgs e) {
-      // e.Cancel = true;
-      // FIXME TerminateProver and RunningProverFromCommandLine
-      // Cancel the current verification? TerminateProver()? Or kill entirely?
-    }
-
     bool EndOfPayload(out string line) {
       line = Console.ReadLine();
       return line == null || line == Interaction.CLIENT_EOM_TAG;
diff --git a/Source/DafnyServer/Utilities.cs b/Source/DafnyServer/Utilities.cs
index d6654ac1..59b3abb9 100644
--- a/Source/DafnyServer/Utilities.cs
+++ b/Source/DafnyServer/Utilities.cs
@@ -45,13 +45,11 @@ namespace Microsoft.Dafny {
 
     internal static void ApplyArgs(string[] args) {
       Dafny.DafnyOptions.Install(new Dafny.DafnyOptions());
-      Dafny.DafnyOptions.O.ProverKillTime = 10;
+      Dafny.DafnyOptions.O.ProverKillTime = 15; //This is just a default; it can be overriden
 
       if (CommandLineOptions.Clo.Parse(args)) {
-        // Dafny.DafnyOptions.O.ErrorTrace = 0; //FIXME
-        // Dafny.DafnyOptions.O.ModelViewFile = "-";
         DafnyOptions.O.VerifySnapshots = 2; // Use caching
-        DafnyOptions.O.VcsCores = Math.Max(1, System.Environment.ProcessorCount - 1); //FIXME
+        DafnyOptions.O.VcsCores = Math.Max(1, System.Environment.ProcessorCount / 2); // Don't use too many cores
         DafnyOptions.O.PrintTooltips = true; // Dump tooptips (ErrorLevel.Info) to stdout
         DafnyOptions.O.UnicodeOutput = true; // Use pretty warning signs
         DafnyOptions.O.TraceProofObligations = true; // Show which method is being verified, but don't show duration of verification
-- 
cgit v1.2.3


From b819c42e85eb8ac0968abeab9f3fa3420a5dd760 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 21 Aug 2015 09:40:17 -0700
Subject: Allow display expressions as trigger terms

---
 Source/Dafny/Triggers/TriggersCollector.cs | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index 30f7b9e8..167a6a1b 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -169,7 +169,7 @@ namespace Microsoft.Dafny.Triggers {
       expr.SubExpressions.Iter(e => Annotate(e));
 
       TriggerAnnotation annotation; // TODO: Using ApplySuffix fixes the unresolved members problem in GenericSort
-      if (expr is FunctionCallExpr || expr is SeqSelectExpr || expr is MemberSelectExpr || expr is OldExpr || expr is ApplyExpr ||
+      if (expr is FunctionCallExpr || expr is SeqSelectExpr || expr is MemberSelectExpr || expr is OldExpr || expr is ApplyExpr || expr is DisplayExpression ||
           (expr is UnaryOpExpr && (((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Cardinality)) || // FIXME || ((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Fresh doesn't work, as fresh is a pretty tricky predicate when it's not about datatypes. See translator.cs:10944
           (expr is BinaryExpr && (((BinaryExpr)expr).Op == BinaryExpr.Opcode.NotIn || ((BinaryExpr)expr).Op == BinaryExpr.Opcode.In))) {
         annotation = AnnotatePotentialCandidate(expr);
@@ -186,8 +186,7 @@ namespace Microsoft.Dafny.Triggers {
                  expr is OldExpr ||
                  expr is ThisExpr ||
                  expr is BoxingCastExpr ||
-                 expr is DatatypeValue ||
-                 expr is SeqDisplayExpr) { //FIXME what abvout other display expressions?
+                 expr is DatatypeValue) {
         annotation = AnnotateOther(expr, false);
       } else {
         annotation = AnnotateOther(expr, true);
-- 
cgit v1.2.3


From 8695668ca1121dde6a91f7a0c00ef0b065104c40 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 21 Aug 2015 09:40:58 -0700
Subject: Give up on trying to set the console's input encoding to UTF8

Fortunately, the server spec already assumes an ASCII input channel.
---
 Source/DafnyServer/Server.cs | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyServer/Server.cs b/Source/DafnyServer/Server.cs
index 77840007..8c94ad5b 100644
--- a/Source/DafnyServer/Server.cs
+++ b/Source/DafnyServer/Server.cs
@@ -31,9 +31,8 @@ namespace Microsoft.Dafny {
     }
 
     private void SetupConsole() {
-      var utf8 = new UTF8Encoding(false, true);
-      Console.InputEncoding = utf8;
-      Console.OutputEncoding = utf8;
+      // Setting InputEncoding to UTF8 causes z3 to choke.
+      Console.OutputEncoding = new UTF8Encoding(false, true);
     }
 
     public Server() {
-- 
cgit v1.2.3


From b41056b45861f6ddb41e2a5e4d7c6d816684f095 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 21 Aug 2015 15:32:50 -0700
Subject: Add some diversity to Dafny's alimentation

---
 Source/Dafny/Translator.cs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 8200f254..6f1a5833 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -2261,9 +2261,9 @@ namespace Microsoft.Dafny {
 
       Bpl.Trigger tr = new Bpl.Trigger(f.tok, true, new List<Bpl.Expr> { funcAppl });
       var typeParams = TrTypeParamDecls(f.TypeArgs);
-      Bpl.Expr meat;
+      Bpl.Expr tastyVegetarianOption;
       if (visibility == FunctionAxiomVisibility.ForeignModuleOnly && f.IsProtected) {
-        meat = Bpl.Expr.True;
+        tastyVegetarianOption = Bpl.Expr.True;
       } else {
         var bodyWithSubst = Substitute(body, null, substMap);
         if (f is PrefixPredicate) {
@@ -2271,14 +2271,14 @@ namespace Microsoft.Dafny {
           bodyWithSubst = PrefixSubstitution(pp, bodyWithSubst);
         }
         var etranBody = layer == null ? etran : etran.LimitedFunctions(f, new Bpl.IdentifierExpr(f.tok, layer));
-        meat = BplAnd(CanCallAssumption(bodyWithSubst, etranBody),
+        tastyVegetarianOption = BplAnd(CanCallAssumption(bodyWithSubst, etranBody),
           Bpl.Expr.Eq(funcAppl, etranBody.TrExpr(bodyWithSubst)));
       }
       QKeyValue kv = null;
       if (lits != null) {
         kv = new QKeyValue(f.tok, "weight", new List<object>() { Bpl.Expr.Literal(3) }, null);
       }
-      Bpl.Expr ax = new Bpl.ForallExpr(f.tok, typeParams, formals, kv, tr, Bpl.Expr.Imp(ante, meat));
+      Bpl.Expr ax = new Bpl.ForallExpr(f.tok, typeParams, formals, kv, tr, Bpl.Expr.Imp(ante, tastyVegetarianOption));
       var activate = AxiomActivation(f, visibility == FunctionAxiomVisibility.ForeignModuleOnly, visibility == FunctionAxiomVisibility.IntraModuleOnly, etran);
       string comment;
       if (overridingClass == null) {
-- 
cgit v1.2.3


From 84b52a48efda3e9658b772dbc02d34a6f6c9d16b Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 21 Aug 2015 19:09:37 -0700
Subject: Adjust WF checks to use unsplit quantifiers.

The logic about split quantifiers is that Boogie (and z3) should never realize
that there was an unsplit quantifier. The WF check code does not produce a
quantifier, at least in it's checking part; thus, it should use original
quantifier. This fixes a problem in VerifyThis2015/Problem2.dfy with a null
check, and a problem spotted by Chris, made into a test case saved in
triggers/wf-checks-use-the-original-quantifier.dfy. The issue boiled down to
being able to verify (forall x :: x != null && x.a == 0).

Of course, the assumption that WF checks produce for a quantifier is a
quantifier, so it uses the split expression.
---
 Source/Dafny/Translator.cs                         | 32 ++++++++++++----------
 .../wf-checks-use-the-original-quantifier.dfy      | 28 +++++++++++++++++++
 ...f-checks-use-the-original-quantifier.dfy.expect | 17 ++++++++++++
 3 files changed, 62 insertions(+), 15 deletions(-)
 create mode 100644 Test/triggers/wf-checks-use-the-original-quantifier.dfy
 create mode 100644 Test/triggers/wf-checks-use-the-original-quantifier.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 6f1a5833..524466c9 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -4437,7 +4437,7 @@ namespace Microsoft.Dafny {
         var e = (ComprehensionExpr)expr;
         var canCall = CanCallAssumption(e.Term, etran);
         var q = e as QuantifierExpr;
-
+        
         if (q != null && q.SplitQuantifier != null) {
           return CanCallAssumption(q.SplitQuantifierExpression, etran);
         }
@@ -4735,12 +4735,7 @@ namespace Microsoft.Dafny {
         // If the quantifier is universal, then continue as:
         //   assume (\forall x :: body(x));
         // Create local variables corresponding to the type arguments:
-
-        if (e.SplitQuantifier != null) {
-          CheckWellformedAndAssume(e.SplitQuantifierExpression, options, locals, builder, etran);
-          return;
-        }
-
+        
         var typeArgumentCopies = Map(e.TypeArgs, tp => e.Refresh(tp, CurrentIdGenerator));
         var typeMap = Util.Dict(e.TypeArgs, Map(typeArgumentCopies, tp => (Type)new UserDefinedType(tp)));
         var newLocals = Map(typeArgumentCopies, tp => new Bpl.LocalVariable(tp.tok, new TypedIdent(tp.tok, nameTypeParam(tp), predef.Ty)));
@@ -4748,15 +4743,24 @@ namespace Microsoft.Dafny {
         // Create local variables corresponding to the in-parameters:
         var substMap = SetupBoundVarsAsLocals(e.BoundVars, builder, locals, etran, typeMap);
         // Get the body of the quantifier and suitably substitute for the type variables and bound variables
-        var body = Substitute(e.LogicalBody(), null, substMap, typeMap);
+        var body = Substitute(e.LogicalBody(true), null, substMap, typeMap);
         CheckWellformedAndAssume(body, options, locals, builder, etran);
+        
         if (e is ForallExpr) {
-          builder.Add(new Bpl.AssumeCmd(expr.tok, etran.TrExpr(expr)));
+          // Although we do the WF check on the original quantifier, we assume the split one.
+          // This ensures that cases like forall x :: x != null && f(x.a) do not fail to verify.
+          builder.Add(new Bpl.AssumeCmd(expr.tok, etran.TrExpr(e.SplitQuantifierExpression ?? e)));
         }
         return;
       }
+
       // resort to the behavior of simply checking well-formedness followed by assuming the translated expression
       CheckWellformed(expr, options, locals, builder, etran);
+
+      // NOTE: If the CheckWellformed call above found a split quantifier, it ignored
+      //       the splitting and proceeded to decompose the full quantifier as
+      //       normal. This call to TrExpr, on the other hand, will indeed use the
+      //       split quantifier.
       builder.Add(new Bpl.AssumeCmd(expr.tok, etran.TrExpr(expr)));
     }
 
@@ -5276,10 +5280,8 @@ namespace Microsoft.Dafny {
         var q = e as QuantifierExpr;
         var lam = e as LambdaExpr;
 
-        if (q != null && q.SplitQuantifier != null) {
-          CheckWellformedWithResult(q.SplitQuantifierExpression, options, result, resultType, locals, builder, etran);
-          return;
-        }
+        // This is a WF check, so we look at the original quantifier, not the split one.
+        // This ensures that cases like forall x :: x != null && f(x.a) do not fail to verify.
 
         var typeMap = new Dictionary<TypeParameter, Type>();
         var copies = new List<TypeParameter>();
@@ -5298,7 +5300,6 @@ namespace Microsoft.Dafny {
         var newEtran = etran;
         builder.Add(new Bpl.CommentCmd("Begin Comprehension WF check"));
         BplIfIf(e.tok, lam != null, null, builder, newBuilder => {
-
           if (lam != null) {
             // Havoc heap, unless oneShot
             if (!lam.OneShot) {
@@ -13098,7 +13099,8 @@ namespace Microsoft.Dafny {
       return f.Formals.Zip(fexp.Args).All(formal_concrete => CanSafelySubstitute(visitor.TriggerVariables, formal_concrete.Item1, formal_concrete.Item2));
     }
 
-    Triggers.TriggersCollector triggersCollector = new Triggers.TriggersCollector();
+    // Using an empty set of old expressions is ok here; the only uses of the triggersCollector will be to check for trigger killers.
+    Triggers.TriggersCollector triggersCollector = new Triggers.TriggersCollector(new HashSet<Expression>());
 
     private bool CanSafelySubstitute(ISet<IVariable> protectedVariables, IVariable variable, Expression substitution) {
       return !(protectedVariables.Contains(variable) && triggersCollector.IsTriggerKiller(substitution));
diff --git a/Test/triggers/wf-checks-use-the-original-quantifier.dfy b/Test/triggers/wf-checks-use-the-original-quantifier.dfy
new file mode 100644
index 00000000..a1a2bd90
--- /dev/null
+++ b/Test/triggers/wf-checks-use-the-original-quantifier.dfy
@@ -0,0 +1,28 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:1 /printTooltips "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// This test checks that typical expressions requiring WF checks do not suddenly
+// loose expressivity due to quantifier splitting. Without special care, the
+// expression (forall x :: x != null && x.a == 0) could fail to verify.
+
+// The logic about split quantifiers is that Boogie (and z3) should never realize
+// that there was an unsplit quantifier. The WF check code does not produce a
+// quantifier, at least in it's checking part; thus, it should use original
+// quantifier. This fixes a problem in VerifyThis2015/Problem2.dfy with a null
+// check, and a problem spotted by Chris, made into a test case saved in
+// triggers/wf-checks-use-the-original-quantifier.dfy.
+
+// Of course, the assumption that WF checks produce for a quantifier is a
+// quantifier, so the assumption part that comes after the WF check does use the
+// split expression.
+
+// This test case is inspired by the example that Chris gave.
+
+predicate P(b: nat)
+function f(a: int): int
+class C { var x: int; }
+
+method M(s: set<C>)
+  requires forall n: nat :: 0 <= f(n) && P(f(n))
+  requires forall c, c' | c in s && c' in s :: c != null && c'!= null && c.x == c'.x {
+}
diff --git a/Test/triggers/wf-checks-use-the-original-quantifier.dfy.expect b/Test/triggers/wf-checks-use-the-original-quantifier.dfy.expect
new file mode 100644
index 00000000..6b152262
--- /dev/null
+++ b/Test/triggers/wf-checks-use-the-original-quantifier.dfy.expect
@@ -0,0 +1,17 @@
+wf-checks-use-the-original-quantifier.dfy(26,11): Info: For expression {0 <= f(n)}:
+   Selected triggers: {f(n)}
+   Rejected triggers: {P(f(n))} (more specific than {f(n)})
+wf-checks-use-the-original-quantifier.dfy(26,11): Info: For expression {P(f(n))}:
+   Selected triggers: {f(n)}
+   Rejected triggers: {P(f(n))} (more specific than {f(n)})
+wf-checks-use-the-original-quantifier.dfy(27,11): Info: For expression {c != null}:
+   Selected triggers:
+     {c'.x, c.x}, {c'.x, c in s}, {c.x, c' in s}, {c' in s, c in s}
+wf-checks-use-the-original-quantifier.dfy(27,11): Info: For expression {c' != null}:
+   Selected triggers:
+     {c'.x, c.x}, {c'.x, c in s}, {c.x, c' in s}, {c' in s, c in s}
+wf-checks-use-the-original-quantifier.dfy(27,11): Info: For expression {c.x == c'.x}:
+   Selected triggers:
+     {c'.x, c.x}, {c'.x, c in s}, {c.x, c' in s}, {c' in s, c in s}
+
+Dafny program verifier finished with 4 verified, 0 errors
-- 
cgit v1.2.3


From a7d63787addef715ba8b77d3adf9455c8c174c48 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 21 Aug 2015 19:10:54 -0700
Subject: Rephrase the message about triggers being rejected because they are
 too strong

---
 Source/Dafny/Triggers/QuantifiersCollection.cs        |  2 +-
 Test/triggers/useless-triggers-are-removed.dfy.expect | 14 +++++++-------
 2 files changed, 8 insertions(+), 8 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index 8e4c3261..1d5625cd 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -137,7 +137,7 @@ namespace Microsoft.Dafny.Triggers {
           (candidate, weakerCandidates) => !weakerCandidates.Any(),
           (candidate, weakerCandidates) => {
             q.RejectedCandidates.Add(candidate);
-            candidate.Annotation = "stronger than " + String.Join(", ", weakerCandidates);
+            candidate.Annotation = "more specific than " + String.Join(", ", weakerCandidates);
           }).ToList();
       }
     }
diff --git a/Test/triggers/useless-triggers-are-removed.dfy.expect b/Test/triggers/useless-triggers-are-removed.dfy.expect
index 6c2c0a2b..a526e517 100644
--- a/Test/triggers/useless-triggers-are-removed.dfy.expect
+++ b/Test/triggers/useless-triggers-are-removed.dfy.expect
@@ -1,17 +1,17 @@
 useless-triggers-are-removed.dfy(16,11): Info: Selected triggers: {f(x)}
  Rejected triggers:
-   {h(g(f(x)))} (stronger than {g(f(x))}, {f(x)})
-   {g(h(f(x)))} (stronger than {h(f(x))}, {f(x)})
-   {h(f(x))} (stronger than {f(x)})
-   {g(f(x))} (stronger than {f(x)})
+   {h(g(f(x)))} (more specific than {g(f(x))}, {f(x)})
+   {g(h(f(x)))} (more specific than {h(f(x))}, {f(x)})
+   {h(f(x))} (more specific than {f(x)})
+   {g(f(x))} (more specific than {f(x)})
 useless-triggers-are-removed.dfy(20,11): Info: Selected triggers: {f(f(x))}
  Rejected triggers: {f(x)} (loops with {f(f(x))})
 useless-triggers-are-removed.dfy(23,11): Info: Selected triggers:
    {g(f(x)), g(y)}, {f(y), f(x)}
  Rejected triggers:
    {g(y), f(x)} (loops with {g(f(y))}, {g(f(x))})
-   {g(f(x)), g(f(y))} (stronger than {g(f(x)), f(y)}, {g(f(y)), f(x)}, {f(y), f(x)})
-   {g(f(x)), f(y)} (stronger than {f(y), f(x)})
-   {g(f(y)), f(x)} (stronger than {f(y), f(x)})
+   {g(f(x)), g(f(y))} (more specific than {g(f(x)), f(y)}, {g(f(y)), f(x)}, {f(y), f(x)})
+   {g(f(x)), f(y)} (more specific than {f(y), f(x)})
+   {g(f(y)), f(x)} (more specific than {f(y), f(x)})
 
 Dafny program verifier finished with 5 verified, 0 errors
-- 
cgit v1.2.3


From ff05bb6936d433e7be5ded41233214c0517dc2d2 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 21 Aug 2015 19:13:56 -0700
Subject: Make `old` a special case for trigger generation.

Old is particular, because in old(g(f(x))), the triggers are old(g(x)) and
old(f(x)). This has a number of implications; see the new tests files for more
information.
---
 Source/Dafny/Rewriter.cs                           |  4 +-
 Source/Dafny/Triggers/QuantifiersCollector.cs      | 17 +++++---
 Source/Dafny/Triggers/TriggerExtensions.cs         | 24 ++++++------
 Source/Dafny/Triggers/TriggerUtils.cs              | 45 +++++++++++++++-------
 Source/Dafny/Triggers/TriggersCollector.cs         | 34 +++++++++++-----
 .../looping-is-hard-to-decide-modulo-equality.dfy  | 32 +++++++++++++++
 ...ng-is-hard-to-decide-modulo-equality.dfy.expect | 10 +++++
 .../old-is-a-special-case-for-triggers.dfy         | 32 +++++++++++++++
 .../old-is-a-special-case-for-triggers.dfy.expect  | 22 +++++++++++
 9 files changed, 178 insertions(+), 42 deletions(-)
 create mode 100644 Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy
 create mode 100644 Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy.expect
 create mode 100644 Test/triggers/old-is-a-special-case-for-triggers.dfy
 create mode 100644 Test/triggers/old-is-a-special-case-for-triggers.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 230d9349..557eee93 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -47,10 +47,10 @@ namespace Microsoft.Dafny
       var finder = new Triggers.QuantifierCollector(reporter);
         
       foreach (var decl in ModuleDefinition.AllCallables(m.TopLevelDecls)) {
-        finder.Visit(decl, null);
+        finder.Visit(decl, false);
       }
       
-      var triggersCollector = new Triggers.TriggersCollector();
+      var triggersCollector = new Triggers.TriggersCollector(finder.exprsInOldContext);
       foreach (var quantifierCollection in finder.quantifierCollections) {
         quantifierCollection.ComputeTriggers(triggersCollector);
         quantifierCollection.CommitTriggers();
diff --git a/Source/Dafny/Triggers/QuantifiersCollector.cs b/Source/Dafny/Triggers/QuantifiersCollector.cs
index b30cb6b1..3385f36e 100644
--- a/Source/Dafny/Triggers/QuantifiersCollector.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollector.cs
@@ -6,18 +6,19 @@ using Microsoft.Boogie;
 using System.Collections.ObjectModel;
 using System.Diagnostics.Contracts;
 
-namespace Microsoft.Dafny.Triggers { //FIXME rename this file
-  internal class QuantifierCollector : TopDownVisitor<object> {
+namespace Microsoft.Dafny.Triggers {
+  internal class QuantifierCollector : TopDownVisitor<bool> {
     readonly ErrorReporter reporter;
-    private HashSet<Expression> quantifiers = new HashSet<Expression>();
-    internal List<QuantifiersCollection> quantifierCollections = new List<QuantifiersCollection>();
+    private readonly HashSet<Expression> quantifiers = new HashSet<Expression>();
+    internal readonly HashSet<Expression> exprsInOldContext = new HashSet<Expression>();
+    internal readonly List<QuantifiersCollection> quantifierCollections = new List<QuantifiersCollection>();
 
     public QuantifierCollector(ErrorReporter reporter) {
       Contract.Requires(reporter != null);
       this.reporter = reporter;
     }
 
-    protected override bool VisitOneExpr(Expression expr, ref object _) {
+    protected override bool VisitOneExpr(Expression expr, ref bool inOldContext) {
       var quantifier = expr as QuantifierExpr;
 
       if (quantifier != null && !quantifiers.Contains(quantifier)) {
@@ -31,6 +32,12 @@ namespace Microsoft.Dafny.Triggers { //FIXME rename this file
         }
       }
 
+      if (expr is OldExpr) {
+        inOldContext = true;
+      } else if (inOldContext) { // FIXME be more restrctive on the type of stuff that we annotate
+        exprsInOldContext.Add(expr);
+      }
+
       return true;
     }
   }
diff --git a/Source/Dafny/Triggers/TriggerExtensions.cs b/Source/Dafny/Triggers/TriggerExtensions.cs
index 6c3f4ee7..02deb92f 100644
--- a/Source/Dafny/Triggers/TriggerExtensions.cs
+++ b/Source/Dafny/Triggers/TriggerExtensions.cs
@@ -38,17 +38,18 @@ namespace Microsoft.Dafny.Triggers {
   }
 
   internal static class ExprExtensions {
-    internal static IEnumerable<Expression> AllSubExpressions(this Expression expr, bool strict = false) {
+    internal static IEnumerable<Expression> AllSubExpressions(this Expression expr, bool wrapOld, bool strict) {
+      bool isOld = expr is OldExpr;
+
       foreach (var subexpr in expr.SubExpressions) {
-        foreach (var r_subexpr in AllSubExpressions(subexpr, false)) {
-          yield return r_subexpr;
+        foreach (var r_subexpr in AllSubExpressions(subexpr, wrapOld, false)) {
+          yield return TriggerUtils.MaybeWrapInOld(r_subexpr, isOld);
         }
-        yield return subexpr;
       }
 
       if (expr is StmtExpr) {
-        foreach (var r_subexpr in AllSubExpressions(((StmtExpr)expr).S, false)) {
-          yield return r_subexpr;
+        foreach (var r_subexpr in AllSubExpressions(((StmtExpr)expr).S, wrapOld, false)) {
+          yield return TriggerUtils.MaybeWrapInOld(r_subexpr, isOld);
         }
       }
 
@@ -57,16 +58,15 @@ namespace Microsoft.Dafny.Triggers {
       }
     }
 
-    internal static IEnumerable<Expression> AllSubExpressions(this Statement stmt, bool strict = false) {
+    internal static IEnumerable<Expression> AllSubExpressions(this Statement stmt, bool wrapOld, bool strict) {
       foreach (var subexpr in stmt.SubExpressions) {
-        foreach (var r_subexpr in AllSubExpressions(subexpr, false)) {
+        foreach (var r_subexpr in AllSubExpressions(subexpr, wrapOld, false)) {
           yield return r_subexpr;
         }
-        yield return subexpr;
       }
 
       foreach (var substmt in stmt.SubStatements) {
-        foreach (var r_subexpr in AllSubExpressions(substmt, false)) {
+        foreach (var r_subexpr in AllSubExpressions(substmt, wrapOld, false)) {
           yield return r_subexpr;
         }
       }
@@ -121,8 +121,8 @@ namespace Microsoft.Dafny.Triggers {
     }
 
     internal static IEnumerable<TriggerMatch> SubexpressionsMatchingTrigger(this QuantifierExpr quantifier, Expression trigger) {
-      return quantifier.Term.AllSubExpressions()
-        .Select(e => TriggerUtils.CleanupExprForInclusionInTrigger(e).MatchAgainst(trigger, quantifier.BoundVars, e))
+      return quantifier.Term.AllSubExpressions(true, false) //FIXME should loop detection actually pass true here?
+        .Select(e => TriggerUtils.PrepareExprForInclusionInTrigger(e).MatchAgainst(trigger, quantifier.BoundVars, e))
         .Where(e => e.HasValue).Select(e => e.Value);
     }
 
diff --git a/Source/Dafny/Triggers/TriggerUtils.cs b/Source/Dafny/Triggers/TriggerUtils.cs
index 6f76464b..4fd139e2 100644
--- a/Source/Dafny/Triggers/TriggerUtils.cs
+++ b/Source/Dafny/Triggers/TriggerUtils.cs
@@ -129,35 +129,52 @@ namespace Microsoft.Dafny.Triggers {
       throw new ArgumentException();
     }
 
-    internal static Expression CleanupExprForInclusionInTrigger(Expression expr, out bool isKiller) {
+    internal static Expression PrepareExprForInclusionInTrigger(Expression expr, out bool isKiller) {
       isKiller = false;
 
-      if (!(expr is BinaryExpr)) {
-        return expr;
+      var ret = expr;
+      if (ret is BinaryExpr) {
+        ret = PrepareInMultisetForInclusionInTrigger(PrepareNotInForInclusionInTrigger((BinaryExpr)ret), ref isKiller);
       }
 
-      var bexpr = expr as BinaryExpr;
+      return ret;
+    }
 
-      BinaryExpr new_expr = bexpr;
+    private static BinaryExpr PrepareNotInForInclusionInTrigger(BinaryExpr bexpr) {
       if (bexpr.Op == BinaryExpr.Opcode.NotIn) {
-        new_expr = new BinaryExpr(bexpr.tok, BinaryExpr.Opcode.In, bexpr.E0, bexpr.E1);
+        var new_expr = new BinaryExpr(bexpr.tok, BinaryExpr.Opcode.In, bexpr.E0, bexpr.E1);
         new_expr.ResolvedOp = RemoveNotInBinaryExprIn(bexpr.ResolvedOp);
         new_expr.Type = bexpr.Type;
+        return new_expr;
+      } else {
+        return bexpr;
       }
+    }
 
-      Expression returned_expr = new_expr;
-      if (new_expr.ResolvedOp == BinaryExpr.ResolvedOpcode.InMultiSet) {
-        returned_expr = new SeqSelectExpr(new_expr.tok, true, new_expr.E1, new_expr.E0, null);
-        returned_expr.Type = bexpr.Type;
+    private static Expression PrepareInMultisetForInclusionInTrigger(BinaryExpr bexpr, ref bool isKiller) {
+      if (bexpr.ResolvedOp == BinaryExpr.ResolvedOpcode.InMultiSet) {
+        var new_expr = new SeqSelectExpr(bexpr.tok, true, bexpr.E1, bexpr.E0, null);
+        new_expr.Type = bexpr.Type;
         isKiller = true; // [a in s] becomes [s[a] > 0], which is a trigger killer
+        return new_expr;
+      } else {
+        return bexpr;
       }
-
-      return returned_expr;
     }
 
-    internal static Expression CleanupExprForInclusionInTrigger(Expression expr) {
+    internal static Expression PrepareExprForInclusionInTrigger(Expression expr) {
       bool _;
-      return CleanupExprForInclusionInTrigger(expr, out _);
+      return PrepareExprForInclusionInTrigger(expr, out _);
+    }
+
+    internal static Expression MaybeWrapInOld(Expression expr, bool wrap) {
+      if (wrap && !(expr is NameSegment) && !(expr is IdentifierExpr)) {
+        var newExpr = new OldExpr(expr.tok, expr);
+        newExpr.Type = expr.Type;
+        return newExpr;
+      } else {
+        return expr;
+      }
     }
   }
 }
diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index 167a6a1b..11860404 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -27,7 +27,7 @@ namespace Microsoft.Dafny.Triggers {
     internal TermComparison CompareTo(TriggerTerm other) {
       if (this == other) {
         return TermComparison.SameStrength;
-      } else if (Expr.AllSubExpressions(true).Any(other.Expr.ExpressionEq)) {
+      } else if (Expr.AllSubExpressions(true, true).Any(other.Expr.ExpressionEq)) {
         return TermComparison.Stronger;
       } else {
         return TermComparison.NotStronger;
@@ -92,7 +92,7 @@ namespace Microsoft.Dafny.Triggers {
     }
   }
 
-  class TriggerAnnotation {
+  internal class TriggerAnnotation {
     internal bool IsTriggerKiller;
     internal ISet<IVariable> Variables;
     internal readonly List<TriggerTerm> PrivateTerms;
@@ -132,11 +132,27 @@ namespace Microsoft.Dafny.Triggers {
     }
   }
 
-  public class TriggersCollector {
-    Dictionary<Expression, TriggerAnnotation> cache;
+  internal class TriggerAnnotationsCache {
+    public readonly HashSet<Expression> exprsInOldContext;
+    public readonly Dictionary<Expression, TriggerAnnotation> annotations;
 
-    internal TriggersCollector() {
-      this.cache = new Dictionary<Expression, TriggerAnnotation>();
+    /// <summary>
+    /// For certain operations, the TriggersCollector class needs to know whether 
+    /// an particular expression is under an old(...) wrapper. This is in particular 
+    /// true for generating trigger terms (but it is not for checking wehter something 
+    /// is a trigger killer, so passing an empty set here for that case would be fine.
+    /// </summary>
+    public TriggerAnnotationsCache(HashSet<Expression> exprsInOldContext) {
+      this.exprsInOldContext = exprsInOldContext;
+      annotations = new Dictionary<Expression, TriggerAnnotation>();
+    }
+  }
+
+  internal class TriggersCollector {
+    TriggerAnnotationsCache cache;
+
+    internal TriggersCollector(HashSet<Expression> exprsInOldContext) {
+      this.cache = new TriggerAnnotationsCache(exprsInOldContext);
     }
 
     private T ReduceAnnotatedSubExpressions<T>(Expression expr, T seed, Func<TriggerAnnotation, T> map, Func<T, T, T> reduce) {
@@ -162,7 +178,7 @@ namespace Microsoft.Dafny.Triggers {
 
     private TriggerAnnotation Annotate(Expression expr) {
       TriggerAnnotation cached;
-      if (cache.TryGetValue(expr, out cached)) {
+      if (cache.annotations.TryGetValue(expr, out cached)) {
         return cached;
       }
 
@@ -193,13 +209,13 @@ namespace Microsoft.Dafny.Triggers {
       }
 
       TriggerUtils.DebugTriggers("{0} ({1})\n{2}", Printer.ExprToString(expr), expr.GetType(), annotation);
-      cache[expr] = annotation;
+      cache.annotations[expr] = annotation;
       return annotation;
     }
 
     private TriggerAnnotation AnnotatePotentialCandidate(Expression expr) {
       bool expr_is_killer = false;
-      var new_expr = TriggerUtils.CleanupExprForInclusionInTrigger(expr, out expr_is_killer);
+      var new_expr = TriggerUtils.MaybeWrapInOld(TriggerUtils.PrepareExprForInclusionInTrigger(expr, out expr_is_killer), cache.exprsInOldContext.Contains(expr));
       var new_term = new TriggerTerm { Expr = new_expr, OriginalExpr = expr, Variables = CollectVariables(expr) };
 
       List<TriggerTerm> collected_terms = CollectExportedCandidates(expr);
diff --git a/Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy b/Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy
new file mode 100644
index 00000000..c54089f2
--- /dev/null
+++ b/Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy
@@ -0,0 +1,32 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:1 /printTooltips "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// This file shows cases where loops could hide behind equalities. In all three
+// cases we behave the same; that is, we don't warn for loops that would only
+// exist in the presence of an equality. The easiest way to understand the
+// issue, I (CPC) feel, is to look at the old case: f(x) could very well loop
+// with old(f(f(x))) if f(f(x)) did not change the heap at all.
+
+// This equality issue is generally undecidable. It could make sense to special
+// case `old`, but KRML and CPC decided against it on 2015-08-21. Future
+// experiences could cause a change of mind.
+
+class C { }
+function f(c: C): C
+function g(c: C): C
+function h(c: C, i: int): C
+
+// With explicit arguments
+method M0(i: int, j: int, sc: set<C>) {
+  assert forall c | c in sc :: true || h(c, i) == h(h(c, j), j);
+}
+
+// With implicit arguments (f and g respectively, to Apply)
+method M1(f: int -> int, g: int -> int) {
+  assert forall x :: true || f(x) == g(f(x));
+}
+
+// With implicit arguments (the heap, to old)
+method M2(sc: set<C>) {
+  assert forall c | c in sc :: true || f(c) == old(f(f(c)));
+}
diff --git a/Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy.expect b/Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy.expect
new file mode 100644
index 00000000..c0eebdba
--- /dev/null
+++ b/Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy.expect
@@ -0,0 +1,10 @@
+looping-is-hard-to-decide-modulo-equality.dfy(21,9): Info: Selected triggers:
+   {h(h(c, j), j)}, {h(c, i)}, {c in sc}
+ Rejected triggers: {h(c, j)} (loops with {h(h(c, j), j)})
+looping-is-hard-to-decide-modulo-equality.dfy(26,9): Info: Selected triggers: {f(x)}
+ Rejected triggers: {g(f(x))} (more specific than {f(x)})
+looping-is-hard-to-decide-modulo-equality.dfy(31,9): Info: Selected triggers:
+   {old(f(f(c)))}, {f(c)}, {c in sc}
+ Rejected triggers: {old(f(c))} (loops with {old(f(f(c)))})
+
+Dafny program verifier finished with 9 verified, 0 errors
diff --git a/Test/triggers/old-is-a-special-case-for-triggers.dfy b/Test/triggers/old-is-a-special-case-for-triggers.dfy
new file mode 100644
index 00000000..4424e8d3
--- /dev/null
+++ b/Test/triggers/old-is-a-special-case-for-triggers.dfy
@@ -0,0 +1,32 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:1 /printTooltips "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// This file ensures that `old()` receives the special treatment that it
+// requires; that is, `old(f(x))` is not less liberal than `f(x)`, and
+// old(f(f(x))) does not loop with f(x) (doesn't it?)
+
+class C { }
+function f(c: C): C
+function g(c: C): C
+function h(c: C, i: int): C
+
+method M(sc: set<C>)
+  // Ensure that old(c) does not get picked as a trigger
+  ensures forall c | c in sc :: true || c == old(f(c))
+
+  // This checks whether loop detection handles `old` expressions properly.
+  // In the first one f(c)/old(f(f(c))) is not reported as a loop. See
+  // looping-is-hard-to-decide-modulo-equalities.dfy for an explanation.
+  ensures forall c | c in sc :: true || f(c) == old(f(f(c)))
+  ensures forall c | c in sc :: true || old(f(f(c))) == old(g(f(c))) || old(f(g(c))) == g(f(c)) || f(g(c)) == g(f(c))
+
+  // These check that the final trigger filtering step doesn't get confused
+  // between old expressions and regular expressions.
+  ensures forall c | c in sc :: true || f(c) == old(g(f(c)))
+  ensures forall c | c in sc :: true || f(c) == old(f(c)) || old(g(f(c))) == g(f(c))
+
+  // WISH: A Dafny rewriter could cleanup expressions so that adding the
+  //       expression forall c :: c == old(c) in a quantifier would cause a warning,
+  //       instead of a trigger generation error as it does now.
+{
+}
diff --git a/Test/triggers/old-is-a-special-case-for-triggers.dfy.expect b/Test/triggers/old-is-a-special-case-for-triggers.dfy.expect
new file mode 100644
index 00000000..23ec089d
--- /dev/null
+++ b/Test/triggers/old-is-a-special-case-for-triggers.dfy.expect
@@ -0,0 +1,22 @@
+old-is-a-special-case-for-triggers.dfy(15,10): Info: Selected triggers:
+   {old(f(c))}, {c in sc}
+old-is-a-special-case-for-triggers.dfy(20,10): Info: Selected triggers:
+   {old(f(f(c)))}, {f(c)}, {c in sc}
+ Rejected triggers: {old(f(c))} (loops with {old(f(f(c)))})
+old-is-a-special-case-for-triggers.dfy(21,10): Info: Selected triggers:
+   {f(g(c))}, {g(f(c))}, {old(f(g(c)))}, {old(g(f(c)))}, {old(f(f(c)))}, {c in sc}
+ Rejected triggers:
+   {g(c)} (loops with {g(f(c))})
+   {f(c)} (loops with {f(g(c))})
+   {old(g(c))} (loops with {old(g(f(c)))})
+   {old(f(c))} (loops with {old(f(f(c)))}, {old(f(g(c)))})
+old-is-a-special-case-for-triggers.dfy(25,10): Info: Selected triggers:
+   {old(f(c))}, {f(c)}, {c in sc}
+ Rejected triggers: {old(g(f(c)))} (more specific than {old(f(c))})
+old-is-a-special-case-for-triggers.dfy(26,10): Info: Selected triggers:
+   {old(f(c))}, {f(c)}, {c in sc}
+ Rejected triggers:
+   {g(f(c))} (more specific than {f(c)})
+   {old(g(f(c)))} (more specific than {old(f(c))})
+
+Dafny program verifier finished with 5 verified, 0 errors
-- 
cgit v1.2.3


From 5b62a70205871f5f4d62db5247f11ac6c53fc57e Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Sat, 22 Aug 2015 15:39:50 -0700
Subject: Look at the full quantifier to find loops, not just the term.

---
 Source/Dafny/Triggers/TriggerExtensions.cs                 |  2 +-
 Test/triggers/loop-detection-looks-at-ranges-too.dfy       | 14 ++++++++++++++
 .../triggers/loop-detection-looks-at-ranges-too.dfy.expect |  6 ++++++
 3 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 Test/triggers/loop-detection-looks-at-ranges-too.dfy
 create mode 100644 Test/triggers/loop-detection-looks-at-ranges-too.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/TriggerExtensions.cs b/Source/Dafny/Triggers/TriggerExtensions.cs
index 02deb92f..71414eee 100644
--- a/Source/Dafny/Triggers/TriggerExtensions.cs
+++ b/Source/Dafny/Triggers/TriggerExtensions.cs
@@ -121,7 +121,7 @@ namespace Microsoft.Dafny.Triggers {
     }
 
     internal static IEnumerable<TriggerMatch> SubexpressionsMatchingTrigger(this QuantifierExpr quantifier, Expression trigger) {
-      return quantifier.Term.AllSubExpressions(true, false) //FIXME should loop detection actually pass true here?
+      return quantifier.AllSubExpressions(true, true)
         .Select(e => TriggerUtils.PrepareExprForInclusionInTrigger(e).MatchAgainst(trigger, quantifier.BoundVars, e))
         .Where(e => e.HasValue).Select(e => e.Value);
     }
diff --git a/Test/triggers/loop-detection-looks-at-ranges-too.dfy b/Test/triggers/loop-detection-looks-at-ranges-too.dfy
new file mode 100644
index 00000000..7a99ea2d
--- /dev/null
+++ b/Test/triggers/loop-detection-looks-at-ranges-too.dfy
@@ -0,0 +1,14 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:1 /printTooltips "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// This file checks that loops between the range and the term of a quantifier
+// are properly detected.
+
+predicate P(x: int)
+
+method M(x: int) {
+  // This will be flagged as a loop even without looking at the range
+  assert true || forall x: int | P(x) :: P(x+1);
+  // This requires checking the range for looping terms
+  assert true || forall x: int | P(x+1) :: P(x);
+}
diff --git a/Test/triggers/loop-detection-looks-at-ranges-too.dfy.expect b/Test/triggers/loop-detection-looks-at-ranges-too.dfy.expect
new file mode 100644
index 00000000..72482de5
--- /dev/null
+++ b/Test/triggers/loop-detection-looks-at-ranges-too.dfy.expect
@@ -0,0 +1,6 @@
+loop-detection-looks-at-ranges-too.dfy(11,17): Warning: Selected triggers: {P(x)} (loops with {P(x + 1)})
+ (!) Suppressing loops would leave this expression without triggers.
+loop-detection-looks-at-ranges-too.dfy(13,17): Warning: Selected triggers: {P(x)} (loops with {P(x + 1)})
+ (!) Suppressing loops would leave this expression without triggers.
+
+Dafny program verifier finished with 3 verified, 0 errors
-- 
cgit v1.2.3


From 2142e51d713394d384b0f33c1189f633dcbe301a Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Sat, 22 Aug 2015 20:15:34 -0700
Subject: Grant "wishlist/useless-casts-in-decreases-clauses.dfy"

---
 Source/Dafny/DafnyAst.cs                                | 17 +++++++++++++----
 Test/tutorial/maximum.dfy.expect                        | 14 +++++++-------
 .../granted/useless-casts-in-decreases-clauses.dfy      |  9 +++++++++
 .../useless-casts-in-decreases-clauses.dfy.expect       |  3 +++
 Test/wishlist/useless-casts-in-decreases-clauses.dfy    |  9 ---------
 .../useless-casts-in-decreases-clauses.dfy.expect       |  3 ---
 6 files changed, 32 insertions(+), 23 deletions(-)
 create mode 100644 Test/wishlist/granted/useless-casts-in-decreases-clauses.dfy
 create mode 100644 Test/wishlist/granted/useless-casts-in-decreases-clauses.dfy.expect
 delete mode 100644 Test/wishlist/useless-casts-in-decreases-clauses.dfy
 delete mode 100644 Test/wishlist/useless-casts-in-decreases-clauses.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 35c6cec4..c4ea0a5a 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -5182,6 +5182,7 @@ namespace Microsoft.Dafny {
       return s;
     }
 
+
     /// <summary>
     /// Create a resolved expression of the form "CVT(e0) - CVT(e1)", where "CVT" is either "int" (if
     /// e0.Type is an integer-based numeric type) or "real" (if e0.Type is a real-based numeric type).
@@ -5195,13 +5196,21 @@ namespace Microsoft.Dafny {
       Contract.Ensures(Contract.Result<Expression>() != null);
 
       Type toType = e0.Type.IsNumericBased(Type.NumericPersuation.Int) ? (Type)Type.Int : Type.Real;
-      e0 = new ConversionExpr(e0.tok, e0, toType);
-      e0.Type = toType;
-      e1 = new ConversionExpr(e1.tok, e1, toType);
-      e1.Type = toType;
+      e0 = CastIfNeeded(e0, toType);
+      e1 = CastIfNeeded(e1, toType);
       return CreateSubtract(e0, e1);
     }
 
+    private static Expression CastIfNeeded(Expression expr, Type toType) {
+      if (!expr.Type.Equals(toType)) {
+        var cast = new ConversionExpr(expr.tok, expr, toType);
+        cast.Type = toType;
+        return cast;
+      } else {
+        return expr;
+      }
+    }
+
     /// <summary>
     /// Create a resolved expression of the form "e0 - e1"
     /// </summary>
diff --git a/Test/tutorial/maximum.dfy.expect b/Test/tutorial/maximum.dfy.expect
index 70768304..16a67088 100644
--- a/Test/tutorial/maximum.dfy.expect
+++ b/Test/tutorial/maximum.dfy.expect
@@ -1,7 +1,7 @@
-maximum.dfy(11,10): Info: Selected triggers: {values[i]}
-maximum.dfy(18,14): Info: Selected triggers: {values[j]}
-maximum.dfy(28,27): Info: Selected triggers: {values[i]}
-maximum.dfy(29,27): Info: Selected triggers: {values[i]}
-maximum.dfy(15,2): Info: decreases int(|values|) - int(idx)
-
-Dafny program verifier finished with 4 verified, 0 errors
+maximum.dfy(11,10): Info: Selected triggers: {values[i]}
+maximum.dfy(18,14): Info: Selected triggers: {values[j]}
+maximum.dfy(28,27): Info: Selected triggers: {values[i]}
+maximum.dfy(29,27): Info: Selected triggers: {values[i]}
+maximum.dfy(15,2): Info: decreases |values| - idx
+
+Dafny program verifier finished with 4 verified, 0 errors
diff --git a/Test/wishlist/granted/useless-casts-in-decreases-clauses.dfy b/Test/wishlist/granted/useless-casts-in-decreases-clauses.dfy
new file mode 100644
index 00000000..9b002d47
--- /dev/null
+++ b/Test/wishlist/granted/useless-casts-in-decreases-clauses.dfy
@@ -0,0 +1,9 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /printTooltips "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+method M() {
+  var pos := 10;
+  while (pos > 0) { // This shouldn't print int(pos) - int(0); pos - 0 would be better
+    pos := pos - 1;
+  }
+}
diff --git a/Test/wishlist/granted/useless-casts-in-decreases-clauses.dfy.expect b/Test/wishlist/granted/useless-casts-in-decreases-clauses.dfy.expect
new file mode 100644
index 00000000..36d7e6b8
--- /dev/null
+++ b/Test/wishlist/granted/useless-casts-in-decreases-clauses.dfy.expect
@@ -0,0 +1,3 @@
+useless-casts-in-decreases-clauses.dfy(6,2): Info: decreases pos - 0
+
+Dafny program verifier finished with 2 verified, 0 errors
diff --git a/Test/wishlist/useless-casts-in-decreases-clauses.dfy b/Test/wishlist/useless-casts-in-decreases-clauses.dfy
deleted file mode 100644
index 9b002d47..00000000
--- a/Test/wishlist/useless-casts-in-decreases-clauses.dfy
+++ /dev/null
@@ -1,9 +0,0 @@
-// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /printTooltips "%s" > "%t"
-// RUN: %diff "%s.expect" "%t"
-
-method M() {
-  var pos := 10;
-  while (pos > 0) { // This shouldn't print int(pos) - int(0); pos - 0 would be better
-    pos := pos - 1;
-  }
-}
diff --git a/Test/wishlist/useless-casts-in-decreases-clauses.dfy.expect b/Test/wishlist/useless-casts-in-decreases-clauses.dfy.expect
deleted file mode 100644
index e37b8b9b..00000000
--- a/Test/wishlist/useless-casts-in-decreases-clauses.dfy.expect
+++ /dev/null
@@ -1,3 +0,0 @@
-useless-casts-in-decreases-clauses.dfy(6,2): Info: decreases int(pos) - int(0)
-
-Dafny program verifier finished with 2 verified, 0 errors
-- 
cgit v1.2.3


From 69f54c327bcc5a41a143bce88b5ba2327d7246a7 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Sun, 23 Aug 2015 00:06:17 -0700
Subject: Fix: multi-dimensional OOB errors were sometimes reported on
 incorrect locations.

---
 Source/Dafny/Translator.cs        | 17 +++++++++--------
 Test/dafny0/Matrix-OOB.dfy        | 13 +++++++++++++
 Test/dafny0/Matrix-OOB.dfy.expect | 12 ++++++++++++
 3 files changed, 34 insertions(+), 8 deletions(-)
 create mode 100644 Test/dafny0/Matrix-OOB.dfy
 create mode 100644 Test/dafny0/Matrix-OOB.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 524466c9..09ca32e0 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -4885,16 +4885,17 @@ namespace Microsoft.Dafny {
         MultiSelectExpr e = (MultiSelectExpr)expr;
         CheckWellformed(e.Array, options, locals, builder, etran);
         Bpl.Expr array = etran.TrExpr(e.Array);
-        int i = 0;
-        foreach (Expression idx in e.Indices) {
+        for (int idxId = 0; idxId < e.Indices.Count; idxId++) {
+          var idx = e.Indices[idxId];
           CheckWellformed(idx, options, locals, builder, etran);
 
-          Bpl.Expr index = etran.TrExpr(idx);
-          Bpl.Expr lower = Bpl.Expr.Le(Bpl.Expr.Literal(0), index);
-          Bpl.Expr length = ArrayLength(idx.tok, array, e.Indices.Count, i);
-          Bpl.Expr upper = Bpl.Expr.Lt(index, length);
-          builder.Add(Assert(idx.tok, Bpl.Expr.And(lower, upper), "index " + i + " out of range", options.AssertKv));
-          i++;
+          var index = etran.TrExpr(idx);
+          var lower = Bpl.Expr.Le(Bpl.Expr.Literal(0), index);
+          var length = ArrayLength(idx.tok, array, e.Indices.Count, idxId);
+          var upper = Bpl.Expr.Lt(index, length);
+          var tok = idx is IdentifierExpr ? e.tok : idx.tok; // TODO: Reusing the token of an identifier expression would underline its definition. but this is still not perfect.
+
+          builder.Add(Assert(tok, Bpl.Expr.And(lower, upper), String.Format("index {0} out of range", idxId), options.AssertKv));
         }
       } else if (expr is SeqUpdateExpr) {
         SeqUpdateExpr e = (SeqUpdateExpr)expr;
diff --git a/Test/dafny0/Matrix-OOB.dfy b/Test/dafny0/Matrix-OOB.dfy
new file mode 100644
index 00000000..2e5c0366
--- /dev/null
+++ b/Test/dafny0/Matrix-OOB.dfy
@@ -0,0 +1,13 @@
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" /printTooltips "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// This is a regression test: OOB errors for matrices used to be reported on the
+// quantifier that introduced the variables that constituted the invalid indices.
+
+// WISH: It would be even better to report the error on the variables inside the
+// array instead of the array itself.
+
+method M(m: array2<int>)
+  requires m != null
+  ensures forall i, j :: m[i, j] == 0
+{ }
diff --git a/Test/dafny0/Matrix-OOB.dfy.expect b/Test/dafny0/Matrix-OOB.dfy.expect
new file mode 100644
index 00000000..94e77aa4
--- /dev/null
+++ b/Test/dafny0/Matrix-OOB.dfy.expect
@@ -0,0 +1,12 @@
+Matrix-OOB.dfy(12,26): Error: index 0 out of range
+Execution trace:
+    (0,0): anon0
+Matrix-OOB.dfy(12,26): Error: index 1 out of range
+Execution trace:
+    (0,0): anon0
+Matrix-OOB.dfy(13,0): Error BP5003: A postcondition might not hold on this return path.
+Matrix-OOB.dfy(12,10): Related location: This is the postcondition that might not hold.
+Execution trace:
+    (0,0): anon0
+
+Dafny program verifier finished with 0 verified, 3 errors
-- 
cgit v1.2.3


From 489605d67b72247866a9797d8c70c06e117e5596 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Sun, 23 Aug 2015 00:07:59 -0700
Subject: Trivial code cleanup

---
 Source/Dafny/Triggers/QuantifiersCollector.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifiersCollector.cs b/Source/Dafny/Triggers/QuantifiersCollector.cs
index 3385f36e..1f37dcfa 100644
--- a/Source/Dafny/Triggers/QuantifiersCollector.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollector.cs
@@ -26,7 +26,7 @@ namespace Microsoft.Dafny.Triggers {
         if (quantifier.SplitQuantifier != null) {
           var collection = quantifier.SplitQuantifier.Select(q => q as QuantifierExpr).Where(q => q != null);
           quantifierCollections.Add(new QuantifiersCollection(collection, reporter));
-          foreach (var q in quantifier.SplitQuantifier) { quantifiers.Add(q); }
+          quantifiers.UnionWith(quantifier.SplitQuantifier);
         } else {
           quantifierCollections.Add(new QuantifiersCollection(Enumerable.Repeat(quantifier, 1), reporter));
         }
-- 
cgit v1.2.3


From 1a0ef1ae83a88966a2d68e5eba5a70a215f28f3e Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Sun, 23 Aug 2015 00:08:25 -0700
Subject: Allow MultiSelectExpr as quantifier heads

---
 Source/Dafny/Triggers/TriggersCollector.cs            |  3 ++-
 Test/triggers/matrix-accesses-are-triggers.dfy        |  9 +++++++++
 Test/triggers/matrix-accesses-are-triggers.dfy.expect | 12 ++++++++++++
 3 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 Test/triggers/matrix-accesses-are-triggers.dfy
 create mode 100644 Test/triggers/matrix-accesses-are-triggers.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index 11860404..69c47d90 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -185,7 +185,8 @@ namespace Microsoft.Dafny.Triggers {
       expr.SubExpressions.Iter(e => Annotate(e));
 
       TriggerAnnotation annotation; // TODO: Using ApplySuffix fixes the unresolved members problem in GenericSort
-      if (expr is FunctionCallExpr || expr is SeqSelectExpr || expr is MemberSelectExpr || expr is OldExpr || expr is ApplyExpr || expr is DisplayExpression ||
+      if (expr is FunctionCallExpr || expr is SeqSelectExpr || expr is MultiSelectExpr || expr is MemberSelectExpr || 
+          expr is OldExpr || expr is ApplyExpr || expr is DisplayExpression ||
           (expr is UnaryOpExpr && (((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Cardinality)) || // FIXME || ((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Fresh doesn't work, as fresh is a pretty tricky predicate when it's not about datatypes. See translator.cs:10944
           (expr is BinaryExpr && (((BinaryExpr)expr).Op == BinaryExpr.Opcode.NotIn || ((BinaryExpr)expr).Op == BinaryExpr.Opcode.In))) {
         annotation = AnnotatePotentialCandidate(expr);
diff --git a/Test/triggers/matrix-accesses-are-triggers.dfy b/Test/triggers/matrix-accesses-are-triggers.dfy
new file mode 100644
index 00000000..630fab9d
--- /dev/null
+++ b/Test/triggers/matrix-accesses-are-triggers.dfy
@@ -0,0 +1,9 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:1 /printTooltips "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// This file checks that multi-dimensional array accesses yield trigger candidates
+
+method M(m: array2<int>)
+  requires m != null
+  requires forall i, j | 0 <= i < m.Length0 && 0 <= j < m.Length1 :: m[i, j] == m[j, i+1] {
+}
diff --git a/Test/triggers/matrix-accesses-are-triggers.dfy.expect b/Test/triggers/matrix-accesses-are-triggers.dfy.expect
new file mode 100644
index 00000000..b9dd1d88
--- /dev/null
+++ b/Test/triggers/matrix-accesses-are-triggers.dfy.expect
@@ -0,0 +1,12 @@
+matrix-accesses-are-triggers.dfy(8,11): Warning: Selected triggers: {m[i, j]} (loops with {m[j, i + 1]})
+ (!) Suppressing loops would leave this expression without triggers.
+matrix-accesses-are-triggers.dfy(8,81): Error: index 0 out of range
+Execution trace:
+    (0,0): anon0
+    (0,0): anon4_Then
+matrix-accesses-are-triggers.dfy(8,86): Error: index 1 out of range
+Execution trace:
+    (0,0): anon0
+    (0,0): anon4_Then
+
+Dafny program verifier finished with 1 verified, 2 errors
-- 
cgit v1.2.3


From e0dbb8af7290beb81350acd0088866c0ca54acb8 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Sun, 23 Aug 2015 00:09:36 -0700
Subject: Improve error reporting for split quantifiers

---
 Source/Dafny/Triggers/QuantifierSplitter.cs        |  3 +-
 Test/triggers/splitting-picks-the-right-tokens.dfy | 24 ++++++++++++++
 .../splitting-picks-the-right-tokens.dfy.expect    | 38 ++++++++++++++++++++++
 3 files changed, 64 insertions(+), 1 deletion(-)
 create mode 100644 Test/triggers/splitting-picks-the-right-tokens.dfy
 create mode 100644 Test/triggers/splitting-picks-the-right-tokens.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifierSplitter.cs b/Source/Dafny/Triggers/QuantifierSplitter.cs
index c50bc9c6..ae76b780 100644
--- a/Source/Dafny/Triggers/QuantifierSplitter.cs
+++ b/Source/Dafny/Triggers/QuantifierSplitter.cs
@@ -48,7 +48,8 @@ namespace Microsoft.Dafny.Triggers {
 
     internal static IEnumerable<Expression> SplitAndStich(BinaryExpr pair, BinaryExpr.Opcode separator) {
       foreach (var e1 in SplitExpr(pair.E1, separator)) {
-        yield return new BinaryExpr(pair.tok, pair.Op, pair.E0, e1) { ResolvedOp = pair.ResolvedOp, Type = pair.Type };
+        // Notice the token. This makes triggers/splitting-picks-the-right-tokens.dfy possible
+        yield return new BinaryExpr(e1.tok, pair.Op, pair.E0, e1) { ResolvedOp = pair.ResolvedOp, Type = pair.Type };
       }
     }
 
diff --git a/Test/triggers/splitting-picks-the-right-tokens.dfy b/Test/triggers/splitting-picks-the-right-tokens.dfy
new file mode 100644
index 00000000..76065eca
--- /dev/null
+++ b/Test/triggers/splitting-picks-the-right-tokens.dfy
@@ -0,0 +1,24 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:1 /printTooltips "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// This file ensures that trigger splitting picks the right tokens
+
+function Id(i: int): int { i }
+
+method MSuchThat()
+  requires forall x | x > 0 :: Id(x) > 1 && x > 2 && x > -1 { }
+
+method MImplies()
+  // The bodies of the two terms that are produced here are both
+  // BinaryExpressions(==>); the token they use, however, is that of the RHS
+  // terms of these implications; otherwise, error messages would get stacked on
+  // the ==> sign
+  requires forall x :: x > 0 ==> Id(x) > 1 && x > 2 && x > -1 { }
+
+method M() {
+  if * {
+    MImplies();
+  } else {
+    MSuchThat();
+  }
+}
diff --git a/Test/triggers/splitting-picks-the-right-tokens.dfy.expect b/Test/triggers/splitting-picks-the-right-tokens.dfy.expect
new file mode 100644
index 00000000..af274e75
--- /dev/null
+++ b/Test/triggers/splitting-picks-the-right-tokens.dfy.expect
@@ -0,0 +1,38 @@
+splitting-picks-the-right-tokens.dfy(9,11): Info: For expression {Id(x) > 1}:
+   Selected triggers: {Id(x)}
+splitting-picks-the-right-tokens.dfy(9,11): Info: For expression {x > 2}:
+   Selected triggers: {Id(x)}
+splitting-picks-the-right-tokens.dfy(9,11): Info: For expression {x > -1}:
+   Selected triggers: {Id(x)}
+splitting-picks-the-right-tokens.dfy(16,11): Info: For expression {x > 0 ==> Id(x) > 1}:
+   Selected triggers: {Id(x)}
+splitting-picks-the-right-tokens.dfy(16,11): Info: For expression {x > 0 ==> x > 2}:
+   Selected triggers: {Id(x)}
+splitting-picks-the-right-tokens.dfy(16,11): Info: For expression {x > 0 ==> x > -1}:
+   Selected triggers: {Id(x)}
+splitting-picks-the-right-tokens.dfy(20,12): Error BP5002: A precondition for this call might not hold.
+splitting-picks-the-right-tokens.dfy(16,11): Related location: This is the precondition that might not hold.
+splitting-picks-the-right-tokens.dfy(16,48): Related location
+Execution trace:
+    (0,0): anon0
+    (0,0): anon3_Then
+splitting-picks-the-right-tokens.dfy(20,12): Error BP5002: A precondition for this call might not hold.
+splitting-picks-the-right-tokens.dfy(16,11): Related location: This is the precondition that might not hold.
+splitting-picks-the-right-tokens.dfy(16,39): Related location
+Execution trace:
+    (0,0): anon0
+    (0,0): anon3_Then
+splitting-picks-the-right-tokens.dfy(22,13): Error BP5002: A precondition for this call might not hold.
+splitting-picks-the-right-tokens.dfy(9,11): Related location: This is the precondition that might not hold.
+splitting-picks-the-right-tokens.dfy(9,46): Related location
+Execution trace:
+    (0,0): anon0
+    (0,0): anon3_Else
+splitting-picks-the-right-tokens.dfy(22,13): Error BP5002: A precondition for this call might not hold.
+splitting-picks-the-right-tokens.dfy(9,11): Related location: This is the precondition that might not hold.
+splitting-picks-the-right-tokens.dfy(9,37): Related location
+Execution trace:
+    (0,0): anon0
+    (0,0): anon3_Else
+
+Dafny program verifier finished with 6 verified, 4 errors
-- 
cgit v1.2.3


From 084f7c82033315d605dce606ce64a26e1dcc0b3d Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Sun, 23 Aug 2015 00:10:05 -0700
Subject: Add a sanity check in QuantifiersCollection

---
 Source/Dafny/Triggers/QuantifiersCollection.cs | 1 +
 1 file changed, 1 insertion(+)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index 1d5625cd..0ef59bad 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -34,6 +34,7 @@ namespace Microsoft.Dafny.Triggers {
     readonly List<QuantifierWithTriggers> quantifiers;
    
     internal QuantifiersCollection(IEnumerable<QuantifierExpr> quantifiers, ErrorReporter reporter) {
+      Contract.Requires(quantifiers.All(q => q.SplitQuantifier == null));
       this.reporter = reporter;
       this.quantifiers = quantifiers.Select(q => new QuantifierWithTriggers(q)).ToList();
     }
-- 
cgit v1.2.3


From be66434c97446d311aada9aec42fdbc8eba26ea8 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Sun, 23 Aug 2015 00:11:00 -0700
Subject: Shallow-copy quantifier attributes when splitting

---
 Source/Dafny/Triggers/QuantifierSplitter.cs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifierSplitter.cs b/Source/Dafny/Triggers/QuantifierSplitter.cs
index ae76b780..83059f8d 100644
--- a/Source/Dafny/Triggers/QuantifierSplitter.cs
+++ b/Source/Dafny/Triggers/QuantifierSplitter.cs
@@ -66,7 +66,7 @@ namespace Microsoft.Dafny.Triggers {
         }
         foreach (var e in stream) {
           var tok = new NestedToken(quantifier.tok, e.tok);
-          yield return new ForallExpr(tok, quantifier.TypeArgs, quantifier.BoundVars, quantifier.Range, e, quantifier.Attributes) { Type = quantifier.Type };
+          yield return new ForallExpr(tok, quantifier.TypeArgs, quantifier.BoundVars, quantifier.Range, e, CopyAttributes(quantifier.Attributes)) { Type = quantifier.Type };
         }
       } else if (quantifier is ExistsExpr) {
         IEnumerable<Expression> stream;
@@ -77,7 +77,7 @@ namespace Microsoft.Dafny.Triggers {
         }
         foreach (var e in stream) {
           var tok = new NestedToken(quantifier.tok, e.tok);
-          yield return new ExistsExpr(tok, quantifier.TypeArgs, quantifier.BoundVars, quantifier.Range, e, quantifier.Attributes) { Type = quantifier.Type };
+          yield return new ExistsExpr(tok, quantifier.TypeArgs, quantifier.BoundVars, quantifier.Range, e, CopyAttributes(quantifier.Attributes)) { Type = quantifier.Type };
         }
       } else {
         yield return quantifier;
-- 
cgit v1.2.3


From dc08d67a27ffeb26889a56daa573ccc56daa1c0d Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Sun, 23 Aug 2015 00:12:04 -0700
Subject: Make quantifier splitting a two step process

This fixes a bug that affected Monad.dfy
---
 Source/Dafny/DafnyAst.cs                    |  2 +-
 Source/Dafny/Rewriter.cs                    |  1 +
 Source/Dafny/Triggers/QuantifierSplitter.cs | 42 ++++++++++++++++++++++++-----
 Test/triggers/regression-tests.dfy          | 20 ++++++++++++++
 Test/triggers/regression-tests.dfy.expect   |  3 +++
 5 files changed, 60 insertions(+), 8 deletions(-)
 create mode 100644 Test/triggers/regression-tests.dfy
 create mode 100644 Test/triggers/regression-tests.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index c4ea0a5a..c7aae173 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -4796,7 +4796,7 @@ namespace Microsoft.Dafny {
     }
     public override IEnumerable<Expression> SubExpressions
     {
-      get {
+      get { // FIXME: This can return duplicates; this could confuse BottomUpVisitors that modify the AST in place
         foreach (var e in base.SubExpressions) { yield return e; }
         foreach (var e in Attributes.SubExpressions(Attributes)) { yield return e; }
         
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 557eee93..9bc24c30 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -68,6 +68,7 @@ namespace Microsoft.Dafny
       foreach (var decl in ModuleDefinition.AllCallables(m.TopLevelDecls)) {
         splitter.Visit(decl);
       }
+      splitter.Commit();
     }
   }
 
diff --git a/Source/Dafny/Triggers/QuantifierSplitter.cs b/Source/Dafny/Triggers/QuantifierSplitter.cs
index 83059f8d..865aa33e 100644
--- a/Source/Dafny/Triggers/QuantifierSplitter.cs
+++ b/Source/Dafny/Triggers/QuantifierSplitter.cs
@@ -1,11 +1,19 @@
 using Microsoft.Boogie;
 using System;
 using System.Collections.Generic;
+using System.Diagnostics.Contracts;
 using System.Linq;
 using System.Text;
 
 namespace Microsoft.Dafny.Triggers {
   class QuantifierSplitter : BottomUpVisitor {
+    /// This cache was introduced because some statements (notably calc) return the same SubExpression multiple times.
+    /// This ended up causing an inconsistent situation when the calc statement's subexpressions contained the same quantifier 
+    /// twice: on the first pass that quantifier got its SplitQuantifiers generated, and on the the second pass these 
+    /// split quantifiers got re-split, creating a situation where the direct children of a split quantifier were 
+    /// also split quantifiers.
+    private Dictionary<QuantifierExpr, List<Expression>> splits = new Dictionary<QuantifierExpr, List<Expression>>();
+
     private static BinaryExpr.Opcode FlipOpcode(BinaryExpr.Opcode opCode) {
       if (opCode == BinaryExpr.Opcode.And) {
         return BinaryExpr.Opcode.Or;
@@ -24,8 +32,15 @@ namespace Microsoft.Dafny.Triggers {
     //   forall x :: P(x) ==> (Q(x) && R(x))
 
     private static UnaryOpExpr Not(Expression expr) {
-      var not = new UnaryOpExpr(expr.tok, UnaryOpExpr.Opcode.Not, expr) { Type = expr.Type };
-      return not;
+      return new UnaryOpExpr(expr.tok, UnaryOpExpr.Opcode.Not, expr) { Type = expr.Type };
+    }
+
+    private static Attributes CopyAttributes(Attributes source) {
+      if (source == null) {
+        return null;
+      } else {
+        return new Attributes(source.Name, source.Args, CopyAttributes(source.Prev));
+      }
     }
 
     internal static IEnumerable<Expression> SplitExpr(Expression expr, BinaryExpr.Opcode separator) {
@@ -83,16 +98,29 @@ namespace Microsoft.Dafny.Triggers {
         yield return quantifier;
       }
     }
+    
+    private static bool AllowsSplitting(QuantifierExpr quantifier) {
+      bool splitAttr = true;
+      return !Attributes.ContainsBool(quantifier.Attributes, "split", ref splitAttr) || splitAttr;
+    }
 
     protected override void VisitOneExpr(Expression expr) {
       var quantifier = expr as QuantifierExpr;
-      if (quantifier != null && quantifier.SplitQuantifier == null) {
-        bool splitAttr = true;
-        if (!Attributes.ContainsBool(quantifier.Attributes, "split", ref splitAttr) || splitAttr) {
-          var split = SplitQuantifier(quantifier).ToList();
-          quantifier.SplitQuantifier = split;
+      if (quantifier != null) {
+        Contract.Assert(quantifier.SplitQuantifier == null);
+        if (!splits.ContainsKey(quantifier) && AllowsSplitting(quantifier)) {
+          splits[quantifier] = SplitQuantifier(quantifier).ToList();
         }
       }
     }
+
+    /// <summary>
+    /// See comments above definition of splits for reason why this method exists
+    /// </summary>
+    internal void Commit() {
+      foreach (var quantifier in splits.Keys) {
+        quantifier.SplitQuantifier = splits[quantifier];
+      }
+    }
   }
 }
diff --git a/Test/triggers/regression-tests.dfy b/Test/triggers/regression-tests.dfy
new file mode 100644
index 00000000..263e424a
--- /dev/null
+++ b/Test/triggers/regression-tests.dfy
@@ -0,0 +1,20 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:1 /printTooltips "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// This tests checks that quantifier splitting is resilient to the fact that
+// certain statements (like calc) can return duplicate subexpressions. This was
+// once a problem, because a quantifier that got returned twice would get split
+// on the first pass over it, and would have its nely created children re-split
+// on the second pass. This created a split quantifier whose children were split
+// quantifiers, which violated an invariant of spliit quantifiers.
+
+abstract module Base { }
+
+module Blah refines Base {
+  lemma A() {
+    calc {
+	    forall b :: b;
+   	}
+  }
+}
+
diff --git a/Test/triggers/regression-tests.dfy.expect b/Test/triggers/regression-tests.dfy.expect
new file mode 100644
index 00000000..a03810fb
--- /dev/null
+++ b/Test/triggers/regression-tests.dfy.expect
@@ -0,0 +1,3 @@
+regression-tests.dfy(16,5): Warning: (!) No terms found to trigger on.
+
+Dafny program verifier finished with 2 verified, 0 errors
-- 
cgit v1.2.3


From 7cd998145a00c54a25cc46a82f034769b281c4c1 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Sun, 23 Aug 2015 14:09:00 -0700
Subject: s/loops with/may loop with/

---
 Source/Dafny/Triggers/QuantifiersCollection.cs             |  2 +-
 Test/triggers/loop-detection-is-not-too-strict.dfy.expect  |  2 +-
 .../triggers/loop-detection-looks-at-ranges-too.dfy.expect |  4 ++--
 .../loop-detection-messages--unit-tests.dfy.expect         | 12 ++++++------
 .../looping-is-hard-to-decide-modulo-equality.dfy.expect   |  4 ++--
 Test/triggers/matrix-accesses-are-triggers.dfy.expect      |  2 +-
 .../triggers/old-is-a-special-case-for-triggers.dfy.expect | 10 +++++-----
 ...rms-do-not-look-like-the-triggers-they-match.dfy.expect |  6 +++---
 .../splitting-triggers-recovers-expressivity.dfy.expect    | 14 +++++++-------
 Test/triggers/useless-triggers-are-removed.dfy.expect      |  4 ++--
 10 files changed, 30 insertions(+), 30 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index 0ef59bad..6555b52a 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -119,7 +119,7 @@ namespace Microsoft.Dafny.Triggers {
           (candidate, loopingSubterms) => !loopingSubterms.Any(),
           (candidate, loopingSubterms) => {
             looping.Add(candidate);
-            candidate.Annotation = "loops with " + loopingSubterms.MapConcat(t => "{" + Printer.ExprToString(t.OriginalExpr) + "}", ", ");
+            candidate.Annotation = "may loop with " + loopingSubterms.MapConcat(t => "{" + Printer.ExprToString(t.OriginalExpr) + "}", ", ");
           }).ToList();
 
         q.CouldSuppressLoops = safe.Count > 0;
diff --git a/Test/triggers/loop-detection-is-not-too-strict.dfy.expect b/Test/triggers/loop-detection-is-not-too-strict.dfy.expect
index 270f7e57..6f5ed3d7 100644
--- a/Test/triggers/loop-detection-is-not-too-strict.dfy.expect
+++ b/Test/triggers/loop-detection-is-not-too-strict.dfy.expect
@@ -2,7 +2,7 @@ loop-detection-is-not-too-strict.dfy(14,9): Info: Selected triggers:
    {P(y, x)}, {P(x, y)}
 loop-detection-is-not-too-strict.dfy(17,9): Info: Selected triggers:
    {P(y, x)}, {P(x, y)}
-loop-detection-is-not-too-strict.dfy(20,9): Warning: Selected triggers: {P(x, y)} (loops with {P(x, y + 1)})
+loop-detection-is-not-too-strict.dfy(20,9): Warning: Selected triggers: {P(x, y)} (may loop with {P(x, y + 1)})
  (!) Suppressing loops would leave this expression without triggers.
 
 Dafny program verifier finished with 3 verified, 0 errors
diff --git a/Test/triggers/loop-detection-looks-at-ranges-too.dfy.expect b/Test/triggers/loop-detection-looks-at-ranges-too.dfy.expect
index 72482de5..ce62d868 100644
--- a/Test/triggers/loop-detection-looks-at-ranges-too.dfy.expect
+++ b/Test/triggers/loop-detection-looks-at-ranges-too.dfy.expect
@@ -1,6 +1,6 @@
-loop-detection-looks-at-ranges-too.dfy(11,17): Warning: Selected triggers: {P(x)} (loops with {P(x + 1)})
+loop-detection-looks-at-ranges-too.dfy(11,17): Warning: Selected triggers: {P(x)} (may loop with {P(x + 1)})
  (!) Suppressing loops would leave this expression without triggers.
-loop-detection-looks-at-ranges-too.dfy(13,17): Warning: Selected triggers: {P(x)} (loops with {P(x + 1)})
+loop-detection-looks-at-ranges-too.dfy(13,17): Warning: Selected triggers: {P(x)} (may loop with {P(x + 1)})
  (!) Suppressing loops would leave this expression without triggers.
 
 Dafny program verifier finished with 3 verified, 0 errors
diff --git a/Test/triggers/loop-detection-messages--unit-tests.dfy.expect b/Test/triggers/loop-detection-messages--unit-tests.dfy.expect
index 89d7265c..804a0116 100644
--- a/Test/triggers/loop-detection-messages--unit-tests.dfy.expect
+++ b/Test/triggers/loop-detection-messages--unit-tests.dfy.expect
@@ -1,21 +1,21 @@
 loop-detection-messages--unit-tests.dfy(11,9): Info: Selected triggers: {f(f(i))}
- Rejected triggers: {f(i)} (loops with {f(f(i))})
-loop-detection-messages--unit-tests.dfy(12,9): Warning: Selected triggers: {f(i)} (loops with {f(i + 1)})
+ Rejected triggers: {f(i)} (may loop with {f(f(i))})
+loop-detection-messages--unit-tests.dfy(12,9): Warning: Selected triggers: {f(i)} (may loop with {f(i + 1)})
  (!) Suppressing loops would leave this expression without triggers.
-loop-detection-messages--unit-tests.dfy(13,9): Info: Selected triggers: {f(i)} (loops with {f(i + 1)})
+loop-detection-messages--unit-tests.dfy(13,9): Info: Selected triggers: {f(i)} (may loop with {f(i + 1)})
 loop-detection-messages--unit-tests.dfy(15,9): Info: For expression {false ==> f(i) == f(i + 1)}:
    Selected triggers: {g(i)}
-   Rejected triggers: {f(i)} (loops with {f(i + 1)})
+   Rejected triggers: {f(i)} (may loop with {f(i + 1)})
 loop-detection-messages--unit-tests.dfy(15,9): Info: For expression {false ==> f(i) == g(i)}:
    Selected triggers:
      {g(i)}, {f(i)}
 loop-detection-messages--unit-tests.dfy(16,9): Warning: For expression {false ==> f(i) == f(i + 1)}:
-   Selected triggers: {f(i)} (loops with {f(i + 1)})
+   Selected triggers: {f(i)} (may loop with {f(i + 1)})
    (!) Suppressing loops would leave this expression without triggers.
 loop-detection-messages--unit-tests.dfy(16,9): Info: For expression {false ==> f(i) == f(i)}:
    Selected triggers: {f(i)}
 loop-detection-messages--unit-tests.dfy(17,9): Info: For expression {false ==> f(i) == f(i + 1)}:
-   Selected triggers: {f(i)} (loops with {f(i + 1)})
+   Selected triggers: {f(i)} (may loop with {f(i + 1)})
 loop-detection-messages--unit-tests.dfy(17,9): Info: For expression {false ==> f(i) == f(i)}:
    Selected triggers: {f(i)}
 loop-detection-messages--unit-tests.dfy(19,9): Info: Selected triggers: {f(i)}
diff --git a/Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy.expect b/Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy.expect
index c0eebdba..58094110 100644
--- a/Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy.expect
+++ b/Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy.expect
@@ -1,10 +1,10 @@
 looping-is-hard-to-decide-modulo-equality.dfy(21,9): Info: Selected triggers:
    {h(h(c, j), j)}, {h(c, i)}, {c in sc}
- Rejected triggers: {h(c, j)} (loops with {h(h(c, j), j)})
+ Rejected triggers: {h(c, j)} (may loop with {h(h(c, j), j)})
 looping-is-hard-to-decide-modulo-equality.dfy(26,9): Info: Selected triggers: {f(x)}
  Rejected triggers: {g(f(x))} (more specific than {f(x)})
 looping-is-hard-to-decide-modulo-equality.dfy(31,9): Info: Selected triggers:
    {old(f(f(c)))}, {f(c)}, {c in sc}
- Rejected triggers: {old(f(c))} (loops with {old(f(f(c)))})
+ Rejected triggers: {old(f(c))} (may loop with {old(f(f(c)))})
 
 Dafny program verifier finished with 9 verified, 0 errors
diff --git a/Test/triggers/matrix-accesses-are-triggers.dfy.expect b/Test/triggers/matrix-accesses-are-triggers.dfy.expect
index b9dd1d88..35df02f5 100644
--- a/Test/triggers/matrix-accesses-are-triggers.dfy.expect
+++ b/Test/triggers/matrix-accesses-are-triggers.dfy.expect
@@ -1,4 +1,4 @@
-matrix-accesses-are-triggers.dfy(8,11): Warning: Selected triggers: {m[i, j]} (loops with {m[j, i + 1]})
+matrix-accesses-are-triggers.dfy(8,11): Warning: Selected triggers: {m[i, j]} (may loop with {m[j, i + 1]})
  (!) Suppressing loops would leave this expression without triggers.
 matrix-accesses-are-triggers.dfy(8,81): Error: index 0 out of range
 Execution trace:
diff --git a/Test/triggers/old-is-a-special-case-for-triggers.dfy.expect b/Test/triggers/old-is-a-special-case-for-triggers.dfy.expect
index 23ec089d..313d7c16 100644
--- a/Test/triggers/old-is-a-special-case-for-triggers.dfy.expect
+++ b/Test/triggers/old-is-a-special-case-for-triggers.dfy.expect
@@ -2,14 +2,14 @@ old-is-a-special-case-for-triggers.dfy(15,10): Info: Selected triggers:
    {old(f(c))}, {c in sc}
 old-is-a-special-case-for-triggers.dfy(20,10): Info: Selected triggers:
    {old(f(f(c)))}, {f(c)}, {c in sc}
- Rejected triggers: {old(f(c))} (loops with {old(f(f(c)))})
+ Rejected triggers: {old(f(c))} (may loop with {old(f(f(c)))})
 old-is-a-special-case-for-triggers.dfy(21,10): Info: Selected triggers:
    {f(g(c))}, {g(f(c))}, {old(f(g(c)))}, {old(g(f(c)))}, {old(f(f(c)))}, {c in sc}
  Rejected triggers:
-   {g(c)} (loops with {g(f(c))})
-   {f(c)} (loops with {f(g(c))})
-   {old(g(c))} (loops with {old(g(f(c)))})
-   {old(f(c))} (loops with {old(f(f(c)))}, {old(f(g(c)))})
+   {g(c)} (may loop with {g(f(c))})
+   {f(c)} (may loop with {f(g(c))})
+   {old(g(c))} (may loop with {old(g(f(c)))})
+   {old(f(c))} (may loop with {old(f(f(c)))}, {old(f(g(c)))})
 old-is-a-special-case-for-triggers.dfy(25,10): Info: Selected triggers:
    {old(f(c))}, {f(c)}, {c in sc}
  Rejected triggers: {old(g(f(c)))} (more specific than {old(f(c))})
diff --git a/Test/triggers/some-terms-do-not-look-like-the-triggers-they-match.dfy.expect b/Test/triggers/some-terms-do-not-look-like-the-triggers-they-match.dfy.expect
index 83648626..f5e47454 100644
--- a/Test/triggers/some-terms-do-not-look-like-the-triggers-they-match.dfy.expect
+++ b/Test/triggers/some-terms-do-not-look-like-the-triggers-they-match.dfy.expect
@@ -1,10 +1,10 @@
-some-terms-do-not-look-like-the-triggers-they-match.dfy(12,17): Warning: Selected triggers: {s[x]} (loops with {s[x + 1]})
+some-terms-do-not-look-like-the-triggers-they-match.dfy(12,17): Warning: Selected triggers: {s[x]} (may loop with {s[x + 1]})
  (!) Suppressing loops would leave this expression without triggers.
 some-terms-do-not-look-like-the-triggers-they-match.dfy(15,17): Warning: For expression {x in s ==> s[x + 1] > 0}:
-   Selected triggers: {s[x]} (loops with {s[x + 1]})
+   Selected triggers: {s[x]} (may loop with {s[x + 1]})
    (!) Suppressing loops would leave this expression without triggers.
 some-terms-do-not-look-like-the-triggers-they-match.dfy(15,17): Warning: For expression {x in s ==> x + 2 !in s}:
-   Selected triggers: {s[x]} (loops with {x + 2 !in s})
+   Selected triggers: {s[x]} (may loop with {x + 2 !in s})
    (!) Suppressing loops would leave this expression without triggers.
 
 Dafny program verifier finished with 2 verified, 0 errors
diff --git a/Test/triggers/splitting-triggers-recovers-expressivity.dfy.expect b/Test/triggers/splitting-triggers-recovers-expressivity.dfy.expect
index 63cbc476..58c8dd2b 100644
--- a/Test/triggers/splitting-triggers-recovers-expressivity.dfy.expect
+++ b/Test/triggers/splitting-triggers-recovers-expressivity.dfy.expect
@@ -1,11 +1,11 @@
 splitting-triggers-recovers-expressivity.dfy(12,10): Info: Selected triggers: {Q(i)}
- Rejected triggers: {P(i)} (loops with {P(i + 1)})
+ Rejected triggers: {P(i)} (may loop with {P(i + 1)})
 splitting-triggers-recovers-expressivity.dfy(17,11): Info: Selected triggers: {Q(j)}
- Rejected triggers: {P(j)} (loops with {P(j + 1)})
+ Rejected triggers: {P(j)} (may loop with {P(j + 1)})
 splitting-triggers-recovers-expressivity.dfy(26,10): Info: Selected triggers: {Q(i)}
- Rejected triggers: {P(i)} (loops with {P(i + 1)})
+ Rejected triggers: {P(i)} (may loop with {P(i + 1)})
 splitting-triggers-recovers-expressivity.dfy(33,11): Info: Selected triggers: {Q(j)}
- Rejected triggers: {P(j)} (loops with {P(j + 1)})
+ Rejected triggers: {P(j)} (may loop with {P(j + 1)})
 splitting-triggers-recovers-expressivity.dfy(44,10): Info: For expression {P(i)}:
    Selected triggers:
      {Q(i)}, {P(i)}
@@ -14,19 +14,19 @@ splitting-triggers-recovers-expressivity.dfy(44,10): Info: For expression {!Q(i)
      {Q(i)}, {P(i)}
 splitting-triggers-recovers-expressivity.dfy(44,10): Info: For expression {P(i + 1)}:
    Selected triggers: {Q(i)}
-   Rejected triggers: {P(i)} (loops with {P(i + 1)})
+   Rejected triggers: {P(i)} (may loop with {P(i + 1)})
 splitting-triggers-recovers-expressivity.dfy(49,11): Info: For expression {j >= 0 ==> P(j)}:
    Selected triggers:
      {Q(j)}, {P(j)}
 splitting-triggers-recovers-expressivity.dfy(49,11): Info: For expression {j >= 0 ==> Q(j) ==> P(j + 1)}:
    Selected triggers: {Q(j)}
-   Rejected triggers: {P(j)} (loops with {P(j + 1)})
+   Rejected triggers: {P(j)} (may loop with {P(j + 1)})
 splitting-triggers-recovers-expressivity.dfy(58,11): Info: For expression {i >= 0 ==> Q(i)}:
    Selected triggers:
      {P(i)}, {Q(i)}
 splitting-triggers-recovers-expressivity.dfy(58,11): Info: For expression {i >= 0 ==> P(i) ==> P(i + 1)}:
    Selected triggers:
-     {P(i)} (loops with {P(i + 1)}), {Q(i)}
+     {P(i)} (may loop with {P(i + 1)}), {Q(i)}
 splitting-triggers-recovers-expressivity.dfy(12,63): Error BP5003: A postcondition might not hold on this return path.
 splitting-triggers-recovers-expressivity.dfy(12,10): Related location: This is the postcondition that might not hold.
 Execution trace:
diff --git a/Test/triggers/useless-triggers-are-removed.dfy.expect b/Test/triggers/useless-triggers-are-removed.dfy.expect
index a526e517..2e9bbedf 100644
--- a/Test/triggers/useless-triggers-are-removed.dfy.expect
+++ b/Test/triggers/useless-triggers-are-removed.dfy.expect
@@ -5,11 +5,11 @@ useless-triggers-are-removed.dfy(16,11): Info: Selected triggers: {f(x)}
    {h(f(x))} (more specific than {f(x)})
    {g(f(x))} (more specific than {f(x)})
 useless-triggers-are-removed.dfy(20,11): Info: Selected triggers: {f(f(x))}
- Rejected triggers: {f(x)} (loops with {f(f(x))})
+ Rejected triggers: {f(x)} (may loop with {f(f(x))})
 useless-triggers-are-removed.dfy(23,11): Info: Selected triggers:
    {g(f(x)), g(y)}, {f(y), f(x)}
  Rejected triggers:
-   {g(y), f(x)} (loops with {g(f(y))}, {g(f(x))})
+   {g(y), f(x)} (may loop with {g(f(y))}, {g(f(x))})
    {g(f(x)), g(f(y))} (more specific than {g(f(x)), f(y)}, {g(f(y)), f(x)}, {f(y), f(x)})
    {g(f(x)), f(y)} (more specific than {f(y), f(x)})
    {g(f(y)), f(x)} (more specific than {f(y), f(x)})
-- 
cgit v1.2.3


From c55cb226f4de90b080aa809d883d52c3386db063 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Wed, 26 Aug 2015 18:36:34 -0700
Subject: Improve the redundancy detection algorithm used while constructing
 sets of terms

Based on an issue noted by Chris with redundancy removal resuls being dependent
on the order of the terms. Interestingly, one of our tests already had an
instance of that problem.

Also fix the issue with nested quantifiers getting redundant triggers.
---
 Source/Dafny/DafnyAst.cs                           |   1 +
 Source/Dafny/Triggers/QuantifiersCollection.cs     |  17 ++--
 Source/Dafny/Triggers/TriggerUtils.cs              | 100 ++++++++++++++++++---
 Source/Dafny/Triggers/TriggersCollector.cs         |   5 ++
 .../function-applications-are-triggers.dfy.expect  |   2 +-
 .../redundancy-detection-is-bidirectional.dfy      |  29 ++++++
 ...edundancy-detection-is-bidirectional.dfy.expect |  12 +++
 7 files changed, 143 insertions(+), 23 deletions(-)
 create mode 100644 Test/triggers/redundancy-detection-is-bidirectional.dfy
 create mode 100644 Test/triggers/redundancy-detection-is-bidirectional.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index c7aae173..9bff2038 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -2965,6 +2965,7 @@ namespace Microsoft.Dafny {
     }
   }
 
+  [DebuggerDisplay("Bound<{name}>")]
   public class BoundVar : NonglobalVariable {
     public override bool IsMutable {
       get {
diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index 6555b52a..114d5f5d 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -47,15 +47,9 @@ namespace Microsoft.Dafny.Triggers {
       SelectTriggers();
     }
     
-    private bool SubsetGenerationPredicate(List<TriggerTerm> terms, TriggerTerm additionalTerm) {
-      // Simple formulas like [P0(i) && P1(i) && P2(i) && P3(i) && P4(i)] yield very
-      // large numbers of multi-triggers, most of which are useless. This filter
-      // restricts subsets of terms so that we only generate sets of terms where each
-      // element contributes at least one variable. In the example above, we'll only
-      // get 5 triggers.
-      // Note that this may still be an over-approximation, as in the following example:
-      // forall a, b :: forall x :: a[x] || b[x] > 0.
-      return additionalTerm.Variables.Where(v => v is BoundVar && !terms.Any(t => t.Variables.Contains(v))).Any();
+    private bool SubsetGenerationPredicate(TriggerUtils.SetOfTerms terms, TriggerTerm additionalTerm) {
+      return true; // FIXME Remove this
+      //return additionalTerm.Variables.Where(v => v is BoundVar && !terms.Any(t => t.Variables.Contains(v))).Any();
     }
 
     /// <summary>
@@ -68,11 +62,10 @@ namespace Microsoft.Dafny.Triggers {
     void CollectAndShareTriggers(TriggersCollector triggersCollector) {
       var pool = quantifiers.SelectMany(q => triggersCollector.CollectTriggers(q.quantifier));
       var distinctPool = pool.Deduplicate(TriggerTerm.Eq);
-      var multiPool = TriggerUtils.AllNonEmptySubsets(distinctPool, SubsetGenerationPredicate).Select(candidates => new TriggerCandidate(candidates)).ToList();
 
       foreach (var q in quantifiers) {
-        q.CandidateTerms = distinctPool; //Candidate terms are immutable: no copy needed
-        q.Candidates = multiPool.Select(candidate => new TriggerCandidate(candidate)).ToList();
+        q.CandidateTerms = distinctPool; // The list of candidate terms is immutable
+        q.Candidates = TriggerUtils.AllNonEmptySubsets(distinctPool, SubsetGenerationPredicate, q.quantifier.BoundVars).Select(set => set.ToTriggerCandidate()).ToList();
       }
     }
 
diff --git a/Source/Dafny/Triggers/TriggerUtils.cs b/Source/Dafny/Triggers/TriggerUtils.cs
index 4fd139e2..efa1f167 100644
--- a/Source/Dafny/Triggers/TriggerUtils.cs
+++ b/Source/Dafny/Triggers/TriggerUtils.cs
@@ -15,29 +15,109 @@ namespace Microsoft.Dafny.Triggers {
       return copy;
     }
 
-    internal static IEnumerable<List<T>> AllSubsets<T>(IList<T> source, Func<List<T>, T, bool> predicate, int offset) {
+    internal class SetOfTerms {
+      internal bool IsRedundant { get; private set; }
+      internal List<TriggerTerm> Terms { get; set; }
+
+      private ISet<BoundVar> variables;
+      private Dictionary<BoundVar, TriggerTerm> termOwningAUniqueVar;
+      private Dictionary<TriggerTerm, ISet<BoundVar>> uniqueVarsOwnedByATerm;
+
+      public int Count { get { return Terms.Count; } }
+
+      private SetOfTerms() { }
+
+      internal TriggerCandidate ToTriggerCandidate() {
+        return new TriggerCandidate(Terms);
+      }
+      
+      internal static SetOfTerms Empty() {
+        var newSet = new SetOfTerms();
+        newSet.IsRedundant = false;
+        newSet.Terms = new List<TriggerTerm>();
+        newSet.variables = new HashSet<BoundVar>();
+        newSet.termOwningAUniqueVar = new Dictionary<BoundVar, TriggerTerm>();
+        newSet.uniqueVarsOwnedByATerm = new Dictionary<TriggerTerm, ISet<BoundVar>>();
+        return newSet;
+      }
+
+      /// <summary>
+      /// Simple formulas like [P0(i) && P1(i) && P2(i) && P3(i) && P4(i)] yield very
+      /// large numbers of multi-triggers, most of which are useless. As it copies its
+      /// argument, this method updates various datastructures that allow it to
+      /// efficiently track ownership relations between formulae and bound variables,
+      /// and sets the IsRedundant flag of the returned set, allowing the caller to
+      /// discard that set of terms, and the ones that would have been built on top of
+      /// it, thus ensuring that the only sets of terms produced in the end are sets
+      /// of terms in which each element contributes (owns) at least one variable.
+      ///
+      /// Note that this is trickier than just checking every term for new variables;
+      /// indeed, a new term that does bring new variables in can make an existing
+      /// term redundant (see redundancy-detection-does-its-job-properly.dfy).
+      /// </summary>
+      internal SetOfTerms CopyWithAdd(TriggerTerm term, ISet<BoundVar> relevantVariables) {
+        var copy = new SetOfTerms();
+        copy.Terms = new List<TriggerTerm>(Terms);
+        copy.variables = new HashSet<BoundVar>(variables);
+        copy.termOwningAUniqueVar = new Dictionary<BoundVar, TriggerTerm>(termOwningAUniqueVar);
+        copy.uniqueVarsOwnedByATerm = new Dictionary<TriggerTerm, ISet<BoundVar>>(uniqueVarsOwnedByATerm);
+
+        copy.Terms.Add(term);
+
+        var varsInNewTerm = new HashSet<BoundVar>(term.BoundVars);
+        varsInNewTerm.IntersectWith(relevantVariables);
+
+        var ownedByNewTerm = new HashSet<BoundVar>();
+
+        // Check #0: does this term bring anything new?
+        copy.IsRedundant = IsRedundant || varsInNewTerm.All(bv => copy.variables.Contains(bv));
+        copy.variables.UnionWith(varsInNewTerm);
+        
+        // Check #1: does this term claiming ownership of all its variables cause another term to become useless?
+        foreach (var v in varsInNewTerm) {
+          TriggerTerm originalOwner;
+          if (copy.termOwningAUniqueVar.TryGetValue(v, out originalOwner)) {
+            var alsoOwnedByOriginalOwner = copy.uniqueVarsOwnedByATerm[originalOwner];
+            alsoOwnedByOriginalOwner.Remove(v);
+            if (!alsoOwnedByOriginalOwner.Any()) {
+              copy.IsRedundant = true;
+            }
+          } else {
+            ownedByNewTerm.Add(v);
+            copy.termOwningAUniqueVar[v] = term;
+          }
+        }
+
+        // Actually claim ownership
+        copy.uniqueVarsOwnedByATerm[term] = ownedByNewTerm;
+
+        return copy;
+      }
+    }
+
+    internal static IEnumerable<SetOfTerms> AllSubsets(IList<TriggerTerm> source, Func<SetOfTerms, TriggerTerm, bool> predicate, int offset, ISet<BoundVar> relevantVariables) {
       if (offset >= source.Count) {
-        yield return new List<T>();
+        yield return SetOfTerms.Empty();
         yield break;
       }
 
-      foreach (var subset in AllSubsets<T>(source, predicate, offset + 1)) {
-        if (predicate(subset, source[offset])) {
-          yield return CopyAndAdd(subset, source[offset]);
+      foreach (var subset in AllSubsets(source, predicate, offset + 1, relevantVariables)) {
+        var newSet = subset.CopyWithAdd(source[offset], relevantVariables);
+        if (!newSet.IsRedundant && predicate(subset, source[offset])) { // Fixme remove the predicate?
+          yield return newSet;
         }
-        yield return new List<T>(subset);
+        yield return subset;
       }
     }
 
-    internal static IEnumerable<List<T>> AllNonEmptySubsets<T>(IEnumerable<T> source, Func<List<T>, T, bool> predicate) {
-      List<T> all = new List<T>(source);
-      foreach (var subset in AllSubsets(all, predicate, 0)) {
+    internal static IEnumerable<SetOfTerms> AllNonEmptySubsets(IList<TriggerTerm> source, Func<SetOfTerms, TriggerTerm, bool> predicate, IEnumerable<BoundVar> relevantVariables) {
+      foreach (var subset in AllSubsets(source, predicate, 0, new HashSet<BoundVar>(relevantVariables))) {
         if (subset.Count > 0) {
           yield return subset;
         }
       }
     }
-
+    
     internal static List<T> MergeAlterFirst<T>(List<T> a, List<T> b) {
       Contract.Requires(a != null);
       Contract.Requires(b != null);
diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index 69c47d90..d78bcb9e 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -11,6 +11,11 @@ namespace Microsoft.Dafny.Triggers {
     internal Expression Expr { get; set; }
     internal Expression OriginalExpr { get; set; }
     internal ISet<IVariable> Variables { get; set; }
+    internal IEnumerable<BoundVar> BoundVars {
+      get {
+        return Variables.Select(v => v as BoundVar).Where(v => v != null);
+      }
+    }
 
     public override string ToString() {
       return Printer.ExprToString(Expr); 
diff --git a/Test/triggers/function-applications-are-triggers.dfy.expect b/Test/triggers/function-applications-are-triggers.dfy.expect
index 7922e88d..501cfa51 100644
--- a/Test/triggers/function-applications-are-triggers.dfy.expect
+++ b/Test/triggers/function-applications-are-triggers.dfy.expect
@@ -8,6 +8,6 @@ function-applications-are-triggers.dfy(10,9): Info: For expression {P(f) ==> f(1
 function-applications-are-triggers.dfy(11,9): Info: Selected triggers:
    {f(10)}, {f.requires(10)}
 function-applications-are-triggers.dfy(12,5): Info: Selected triggers:
-   {g(x), f(x)}, {g(x), f.requires(x)}, {g(x)}, {f(x)}, {g.requires(x), f.requires(x)}, {g.requires(x)}, {f.requires(x)}
+   {g(x)}, {f(x)}, {g.requires(x)}, {f.requires(x)}
 
 Dafny program verifier finished with 2 verified, 0 errors
diff --git a/Test/triggers/redundancy-detection-is-bidirectional.dfy b/Test/triggers/redundancy-detection-is-bidirectional.dfy
new file mode 100644
index 00000000..df1d78c3
--- /dev/null
+++ b/Test/triggers/redundancy-detection-is-bidirectional.dfy
@@ -0,0 +1,29 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:1 /printTooltips "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// This tests checks for tricky cases of redundancy suppression when building
+// triggers.
+
+predicate P(x: int, y: int)
+predicate Q(x: int)
+predicate R(x: int)
+
+method M() {
+  // For this term, it is enough to order the terms by number of variables
+  assert forall x, y :: true || P(x, y) || Q(y) || R(x);
+  assert forall x, y :: true || Q(y) || P(x, y) || R(x);
+  assert forall x, y :: true || Q(y) || R(x) || P(x, y);
+}
+
+predicate PP(x: int, y: int, z: int)
+predicate QQ(x: int, y: int)
+predicate RR(x: int, y: int)
+predicate SS(x: int, y: int)
+
+method MM() {
+  // Not for this one, though
+  assert forall x, y, z, u, v, w :: true || PP(x, y, z) || QQ(x, u) || RR(y, v) || SS(z, w);
+  assert forall x, y, z, u, v, w :: true || QQ(x, u) || PP(x, y, z) || RR(y, v) || SS(z, w);
+  assert forall x, y, z, u, v, w :: true || QQ(x, u) || RR(y, v) || PP(x, y, z) || SS(z, w);
+  assert forall x, y, z, u, v, w :: true || QQ(x, u) || RR(y, v) || SS(z, w) || PP(x, y, z);
+}
diff --git a/Test/triggers/redundancy-detection-is-bidirectional.dfy.expect b/Test/triggers/redundancy-detection-is-bidirectional.dfy.expect
new file mode 100644
index 00000000..78c9e7ca
--- /dev/null
+++ b/Test/triggers/redundancy-detection-is-bidirectional.dfy.expect
@@ -0,0 +1,12 @@
+redundancy-detection-is-bidirectional.dfy(13,9): Info: Selected triggers:
+   {R(x), Q(y)}, {P(x, y)}
+redundancy-detection-is-bidirectional.dfy(14,9): Info: Selected triggers:
+   {R(x), Q(y)}, {P(x, y)}
+redundancy-detection-is-bidirectional.dfy(15,9): Info: Selected triggers:
+   {P(x, y)}, {R(x), Q(y)}
+redundancy-detection-is-bidirectional.dfy(25,9): Info: Selected triggers: {SS(z, w), RR(y, v), QQ(x, u)}
+redundancy-detection-is-bidirectional.dfy(26,9): Info: Selected triggers: {SS(z, w), RR(y, v), QQ(x, u)}
+redundancy-detection-is-bidirectional.dfy(27,9): Info: Selected triggers: {SS(z, w), RR(y, v), QQ(x, u)}
+redundancy-detection-is-bidirectional.dfy(28,9): Info: Selected triggers: {SS(z, w), RR(y, v), QQ(x, u)}
+
+Dafny program verifier finished with 11 verified, 0 errors
-- 
cgit v1.2.3


From 7a993f6c87eaa82f383b1c5e7411f1878d4edf30 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 27 Aug 2015 16:10:25 -0700
Subject: Small fix: there is no loop in (forall x :: Q(x) && Q(0))

Again, spotted by Chris :)
---
 Source/Dafny/Triggers/QuantifiersCollection.cs          | 4 +++-
 Source/Dafny/Triggers/TriggerExtensions.cs              | 8 ++++----
 Test/triggers/redundancy-detection-is-bidirectional.dfy | 2 +-
 3 files changed, 8 insertions(+), 6 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index 114d5f5d..b77afccb 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -100,7 +100,9 @@ namespace Microsoft.Dafny.Triggers {
       // quantifier that matches one of the terms of the trigger (this ensures that
       // [∀ x {f(x), f(f(x))} ⋅ f(x) = f(f(x))] is not a loop). And we even
       // ignore terms that almost match a trigger term, modulo a single variable
-      // (this ensures that [∀ x y {a(x, y)} ⋅ a(x, y) == a(y, x)] is not a loop).
+      // (this ensures that [∀ x y {a(x, y)} ⋅ a(x, y) == a(y, x)] is not a loop). 
+      // The last thing that we ignore is matching variables against constants, 
+      // to ensure that P(x) is not flagged as looping with P(0).
       // This ignoring logic is implemented by the CouldCauseLoops method.
 
       foreach (var q in quantifiers) {
diff --git a/Source/Dafny/Triggers/TriggerExtensions.cs b/Source/Dafny/Triggers/TriggerExtensions.cs
index 71414eee..dccd996d 100644
--- a/Source/Dafny/Triggers/TriggerExtensions.cs
+++ b/Source/Dafny/Triggers/TriggerExtensions.cs
@@ -33,7 +33,7 @@ namespace Microsoft.Dafny.Triggers {
 
     internal bool CouldCauseLoops(List<TriggerTerm> terms) {
       var expr = Expr;
-      return !terms.Any(term => term.Expr.ExpressionEqModuloVariableNames(expr));
+      return !terms.Any(term => term.Expr.ExpressionEqModuloVariableNamesAndConstants(expr));
     }
   }
 
@@ -79,15 +79,15 @@ namespace Microsoft.Dafny.Triggers {
       return ShallowEq_Top(expr1, expr2) && TriggerUtils.SameLists(expr1.SubExpressions, expr2.SubExpressions, (e1, e2) => ExpressionEq(e1, e2));
     }
 
-    internal static bool ExpressionEqModuloVariableNames(this Expression expr1, Expression expr2) {
+    internal static bool ExpressionEqModuloVariableNamesAndConstants(this Expression expr1, Expression expr2) {
       expr1 = expr1.Resolved;
       expr2 = expr2.Resolved;
 
       if (expr1 is IdentifierExpr) {
-        return expr2 is IdentifierExpr;
+        return expr2 is IdentifierExpr || expr2 is LiteralExpr;
       }
 
-      return ShallowEq_Top(expr1, expr2) && TriggerUtils.SameLists(expr1.SubExpressions, expr2.SubExpressions, (e1, e2) => ExpressionEqModuloVariableNames(e1, e2));
+      return ShallowEq_Top(expr1, expr2) && TriggerUtils.SameLists(expr1.SubExpressions, expr2.SubExpressions, (e1, e2) => ExpressionEqModuloVariableNamesAndConstants(e1, e2));
     }
 
     internal static bool MatchesTrigger(this Expression expr, Expression trigger, ISet<BoundVar> holes, Dictionary<IVariable, Expression> bindings) {
diff --git a/Test/triggers/redundancy-detection-is-bidirectional.dfy b/Test/triggers/redundancy-detection-is-bidirectional.dfy
index df1d78c3..06541b70 100644
--- a/Test/triggers/redundancy-detection-is-bidirectional.dfy
+++ b/Test/triggers/redundancy-detection-is-bidirectional.dfy
@@ -1,7 +1,7 @@
 // RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:1 /printTooltips "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
-// This tests checks for tricky cases of redundancy suppression when building
+// This test checks for tricky cases of redundancy suppression when building
 // triggers.
 
 predicate P(x: int, y: int)
-- 
cgit v1.2.3


From 1e725f0c9382a3dd8be109d160581868c9567f61 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 27 Aug 2015 21:25:06 -0700
Subject: Further relax the loop detection conditions

Mismatches are now allowed up to expressions not involving any of the bound
variables of the quantifier under inspection.
---
 Source/Dafny/Triggers/QuantifiersCollection.cs     |  7 +++++--
 Source/Dafny/Triggers/TriggerExtensions.cs         | 23 +++++++++++++++++-----
 Source/Dafny/Triggers/TriggersCollector.cs         |  3 ++-
 Test/triggers/loop-detection-is-not-too-strict.dfy | 21 +++++++++++++++++++-
 .../loop-detection-is-not-too-strict.dfy.expect    | 17 ++++++++++++----
 5 files changed, 58 insertions(+), 13 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index b77afccb..50458ab7 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -101,8 +101,11 @@ namespace Microsoft.Dafny.Triggers {
       // [∀ x {f(x), f(f(x))} ⋅ f(x) = f(f(x))] is not a loop). And we even
       // ignore terms that almost match a trigger term, modulo a single variable
       // (this ensures that [∀ x y {a(x, y)} ⋅ a(x, y) == a(y, x)] is not a loop). 
-      // The last thing that we ignore is matching variables against constants, 
-      // to ensure that P(x) is not flagged as looping with P(0).
+      // In addition, we ignore cases where the only differences between a trigger
+      // and a trigger match are places where a variable is replaced with an 
+      // expression whose free variables do not intersect that of the quantifier 
+      // in which that expression is found. For examples of this behavious, see
+      // triggers/literals-do-not-cause-loops.
       // This ignoring logic is implemented by the CouldCauseLoops method.
 
       foreach (var q in quantifiers) {
diff --git a/Source/Dafny/Triggers/TriggerExtensions.cs b/Source/Dafny/Triggers/TriggerExtensions.cs
index dccd996d..d4a822a8 100644
--- a/Source/Dafny/Triggers/TriggerExtensions.cs
+++ b/Source/Dafny/Triggers/TriggerExtensions.cs
@@ -31,9 +31,15 @@ namespace Microsoft.Dafny.Triggers {
       return ExprExtensions.ExpressionEq(t1.Expr, t2.Expr);
     }
 
-    internal bool CouldCauseLoops(List<TriggerTerm> terms) {
+    /// <summary>
+    ///  This method checks whether this match could actually cause a loop, given a set of terms participating in a trigger; 
+    ///  to compute an answer, we match the Expr of this match against the Exprs of each of these term, allowing for harmless 
+    ///  variations. If any of these tests does match, this term likely won't cause a loop.
+    ///  The boundVars list is useful to determine that forall x :: P(x) == P(y+z) does not loop.
+    /// </summary>
+    internal bool CouldCauseLoops(List<TriggerTerm> terms, ISet<BoundVar> boundVars) {
       var expr = Expr;
-      return !terms.Any(term => term.Expr.ExpressionEqModuloVariableNamesAndConstants(expr));
+      return !terms.Any(term => term.Expr.ExpressionEqModuloExpressionsNotInvolvingBoundVariables(expr, boundVars));
     }
   }
 
@@ -79,15 +85,22 @@ namespace Microsoft.Dafny.Triggers {
       return ShallowEq_Top(expr1, expr2) && TriggerUtils.SameLists(expr1.SubExpressions, expr2.SubExpressions, (e1, e2) => ExpressionEq(e1, e2));
     }
 
-    internal static bool ExpressionEqModuloVariableNamesAndConstants(this Expression expr1, Expression expr2) {
+    internal static bool ExpressionEqModuloExpressionsNotInvolvingBoundVariables(this Expression expr1, Expression expr2, ISet<BoundVar> boundVars) {
       expr1 = expr1.Resolved;
       expr2 = expr2.Resolved;
 
       if (expr1 is IdentifierExpr) {
-        return expr2 is IdentifierExpr || expr2 is LiteralExpr;
+        if (expr2 is IdentifierExpr) {
+          return true;
+        } else {
+          var freeInE2 = Translator.ComputeFreeVariables(expr2);
+          freeInE2.IntersectWith(boundVars);
+          return !freeInE2.Any();
+        }
       }
 
-      return ShallowEq_Top(expr1, expr2) && TriggerUtils.SameLists(expr1.SubExpressions, expr2.SubExpressions, (e1, e2) => ExpressionEqModuloVariableNamesAndConstants(e1, e2));
+      return ShallowEq_Top(expr1, expr2) && TriggerUtils.SameLists(expr1.SubExpressions, 
+        expr2.SubExpressions, (e1, e2) => ExpressionEqModuloExpressionsNotInvolvingBoundVariables(e1, e2, boundVars));
     }
 
     internal static bool MatchesTrigger(this Expression expr, Expression trigger, ISet<BoundVar> holes, Dictionary<IVariable, Expression> bindings) {
diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index d78bcb9e..cc3b1978 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -69,7 +69,8 @@ namespace Microsoft.Dafny.Triggers {
     internal IEnumerable<TriggerMatch> LoopingSubterms(QuantifierExpr quantifier) {
       Contract.Requires(quantifier.SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
       var matchingSubterms = this.MatchingSubterms(quantifier);
-      return matchingSubterms.Where(tm => tm.CouldCauseLoops(Terms));
+      var boundVars = new HashSet<BoundVar>(quantifier.BoundVars);
+      return matchingSubterms.Where(tm => tm.CouldCauseLoops(Terms, boundVars));
     }
 
     internal List<TriggerMatch> MatchingSubterms(QuantifierExpr quantifier) {
diff --git a/Test/triggers/loop-detection-is-not-too-strict.dfy b/Test/triggers/loop-detection-is-not-too-strict.dfy
index a5a30c81..81f764ad 100644
--- a/Test/triggers/loop-detection-is-not-too-strict.dfy
+++ b/Test/triggers/loop-detection-is-not-too-strict.dfy
@@ -7,8 +7,9 @@
 // equal to that trigger, as long as the only differences are variable
 
 predicate P(x: int, y: int)
+predicate Q(x: int)
 
-method Test() {
+method Test(z: int) {
   // P(x, y) and P(y, x) might look like they would cause a loop. Since they
   // only differ by their variables, though, they won't raise flags.
   assume forall x: int, y: int :: P(x, y) == P(y, x);
@@ -18,4 +19,22 @@ method Test() {
 
   // Contrast with the following:
   assume forall x: int, y: int :: P(x, y) == P(x, y+1);
+
+  // The following examples were made legal after an exchange where Chris
+  // pointed examples in the IronClad sources where things like this were
+  // incorrectly flagged.
+  assert forall x :: true || Q(x) || Q(0);
+  assert forall x :: true || Q(x) || Q(z);
+  assert forall x :: true || P(x, 1) || P(x, z);
+
+  // Support for the following was added following a discussion with Rustan; in
+  // the second one the expression `if z > 1 then z else 3 * z + 1` is not
+  // directly a constant expression, but it does not involve x, so it's ok:
+  assert forall x :: true || Q(x) || Q(0+1);
+  assert forall x :: true || Q(x) || Q(if z > 1 then z else 3 * z + 1);
+  // Sanity check:
+  assert forall x :: true || Q(x) || Q(if z > 1 then x else 3 * z + 1);
+
+  // WISH: It might also be good to zeta-reduce before loop detection.
+  assert forall x :: true || Q(x) || (var xx := x+1; Q(xx));
 }
diff --git a/Test/triggers/loop-detection-is-not-too-strict.dfy.expect b/Test/triggers/loop-detection-is-not-too-strict.dfy.expect
index 6f5ed3d7..705c2a8c 100644
--- a/Test/triggers/loop-detection-is-not-too-strict.dfy.expect
+++ b/Test/triggers/loop-detection-is-not-too-strict.dfy.expect
@@ -1,8 +1,17 @@
-loop-detection-is-not-too-strict.dfy(14,9): Info: Selected triggers:
+loop-detection-is-not-too-strict.dfy(15,9): Info: Selected triggers:
    {P(y, x)}, {P(x, y)}
-loop-detection-is-not-too-strict.dfy(17,9): Info: Selected triggers:
+loop-detection-is-not-too-strict.dfy(18,9): Info: Selected triggers:
    {P(y, x)}, {P(x, y)}
-loop-detection-is-not-too-strict.dfy(20,9): Warning: Selected triggers: {P(x, y)} (may loop with {P(x, y + 1)})
+loop-detection-is-not-too-strict.dfy(21,9): Warning: Selected triggers: {P(x, y)} (may loop with {P(x, y + 1)})
  (!) Suppressing loops would leave this expression without triggers.
+loop-detection-is-not-too-strict.dfy(26,9): Info: Selected triggers: {Q(x)}
+loop-detection-is-not-too-strict.dfy(27,9): Info: Selected triggers: {Q(x)}
+loop-detection-is-not-too-strict.dfy(28,9): Info: Selected triggers:
+   {P(x, z)}, {P(x, 1)}
+loop-detection-is-not-too-strict.dfy(33,9): Info: Selected triggers: {Q(x)}
+loop-detection-is-not-too-strict.dfy(34,9): Info: Selected triggers: {Q(x)}
+loop-detection-is-not-too-strict.dfy(36,9): Warning: Selected triggers: {Q(x)} (may loop with {Q(if z > 1 then x else 3 * z + 1)})
+ (!) Suppressing loops would leave this expression without triggers.
+loop-detection-is-not-too-strict.dfy(39,9): Info: Selected triggers: {Q(x)}
 
-Dafny program verifier finished with 3 verified, 0 errors
+Dafny program verifier finished with 4 verified, 0 errors
-- 
cgit v1.2.3


From 8ede9fda35767f083899940886b69f53640891c9 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 27 Aug 2015 18:59:10 -0700
Subject: Look for z3 in Binaries/z3/bin (but keep the vendored version for
 convenience)

Dafny now first looks for a z3 binary in z3/bin, and if it can't find one it
looks for one in Binaries/z3.exe (mostly for backwards-compatibility with
already set-up source installations).
---
 Binaries/z3                            | Bin 16438468 -> 0 bytes
 Source/Dafny/DafnyOptions.cs           |  37 ++++++++++++++++++++++++++++-----
 Source/Dafny/Reporting.cs              |   2 +-
 Source/DafnyDriver/DafnyDriver.cs      |  14 ++++++-------
 Source/DafnyServer/DafnyHelper.cs      |   5 ++++-
 Source/DafnyServer/Utilities.cs        |   4 ++--
 Source/DafnyServer/VerificationTask.cs |   3 +--
 7 files changed, 47 insertions(+), 18 deletions(-)
 delete mode 100755 Binaries/z3

(limited to 'Source')

diff --git a/Binaries/z3 b/Binaries/z3
deleted file mode 100755
index 7c60feb4..00000000
Binary files a/Binaries/z3 and /dev/null differ
diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index 1986ea6d..08e53d5c 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -9,8 +9,11 @@ namespace Microsoft.Dafny
 {
   public class DafnyOptions : Bpl.CommandLineOptions
   {
-    public DafnyOptions()
+    private ErrorReporter errorReporter;
+
+    public DafnyOptions(ErrorReporter errorReporter = null)
       : base("Dafny", "Dafny program verifier") {
+        this.errorReporter = errorReporter;
         SetZ3ExecutableName();
     }
 
@@ -257,13 +260,37 @@ namespace Microsoft.Dafny
       // TODO: provide attribute help here
     }
 
+    
+    /// <summary>
+    /// Dafny comes with it's own copy of z3, to save new users the trouble of having to install extra dependency. 
+    /// For this to work, Dafny makes the Z3ExecutablePath point to the path were Z3 is put by our release script.
+    /// For developers though (and people getting this from source), it's convenient to be able to run right away, 
+    /// so we vendor a Windows version.
+    /// </summary>
     private void SetZ3ExecutableName() {
       var platform = (int)System.Environment.OSVersion.Platform;
-      var isLinux = platform == 4 || platform ==  128; // http://www.mono-project.com/docs/faq/technical/
 
-      //TODO should we also vendor an OSX build?
-      var binDir = System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location);
-      Z3ExecutablePath = System.IO.Path.Combine(binDir, isLinux ? "z3" : "z3.exe");
+      // http://www.mono-project.com/docs/faq/technical/
+      var isUnix = platform == 4 || platform == 128;
+      
+      var z3binName = isUnix ? "z3" : "z3.exe";
+      var dafnyBinDir = System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location);
+      var z3BinDir = System.IO.Path.Combine(dafnyBinDir, "z3", "bin");
+      var z3BinPath = System.IO.Path.Combine(z3BinDir, z3binName);
+
+      if (!System.IO.File.Exists(z3BinPath) && !isUnix) {
+        // This is most likely a Windows user running from source without downloading z3 
+        // separately; this is ok, since we vendor z3.exe.
+        z3BinPath = System.IO.Path.Combine(dafnyBinDir, z3binName);
+      }
+      
+      if (!System.IO.File.Exists(z3BinPath) && errorReporter != null) {
+        var tok = new Bpl.Token(1, 1) { filename = "*** " };
+        errorReporter.Warning(MessageSource.Other, tok, "Could not find '{0}' in '{1}'.{2}Downloading and extracting a Z3 distribution to Dafny's 'Binaries' folder would solve this issue; for now, we'll rely on Boogie to find Z3.", 
+          z3binName, z3BinDir, System.Environment.NewLine);
+      } else {
+        Z3ExecutablePath = z3BinPath;
+      }
     }
 
     public override void Usage() {
diff --git a/Source/Dafny/Reporting.cs b/Source/Dafny/Reporting.cs
index 4cfbf20e..760392ca 100644
--- a/Source/Dafny/Reporting.cs
+++ b/Source/Dafny/Reporting.cs
@@ -143,7 +143,7 @@ namespace Microsoft.Dafny {
     }
 
     public override bool Message(MessageSource source, ErrorLevel level, IToken tok, string msg) {
-      if (base.Message(source, level, tok, msg) && (DafnyOptions.O.PrintTooltips || level != ErrorLevel.Info)) {
+      if (base.Message(source, level, tok, msg) && ((DafnyOptions.O != null && DafnyOptions.O.PrintTooltips) || level != ErrorLevel.Info)) {
         // Extra indent added to make it easier to distinguish multiline error messages for clients that rely on the CLI
         msg = msg.Replace(Environment.NewLine, Environment.NewLine + " ");
 
diff --git a/Source/DafnyDriver/DafnyDriver.cs b/Source/DafnyDriver/DafnyDriver.cs
index 4b5ae8d8..c45d66fc 100644
--- a/Source/DafnyDriver/DafnyDriver.cs
+++ b/Source/DafnyDriver/DafnyDriver.cs
@@ -40,10 +40,11 @@ namespace Microsoft.Dafny
     public static int ThreadMain(string[] args)
     {
       Contract.Requires(cce.NonNullElements(args));
-         
+
+      ErrorReporter reporter = new ConsoleErrorReporter();
       ExecutionEngine.printer = new DafnyConsolePrinter(); // For boogie errors
 
-      DafnyOptions.Install(new DafnyOptions());
+      DafnyOptions.Install(new DafnyOptions(reporter));
 
       ExitValue exitValue = ExitValue.VERIFIED;
       CommandLineOptions.Clo.RunningBoogieFromCommandLine = true;
@@ -92,7 +93,7 @@ namespace Microsoft.Dafny
           goto END;
         }
       }
-      exitValue = ProcessFiles(CommandLineOptions.Clo.Files);
+      exitValue = ProcessFiles(CommandLineOptions.Clo.Files, reporter);
 
       END:
         if (CommandLineOptions.Clo.XmlSink != null) {
@@ -112,7 +113,7 @@ namespace Microsoft.Dafny
     }
 
 
-    static ExitValue ProcessFiles(IList<string/*!*/>/*!*/ fileNames, bool lookForSnapshots = true, string programId = null)
+    static ExitValue ProcessFiles(IList<string/*!*/>/*!*/ fileNames, ErrorReporter reporter, bool lookForSnapshots = true, string programId = null)
     {
       Contract.Requires(cce.NonNullElements(fileNames));
 
@@ -128,7 +129,7 @@ namespace Microsoft.Dafny
         {
           Console.WriteLine();
           Console.WriteLine("-------------------- {0} --------------------", f);
-          var ev = ProcessFiles(new List<string> { f }, lookForSnapshots, f);
+          var ev = ProcessFiles(new List<string> { f }, reporter, lookForSnapshots, f);
           if (exitValue != ev && ev != ExitValue.VERIFIED)
           {
             exitValue = ev;
@@ -142,7 +143,7 @@ namespace Microsoft.Dafny
         var snapshotsByVersion = ExecutionEngine.LookForSnapshots(fileNames);
         foreach (var s in snapshotsByVersion)
         {
-          var ev = ProcessFiles(new List<string>(s), false, programId);
+          var ev = ProcessFiles(new List<string>(s), reporter, false, programId);
           if (exitValue != ev && ev != ExitValue.VERIFIED)
           {
             exitValue = ev;
@@ -153,7 +154,6 @@ namespace Microsoft.Dafny
       
       using (XmlFileScope xf = new XmlFileScope(CommandLineOptions.Clo.XmlSink, fileNames[fileNames.Count-1])) {
         Dafny.Program dafnyProgram;
-        ErrorReporter reporter = new ConsoleErrorReporter();
         string programName = fileNames.Count == 1 ? fileNames[0] : "the program";
         string err = Dafny.Main.ParseCheck(fileNames, programName, reporter, out dafnyProgram);
         if (err != null) {
diff --git a/Source/DafnyServer/DafnyHelper.cs b/Source/DafnyServer/DafnyHelper.cs
index 3204fdb3..e54e2b48 100644
--- a/Source/DafnyServer/DafnyHelper.cs
+++ b/Source/DafnyServer/DafnyHelper.cs
@@ -29,18 +29,21 @@ namespace Microsoft.Dafny {
   class DafnyHelper {
     private string fname;
     private string source;
+    private string[] args;
 
     private readonly Dafny.ErrorReporter reporter;
     private Dafny.Program dafnyProgram;
     private Bpl.Program boogieProgram;
 
-    public DafnyHelper(string fname, string source) {
+    public DafnyHelper(string[] args, string fname, string source) {
+      this.args = args;
       this.fname = fname;
       this.source = source;
       this.reporter = new Dafny.ConsoleErrorReporter();
     }
 
     public bool Verify() {
+      ServerUtils.ApplyArgs(args, reporter);
       return Parse() && Resolve() && Translate() && Boogie();
     }
 
diff --git a/Source/DafnyServer/Utilities.cs b/Source/DafnyServer/Utilities.cs
index 59b3abb9..5e2c6f96 100644
--- a/Source/DafnyServer/Utilities.cs
+++ b/Source/DafnyServer/Utilities.cs
@@ -43,8 +43,8 @@ namespace Microsoft.Dafny {
       }
     }
 
-    internal static void ApplyArgs(string[] args) {
-      Dafny.DafnyOptions.Install(new Dafny.DafnyOptions());
+    internal static void ApplyArgs(string[] args, ErrorReporter reporter) {
+      Dafny.DafnyOptions.Install(new Dafny.DafnyOptions(reporter));
       Dafny.DafnyOptions.O.ProverKillTime = 15; //This is just a default; it can be overriden
 
       if (CommandLineOptions.Clo.Parse(args)) {
diff --git a/Source/DafnyServer/VerificationTask.cs b/Source/DafnyServer/VerificationTask.cs
index a00688b1..eb740e70 100644
--- a/Source/DafnyServer/VerificationTask.cs
+++ b/Source/DafnyServer/VerificationTask.cs
@@ -52,8 +52,7 @@ namespace Microsoft.Dafny {
     }
 
     internal void Run() {
-      ServerUtils.ApplyArgs(args);
-      new DafnyHelper(filename, ProgramSource).Verify();
+      new DafnyHelper(args, filename, ProgramSource).Verify();
     }
   }
 }
-- 
cgit v1.2.3


From 6f2504ad3b3046dbf58a3fd2c52325d3b2009428 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Thu, 27 Aug 2015 20:51:43 -0700
Subject: Tiny cleanup in TriggersCollector

---
 Source/Dafny/Triggers/TriggersCollector.cs | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index cc3b1978..c25f65b9 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -191,8 +191,13 @@ namespace Microsoft.Dafny.Triggers {
       expr.SubExpressions.Iter(e => Annotate(e));
 
       TriggerAnnotation annotation; // TODO: Using ApplySuffix fixes the unresolved members problem in GenericSort
-      if (expr is FunctionCallExpr || expr is SeqSelectExpr || expr is MultiSelectExpr || expr is MemberSelectExpr || 
-          expr is OldExpr || expr is ApplyExpr || expr is DisplayExpression ||
+      if (expr is FunctionCallExpr || 
+          expr is SeqSelectExpr || 
+          expr is MultiSelectExpr || 
+          expr is MemberSelectExpr || 
+          expr is OldExpr || 
+          expr is ApplyExpr || 
+          expr is DisplayExpression ||
           (expr is UnaryOpExpr && (((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Cardinality)) || // FIXME || ((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Fresh doesn't work, as fresh is a pretty tricky predicate when it's not about datatypes. See translator.cs:10944
           (expr is BinaryExpr && (((BinaryExpr)expr).Op == BinaryExpr.Opcode.NotIn || ((BinaryExpr)expr).Op == BinaryExpr.Opcode.In))) {
         annotation = AnnotatePotentialCandidate(expr);
-- 
cgit v1.2.3


From 2db858bf6e72e521b49aa0ae3a993dc943b8c875 Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 28 Aug 2015 20:39:02 -0700
Subject: Implement {:nowarn}, clarify some messages, and add a few tests

---
 Source/Dafny/Triggers/QuantifiersCollection.cs     | 26 +++++++----
 Source/Dafny/Triggers/TriggerUtils.cs              | 11 +++--
 .../triggers/constructors-cause-matching-loops.dfy | 11 +++++
 .../constructors-cause-matching-loops.dfy.expect   |  6 +++
 .../function-applications-are-triggers.dfy.expect  |  4 +-
 .../loop-detection-is-not-too-strict.dfy.expect    |  8 ++--
 .../loop-detection-looks-at-ranges-too.dfy.expect  |  8 ++--
 .../loop-detection-messages--unit-tests.dfy.expect | 50 +++++++++++-----------
 ...ng-is-hard-to-decide-modulo-equality.dfy.expect |  4 +-
 .../matrix-accesses-are-triggers.dfy.expect        |  4 +-
 .../old-is-a-special-case-for-triggers.dfy.expect  | 10 ++---
 Test/triggers/regression-tests.dfy.expect          |  2 +-
 .../some-proofs-only-work-without-autoTriggers.dfy | 48 +++++++++++++++++++++
 ...roofs-only-work-without-autoTriggers.dfy.expect | 31 ++++++++++++++
 ...ot-look-like-the-triggers-they-match.dfy.expect | 16 +++----
 .../splitting-picks-the-right-tokens.dfy.expect    | 12 +++---
 ...tting-triggers-recovers-expressivity.dfy.expect | 28 ++++++------
 ...s-better-precondition-related-errors.dfy.expect | 16 +++----
 .../suppressing-warnings-behaves-properly.dfy      | 21 +++++++++
 ...uppressing-warnings-behaves-properly.dfy.expect | 14 ++++++
 .../useless-triggers-are-removed.dfy.expect        |  4 +-
 ...f-checks-use-the-original-quantifier.dfy.expect | 10 ++---
 22 files changed, 244 insertions(+), 100 deletions(-)
 create mode 100644 Test/triggers/constructors-cause-matching-loops.dfy
 create mode 100644 Test/triggers/constructors-cause-matching-loops.dfy.expect
 create mode 100644 Test/triggers/some-proofs-only-work-without-autoTriggers.dfy
 create mode 100644 Test/triggers/some-proofs-only-work-without-autoTriggers.dfy.expect
 create mode 100644 Test/triggers/suppressing-warnings-behaves-properly.dfy
 create mode 100644 Test/triggers/suppressing-warnings-behaves-properly.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifiersCollection.cs b/Source/Dafny/Triggers/QuantifiersCollection.cs
index 50458ab7..f72dab7f 100644
--- a/Source/Dafny/Triggers/QuantifiersCollection.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollection.cs
@@ -117,7 +117,7 @@ namespace Microsoft.Dafny.Triggers {
           (candidate, loopingSubterms) => !loopingSubterms.Any(),
           (candidate, loopingSubterms) => {
             looping.Add(candidate);
-            candidate.Annotation = "may loop with " + loopingSubterms.MapConcat(t => "{" + Printer.ExprToString(t.OriginalExpr) + "}", ", ");
+            candidate.Annotation = "may loop with " + loopingSubterms.MapConcat(t => "\"" + Printer.ExprToString(t.OriginalExpr) + "\"", ", ");
           }).ToList();
 
         q.CouldSuppressLoops = safe.Count > 0;
@@ -145,12 +145,14 @@ namespace Microsoft.Dafny.Triggers {
       var errorLevel = ErrorLevel.Info;
       var msg = new StringBuilder();
       var indent = addHeader ? "  " : "";
+      bool suppressWarnings = Attributes.Contains(q.quantifier.Attributes, "nowarn");
 
-      if (!TriggerUtils.NeedsAutoTriggers(q.quantifier)) { // NOTE: matchingloop, split and autotriggers attributes are passed down to Boogie
-        msg.AppendFormat("Not generating triggers for {{{0}}}.", Printer.ExprToString(q.quantifier.Term)).AppendLine(); 
+      if (!TriggerUtils.NeedsAutoTriggers(q.quantifier)) { // NOTE: split and autotriggers attributes are passed down to Boogie
+        var extraMsg = TriggerUtils.WantsAutoTriggers(q.quantifier) ? "" : " Note that {:autotriggers false} can cause instabilities. Consider using {:nowarn}, {:matchingloop} (not great either), or a manual trigger instead.";
+        msg.AppendFormat("Not generating triggers for \"{0}\".{1}", Printer.ExprToString(q.quantifier.Term), extraMsg).AppendLine(); 
       } else {
         if (addHeader) {
-          msg.AppendFormat("For expression {{{0}}}:", Printer.ExprToString(q.quantifier.Term)).AppendLine();
+          msg.AppendFormat("For expression \"{0}\":", Printer.ExprToString(q.quantifier.Term)).AppendLine();
         }
 
         foreach (var candidate in q.Candidates) {
@@ -161,20 +163,26 @@ namespace Microsoft.Dafny.Triggers {
         AddTriggersToMessage("Rejected triggers:", q.RejectedCandidates, msg, indent, true);
 
 #if QUANTIFIER_WARNINGS
-        string WARN = indent + (DafnyOptions.O.UnicodeOutput ? "⚠ " : "(!) ");
+        var WARN_TAG = DafnyOptions.O.UnicodeOutput ? "⚠ " : "/!\\ ";
+        var WARN_TAG_OVERRIDE = suppressWarnings ? "(Suppressed warning) " : WARN_TAG;
+        var WARN_LEVEL = suppressWarnings ? ErrorLevel.Info : ErrorLevel.Warning;
+        var WARN = indent + WARN_TAG_OVERRIDE;
         if (!q.CandidateTerms.Any()) {
-          errorLevel = ErrorLevel.Warning;
+          errorLevel = WARN_LEVEL;
           msg.Append(WARN).AppendLine("No terms found to trigger on.");
         } else if (!q.Candidates.Any()) {
-          errorLevel = ErrorLevel.Warning;
+          errorLevel = WARN_LEVEL;
           msg.Append(WARN).AppendLine("No trigger covering all quantified variables found.");
         } else if (!q.CouldSuppressLoops && !q.AllowsLoops) {
-          errorLevel = ErrorLevel.Warning;
+          errorLevel = WARN_LEVEL;
           msg.Append(WARN).AppendLine("Suppressing loops would leave this expression without triggers.");
+        } else if (suppressWarnings) {
+          errorLevel = ErrorLevel.Warning;
+          msg.Append(indent).Append(WARN_TAG).AppendLine("There is no warning here to suppress.");
         }
 #endif
       }
-      
+
       if (msg.Length > 0) {
         var msgStr = msg.ToString().TrimEnd("\r\n ".ToCharArray());
         reporter.Message(MessageSource.Rewriter, errorLevel, q.quantifier.tok, msgStr);
diff --git a/Source/Dafny/Triggers/TriggerUtils.cs b/Source/Dafny/Triggers/TriggerUtils.cs
index efa1f167..c16a3e44 100644
--- a/Source/Dafny/Triggers/TriggerUtils.cs
+++ b/Source/Dafny/Triggers/TriggerUtils.cs
@@ -183,14 +183,19 @@ namespace Microsoft.Dafny.Triggers {
 
     internal static bool AllowsMatchingLoops(QuantifierExpr quantifier) {
       Contract.Requires(quantifier.SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
+      // This is different from nowarn: it won't remove loops at all, even if another trigger is available.
       return Attributes.Contains(quantifier.Attributes, "matchingloop");
     }
 
-    internal static bool NeedsAutoTriggers(QuantifierExpr quantifier) {
+    internal static bool WantsAutoTriggers(QuantifierExpr quantifier) {
       Contract.Requires(quantifier.SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
       bool wantsAutoTriggers = true;
-      return !Attributes.Contains(quantifier.Attributes, "trigger") && 
-        (!Attributes.ContainsBool(quantifier.Attributes, "autotriggers", ref wantsAutoTriggers) || wantsAutoTriggers);
+      return !Attributes.ContainsBool(quantifier.Attributes, "autotriggers", ref wantsAutoTriggers) || wantsAutoTriggers;
+    }
+
+    internal static bool NeedsAutoTriggers(QuantifierExpr quantifier) {
+      Contract.Requires(quantifier.SplitQuantifier == null); // Don't call this on a quantifier with a Split clause: it's not a real quantifier
+      return !Attributes.Contains(quantifier.Attributes, "trigger") && WantsAutoTriggers(quantifier);
     }
 
     internal static BinaryExpr.ResolvedOpcode RemoveNotInBinaryExprIn(BinaryExpr.ResolvedOpcode opcode) {
diff --git a/Test/triggers/constructors-cause-matching-loops.dfy b/Test/triggers/constructors-cause-matching-loops.dfy
new file mode 100644
index 00000000..61e6a66b
--- /dev/null
+++ b/Test/triggers/constructors-cause-matching-loops.dfy
@@ -0,0 +1,11 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:1 /printTooltips "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// This file is just a small test to check that constructors do cause loops
+
+datatype Nat = Zero | Succ(x: Nat)
+function f(n: Nat): Nat
+
+method M() {
+  assert forall s :: true || f(Succ(s)) == f(s);
+}
diff --git a/Test/triggers/constructors-cause-matching-loops.dfy.expect b/Test/triggers/constructors-cause-matching-loops.dfy.expect
new file mode 100644
index 00000000..e7a671ab
--- /dev/null
+++ b/Test/triggers/constructors-cause-matching-loops.dfy.expect
@@ -0,0 +1,6 @@
+constructors-cause-matching-loops.dfy(10,9): Info: Selected triggers: {Succ(s)}
+ Rejected triggers:
+   {f(s)} (may loop with "f(Succ(s))")
+   {f(Succ(s))} (more specific than {Succ(s)})
+
+Dafny program verifier finished with 3 verified, 0 errors
diff --git a/Test/triggers/function-applications-are-triggers.dfy.expect b/Test/triggers/function-applications-are-triggers.dfy.expect
index 501cfa51..1214536d 100644
--- a/Test/triggers/function-applications-are-triggers.dfy.expect
+++ b/Test/triggers/function-applications-are-triggers.dfy.expect
@@ -1,8 +1,8 @@
 function-applications-are-triggers.dfy(9,9): Info: Selected triggers: {P.requires(f)}
-function-applications-are-triggers.dfy(10,9): Info: For expression {P(f) ==> f.requires(10)}:
+function-applications-are-triggers.dfy(10,9): Info: For expression "P(f) ==> f.requires(10)":
    Selected triggers:
      {f(10)}, {f.requires(10)}, {P(f)}
-function-applications-are-triggers.dfy(10,9): Info: For expression {P(f) ==> f(10) == 0}:
+function-applications-are-triggers.dfy(10,9): Info: For expression "P(f) ==> f(10) == 0":
    Selected triggers:
      {f(10)}, {f.requires(10)}, {P(f)}
 function-applications-are-triggers.dfy(11,9): Info: Selected triggers:
diff --git a/Test/triggers/loop-detection-is-not-too-strict.dfy.expect b/Test/triggers/loop-detection-is-not-too-strict.dfy.expect
index 705c2a8c..65ea0d79 100644
--- a/Test/triggers/loop-detection-is-not-too-strict.dfy.expect
+++ b/Test/triggers/loop-detection-is-not-too-strict.dfy.expect
@@ -2,16 +2,16 @@ loop-detection-is-not-too-strict.dfy(15,9): Info: Selected triggers:
    {P(y, x)}, {P(x, y)}
 loop-detection-is-not-too-strict.dfy(18,9): Info: Selected triggers:
    {P(y, x)}, {P(x, y)}
-loop-detection-is-not-too-strict.dfy(21,9): Warning: Selected triggers: {P(x, y)} (may loop with {P(x, y + 1)})
- (!) Suppressing loops would leave this expression without triggers.
+loop-detection-is-not-too-strict.dfy(21,9): Warning: Selected triggers: {P(x, y)} (may loop with "P(x, y + 1)")
+ /!\ Suppressing loops would leave this expression without triggers.
 loop-detection-is-not-too-strict.dfy(26,9): Info: Selected triggers: {Q(x)}
 loop-detection-is-not-too-strict.dfy(27,9): Info: Selected triggers: {Q(x)}
 loop-detection-is-not-too-strict.dfy(28,9): Info: Selected triggers:
    {P(x, z)}, {P(x, 1)}
 loop-detection-is-not-too-strict.dfy(33,9): Info: Selected triggers: {Q(x)}
 loop-detection-is-not-too-strict.dfy(34,9): Info: Selected triggers: {Q(x)}
-loop-detection-is-not-too-strict.dfy(36,9): Warning: Selected triggers: {Q(x)} (may loop with {Q(if z > 1 then x else 3 * z + 1)})
- (!) Suppressing loops would leave this expression without triggers.
+loop-detection-is-not-too-strict.dfy(36,9): Warning: Selected triggers: {Q(x)} (may loop with "Q(if z > 1 then x else 3 * z + 1)")
+ /!\ Suppressing loops would leave this expression without triggers.
 loop-detection-is-not-too-strict.dfy(39,9): Info: Selected triggers: {Q(x)}
 
 Dafny program verifier finished with 4 verified, 0 errors
diff --git a/Test/triggers/loop-detection-looks-at-ranges-too.dfy.expect b/Test/triggers/loop-detection-looks-at-ranges-too.dfy.expect
index ce62d868..a32e4a60 100644
--- a/Test/triggers/loop-detection-looks-at-ranges-too.dfy.expect
+++ b/Test/triggers/loop-detection-looks-at-ranges-too.dfy.expect
@@ -1,6 +1,6 @@
-loop-detection-looks-at-ranges-too.dfy(11,17): Warning: Selected triggers: {P(x)} (may loop with {P(x + 1)})
- (!) Suppressing loops would leave this expression without triggers.
-loop-detection-looks-at-ranges-too.dfy(13,17): Warning: Selected triggers: {P(x)} (may loop with {P(x + 1)})
- (!) Suppressing loops would leave this expression without triggers.
+loop-detection-looks-at-ranges-too.dfy(11,17): Warning: Selected triggers: {P(x)} (may loop with "P(x + 1)")
+ /!\ Suppressing loops would leave this expression without triggers.
+loop-detection-looks-at-ranges-too.dfy(13,17): Warning: Selected triggers: {P(x)} (may loop with "P(x + 1)")
+ /!\ Suppressing loops would leave this expression without triggers.
 
 Dafny program verifier finished with 3 verified, 0 errors
diff --git a/Test/triggers/loop-detection-messages--unit-tests.dfy.expect b/Test/triggers/loop-detection-messages--unit-tests.dfy.expect
index 804a0116..eba8c179 100644
--- a/Test/triggers/loop-detection-messages--unit-tests.dfy.expect
+++ b/Test/triggers/loop-detection-messages--unit-tests.dfy.expect
@@ -1,37 +1,37 @@
 loop-detection-messages--unit-tests.dfy(11,9): Info: Selected triggers: {f(f(i))}
- Rejected triggers: {f(i)} (may loop with {f(f(i))})
-loop-detection-messages--unit-tests.dfy(12,9): Warning: Selected triggers: {f(i)} (may loop with {f(i + 1)})
- (!) Suppressing loops would leave this expression without triggers.
-loop-detection-messages--unit-tests.dfy(13,9): Info: Selected triggers: {f(i)} (may loop with {f(i + 1)})
-loop-detection-messages--unit-tests.dfy(15,9): Info: For expression {false ==> f(i) == f(i + 1)}:
+ Rejected triggers: {f(i)} (may loop with "f(f(i))")
+loop-detection-messages--unit-tests.dfy(12,9): Warning: Selected triggers: {f(i)} (may loop with "f(i + 1)")
+ /!\ Suppressing loops would leave this expression without triggers.
+loop-detection-messages--unit-tests.dfy(13,9): Info: Selected triggers: {f(i)} (may loop with "f(i + 1)")
+loop-detection-messages--unit-tests.dfy(15,9): Info: For expression "false ==> f(i) == f(i + 1)":
    Selected triggers: {g(i)}
-   Rejected triggers: {f(i)} (may loop with {f(i + 1)})
-loop-detection-messages--unit-tests.dfy(15,9): Info: For expression {false ==> f(i) == g(i)}:
+   Rejected triggers: {f(i)} (may loop with "f(i + 1)")
+loop-detection-messages--unit-tests.dfy(15,9): Info: For expression "false ==> f(i) == g(i)":
    Selected triggers:
      {g(i)}, {f(i)}
-loop-detection-messages--unit-tests.dfy(16,9): Warning: For expression {false ==> f(i) == f(i + 1)}:
-   Selected triggers: {f(i)} (may loop with {f(i + 1)})
-   (!) Suppressing loops would leave this expression without triggers.
-loop-detection-messages--unit-tests.dfy(16,9): Info: For expression {false ==> f(i) == f(i)}:
+loop-detection-messages--unit-tests.dfy(16,9): Warning: For expression "false ==> f(i) == f(i + 1)":
+   Selected triggers: {f(i)} (may loop with "f(i + 1)")
+   /!\ Suppressing loops would leave this expression without triggers.
+loop-detection-messages--unit-tests.dfy(16,9): Info: For expression "false ==> f(i) == f(i)":
    Selected triggers: {f(i)}
-loop-detection-messages--unit-tests.dfy(17,9): Info: For expression {false ==> f(i) == f(i + 1)}:
-   Selected triggers: {f(i)} (may loop with {f(i + 1)})
-loop-detection-messages--unit-tests.dfy(17,9): Info: For expression {false ==> f(i) == f(i)}:
+loop-detection-messages--unit-tests.dfy(17,9): Info: For expression "false ==> f(i) == f(i + 1)":
+   Selected triggers: {f(i)} (may loop with "f(i + 1)")
+loop-detection-messages--unit-tests.dfy(17,9): Info: For expression "false ==> f(i) == f(i)":
    Selected triggers: {f(i)}
 loop-detection-messages--unit-tests.dfy(19,9): Info: Selected triggers: {f(i)}
-loop-detection-messages--unit-tests.dfy(20,9): Warning: (!) No terms found to trigger on.
-loop-detection-messages--unit-tests.dfy(21,9): Info: Not generating triggers for {false ==> f(i + 1) == 0}.
+loop-detection-messages--unit-tests.dfy(20,9): Warning: /!\ No terms found to trigger on.
+loop-detection-messages--unit-tests.dfy(21,9): Info: Not generating triggers for "false ==> f(i + 1) == 0". Note that {:autotriggers false} can cause instabilities. Consider using {:nowarn}, {:matchingloop} (not great either), or a manual trigger instead.
 loop-detection-messages--unit-tests.dfy(23,9): Info: Selected triggers: {f(j), f(i)}
-loop-detection-messages--unit-tests.dfy(24,9): Warning: (!) No trigger covering all quantified variables found.
-loop-detection-messages--unit-tests.dfy(25,9): Info: For expression {false ==> f(i) == f(i)}:
+loop-detection-messages--unit-tests.dfy(24,9): Warning: /!\ No trigger covering all quantified variables found.
+loop-detection-messages--unit-tests.dfy(25,9): Info: For expression "false ==> f(i) == f(i)":
    Selected triggers: {g(j), f(i)}
-loop-detection-messages--unit-tests.dfy(25,9): Info: For expression {false ==> g(j) == 0}:
+loop-detection-messages--unit-tests.dfy(25,9): Info: For expression "false ==> g(j) == 0":
    Selected triggers: {g(j), f(i)}
-loop-detection-messages--unit-tests.dfy(26,9): Warning: For expression {false ==> f(i) == f(i)}:
-   (!) No trigger covering all quantified variables found.
-loop-detection-messages--unit-tests.dfy(26,9): Warning: For expression {false ==> g(j + 1) == 0}:
-   (!) No trigger covering all quantified variables found.
-loop-detection-messages--unit-tests.dfy(27,9): Info: Not generating triggers for {false ==> f(i) == f(i)}.
-loop-detection-messages--unit-tests.dfy(28,9): Info: Not generating triggers for {false ==> f(i) == f(i)}.
+loop-detection-messages--unit-tests.dfy(26,9): Warning: For expression "false ==> f(i) == f(i)":
+   /!\ No trigger covering all quantified variables found.
+loop-detection-messages--unit-tests.dfy(26,9): Warning: For expression "false ==> g(j + 1) == 0":
+   /!\ No trigger covering all quantified variables found.
+loop-detection-messages--unit-tests.dfy(27,9): Info: Not generating triggers for "false ==> f(i) == f(i)". Note that {:autotriggers false} can cause instabilities. Consider using {:nowarn}, {:matchingloop} (not great either), or a manual trigger instead.
+loop-detection-messages--unit-tests.dfy(28,9): Info: Not generating triggers for "false ==> f(i) == f(i)".
 
 Dafny program verifier finished with 4 verified, 0 errors
diff --git a/Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy.expect b/Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy.expect
index 58094110..e900c1f9 100644
--- a/Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy.expect
+++ b/Test/triggers/looping-is-hard-to-decide-modulo-equality.dfy.expect
@@ -1,10 +1,10 @@
 looping-is-hard-to-decide-modulo-equality.dfy(21,9): Info: Selected triggers:
    {h(h(c, j), j)}, {h(c, i)}, {c in sc}
- Rejected triggers: {h(c, j)} (may loop with {h(h(c, j), j)})
+ Rejected triggers: {h(c, j)} (may loop with "h(h(c, j), j)")
 looping-is-hard-to-decide-modulo-equality.dfy(26,9): Info: Selected triggers: {f(x)}
  Rejected triggers: {g(f(x))} (more specific than {f(x)})
 looping-is-hard-to-decide-modulo-equality.dfy(31,9): Info: Selected triggers:
    {old(f(f(c)))}, {f(c)}, {c in sc}
- Rejected triggers: {old(f(c))} (may loop with {old(f(f(c)))})
+ Rejected triggers: {old(f(c))} (may loop with "old(f(f(c)))")
 
 Dafny program verifier finished with 9 verified, 0 errors
diff --git a/Test/triggers/matrix-accesses-are-triggers.dfy.expect b/Test/triggers/matrix-accesses-are-triggers.dfy.expect
index 35df02f5..572fc41f 100644
--- a/Test/triggers/matrix-accesses-are-triggers.dfy.expect
+++ b/Test/triggers/matrix-accesses-are-triggers.dfy.expect
@@ -1,5 +1,5 @@
-matrix-accesses-are-triggers.dfy(8,11): Warning: Selected triggers: {m[i, j]} (may loop with {m[j, i + 1]})
- (!) Suppressing loops would leave this expression without triggers.
+matrix-accesses-are-triggers.dfy(8,11): Warning: Selected triggers: {m[i, j]} (may loop with "m[j, i + 1]")
+ /!\ Suppressing loops would leave this expression without triggers.
 matrix-accesses-are-triggers.dfy(8,81): Error: index 0 out of range
 Execution trace:
     (0,0): anon0
diff --git a/Test/triggers/old-is-a-special-case-for-triggers.dfy.expect b/Test/triggers/old-is-a-special-case-for-triggers.dfy.expect
index 313d7c16..7388a911 100644
--- a/Test/triggers/old-is-a-special-case-for-triggers.dfy.expect
+++ b/Test/triggers/old-is-a-special-case-for-triggers.dfy.expect
@@ -2,14 +2,14 @@ old-is-a-special-case-for-triggers.dfy(15,10): Info: Selected triggers:
    {old(f(c))}, {c in sc}
 old-is-a-special-case-for-triggers.dfy(20,10): Info: Selected triggers:
    {old(f(f(c)))}, {f(c)}, {c in sc}
- Rejected triggers: {old(f(c))} (may loop with {old(f(f(c)))})
+ Rejected triggers: {old(f(c))} (may loop with "old(f(f(c)))")
 old-is-a-special-case-for-triggers.dfy(21,10): Info: Selected triggers:
    {f(g(c))}, {g(f(c))}, {old(f(g(c)))}, {old(g(f(c)))}, {old(f(f(c)))}, {c in sc}
  Rejected triggers:
-   {g(c)} (may loop with {g(f(c))})
-   {f(c)} (may loop with {f(g(c))})
-   {old(g(c))} (may loop with {old(g(f(c)))})
-   {old(f(c))} (may loop with {old(f(f(c)))}, {old(f(g(c)))})
+   {g(c)} (may loop with "g(f(c))")
+   {f(c)} (may loop with "f(g(c))")
+   {old(g(c))} (may loop with "old(g(f(c)))")
+   {old(f(c))} (may loop with "old(f(f(c)))", "old(f(g(c)))")
 old-is-a-special-case-for-triggers.dfy(25,10): Info: Selected triggers:
    {old(f(c))}, {f(c)}, {c in sc}
  Rejected triggers: {old(g(f(c)))} (more specific than {old(f(c))})
diff --git a/Test/triggers/regression-tests.dfy.expect b/Test/triggers/regression-tests.dfy.expect
index a03810fb..e780e966 100644
--- a/Test/triggers/regression-tests.dfy.expect
+++ b/Test/triggers/regression-tests.dfy.expect
@@ -1,3 +1,3 @@
-regression-tests.dfy(16,5): Warning: (!) No terms found to trigger on.
+regression-tests.dfy(16,5): Warning: /!\ No terms found to trigger on.
 
 Dafny program verifier finished with 2 verified, 0 errors
diff --git a/Test/triggers/some-proofs-only-work-without-autoTriggers.dfy b/Test/triggers/some-proofs-only-work-without-autoTriggers.dfy
new file mode 100644
index 00000000..98cea392
--- /dev/null
+++ b/Test/triggers/some-proofs-only-work-without-autoTriggers.dfy
@@ -0,0 +1,48 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:1 /printTooltips "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// The examples below work nicely with /autoTriggers:0, but break when we ass
+// /autoTriggers.
+
+// The issue is that the axioms for sequences are missing a number of facts,
+// which was not a problem before /autoTriggers and /stricterTriggers, but has
+// become one. Here are examples of things that Dafny won’t prove with
+// /autoTriggers (I would expect it wouldn’t with stricterTriggers either,
+// though the second example is trickier than the first):
+
+method M(a: seq<int>) {
+  if * {
+    // This fails; it needs the following axiom:
+    //   axiom (forall<T> s: Seq T ::
+    //    { Seq#Take(s, Seq#Length(s)) }
+    //    Seq#Take(s, Seq#Length(s)) == s);
+    assume forall x :: x in a ==> x > 0;
+    assert forall x :: x in a[..|a|] ==> x > 0;
+  } else if * {
+    // This fails; it needs the following axiom:
+    //   axiom (forall<T> s: Seq T, i: int ::
+    //    { Seq#Index(s, i) }
+    //    0 <= i && i < Seq#Length(s) ==>
+    //    Seq#Contains(s, Seq#Index(s, i)));
+    assume forall x :: x in a ==> x > 0;
+    assert forall i | 0 <= i < |a| ::  a[i] > 0;
+  } else if * {
+    assume |a| > 3;
+    assume forall x | x in a[..3] :: x > 1;
+    // This fails, but here it's a lot harder to know what a good axiom would be.
+    assert forall x | x in a[..2] :: x > 1;
+  }
+}
+
+
+// In the first case, the Boogie version is
+//
+//   Seq#Contains(Seq#Take(a#0, Seq#Length(a#0)), $Box(x#0_1)) ⟹ x#0_1 > 0
+//
+// And of course Z3 picks $Box(x#0_1). The third case is similar.
+//
+// The problem is of course that knowing that x ∈ a[..2] doesn’t magically give
+// you a term that matches x ∈ a[..3]. One could imagine introducing an extra
+// symbol in the translation to put x and a together for triggering purposes,
+// but that would have the same sort of issues as adding symbols for arithmetic
+// operators.
diff --git a/Test/triggers/some-proofs-only-work-without-autoTriggers.dfy.expect b/Test/triggers/some-proofs-only-work-without-autoTriggers.dfy.expect
new file mode 100644
index 00000000..d48840b8
--- /dev/null
+++ b/Test/triggers/some-proofs-only-work-without-autoTriggers.dfy.expect
@@ -0,0 +1,31 @@
+some-proofs-only-work-without-autoTriggers.dfy(19,11): Info: Selected triggers: {x in a}
+some-proofs-only-work-without-autoTriggers.dfy(20,11): Info: Selected triggers: {x in a[..|a|]}
+some-proofs-only-work-without-autoTriggers.dfy(27,11): Info: Selected triggers: {x in a}
+some-proofs-only-work-without-autoTriggers.dfy(28,11): Info: Selected triggers: {a[i]}
+some-proofs-only-work-without-autoTriggers.dfy(31,11): Info: Selected triggers: {x in a[..3]}
+some-proofs-only-work-without-autoTriggers.dfy(33,11): Info: Selected triggers: {x in a[..2]}
+some-proofs-only-work-without-autoTriggers.dfy(20,11): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+    (0,0): anon22_Then
+    (0,0): anon3
+    (0,0): anon23_Then
+    (0,0): anon5
+some-proofs-only-work-without-autoTriggers.dfy(28,11): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+    (0,0): anon25_Then
+    (0,0): anon9
+    (0,0): anon26_Then
+    (0,0): anon27_Then
+    (0,0): anon13
+some-proofs-only-work-without-autoTriggers.dfy(33,11): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+    (0,0): anon28_Then
+    (0,0): anon29_Then
+    (0,0): anon17
+    (0,0): anon30_Then
+    (0,0): anon19
+
+Dafny program verifier finished with 1 verified, 3 errors
diff --git a/Test/triggers/some-terms-do-not-look-like-the-triggers-they-match.dfy.expect b/Test/triggers/some-terms-do-not-look-like-the-triggers-they-match.dfy.expect
index f5e47454..1a143edb 100644
--- a/Test/triggers/some-terms-do-not-look-like-the-triggers-they-match.dfy.expect
+++ b/Test/triggers/some-terms-do-not-look-like-the-triggers-they-match.dfy.expect
@@ -1,10 +1,10 @@
-some-terms-do-not-look-like-the-triggers-they-match.dfy(12,17): Warning: Selected triggers: {s[x]} (may loop with {s[x + 1]})
- (!) Suppressing loops would leave this expression without triggers.
-some-terms-do-not-look-like-the-triggers-they-match.dfy(15,17): Warning: For expression {x in s ==> s[x + 1] > 0}:
-   Selected triggers: {s[x]} (may loop with {s[x + 1]})
-   (!) Suppressing loops would leave this expression without triggers.
-some-terms-do-not-look-like-the-triggers-they-match.dfy(15,17): Warning: For expression {x in s ==> x + 2 !in s}:
-   Selected triggers: {s[x]} (may loop with {x + 2 !in s})
-   (!) Suppressing loops would leave this expression without triggers.
+some-terms-do-not-look-like-the-triggers-they-match.dfy(12,17): Warning: Selected triggers: {s[x]} (may loop with "s[x + 1]")
+ /!\ Suppressing loops would leave this expression without triggers.
+some-terms-do-not-look-like-the-triggers-they-match.dfy(15,17): Warning: For expression "x in s ==> s[x + 1] > 0":
+   Selected triggers: {s[x]} (may loop with "s[x + 1]")
+   /!\ Suppressing loops would leave this expression without triggers.
+some-terms-do-not-look-like-the-triggers-they-match.dfy(15,17): Warning: For expression "x in s ==> x + 2 !in s":
+   Selected triggers: {s[x]} (may loop with "x + 2 !in s")
+   /!\ Suppressing loops would leave this expression without triggers.
 
 Dafny program verifier finished with 2 verified, 0 errors
diff --git a/Test/triggers/splitting-picks-the-right-tokens.dfy.expect b/Test/triggers/splitting-picks-the-right-tokens.dfy.expect
index af274e75..f01ed1a0 100644
--- a/Test/triggers/splitting-picks-the-right-tokens.dfy.expect
+++ b/Test/triggers/splitting-picks-the-right-tokens.dfy.expect
@@ -1,14 +1,14 @@
-splitting-picks-the-right-tokens.dfy(9,11): Info: For expression {Id(x) > 1}:
+splitting-picks-the-right-tokens.dfy(9,11): Info: For expression "Id(x) > 1":
    Selected triggers: {Id(x)}
-splitting-picks-the-right-tokens.dfy(9,11): Info: For expression {x > 2}:
+splitting-picks-the-right-tokens.dfy(9,11): Info: For expression "x > 2":
    Selected triggers: {Id(x)}
-splitting-picks-the-right-tokens.dfy(9,11): Info: For expression {x > -1}:
+splitting-picks-the-right-tokens.dfy(9,11): Info: For expression "x > -1":
    Selected triggers: {Id(x)}
-splitting-picks-the-right-tokens.dfy(16,11): Info: For expression {x > 0 ==> Id(x) > 1}:
+splitting-picks-the-right-tokens.dfy(16,11): Info: For expression "x > 0 ==> Id(x) > 1":
    Selected triggers: {Id(x)}
-splitting-picks-the-right-tokens.dfy(16,11): Info: For expression {x > 0 ==> x > 2}:
+splitting-picks-the-right-tokens.dfy(16,11): Info: For expression "x > 0 ==> x > 2":
    Selected triggers: {Id(x)}
-splitting-picks-the-right-tokens.dfy(16,11): Info: For expression {x > 0 ==> x > -1}:
+splitting-picks-the-right-tokens.dfy(16,11): Info: For expression "x > 0 ==> x > -1":
    Selected triggers: {Id(x)}
 splitting-picks-the-right-tokens.dfy(20,12): Error BP5002: A precondition for this call might not hold.
 splitting-picks-the-right-tokens.dfy(16,11): Related location: This is the precondition that might not hold.
diff --git a/Test/triggers/splitting-triggers-recovers-expressivity.dfy.expect b/Test/triggers/splitting-triggers-recovers-expressivity.dfy.expect
index 58c8dd2b..a8bb2345 100644
--- a/Test/triggers/splitting-triggers-recovers-expressivity.dfy.expect
+++ b/Test/triggers/splitting-triggers-recovers-expressivity.dfy.expect
@@ -1,32 +1,32 @@
 splitting-triggers-recovers-expressivity.dfy(12,10): Info: Selected triggers: {Q(i)}
- Rejected triggers: {P(i)} (may loop with {P(i + 1)})
+ Rejected triggers: {P(i)} (may loop with "P(i + 1)")
 splitting-triggers-recovers-expressivity.dfy(17,11): Info: Selected triggers: {Q(j)}
- Rejected triggers: {P(j)} (may loop with {P(j + 1)})
+ Rejected triggers: {P(j)} (may loop with "P(j + 1)")
 splitting-triggers-recovers-expressivity.dfy(26,10): Info: Selected triggers: {Q(i)}
- Rejected triggers: {P(i)} (may loop with {P(i + 1)})
+ Rejected triggers: {P(i)} (may loop with "P(i + 1)")
 splitting-triggers-recovers-expressivity.dfy(33,11): Info: Selected triggers: {Q(j)}
- Rejected triggers: {P(j)} (may loop with {P(j + 1)})
-splitting-triggers-recovers-expressivity.dfy(44,10): Info: For expression {P(i)}:
+ Rejected triggers: {P(j)} (may loop with "P(j + 1)")
+splitting-triggers-recovers-expressivity.dfy(44,10): Info: For expression "P(i)":
    Selected triggers:
      {Q(i)}, {P(i)}
-splitting-triggers-recovers-expressivity.dfy(44,10): Info: For expression {!Q(i)}:
+splitting-triggers-recovers-expressivity.dfy(44,10): Info: For expression "!Q(i)":
    Selected triggers:
      {Q(i)}, {P(i)}
-splitting-triggers-recovers-expressivity.dfy(44,10): Info: For expression {P(i + 1)}:
+splitting-triggers-recovers-expressivity.dfy(44,10): Info: For expression "P(i + 1)":
    Selected triggers: {Q(i)}
-   Rejected triggers: {P(i)} (may loop with {P(i + 1)})
-splitting-triggers-recovers-expressivity.dfy(49,11): Info: For expression {j >= 0 ==> P(j)}:
+   Rejected triggers: {P(i)} (may loop with "P(i + 1)")
+splitting-triggers-recovers-expressivity.dfy(49,11): Info: For expression "j >= 0 ==> P(j)":
    Selected triggers:
      {Q(j)}, {P(j)}
-splitting-triggers-recovers-expressivity.dfy(49,11): Info: For expression {j >= 0 ==> Q(j) ==> P(j + 1)}:
+splitting-triggers-recovers-expressivity.dfy(49,11): Info: For expression "j >= 0 ==> Q(j) ==> P(j + 1)":
    Selected triggers: {Q(j)}
-   Rejected triggers: {P(j)} (may loop with {P(j + 1)})
-splitting-triggers-recovers-expressivity.dfy(58,11): Info: For expression {i >= 0 ==> Q(i)}:
+   Rejected triggers: {P(j)} (may loop with "P(j + 1)")
+splitting-triggers-recovers-expressivity.dfy(58,11): Info: For expression "i >= 0 ==> Q(i)":
    Selected triggers:
      {P(i)}, {Q(i)}
-splitting-triggers-recovers-expressivity.dfy(58,11): Info: For expression {i >= 0 ==> P(i) ==> P(i + 1)}:
+splitting-triggers-recovers-expressivity.dfy(58,11): Info: For expression "i >= 0 ==> P(i) ==> P(i + 1)":
    Selected triggers:
-     {P(i)} (may loop with {P(i + 1)}), {Q(i)}
+     {P(i)} (may loop with "P(i + 1)"), {Q(i)}
 splitting-triggers-recovers-expressivity.dfy(12,63): Error BP5003: A postcondition might not hold on this return path.
 splitting-triggers-recovers-expressivity.dfy(12,10): Related location: This is the postcondition that might not hold.
 Execution trace:
diff --git a/Test/triggers/splitting-triggers-yields-better-precondition-related-errors.dfy.expect b/Test/triggers/splitting-triggers-yields-better-precondition-related-errors.dfy.expect
index c8e1a5fa..27548ac9 100644
--- a/Test/triggers/splitting-triggers-yields-better-precondition-related-errors.dfy.expect
+++ b/Test/triggers/splitting-triggers-yields-better-precondition-related-errors.dfy.expect
@@ -1,11 +1,11 @@
-splitting-triggers-yields-better-precondition-related-errors.dfy(7,11): Warning: For expression {y > 0}:
-   (!) No terms found to trigger on.
-splitting-triggers-yields-better-precondition-related-errors.dfy(7,11): Warning: For expression {y < 0}:
-   (!) No terms found to trigger on.
-splitting-triggers-yields-better-precondition-related-errors.dfy(15,11): Warning: For expression {y > 0}:
-   (!) No terms found to trigger on.
-splitting-triggers-yields-better-precondition-related-errors.dfy(15,11): Warning: For expression {y < 0}:
-   (!) No terms found to trigger on.
+splitting-triggers-yields-better-precondition-related-errors.dfy(7,11): Warning: For expression "y > 0":
+   /!\ No terms found to trigger on.
+splitting-triggers-yields-better-precondition-related-errors.dfy(7,11): Warning: For expression "y < 0":
+   /!\ No terms found to trigger on.
+splitting-triggers-yields-better-precondition-related-errors.dfy(15,11): Warning: For expression "y > 0":
+   /!\ No terms found to trigger on.
+splitting-triggers-yields-better-precondition-related-errors.dfy(15,11): Warning: For expression "y < 0":
+   /!\ No terms found to trigger on.
 splitting-triggers-yields-better-precondition-related-errors.dfy(11,3): Error BP5002: A precondition for this call might not hold.
 splitting-triggers-yields-better-precondition-related-errors.dfy(7,11): Related location: This is the precondition that might not hold.
 splitting-triggers-yields-better-precondition-related-errors.dfy(7,34): Related location
diff --git a/Test/triggers/suppressing-warnings-behaves-properly.dfy b/Test/triggers/suppressing-warnings-behaves-properly.dfy
new file mode 100644
index 00000000..237269e5
--- /dev/null
+++ b/Test/triggers/suppressing-warnings-behaves-properly.dfy
@@ -0,0 +1,21 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:1 /printTooltips "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+// This file checks that suppressing warnings works properly
+
+predicate f(x: int)
+predicate g(x: int)
+
+method M() {
+  assert forall n :: n >= 0 || n < 0;
+  assert forall n {:nowarn} :: n >= 0 || n < 0;
+  assert forall n {:autotriggers false} :: n >= 0 || n < 0;
+
+  assert forall n: nat :: (n != 0) == f(n) || true;
+  assert forall n: nat {:nowarn} :: (n != 0) == f(n) || true;
+  assert forall n: nat {:autotriggers false} :: (n != 0) == f(n) || true;
+
+  assert forall n: nat :: f(n) == f(n+1) || g(n) || true;
+  assert forall n: nat {:nowarn} :: (n != 0) == f(n) || true;
+  assert forall n: nat {:autotriggers false} :: (n != 0) == f(n) || true;
+}
diff --git a/Test/triggers/suppressing-warnings-behaves-properly.dfy.expect b/Test/triggers/suppressing-warnings-behaves-properly.dfy.expect
new file mode 100644
index 00000000..124984b1
--- /dev/null
+++ b/Test/triggers/suppressing-warnings-behaves-properly.dfy.expect
@@ -0,0 +1,14 @@
+suppressing-warnings-behaves-properly.dfy(10,9): Warning: /!\ No terms found to trigger on.
+suppressing-warnings-behaves-properly.dfy(11,9): Info: (Suppressed warning) No terms found to trigger on.
+suppressing-warnings-behaves-properly.dfy(12,9): Info: Not generating triggers for "n >= 0 || n < 0". Note that {:autotriggers false} can cause instabilities. Consider using {:nowarn}, {:matchingloop} (not great either), or a manual trigger instead.
+suppressing-warnings-behaves-properly.dfy(14,9): Info: Selected triggers: {f(n)}
+suppressing-warnings-behaves-properly.dfy(15,9): Warning: Selected triggers: {f(n)}
+ /!\ There is no warning here to suppress.
+suppressing-warnings-behaves-properly.dfy(16,9): Info: Not generating triggers for "(n != 0) == f(n) || true". Note that {:autotriggers false} can cause instabilities. Consider using {:nowarn}, {:matchingloop} (not great either), or a manual trigger instead.
+suppressing-warnings-behaves-properly.dfy(18,9): Info: Selected triggers: {g(n)}
+ Rejected triggers: {f(n)} (may loop with "f(n + 1)")
+suppressing-warnings-behaves-properly.dfy(19,9): Warning: Selected triggers: {f(n)}
+ /!\ There is no warning here to suppress.
+suppressing-warnings-behaves-properly.dfy(20,9): Info: Not generating triggers for "(n != 0) == f(n) || true". Note that {:autotriggers false} can cause instabilities. Consider using {:nowarn}, {:matchingloop} (not great either), or a manual trigger instead.
+
+Dafny program verifier finished with 4 verified, 0 errors
diff --git a/Test/triggers/useless-triggers-are-removed.dfy.expect b/Test/triggers/useless-triggers-are-removed.dfy.expect
index 2e9bbedf..d6b49a9e 100644
--- a/Test/triggers/useless-triggers-are-removed.dfy.expect
+++ b/Test/triggers/useless-triggers-are-removed.dfy.expect
@@ -5,11 +5,11 @@ useless-triggers-are-removed.dfy(16,11): Info: Selected triggers: {f(x)}
    {h(f(x))} (more specific than {f(x)})
    {g(f(x))} (more specific than {f(x)})
 useless-triggers-are-removed.dfy(20,11): Info: Selected triggers: {f(f(x))}
- Rejected triggers: {f(x)} (may loop with {f(f(x))})
+ Rejected triggers: {f(x)} (may loop with "f(f(x))")
 useless-triggers-are-removed.dfy(23,11): Info: Selected triggers:
    {g(f(x)), g(y)}, {f(y), f(x)}
  Rejected triggers:
-   {g(y), f(x)} (may loop with {g(f(y))}, {g(f(x))})
+   {g(y), f(x)} (may loop with "g(f(y))", "g(f(x))")
    {g(f(x)), g(f(y))} (more specific than {g(f(x)), f(y)}, {g(f(y)), f(x)}, {f(y), f(x)})
    {g(f(x)), f(y)} (more specific than {f(y), f(x)})
    {g(f(y)), f(x)} (more specific than {f(y), f(x)})
diff --git a/Test/triggers/wf-checks-use-the-original-quantifier.dfy.expect b/Test/triggers/wf-checks-use-the-original-quantifier.dfy.expect
index 6b152262..6c3e4853 100644
--- a/Test/triggers/wf-checks-use-the-original-quantifier.dfy.expect
+++ b/Test/triggers/wf-checks-use-the-original-quantifier.dfy.expect
@@ -1,16 +1,16 @@
-wf-checks-use-the-original-quantifier.dfy(26,11): Info: For expression {0 <= f(n)}:
+wf-checks-use-the-original-quantifier.dfy(26,11): Info: For expression "0 <= f(n)":
    Selected triggers: {f(n)}
    Rejected triggers: {P(f(n))} (more specific than {f(n)})
-wf-checks-use-the-original-quantifier.dfy(26,11): Info: For expression {P(f(n))}:
+wf-checks-use-the-original-quantifier.dfy(26,11): Info: For expression "P(f(n))":
    Selected triggers: {f(n)}
    Rejected triggers: {P(f(n))} (more specific than {f(n)})
-wf-checks-use-the-original-quantifier.dfy(27,11): Info: For expression {c != null}:
+wf-checks-use-the-original-quantifier.dfy(27,11): Info: For expression "c != null":
    Selected triggers:
      {c'.x, c.x}, {c'.x, c in s}, {c.x, c' in s}, {c' in s, c in s}
-wf-checks-use-the-original-quantifier.dfy(27,11): Info: For expression {c' != null}:
+wf-checks-use-the-original-quantifier.dfy(27,11): Info: For expression "c' != null":
    Selected triggers:
      {c'.x, c.x}, {c'.x, c in s}, {c.x, c' in s}, {c' in s, c in s}
-wf-checks-use-the-original-quantifier.dfy(27,11): Info: For expression {c.x == c'.x}:
+wf-checks-use-the-original-quantifier.dfy(27,11): Info: For expression "c.x == c'.x":
    Selected triggers:
      {c'.x, c.x}, {c'.x, c in s}, {c.x, c' in s}, {c' in s, c in s}
 
-- 
cgit v1.2.3


From 6b1085d784e3773ad9ccbae5bd6b158c97095edc Mon Sep 17 00:00:00 2001
From: Clément Pit--Claudel <clement.pitclaudel@live.com>
Date: Fri, 28 Aug 2015 22:51:32 -0700
Subject: Align the server's default kill time with the one of the VS extension

---
 Source/DafnyServer/Utilities.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/DafnyServer/Utilities.cs b/Source/DafnyServer/Utilities.cs
index 5e2c6f96..30d779e7 100644
--- a/Source/DafnyServer/Utilities.cs
+++ b/Source/DafnyServer/Utilities.cs
@@ -45,7 +45,7 @@ namespace Microsoft.Dafny {
 
     internal static void ApplyArgs(string[] args, ErrorReporter reporter) {
       Dafny.DafnyOptions.Install(new Dafny.DafnyOptions(reporter));
-      Dafny.DafnyOptions.O.ProverKillTime = 15; //This is just a default; it can be overriden
+      Dafny.DafnyOptions.O.ProverKillTime = 10; //This is just a default; it can be overriden
 
       if (CommandLineOptions.Clo.Parse(args)) {
         DafnyOptions.O.VerifySnapshots = 2; // Use caching
-- 
cgit v1.2.3


From 66281ddb041604d1c02d0356b48e38b9ac2c79dc Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Mon, 31 Aug 2015 18:20:33 -0700
Subject: Refactored most of UnifyTypes calls into a ConstrainTypes method,
 preparing for way to build up and later solve type constraints.

---
 Source/Dafny/Resolver.cs | 517 +++++++++++++++++++++++------------------------
 1 file changed, 249 insertions(+), 268 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 899d0a3d..66f8f449 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -667,13 +667,17 @@ namespace Microsoft.Dafny
     }
 
     private void ResolveModuleDefinition(ModuleDefinition m, ModuleSignature sig) {
+      Contract.Requires(AllTypeConstraints.Count == 0);
+      Contract.Ensures(AllTypeConstraints.Count == 0);
       moduleInfo = MergeSignature(sig, systemNameInfo);
       // resolve
       var datatypeDependencies = new Graph<IndDatatypeDecl>();
       var codatatypeDependencies = new Graph<CoDatatypeDecl>();
       int prevErrorCount = reporter.Count(ErrorLevel.Error);
       ResolveTopLevelDecls_Signatures(m, m.TopLevelDecls, datatypeDependencies, codatatypeDependencies);
+      Contract.Assert(AllTypeConstraints.Count == 0);  // signature resolution does not add any type constraints
       ResolveAttributes(m.Attributes, new ResolveOpts(new NoContext(m.Module), false)); // Must follow ResolveTopLevelDecls_Signatures, in case attributes refer to members
+      SolveAllTypeConstraints();  // solve any type constraints entailed by the attributes
       if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
         ResolveTopLevelDecls_Core(m.TopLevelDecls, datatypeDependencies, codatatypeDependencies);
       }
@@ -1334,7 +1338,9 @@ namespace Microsoft.Dafny
       Contract.Requires(cce.NonNullElements(datatypeDependencies));
       Contract.Requires(cce.NonNullElements(codatatypeDependencies));
       Contract.Requires(NFBC_Count == 0);
+      Contract.Requires(AllTypeConstraints.Count == 0);
       Contract.Ensures(NFBC_Count == 0);
+      Contract.Ensures(AllTypeConstraints.Count == 0);
 
       int prevErrorCount = reporter.Count(ErrorLevel.Error);
 
@@ -1363,9 +1369,8 @@ namespace Microsoft.Dafny
             ResolveType(dd.Var.tok, dd.Var.Type, dd, ResolveTypeOptionEnum.DontInfer, null);
             ResolveExpression(dd.Constraint, new ResolveOpts(dd, false, true));
             Contract.Assert(dd.Constraint.Type != null);  // follows from postcondition of ResolveExpression
-            if (!UnifyTypes(dd.Constraint.Type, Type.Bool)) {
-              reporter.Error(MessageSource.Resolver, dd.Constraint, "newtype constraint must be of type bool (instead got {0})", dd.Constraint.Type);
-            }
+            ConstrainTypes(dd.Constraint.Type, Type.Bool, dd.Constraint, "newtype constraint must be of type bool (instead got {0})", dd.Constraint.Type);
+            SolveAllTypeConstraints();
             if (!CheckTypeInference_Visitor.IsDetermined(dd.BaseType.NormalizeExpand())) {
               reporter.Error(MessageSource.Resolver, dd.tok, "newtype's base type is not fully determined; add an explicit type for '{0}'", dd.Var.Name);
             }
@@ -1376,6 +1381,7 @@ namespace Microsoft.Dafny
       }
       // Now, we're ready for the other declarations.
       foreach (TopLevelDecl d in declarations) {
+        Contract.Assert(AllTypeConstraints.Count == 0);
         if (d is TraitDecl && d.TypeArgs.Count > 0) {
           reporter.Error(MessageSource.Resolver, d, "sorry, traits with type parameters are not supported");
         }
@@ -1394,6 +1400,7 @@ namespace Microsoft.Dafny
           ResolveClassMemberBodies(cl);
         }
         allTypeParameters.PopMarker();
+        SolveAllTypeConstraints();
       }
 
       if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
@@ -1863,6 +1870,135 @@ namespace Microsoft.Dafny
       }
     }
 
+    /// <summary>
+    /// Adds the type constraint ty==expected, eventually printing the error message "msg" if this is found to be
+    /// untenable.  If this is immediately known not to be untenable, false is returned.
+    /// </summary>
+    private bool ConstrainTypes(Type ty, Type expected, TopLevelDecl declForToken, string msg, params object[] args) {
+      Contract.Requires(ty != null);
+      Contract.Requires(expected != null);
+      Contract.Requires(declForToken != null);
+      Contract.Requires(msg != null);
+      Contract.Requires(args != null);
+      return ConstrainTypes(ty, expected, declForToken.tok, msg, args);
+    }
+    /// <summary>
+    /// Adds the type constraint ty==expected, eventually printing the error message "msg" if this is found to be
+    /// untenable.  If this is immediately known not to be untenable, false is returned.
+    /// </summary>
+    private bool ConstrainTypes(Type ty, Type expected, MemberDecl declForToken, string msg, params object[] args) {
+      Contract.Requires(ty != null);
+      Contract.Requires(expected != null);
+      Contract.Requires(declForToken != null);
+      Contract.Requires(msg != null);
+      Contract.Requires(args != null);
+      return ConstrainTypes(ty, expected, declForToken.tok, msg, args);
+    }
+    /// <summary>
+    /// Adds the type constraint ty==expected, eventually printing the error message "msg" if this is found to be
+    /// untenable.  If this is immediately known not to be untenable, false is returned.
+    /// </summary>
+    private bool ConstrainTypes(Type ty, Type expected, Statement stmtForToken, string msg, params object[] args) {
+      Contract.Requires(ty != null);
+      Contract.Requires(expected != null);
+      Contract.Requires(stmtForToken != null);
+      Contract.Requires(msg != null);
+      Contract.Requires(args != null);
+      return ConstrainTypes(ty, expected, stmtForToken.Tok, msg, args);
+    }
+    /// <summary>
+    /// Adds the type constraint ty==expected, eventually printing the error message "msg" if this is found to be
+    /// untenable.  If this is immediately known not to be untenable, false is returned.
+    /// </summary>
+    private bool ConstrainTypes(Type ty, Type expected, Expression exprForToken, string msg, params object[] args) {
+      Contract.Requires(ty != null);
+      Contract.Requires(expected != null);
+      Contract.Requires(exprForToken != null);
+      Contract.Requires(msg != null);
+      Contract.Requires(args != null);
+      return ConstrainTypes(ty, expected, exprForToken.tok, msg, args);
+    }
+    /// <summary>
+    /// Adds the type constraint ty==expected, eventually printing the error message "msg" if this is found to be
+    /// untenable.  If this is immediately known not to be untenable, false is returned.
+    /// </summary>
+    private bool ConstrainTypes(Type ty, Type expected, IToken tok, string msg, params object[] args) {
+      Contract.Requires(ty != null);
+      Contract.Requires(expected != null);
+      Contract.Requires(tok != null);
+      Contract.Requires(msg != null);
+      Contract.Requires(args != null);
+#if LAZY_TYPE_CHECKING
+      var c = new TypeConstraint(ty, expected, tok, msg, args);
+      AllTypeConstraints.Add(c);
+      return true;
+#else
+      if (!UnifyTypes(ty, expected)) {
+        reporter.Error(MessageSource.Resolver, tok, msg, args);
+        return false;
+      }
+      return true;
+#endif
+    }
+
+    public List<TypeConstraint> AllTypeConstraints = new List<TypeConstraint>();
+
+    /// <summary>
+    /// Solves or simplifies as many type constraints as possible
+    /// </summary>
+    void PartiallySolveTypeConstraints() {
+      var remainingConstraints = new List<TypeConstraint>();
+      foreach (var constraint in AllTypeConstraints) {
+        if (!constraint.CheckTenable(this)) {
+          remainingConstraints.Add(constraint);
+        }
+      }
+      AllTypeConstraints = remainingConstraints;
+    }
+
+    /// <summary>
+    /// Attempts to fully solve all type constraints.  Upon success, returns "true".
+    /// Upon failure, reports errors and returns "false".
+    /// Clears all constraints.
+    /// </summary>
+    bool SolveAllTypeConstraints() {
+      PartiallySolveTypeConstraints();
+      foreach (var constraint in AllTypeConstraints) {
+        constraint.ReportAsError(reporter);
+      }
+      var success = AllTypeConstraints.Count == 0;
+      AllTypeConstraints.Clear();
+      return success;
+    }
+
+    public class TypeConstraint
+    {
+      readonly Type Ty;
+      readonly Type Expected;
+      readonly IToken Tok;
+      readonly string Msg;
+      readonly object[] MsgArgs;
+      public TypeConstraint(Type ty, Type expected, IToken tok, string msg, object[] msgArgs) {
+        Ty = ty;
+        Expected = expected;
+        Tok = tok;
+        Msg = msg;
+        MsgArgs = msgArgs;
+      }
+      /// <summary>
+      /// Returns "true" if constraint is tenable, "false" otherwise.
+      /// </summary>
+      /// <returns></returns>
+      public bool CheckTenable(Resolver resolver) {
+        Contract.Requires(resolver != null);
+        return resolver.UnifyTypes(Ty, Expected);
+      }
+      public void ReportAsError(ErrorReporter reporter) {
+        Contract.Requires(reporter != null);
+        reporter.Error(MessageSource.Resolver, Tok, Msg, MsgArgs);
+      }
+    }
+
     // ------------------------------------------------------------------------------------------------------
     // ----- Visitors ---------------------------------------------------------------------------------------
     // ------------------------------------------------------------------------------------------------------
@@ -1965,6 +2101,7 @@ namespace Microsoft.Dafny
     }
     void CheckTypeInference(Expression expr) {
       Contract.Requires(expr != null);
+      PartiallySolveTypeConstraints();
       var c = new CheckTypeInference_Visitor(this);
       c.Visit(expr);
     }
@@ -3566,9 +3703,7 @@ namespace Microsoft.Dafny
       foreach (Expression r in f.Req) {
         ResolveExpression(r, new ResolveOpts(f, false, true));
         Contract.Assert(r.Type != null);  // follows from postcondition of ResolveExpression
-        if (!UnifyTypes(r.Type, Type.Bool)) {
-          reporter.Error(MessageSource.Resolver, r, "Precondition must be a boolean (got {0})", r.Type);
-        }
+        ConstrainTypes(r.Type, Type.Bool, r, "Precondition must be a boolean (got {0})", r.Type);
       }
       foreach (FrameExpression fr in f.Reads) {
         ResolveFrameExpression(fr, true, f.IsGhost, f);
@@ -3576,9 +3711,7 @@ namespace Microsoft.Dafny
       foreach (Expression r in f.Ens) {
         ResolveExpression(r, new ResolveOpts(f, false, true));  // since this is a function, the postcondition is still a one-state predicate
         Contract.Assert(r.Type != null);  // follows from postcondition of ResolveExpression
-        if (!UnifyTypes(r.Type, Type.Bool)) {
-          reporter.Error(MessageSource.Resolver, r, "Postcondition must be a boolean (got {0})", r.Type);
-        }
+        ConstrainTypes(r.Type, Type.Bool, r, "Postcondition must be a boolean (got {0})", r.Type);
       }
       ResolveAttributes(f.Decreases.Attributes, new ResolveOpts(f, false, true));
       foreach (Expression r in f.Decreases.Expressions) {
@@ -3592,9 +3725,7 @@ namespace Microsoft.Dafny
           CheckIsNonGhost(f.Body);
         }
         Contract.Assert(f.Body.Type != null);  // follows from postcondition of ResolveExpression
-        if (!UnifyTypes(f.Body.Type, f.ResultType)) {
-          reporter.Error(MessageSource.Resolver, f, "Function body type mismatch (expected {0}, got {1})", f.ResultType, f.Body.Type);
-        }
+        ConstrainTypes(f.Body.Type, f.ResultType, f, "Function body type mismatch (expected {0}, got {1})", f.ResultType, f.Body.Type);
       }
       scope.PopMarker();
     }
@@ -3620,8 +3751,7 @@ namespace Microsoft.Dafny
       if (collType != null) {
         t = collType.Arg;
       }
-      if (!UnifyTypes(t, new ObjectType())) {
-        reporter.Error(MessageSource.Resolver, fe.E, "a {0}-clause expression must denote an object or a collection of objects (instead got {1})", readsFrame ? "reads" : "modifies", fe.E.Type);
+      if (!ConstrainTypes(t, new ObjectType(), fe.E, "a {0}-clause expression must denote an object or a collection of objects (instead got {1})", readsFrame ? "reads" : "modifies", fe.E.Type)) {
       } else if (fe.FieldName != null) {
         NonProxyType nptype;
         MemberDecl member = ResolveMember(fe.E.tok, t, fe.FieldName, out nptype);
@@ -3686,9 +3816,7 @@ namespace Microsoft.Dafny
           ResolveAttributes(e.Attributes, new ResolveOpts(m, false, true));
           ResolveExpression(e.E, new ResolveOpts(m, false, true));
           Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
-          if (!UnifyTypes(e.E.Type, Type.Bool)) {
-            reporter.Error(MessageSource.Resolver, e.E, "Precondition must be a boolean (got {0})", e.E.Type);
-          }
+          ConstrainTypes(e.E.Type, Type.Bool, e.E, "Precondition must be a boolean (got {0})", e.E.Type);
         }
         ResolveAttributes(m.Mod.Attributes, new ResolveOpts(m, false, true));
         foreach (FrameExpression fe in m.Mod.Expressions) {
@@ -3722,9 +3850,7 @@ namespace Microsoft.Dafny
           ResolveAttributes(e.Attributes, new ResolveOpts(m, true, true));
           ResolveExpression(e.E, new ResolveOpts(m, true, true));
           Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
-          if (!UnifyTypes(e.E.Type, Type.Bool)) {
-            reporter.Error(MessageSource.Resolver, e.E, "Postcondition must be a boolean (got {0})", e.E.Type);
-          }
+          ConstrainTypes(e.E.Type, Type.Bool, e.E, "Postcondition must be a boolean (got {0})", e.E.Type);
         }
 
         // Resolve body
@@ -3810,10 +3936,8 @@ namespace Microsoft.Dafny
         ResolveExpression(e, new ResolveOpts(iter, false, true));
         // any type is fine, but associate this type with the corresponding _decreases<n> field
         var d = iter.DecreasesFields[i];
-        if (!UnifyTypes(d.Type, e.Type)) {
-          // bummer, there was a use--and a bad use--of the field before, so this won't be the best of error messages
-          reporter.Error(MessageSource.Resolver, e, "type of field {0} is {1}, but has been constrained elsewhere to be of type {2}", d.Name, e.Type, d.Type);
-        }
+        // If the following type constraint does not hold, then: Bummer, there was a use--and a bad use--of the field before, so this won't be the best of error messages
+        ConstrainTypes(d.Type, e.Type, e, "type of field {0} is {1}, but has been constrained elsewhere to be of type {2}", d.Name, e.Type, d.Type);
       }
       foreach (FrameExpression fe in iter.Reads.Expressions) {
         ResolveFrameExpression(fe, true, false, iter);
@@ -3824,9 +3948,7 @@ namespace Microsoft.Dafny
       foreach (MaybeFreeExpression e in iter.Requires) {
         ResolveExpression(e.E, new ResolveOpts(iter, false, true));
         Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
-        if (!UnifyTypes(e.E.Type, Type.Bool)) {
-          reporter.Error(MessageSource.Resolver, e.E, "Precondition must be a boolean (got {0})", e.E.Type);
-        }
+        ConstrainTypes(e.E.Type, Type.Bool, e.E, "Precondition must be a boolean (got {0})", e.E.Type);
       }
 
       scope.PopMarker();  // for the in-parameters
@@ -3840,23 +3962,17 @@ namespace Microsoft.Dafny
       foreach (MaybeFreeExpression e in iter.YieldRequires) {
         ResolveExpression(e.E, new ResolveOpts(iter, false, true));
         Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
-        if (!UnifyTypes(e.E.Type, Type.Bool)) {
-          reporter.Error(MessageSource.Resolver, e.E, "Yield precondition must be a boolean (got {0})", e.E.Type);
-        }
+        ConstrainTypes(e.E.Type, Type.Bool, e.E, "Yield precondition must be a boolean (got {0})", e.E.Type);
       }
       foreach (MaybeFreeExpression e in iter.YieldEnsures) {
         ResolveExpression(e.E, new ResolveOpts(iter, true, true));
         Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
-        if (!UnifyTypes(e.E.Type, Type.Bool)) {
-          reporter.Error(MessageSource.Resolver, e.E, "Yield postcondition must be a boolean (got {0})", e.E.Type);
-        }
+        ConstrainTypes(e.E.Type, Type.Bool, e.E, "Yield postcondition must be a boolean (got {0})", e.E.Type);
       }
       foreach (MaybeFreeExpression e in iter.Ensures) {
         ResolveExpression(e.E, new ResolveOpts(iter, true, true));
         Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
-        if (!UnifyTypes(e.E.Type, Type.Bool)) {
-          reporter.Error(MessageSource.Resolver, e.E, "Postcondition must be a boolean (got {0})", e.E.Type);
-        }
+        ConstrainTypes(e.E.Type, Type.Bool, e.E, "Postcondition must be a boolean (got {0})", e.E.Type);
       }
 
       ResolveAttributes(iter.Attributes, new ResolveOpts(iter, false, true));
@@ -4715,9 +4831,7 @@ namespace Microsoft.Dafny
         s.IsGhost = true;
         ResolveExpression(s.Expr, new ResolveOpts(codeContext, true, true));
         Contract.Assert(s.Expr.Type != null);  // follows from postcondition of ResolveExpression
-        if (!UnifyTypes(s.Expr.Type, Type.Bool)) {
-          reporter.Error(MessageSource.Resolver, s.Expr, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Expr.Type);
-        }
+        ConstrainTypes(s.Expr.Type, Type.Bool, s.Expr, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Expr.Type);
 
       } else if (stmt is PrintStmt) {
         PrintStmt s = (PrintStmt)stmt;
@@ -4963,9 +5077,7 @@ namespace Microsoft.Dafny
             CheckIsNonGhost(rr.Expr);
           }
           Contract.Assert(rr.Expr.Type != null);  // follows from postcondition of ResolveExpression
-          if (!UnifyTypes(lhsType, rr.Expr.Type)) {
-            reporter.Error(MessageSource.Resolver, stmt, "RHS (of type {0}) not assignable to LHS (of type {1})", rr.Expr.Type, lhsType);
-          }
+          ConstrainTypes(lhsType, rr.Expr.Type, stmt, "RHS (of type {0}) not assignable to LHS (of type {1})", rr.Expr.Type, lhsType);
         } else if (s.Rhs is TypeRhs) {
           TypeRhs rr = (TypeRhs)s.Rhs;
           Type t = ResolveTypeRhs(rr, stmt, lvalueIsGhost, codeContext);
@@ -4981,9 +5093,7 @@ namespace Microsoft.Dafny
               }
             }
           }
-          if (!UnifyTypes(lhsType, t)) {
-            reporter.Error(MessageSource.Resolver, stmt, "type {0} is not assignable to LHS (of type {1})", t, lhsType);
-          }
+          ConstrainTypes(lhsType, t, stmt, "type {0} is not assignable to LHS (of type {1})", t, lhsType);
         } else if (s.Rhs is HavocRhs) {
           // nothing else to do
         } else {
@@ -5011,9 +5121,7 @@ namespace Microsoft.Dafny
           ResolveExpression(s.Guard, new ResolveOpts(codeContext, true, specContextOnly));
           Contract.Assert(s.Guard.Type != null);  // follows from postcondition of ResolveExpression
           bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
-          if (!UnifyTypes(s.Guard.Type, Type.Bool)) {
-            reporter.Error(MessageSource.Resolver, s.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Guard.Type);
-          }
+          ConstrainTypes(s.Guard.Type, Type.Bool, s.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Guard.Type);
           if (!specContextOnly && successfullyResolved) {
             branchesAreSpecOnly = UsesSpecFeatures(s.Guard);
           }
@@ -5045,9 +5153,7 @@ namespace Microsoft.Dafny
           Contract.Assert(s.Guard.Type != null);  // follows from postcondition of ResolveExpression
           bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
           Translator.ComputeFreeVariables(s.Guard, fvs);
-          if (!UnifyTypes(s.Guard.Type, Type.Bool)) {
-            reporter.Error(MessageSource.Resolver, s.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Guard.Type);
-          }
+          ConstrainTypes(s.Guard.Type, Type.Bool, s.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Guard.Type);
           if (!specContextOnly && successfullyResolved) {
             bodyMustBeSpecOnly = UsesSpecFeatures(s.Guard);
           }
@@ -5058,9 +5164,7 @@ namespace Microsoft.Dafny
           ResolveExpression(inv.E, new ResolveOpts(codeContext, true, true));
           Contract.Assert(inv.E.Type != null);  // follows from postcondition of ResolveExpression
           Translator.ComputeFreeVariables(inv.E, fvs);
-          if (!UnifyTypes(inv.E.Type, Type.Bool)) {
-            reporter.Error(MessageSource.Resolver, inv.E, "invariant is expected to be of type {0}, but is {1}", Type.Bool, inv.E.Type);
-          }
+          ConstrainTypes(inv.E.Type, Type.Bool, inv.E, "invariant is expected to be of type {0}, but is {1}", Type.Bool, inv.E.Type);
         }
 
         ResolveAttributes(s.Decreases.Attributes, new ResolveOpts(codeContext, true, true));
@@ -5103,9 +5207,7 @@ namespace Microsoft.Dafny
         foreach (MaybeFreeExpression inv in s.Invariants) {
           ResolveExpression(inv.E, new ResolveOpts(codeContext, true, true));
           Contract.Assert(inv.E.Type != null);  // follows from postcondition of ResolveExpression
-          if (!UnifyTypes(inv.E.Type, Type.Bool)) {
-            reporter.Error(MessageSource.Resolver, inv.E, "invariant is expected to be of type {0}, but is {1}", Type.Bool, inv.E.Type);
-          }
+          ConstrainTypes(inv.E.Type, Type.Bool, inv.E, "invariant is expected to be of type {0}, but is {1}", Type.Bool, inv.E.Type);
         }
 
         foreach (Expression e in s.Decreases.Expressions) {
@@ -5131,15 +5233,11 @@ namespace Microsoft.Dafny
         }
         ResolveExpression(s.Range, new ResolveOpts(codeContext, true, specContextOnly));
         Contract.Assert(s.Range.Type != null);  // follows from postcondition of ResolveExpression
-        if (!UnifyTypes(s.Range.Type, Type.Bool)) {
-          reporter.Error(MessageSource.Resolver, stmt, "range restriction in forall statement must be of type bool (instead got {0})", s.Range.Type);
-        }
+        ConstrainTypes(s.Range.Type, Type.Bool, stmt, "range restriction in forall statement must be of type bool (instead got {0})", s.Range.Type);
         foreach (var ens in s.Ens) {
           ResolveExpression(ens.E, new ResolveOpts(codeContext, true, true));
           Contract.Assert(ens.E.Type != null);  // follows from postcondition of ResolveExpression
-          if (!UnifyTypes(ens.E.Type, Type.Bool)) {
-            reporter.Error(MessageSource.Resolver, ens.E, "ensures condition is expected to be of type {0}, but is {1}", Type.Bool, ens.E.Type);
-          }
+          ConstrainTypes(ens.E.Type, Type.Bool, ens.E, "ensures condition is expected to be of type {0}, but is {1}", Type.Bool, ens.E.Type);
         }
         // Since the range and postconditions are more likely to infer the types of the bound variables, resolve them
         // first (above) and only then resolve the attributes (below).
@@ -5232,8 +5330,7 @@ namespace Microsoft.Dafny
               var e1 = s.Lines[i];
               ResolveExpression(e1, new ResolveOpts(codeContext, true, true));
               Contract.Assert(e1.Type != null);  // follows from postcondition of ResolveExpression
-              if (!UnifyTypes(e0.Type, e1.Type)) {
-                reporter.Error(MessageSource.Resolver, e1, "all lines in a calculation must have the same type (got {0} after {1})", e1.Type, e0.Type);
+              if (!ConstrainTypes(e0.Type, e1.Type, e1, "all lines in a calculation must have the same type (got {0} after {1})", e1.Type, e0.Type)) {
               } else {
                 var step = s.StepOps[i - 1].StepExpr(e0, e1); // Use custom line operator
                 ResolveExpression(step, new ResolveOpts(codeContext, true, true));
@@ -5354,16 +5451,14 @@ namespace Microsoft.Dafny
             if (ctor != null && i < ctor.Formals.Count) {
               Formal formal = ctor.Formals[i];
               Type st = SubstType(formal.Type, subst);
-              if (!UnifyTypes(v.Type, st)) {
-                reporter.Error(MessageSource.Resolver, stmt, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
-              }
+              ConstrainTypes(v.Type, st, stmt, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
               v.IsGhost = formal.IsGhost;
 
               // update the type of the boundvars in the MatchCaseToken
               if (v.tok is MatchCaseToken) {
                 MatchCaseToken mt = (MatchCaseToken)v.tok;
                 foreach (Tuple<IToken, BoundVar, bool> entry in mt.varList) {
-                  UnifyTypes(entry.Item2.Type, v.Type);
+                  UnifyTypes(entry.Item2.Type, v.Type);  // TODO: What if this unification fails? Can it?  --KRML
                 }
               }
             }
@@ -5961,9 +6056,7 @@ namespace Microsoft.Dafny
       s.IsGhost = s.Lhss.TrueForAll(AssignStmt.LhsIsToGhost);
       var ec = reporter.Count(ErrorLevel.Error);
       ResolveExpression(s.Expr, new ResolveOpts(codeContext, true, specContextOnly));
-      if (!UnifyTypes(s.Expr.Type, Type.Bool)) {
-        reporter.Error(MessageSource.Resolver, s.Expr, "type of RHS of assign-such-that statement must be boolean (got {0})", s.Expr.Type);
-      }
+      ConstrainTypes(s.Expr.Type, Type.Bool, s.Expr, "type of RHS of assign-such-that statement must be boolean (got {0})", s.Expr.Type);
       if (ec == reporter.Count(ErrorLevel.Error) && !s.IsGhost && s.AssumeToken == null && !specContextOnly) {
         CheckIsNonGhost(s.Expr);
 
@@ -5990,9 +6083,7 @@ namespace Microsoft.Dafny
         ResolveExpression(alternative.Guard, new ResolveOpts(codeContext, true, specContextOnly));
         Contract.Assert(alternative.Guard.Type != null);  // follows from postcondition of ResolveExpression
         bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
-        if (!UnifyTypes(alternative.Guard.Type, Type.Bool)) {
-          reporter.Error(MessageSource.Resolver, alternative.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, alternative.Guard.Type);
-        }
+        ConstrainTypes(alternative.Guard.Type, Type.Bool, alternative.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, alternative.Guard.Type);
         if (!specContextOnly && successfullyResolved) {
           isGhost = isGhost || UsesSpecFeatures(alternative.Guard);
         }
@@ -6082,15 +6173,12 @@ namespace Microsoft.Dafny
         // type check the arguments
         for (int i = 0; i < callee.Ins.Count; i++) {
           Type st = SubstType(callee.Ins[i].Type, s.MethodSelect.TypeArgumentSubstitutions());
-          if (!UnifyTypes(cce.NonNull(s.Args[i].Type), st)) {
-            reporter.Error(MessageSource.Resolver, s, "incorrect type of method in-parameter {0} (expected {1}, got {2})", i, st, s.Args[i].Type);
-          }
+          ConstrainTypes(s.Args[i].Type, st, s, "incorrect type of method in-parameter {0} (expected {1}, got {2})", i, st, s.Args[i].Type);
         }
         for (int i = 0; i < callee.Outs.Count; i++) {
           Type st = SubstType(callee.Outs[i].Type, s.MethodSelect.TypeArgumentSubstitutions());
           var lhs = s.Lhs[i];
-          if (!UnifyTypes(cce.NonNull(lhs.Type), st)) {
-            reporter.Error(MessageSource.Resolver, s, "incorrect type of method out-parameter {0} (expected {1}, got {2})", i, st, lhs.Type);
+          if (!ConstrainTypes(lhs.Type, st, s, "incorrect type of method out-parameter {0} (expected {1}, got {2})", i, st, lhs.Type)) {
           } else {
             var resolvedLhs = lhs.Resolved;
             if (!specContextOnly && (s.IsGhost || callee.Outs[i].IsGhost)) {
@@ -6164,9 +6252,7 @@ namespace Microsoft.Dafny
         }
       } else if (lhs is SeqSelectExpr) {
         var ll = (SeqSelectExpr)lhs;
-        if (!UnifyTypes(ll.Seq.Type, ResolvedArrayType(ll.Seq.tok, 1, new InferredTypeProxy(), codeContext))) {
-          reporter.Error(MessageSource.Resolver, ll.Seq, "LHS of array assignment must denote an array element (found {0})", ll.Seq.Type);
-        }
+        ConstrainTypes(ll.Seq.Type, ResolvedArrayType(ll.Seq.tok, 1, new InferredTypeProxy(), codeContext), ll.Seq, "LHS of array assignment must denote an array element (found {0})", ll.Seq.Type);
         if (!ll.SelectOne) {
           reporter.Error(MessageSource.Resolver, ll.Seq, "cannot assign to a range of array elements (try the 'forall' statement)");
         }
@@ -6490,9 +6576,7 @@ namespace Microsoft.Dafny
           foreach (Expression dim in rr.ArrayDimensions) {
             Contract.Assert(dim != null);
             ResolveExpression(dim, new ResolveOpts(codeContext, true));
-            if (!UnifyTypes(dim.Type, new OperationTypeProxy(true, false, false, false, false, false))) {
-              reporter.Error(MessageSource.Resolver, stmt, "new must use an integer-based expression for the array size (got {0} for index {1})", dim.Type, i);
-            }
+            ConstrainTypes(dim.Type, new OperationTypeProxy(true, false, false, false, false, false), stmt, "new must use an integer-based expression for the array size (got {0} for index {1})", dim.Type, i);
             i++;
           }
           rr.Type = ResolvedArrayType(stmt.Tok, rr.ArrayDimensions.Count, rr.EType, codeContext);
@@ -6574,6 +6658,8 @@ namespace Microsoft.Dafny
       Contract.Requires(memberName != null);
       Contract.Ensures(Contract.Result<MemberDecl>() == null || Contract.ValueAtReturn(out nptype) != null);
 
+      PartiallySolveTypeConstraints();  // so that we can try to pick up the type of the receiver
+
       nptype = null;  // prepare for the worst
       receiverType = receiverType.NormalizeExpand();
       var opProxy = receiverType as OperationTypeProxy;
@@ -6965,9 +7051,7 @@ namespace Microsoft.Dafny
         foreach (Expression ee in e.Elements) {
           ResolveExpression(ee, opts);
           Contract.Assert(ee.Type != null);  // follows from postcondition of ResolveExpression
-          if (!UnifyTypes(elementType, ee.Type)) {
-            reporter.Error(MessageSource.Resolver, ee, "All elements of display must be of the same type (got {0}, but type of previous elements is {1})", ee.Type, elementType);
-          }
+          ConstrainTypes(elementType, ee.Type, ee, "All elements of display must be of the same type (got {0}, but type of previous elements is {1})", ee.Type, elementType);
         }
         if (expr is SetDisplayExpr) {
           var se = (SetDisplayExpr)expr;
@@ -6984,14 +7068,10 @@ namespace Microsoft.Dafny
         foreach (ExpressionPair p in e.Elements) {
           ResolveExpression(p.A, opts);
           Contract.Assert(p.A.Type != null);  // follows from postcondition of ResolveExpression
-          if (!UnifyTypes(domainType, p.A.Type)) {
-            reporter.Error(MessageSource.Resolver, p.A, "All elements of display must be of the same type (got {0}, but type of previous elements is {1})", p.A.Type, domainType);
-          }
+          ConstrainTypes(domainType, p.A.Type, p.A, "All elements of display must be of the same type (got {0}, but type of previous elements is {1})", p.A.Type, domainType);
           ResolveExpression(p.B, opts);
           Contract.Assert(p.B.Type != null);  // follows from postcondition of ResolveExpression
-          if (!UnifyTypes(rangeType, p.B.Type)) {
-            reporter.Error(MessageSource.Resolver, p.B, "All elements of display must be of the same type (got {0}, but type of previous elements is {1})", p.B.Type, rangeType);
-          }
+          ConstrainTypes(rangeType, p.B.Type, p.B, "All elements of display must be of the same type (got {0}, but type of previous elements is {1})", p.B.Type, rangeType);
         }
         expr.Type = new MapType(e.Finite, domainType, rangeType);
       } else if (expr is NameSegment) {
@@ -7074,17 +7154,13 @@ namespace Microsoft.Dafny
         ResolveExpression(e.Array, opts);
         Contract.Assert(e.Array.Type != null);  // follows from postcondition of ResolveExpression
         Type elementType = new InferredTypeProxy();
-        if (!UnifyTypes(e.Array.Type, ResolvedArrayType(e.Array.tok, e.Indices.Count, elementType, opts.codeContext))) {
-          reporter.Error(MessageSource.Resolver, e.Array, "array selection requires an array{0} (got {1})", e.Indices.Count, e.Array.Type);
-        }
+        ConstrainTypes(e.Array.Type, ResolvedArrayType(e.Array.tok, e.Indices.Count, elementType, opts.codeContext), e.Array, "array selection requires an array{0} (got {1})", e.Indices.Count, e.Array.Type);
         int i = 0;
         foreach (Expression idx in e.Indices) {
           Contract.Assert(idx != null);
           ResolveExpression(idx, opts);
           Contract.Assert(idx.Type != null);  // follows from postcondition of ResolveExpression
-          if (!UnifyTypes(idx.Type, new OperationTypeProxy(true, false, false, false, false, false))) {
-            reporter.Error(MessageSource.Resolver, idx, "array selection requires integer-based numeric indices (got {0} for index {1})", idx.Type, i);
-          }
+          ConstrainTypes(idx.Type, new OperationTypeProxy(true, false, false, false, false, false), idx, "array selection requires integer-based numeric indices (got {0} for index {1})", idx.Type, i);
           i++;
         }
         e.Type = elementType;
@@ -7099,44 +7175,28 @@ namespace Microsoft.Dafny
         if (UnifyTypes(e.Seq.Type, new SeqType(elementType))) {
           ResolveExpression(e.Index, opts);
           Contract.Assert(e.Index.Type != null);  // follows from postcondition of ResolveExpression
-          if (!UnifyTypes(e.Index.Type, Type.Int)) {
-            reporter.Error(MessageSource.Resolver, e.Index, "sequence update requires integer index (got {0})", e.Index.Type);
-          }
+          ConstrainTypes(e.Index.Type, Type.Int, e.Index, "sequence update requires integer index (got {0})", e.Index.Type);
           ResolveExpression(e.Value, opts);
           Contract.Assert(e.Value.Type != null);  // follows from postcondition of ResolveExpression
-          if (!UnifyTypes(e.Value.Type, elementType)) {
-            reporter.Error(MessageSource.Resolver, e.Value, "sequence update requires the value to have the element type of the sequence (got {0})", e.Value.Type);
-          }
+          ConstrainTypes(e.Value.Type, elementType, e.Value, "sequence update requires the value to have the element type of the sequence (got {0})", e.Value.Type);
           expr.Type = e.Seq.Type;
         } else if (UnifyTypes(e.Seq.Type, new MapType(true, domainType, rangeType))) {
           ResolveExpression(e.Index, opts);
-          if (!UnifyTypes(e.Index.Type, domainType)) {
-            reporter.Error(MessageSource.Resolver, e.Index, "map update requires domain element to be of type {0} (got {1})", domainType, e.Index.Type);
-          }
+          ConstrainTypes(e.Index.Type, domainType, e.Index, "map update requires domain element to be of type {0} (got {1})", domainType, e.Index.Type);
           ResolveExpression(e.Value, opts);
-          if (!UnifyTypes(e.Value.Type, rangeType)) {
-            reporter.Error(MessageSource.Resolver, e.Value, "map update requires the value to have the range type {0} (got {1})", rangeType, e.Value.Type);
-          }
+          ConstrainTypes(e.Value.Type, rangeType, e.Value, "map update requires the value to have the range type {0} (got {1})", rangeType, e.Value.Type);
           expr.Type = e.Seq.Type;
         } else if (UnifyTypes(e.Seq.Type, new MapType(false, domainType, rangeType))) {
           ResolveExpression(e.Index, opts);
-          if (!UnifyTypes(e.Index.Type, domainType)) {
-            reporter.Error(MessageSource.Resolver, e.Index, "imap update requires domain element to be of type {0} (got {1})", domainType, e.Index.Type);
-          }
+          ConstrainTypes(e.Index.Type, domainType, e.Index, "imap update requires domain element to be of type {0} (got {1})", domainType, e.Index.Type);
           ResolveExpression(e.Value, opts);
-          if (!UnifyTypes(e.Value.Type, rangeType)) {
-            reporter.Error(MessageSource.Resolver, e.Value, "imap update requires the value to have the range type {0} (got {1})", rangeType, e.Value.Type);
-          }
+          ConstrainTypes(e.Value.Type, rangeType, e.Value, "imap update requires the value to have the range type {0} (got {1})", rangeType, e.Value.Type);
           expr.Type = e.Seq.Type;
         } else if (UnifyTypes(e.Seq.Type, new MultiSetType(elementType))) {
           ResolveExpression(e.Index, opts);
-          if (!UnifyTypes(e.Index.Type, elementType)) {
-            reporter.Error(MessageSource.Resolver, e.Index, "multiset update requires domain element to be of type {0} (got {1})", elementType, e.Index.Type);
-          }
+          ConstrainTypes(e.Index.Type, elementType, e.Index, "multiset update requires domain element to be of type {0} (got {1})", elementType, e.Index.Type);
           ResolveExpression(e.Value, opts);
-          if (!UnifyTypes(e.Value.Type, new OperationTypeProxy(true, false, false, false, false, false))) {
-            reporter.Error(MessageSource.Resolver, e.Value, "multiset update requires integer-based numeric value (got {0})", e.Value.Type);
-          }
+          ConstrainTypes(e.Value.Type, new OperationTypeProxy(true, false, false, false, false, false), e.Value, "multiset update requires integer-based numeric value (got {0})", e.Value.Type);
           expr.Type = e.Seq.Type;
 
         } else if (e.Seq.Type.IsDatatype) {
@@ -7243,9 +7303,7 @@ namespace Microsoft.Dafny
           reporter.Error(MessageSource.Resolver, e.tok, "wrong number of arguments to function application (function type '{0}' expects {1}, got {2})", fnType, fnType.Arity, e.Args.Count);
         } else {
           for (var i = 0; i < fnType.Arity; i++) {
-            if (!UnifyTypes(fnType.Args[i], e.Args[i].Type)) {
-              reporter.Error(MessageSource.Resolver, e.Args[i].tok, "type mismatch for argument {0} (function expects {1}, got {2})", i, fnType.Args[i], e.Args[i].Type);
-            }
+            ConstrainTypes(fnType.Args[i], e.Args[i].Type, e.Args[i].tok, "type mismatch for argument {0} (function expects {1}, got {2})", i, fnType.Args[i], e.Args[i].Type);
           }
         }
         expr.Type = fnType == null ? new InferredTypeProxy() : fnType.Result;
@@ -7272,15 +7330,11 @@ namespace Microsoft.Dafny
         Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
         switch (e.Op) {
           case UnaryOpExpr.Opcode.Not:
-            if (!UnifyTypes(e.E.Type, Type.Bool)) {
-              reporter.Error(MessageSource.Resolver, expr, "logical negation expects a boolean argument (instead got {0})", e.E.Type);
-            }
+            ConstrainTypes(e.E.Type, Type.Bool, expr, "logical negation expects a boolean argument (instead got {0})", e.E.Type);
             expr.Type = Type.Bool;
             break;
           case UnaryOpExpr.Opcode.Cardinality:
-            if (!UnifyTypes(e.E.Type, new CollectionTypeProxy(new InferredTypeProxy(), false, false))) {
-              reporter.Error(MessageSource.Resolver, expr, "size operator expects a collection argument (instead got {0})", e.E.Type);
-            }
+            ConstrainTypes(e.E.Type, new CollectionTypeProxy(new InferredTypeProxy(), false, false), expr, "size operator expects a collection argument (instead got {0})", e.E.Type);
             expr.Type = Type.Int;
             break;
           case UnaryOpExpr.Opcode.Fresh:
@@ -7313,13 +7367,9 @@ namespace Microsoft.Dafny
         ResolveType(e.tok, e.ToType, opts.codeContext, new ResolveTypeOption(ResolveTypeOptionEnum.DontInfer), null);
         ResolveExpression(e.E, opts);
         if (e.ToType.IsNumericBased(Type.NumericPersuation.Int)) {
-          if (!UnifyTypes(e.E.Type, new OperationTypeProxy(true, true, false, false, false, false))) {
-            reporter.Error(MessageSource.Resolver, expr, "type conversion to an int-based type is allowed only from numeric types (got {0})", e.E.Type);
-          }
+          ConstrainTypes(e.E.Type, new OperationTypeProxy(true, true, false, false, false, false), expr, "type conversion to an int-based type is allowed only from numeric types (got {0})", e.E.Type);
         } else if (e.ToType.IsNumericBased(Type.NumericPersuation.Real)) {
-          if (!UnifyTypes(e.E.Type, new OperationTypeProxy(true, true, false, false, false, false))) {
-            reporter.Error(MessageSource.Resolver, expr, "type conversion to a real-based type is allowed only from numeric types (got {0})", e.E.Type);
-          }
+          ConstrainTypes(e.E.Type, new OperationTypeProxy(true, true, false, false, false, false), expr, "type conversion to a real-based type is allowed only from numeric types (got {0})", e.E.Type);
         } else {
           reporter.Error(MessageSource.Resolver, expr, "type conversions are not supported to this type (got {0})", e.ToType);
         }
@@ -7337,12 +7387,8 @@ namespace Microsoft.Dafny
           case BinaryExpr.Opcode.Exp:
           case BinaryExpr.Opcode.And:
           case BinaryExpr.Opcode.Or:
-            if (!UnifyTypes(e.E0.Type, Type.Bool)) {
-              reporter.Error(MessageSource.Resolver, expr, "first argument to {0} must be of type bool (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type);
-            }
-            if (!UnifyTypes(e.E1.Type, Type.Bool)) {
-              reporter.Error(MessageSource.Resolver, expr, "second argument to {0} must be of type bool (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E1.Type);
-            }
+            ConstrainTypes(e.E0.Type, Type.Bool, expr, "first argument to {0} must be of type bool (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type);
+            ConstrainTypes(e.E1.Type, Type.Bool, expr, "second argument to {0} must be of type bool (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E1.Type);
             expr.Type = Type.Bool;
             break;
 
@@ -7369,9 +7415,7 @@ namespace Microsoft.Dafny
 
           case BinaryExpr.Opcode.Disjoint:
             // TODO: the error messages are backwards from what (ideally) they should be. this is necessary because UnifyTypes can't backtrack.
-            if (!UnifyTypes(e.E0.Type, e.E1.Type)) {
-              reporter.Error(MessageSource.Resolver, expr, "arguments must have the same type (got {0} and {1})", e.E0.Type, e.E1.Type);
-            }
+            ConstrainTypes(e.E0.Type, e.E1.Type, expr, "arguments must have the same type (got {0} and {1})", e.E0.Type, e.E1.Type);
             if (!UnifyTypes(e.E0.Type, new SetType(true, new InferredTypeProxy())) &&
                 !UnifyTypes(e.E0.Type, new MultiSetType(new InferredTypeProxy())) &&
                 !UnifyTypes(e.E0.Type, new MapType(true, new InferredTypeProxy(), new InferredTypeProxy()))) {
@@ -7384,34 +7428,25 @@ namespace Microsoft.Dafny
           case BinaryExpr.Opcode.Le:
           case BinaryExpr.Opcode.Add: {
               if (e.Op == BinaryExpr.Opcode.Lt && (e.E0.Type.NormalizeExpand().IsIndDatatype || e.E0.Type.IsTypeParameter)) {
-                if (UnifyTypes(e.E1.Type, new DatatypeProxy(false, false))) {
+                if (ConstrainTypes(e.E1.Type, new DatatypeProxy(false, false), expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E1.Type)) {
                   e.ResolvedOp = BinaryExpr.ResolvedOpcode.RankLt;
-                } else {
-                  reporter.Error(MessageSource.Resolver, expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E1.Type);
                 }
                 expr.Type = Type.Bool;
               } else if (e.Op == BinaryExpr.Opcode.Lt && e.E1.Type.NormalizeExpand().IsIndDatatype) {
-                if (UnifyTypes(e.E0.Type, new DatatypeProxy(false, true))) {
+                if (ConstrainTypes(e.E0.Type, new DatatypeProxy(false, true), expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E0.Type)) {
                   e.ResolvedOp = BinaryExpr.ResolvedOpcode.RankLt;
-                } else {
-                  reporter.Error(MessageSource.Resolver, expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E0.Type);
                 }
                 expr.Type = Type.Bool;
               } else {
-                bool err = false;
                 bool isComparison = e.Op != BinaryExpr.Opcode.Add;
-                if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, true, isComparison, true, true, true))) {
-                  reporter.Error(MessageSource.Resolver, expr, "arguments to {0} must be of a numeric type{2} or a collection type (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type,
-                    isComparison ? ", char," : "");
-                  err = true;
-                }
-                if (!UnifyTypes(e.E1.Type, e.E0.Type)) {
-                  reporter.Error(MessageSource.Resolver, expr, "arguments to {0} must have the same type (got {1} and {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
-                  err = true;
-                }
+                var good0 = ConstrainTypes(e.E0.Type, new OperationTypeProxy(true, true, isComparison, true, true, true),
+                  expr, "arguments to {0} must be of a numeric type{2} or a collection type (instead got {1})",
+                  BinaryExpr.OpcodeString(e.Op), e.E0.Type, isComparison ? ", char," : "");
+                var good1 = ConstrainTypes(e.E1.Type, e.E0.Type,
+                  expr, "arguments to {0} must have the same type (got {1} and {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
                 if (isComparison) {
                   expr.Type = Type.Bool;
-                } else if (!err) {
+                } else if (good0 && good1) {
                   expr.Type = e.E0.Type;
                 }
               }
@@ -7423,34 +7458,24 @@ namespace Microsoft.Dafny
           case BinaryExpr.Opcode.Gt:
           case BinaryExpr.Opcode.Ge: {
               if (e.Op == BinaryExpr.Opcode.Gt && e.E0.Type.NormalizeExpand().IsIndDatatype) {
-                if (UnifyTypes(e.E1.Type, new DatatypeProxy(false, true))) {
+                if (ConstrainTypes(e.E1.Type, new DatatypeProxy(false, true), expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E1.Type)) {
                   e.ResolvedOp = BinaryExpr.ResolvedOpcode.RankGt;
-                } else {
-                  reporter.Error(MessageSource.Resolver, expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E1.Type);
                 }
                 expr.Type = Type.Bool;
               } else if (e.Op == BinaryExpr.Opcode.Gt && (e.E1.Type.NormalizeExpand().IsIndDatatype || e.E1.Type.IsTypeParameter)) {
-                if (UnifyTypes(e.E0.Type, new DatatypeProxy(false, false))) {
+                if (ConstrainTypes(e.E0.Type, new DatatypeProxy(false, false), expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E0.Type)) {
                   e.ResolvedOp = BinaryExpr.ResolvedOpcode.RankGt;
-                } else {
-                  reporter.Error(MessageSource.Resolver, expr, "arguments to rank comparison must be datatypes (instead of {0})", e.E0.Type);
                 }
                 expr.Type = Type.Bool;
               } else {
-                bool err = false;
                 bool isComparison = e.Op == BinaryExpr.Opcode.Gt || e.Op == BinaryExpr.Opcode.Ge;
-                if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, true, isComparison, false, true, true))) {
-                  reporter.Error(MessageSource.Resolver, expr, "arguments to {0} must be of a numeric type{2} or a set type (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type,
-                    isComparison ? ", char, " : "");
-                  err = true;
-                }
-                if (!UnifyTypes(e.E1.Type, e.E0.Type)) {
-                  reporter.Error(MessageSource.Resolver, expr, "arguments to {0} must have the same type (got {1} and {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
-                  err = true;
-                }
+                var good0 = ConstrainTypes(e.E0.Type, new OperationTypeProxy(true, true, isComparison, false, true, true),
+                  expr, "arguments to {0} must be of a numeric type{2} or a set type (instead got {1})",
+                  BinaryExpr.OpcodeString(e.Op), e.E0.Type, isComparison ? ", char, " : "");
+                var good1 = ConstrainTypes(e.E1.Type, e.E0.Type, expr, "arguments to {0} must have the same type (got {1} and {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
                 if (isComparison) {
                   expr.Type = Type.Bool;
-                } else if (!err) {
+                } else if (good0 && good1) {
                   expr.Type = e.E0.Type;
                 }
               }
@@ -7459,29 +7484,23 @@ namespace Microsoft.Dafny
 
           case BinaryExpr.Opcode.In:
           case BinaryExpr.Opcode.NotIn:
-            if (!UnifyTypes(e.E1.Type, new CollectionTypeProxy(e.E0.Type, true, true))) {
-              reporter.Error(MessageSource.Resolver, expr, "second argument to \"{0}\" must be a set, multiset, or sequence with elements of type {1}, or a map with domain {1} (instead got {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
-            }
+            ConstrainTypes(e.E1.Type, new CollectionTypeProxy(e.E0.Type, true, true), expr, "second argument to \"{0}\" must be a set, multiset, or sequence with elements of type {1}, or a map with domain {1} (instead got {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
             expr.Type = Type.Bool;
             break;
 
           case BinaryExpr.Opcode.Div:
-            if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, true, false, false, false, false))) {
-              reporter.Error(MessageSource.Resolver, expr, "first argument to {0} must be of numeric type (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type);
-            }
-            if (!UnifyTypes(e.E1.Type, e.E0.Type)) {
-              reporter.Error(MessageSource.Resolver, expr, "arguments to {0} must have the same type (got {1} and {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
-            }
+            ConstrainTypes(e.E0.Type, new OperationTypeProxy(true, true, false, false, false, false),
+              expr, "first argument to {0} must be of numeric type (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type);
+            ConstrainTypes(e.E1.Type, e.E0.Type,
+              expr, "arguments to {0} must have the same type (got {1} and {2})", BinaryExpr.OpcodeString(e.Op), e.E0.Type, e.E1.Type);
             expr.Type = e.E0.Type;
             break;
 
           case BinaryExpr.Opcode.Mod:
-            if (!UnifyTypes(e.E0.Type, new OperationTypeProxy(true, false, false, false, false, false))) {
-              reporter.Error(MessageSource.Resolver, expr, "first argument to {0} must be of type int (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type);
-            }
-            if (!UnifyTypes(e.E1.Type, e.E0.Type)) {
-              reporter.Error(MessageSource.Resolver, expr, "second argument to {0} must be of type int (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E1.Type);
-            }
+            ConstrainTypes(e.E0.Type, new OperationTypeProxy(true, false, false, false, false, false),
+              expr, "first argument to {0} must be of type int (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E0.Type);
+            ConstrainTypes(e.E1.Type, e.E0.Type,
+              expr, "second argument to {0} must be of type int (instead got {1})", BinaryExpr.OpcodeString(e.Op), e.E1.Type);
             expr.Type = e.E0.Type;
             break;
 
@@ -7499,15 +7518,12 @@ namespace Microsoft.Dafny
         switch (e.Op) {
           case TernaryExpr.Opcode.PrefixEqOp:
           case TernaryExpr.Opcode.PrefixNeqOp:
-            if (!UnifyTypes(e.E0.Type, Type.Int)) {
-              reporter.Error(MessageSource.Resolver, e.E0, "prefix-equality limit argument must be an integer expression (got {0})", e.E0.Type);
-            }
-            if (!UnifyTypes(e.E1.Type, new DatatypeProxy(true))) {
-              reporter.Error(MessageSource.Resolver, expr, "arguments to prefix equality must be codatatypes (instead of {0})", e.E1.Type);
-            }
-            if (!UnifyTypes(e.E1.Type, e.E2.Type)) {
-              reporter.Error(MessageSource.Resolver, expr, "arguments must have the same type (got {0} and {1})", e.E1.Type, e.E2.Type);
-            }
+            ConstrainTypes(e.E0.Type, Type.Int,
+              e.E0, "prefix-equality limit argument must be an integer expression (got {0})", e.E0.Type);
+            ConstrainTypes(e.E1.Type, new DatatypeProxy(true),
+              expr, "arguments to prefix equality must be codatatypes (instead of {0})", e.E1.Type);
+            ConstrainTypes(e.E1.Type, e.E2.Type,
+              expr, "arguments must have the same type (got {0} and {1})", e.E1.Type, e.E2.Type);
             expr.Type = Type.Bool;
             break;
           default:
@@ -7556,9 +7572,7 @@ namespace Microsoft.Dafny
           }
           foreach (var rhs in e.RHSs) {
             ResolveExpression(rhs, opts);
-            if (!UnifyTypes(rhs.Type, Type.Bool)) {
-              reporter.Error(MessageSource.Resolver, rhs.tok, "type of RHS of let-such-that expression must be boolean (got {0})", rhs.Type);
-            }
+            ConstrainTypes(rhs.Type, Type.Bool, rhs.tok, "type of RHS of let-such-that expression must be boolean (got {0})", rhs.Type);
           }
           if (!opts.DontCareAboutCompilation && !e.BoundVars.All(bv => bv.IsGhost)) {
             needFiniteBoundsChecks_LetSuchThatExpr.Add(e);
@@ -7594,15 +7608,11 @@ namespace Microsoft.Dafny
         if (e.Range != null) {
           ResolveExpression(e.Range, new ResolveOpts(opts, true));
           Contract.Assert(e.Range.Type != null);  // follows from postcondition of ResolveExpression
-          if (!UnifyTypes(e.Range.Type, Type.Bool)) {
-            reporter.Error(MessageSource.Resolver, expr, "range of quantifier must be of type bool (instead got {0})", e.Range.Type);
-          }
+          ConstrainTypes(e.Range.Type, Type.Bool, expr, "range of quantifier must be of type bool (instead got {0})", e.Range.Type);
         }
         ResolveExpression(e.Term, new ResolveOpts(opts, true));
         Contract.Assert(e.Term.Type != null);  // follows from postcondition of ResolveExpression
-        if (!UnifyTypes(e.Term.Type, Type.Bool)) {
-          reporter.Error(MessageSource.Resolver, expr, "body of quantifier must be of type bool (instead got {0})", e.Term.Type);
-        }
+        ConstrainTypes(e.Term.Type, Type.Bool, expr, "body of quantifier must be of type bool (instead got {0})", e.Term.Type);
         // Since the body is more likely to infer the types of the bound variables, resolve it
         // first (above) and only then resolve the attributes (below).
         ResolveAttributes(e.Attributes, new ResolveOpts(opts, true));
@@ -7643,9 +7653,7 @@ namespace Microsoft.Dafny
         }
         ResolveExpression(e.Range, opts);
         Contract.Assert(e.Range.Type != null);  // follows from postcondition of ResolveExpression
-        if (!UnifyTypes(e.Range.Type, Type.Bool)) {
-          reporter.Error(MessageSource.Resolver, expr, "range of comprehension must be of type bool (instead got {0})", e.Range.Type);
-        }
+        ConstrainTypes(e.Range.Type, Type.Bool, expr, "range of comprehension must be of type bool (instead got {0})", e.Range.Type);
         ResolveExpression(e.Term, opts);
         Contract.Assert(e.Term.Type != null);  // follows from postcondition of ResolveExpression
 
@@ -7672,9 +7680,7 @@ namespace Microsoft.Dafny
         }
         ResolveExpression(e.Range, opts);
         Contract.Assert(e.Range.Type != null);  // follows from postcondition of ResolveExpression
-        if (!UnifyTypes(e.Range.Type, Type.Bool)) {
-          reporter.Error(MessageSource.Resolver, expr, "range of comprehension must be of type bool (instead got {0})", e.Range.Type);
-        }
+        ConstrainTypes(e.Range.Type, Type.Bool, expr, "range of comprehension must be of type bool (instead got {0})", e.Range.Type);
         ResolveExpression(e.Term, opts);
         Contract.Assert(e.Term.Type != null);  // follows from postcondition of ResolveExpression
 
@@ -7707,9 +7713,7 @@ namespace Microsoft.Dafny
         if (e.Range != null) {
           ResolveExpression(e.Range, opts);
           Contract.Assert(e.Range.Type != null);  // follows from postcondition of ResolveExpression
-          if (!UnifyTypes(e.Range.Type, Type.Bool)) {
-            reporter.Error(MessageSource.Resolver, expr, "Precondition must be boolean (got {0})", e.Range.Type);
-          }
+          ConstrainTypes(e.Range.Type, Type.Bool, expr, "Precondition must be boolean (got {0})", e.Range.Type);
         }
 
         foreach (var read in e.Reads) {
@@ -7747,13 +7751,9 @@ namespace Microsoft.Dafny
         Contract.Assert(e.Thn.Type != null);  // follows from postcondition of ResolveExpression
         ResolveExpression(e.Els, opts);
         Contract.Assert(e.Els.Type != null);  // follows from postcondition of ResolveExpression
-        if (!UnifyTypes(e.Test.Type, Type.Bool)) {
-          reporter.Error(MessageSource.Resolver, expr, "guard condition in if-then-else expression must be a boolean (instead got {0})", e.Test.Type);
-        }
-        if (UnifyTypes(e.Thn.Type, e.Els.Type)) {
+        ConstrainTypes(e.Test.Type, Type.Bool, expr, "guard condition in if-then-else expression must be a boolean (instead got {0})", e.Test.Type);
+        if (ConstrainTypes(e.Thn.Type, e.Els.Type, expr, "the two branches of an if-then-else expression must have the same type (got {0} and {1})", e.Thn.Type, e.Els.Type)) {
           expr.Type = e.Thn.Type;
-        } else {
-          reporter.Error(MessageSource.Resolver, expr, "the two branches of an if-then-else expression must have the same type (got {0} and {1})", e.Thn.Type, e.Els.Type);
         }
 
       } else if (expr is MatchExpr) {
@@ -7835,16 +7835,15 @@ namespace Microsoft.Dafny
             if (ctor != null && i < ctor.Formals.Count) {
               Formal formal = ctor.Formals[i];
               Type st = SubstType(formal.Type, subst);
-              if (!UnifyTypes(v.Type, st)) {
-                reporter.Error(MessageSource.Resolver, expr, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
-              }
+              ConstrainTypes(v.Type, st,
+                expr, "the declared type of the formal ({0}) does not agree with the corresponding type in the constructor's signature ({1})", v.Type, st);
               v.IsGhost = formal.IsGhost;
 
               // update the type of the boundvars in the MatchCaseToken
               if (v.tok is MatchCaseToken) {
                 MatchCaseToken mt = (MatchCaseToken)v.tok;
                 foreach (Tuple<IToken, BoundVar, bool> entry in mt.varList) {
-                  UnifyTypes(entry.Item2.Type, v.Type);
+                  UnifyTypes(entry.Item2.Type, v.Type);  // TODO: What to do if this unification fails? Or can it?  --KRML
                 }
               }
             }
@@ -7862,9 +7861,7 @@ namespace Microsoft.Dafny
         }
 
         Contract.Assert(mc.Body.Type != null);  // follows from postcondition of ResolveExpression
-        if (!UnifyTypes(expr.Type, mc.Body.Type)) {
-          reporter.Error(MessageSource.Resolver, mc.Body.tok, "type of case bodies do not agree (found {0}, previous types {1})", mc.Body.Type, expr.Type);
-        }
+        ConstrainTypes(expr.Type, mc.Body.Type, mc.Body.tok, "type of case bodies do not agree (found {0}, previous types {1})", mc.Body.Type, expr.Type);
         scope.PopMarker();
       }
       if (dtd != null && memberNamesUsed.Count != dtd.Ctors.Count) {
@@ -8198,9 +8195,7 @@ namespace Microsoft.Dafny
         // this is a simple resolution
         var v = pat.Var;
         ResolveType(v.tok, v.Type, context, ResolveTypeOptionEnum.InferTypeProxies, null);
-        if (!UnifyTypes(v.Type, sourceType)) {
-          reporter.Error(MessageSource.Resolver, v.tok, "type of corresponding source/RHS ({0}) does not match type of bound variable ({1})", sourceType, v.Type);
-        }
+        ConstrainTypes(v.Type, sourceType, v.tok, "type of corresponding source/RHS ({0}) does not match type of bound variable ({1})", sourceType, v.Type);
         pat.AssembleExpr(null);
       } else if (dtd == null) {
         reporter.Error(MessageSource.Resolver, pat.tok, "to use a pattern, the type of the source/RHS expression must be a datatype (instead found {0})", sourceType);
@@ -8918,9 +8913,8 @@ namespace Microsoft.Dafny
             reporter.Error(MessageSource.Resolver, e.tok, "wrong number of arguments to function application ({0} expects {1}, got {2})", what, fnType.Arity, e.Args.Count);
           } else {
             for (var i = 0; i < fnType.Arity; i++) {
-              if (!UnifyTypes(fnType.Args[i], e.Args[i].Type)) {
-                reporter.Error(MessageSource.Resolver, e.Args[i].tok, "type mismatch for argument {0} (function expects {1}, got {2})", i, fnType.Args[i], e.Args[i].Type);
-              }
+              ConstrainTypes(fnType.Args[i], e.Args[i].Type,
+                e.Args[i].tok, "type mismatch for argument {0} (function expects {1}, got {2})", i, fnType.Args[i], e.Args[i].Type);
             }
             if (errorCount != reporter.Count(ErrorLevel.Error)) {
               // do nothing else; error has been reported
@@ -8946,9 +8940,7 @@ namespace Microsoft.Dafny
                 ResolveExpression(farg, opts);
                 Contract.Assert(farg.Type != null);  // follows from postcondition of ResolveExpression
                 Type s = SubstType(callee.Formals[i].Type, rr.TypeArgumentSubstitutions);
-                if (!UnifyTypes(farg.Type, s)) {
-                  reporter.Error(MessageSource.Resolver, rr, "incorrect type of function argument {0} (expected {1}, got {2})", i, s, farg.Type);
-                }
+                ConstrainTypes(farg.Type, s, rr, "incorrect type of function argument {0} (expected {1}, got {2})", i, s, farg.Type);
               }
               rr.Type = SubstType(callee.ResultType, rr.TypeArgumentSubstitutions);
               // further bookkeeping
@@ -9004,9 +8996,7 @@ namespace Microsoft.Dafny
         Contract.Assert(arg.Type != null);  // follows from postcondition of ResolveExpression
         if (formal != null) {
           Type st = SubstType(formal.Type, subst);
-          if (!UnifyTypes(arg.Type, st)) {
-            reporter.Error(MessageSource.Resolver, arg.tok, "incorrect type of datatype constructor argument (found {0}, expected {1})", arg.Type, st);
-          }
+          ConstrainTypes(arg.Type, st, arg.tok, "incorrect type of datatype constructor argument (found {0}, expected {1})", arg.Type, st);
         }
         j++;
       }
@@ -9241,9 +9231,7 @@ namespace Microsoft.Dafny
             ResolveExpression(farg, opts);
             Contract.Assert(farg.Type != null);  // follows from postcondition of ResolveExpression
             Type s = SubstType(function.Formals[i].Type, e.TypeArgumentSubstitutions);
-            if (!UnifyTypes(farg.Type, s)) {
-              reporter.Error(MessageSource.Resolver, e, "incorrect type of function argument {0} (expected {1}, got {2})", i, s, farg.Type);
-            }
+            ConstrainTypes(farg.Type, s, e, "incorrect type of function argument {0} (expected {1}, got {2})", i, s, farg.Type);
           }
           e.Type = SubstType(function.ResultType, e.TypeArgumentSubstitutions);
         }
@@ -9296,7 +9284,7 @@ namespace Microsoft.Dafny
     /// </summary>
     public static List<ComprehensionExpr.BoundedPool> DiscoverBestBounds_MultipleVars<VT>(List<VT> bvars, Expression expr, bool polarity, bool onlyFiniteBounds, out List<VT> missingBounds) where VT : IVariable {
       foreach (var bv in bvars) {
-        var c = TypeConstraint(bv, bv.Type, null);
+        var c = GetImpliedTypeConstraint(bv, bv.Type, null);
         expr = polarity ? Expression.CreateAnd(c, expr) : Expression.CreateImplies(c, expr);
       }
       var all = DiscoverAllBounds_Aux_MultipleVars(bvars, expr, polarity);
@@ -9311,7 +9299,7 @@ namespace Microsoft.Dafny
     }
 
     public static List<ComprehensionExpr.BoundedPool> DiscoverAllBounds_SingleVar<VT>(VT v, Expression expr) where VT : IVariable {
-      expr = Expression.CreateAnd(TypeConstraint(v, v.Type, null), expr);
+      expr = Expression.CreateAnd(GetImpliedTypeConstraint(v, v.Type, null), expr);
       return DiscoverAllBounds_Aux_SingleVar(new List<VT> { v }, 0, expr, true);
     }
 
@@ -9425,13 +9413,13 @@ namespace Microsoft.Dafny
       return bounds;
     }
 
-    static Expression TypeConstraint(IVariable bv, Type ty, ErrorReporter reporter) {
+    static Expression GetImpliedTypeConstraint(IVariable bv, Type ty, ErrorReporter reporter) {
       Contract.Requires(bv != null);
       Contract.Requires(ty != null);
       ty = ty.NormalizeExpand();
       var dd = ty.AsNewtype;
       if (dd != null) {
-        var c = TypeConstraint(bv, dd.BaseType, reporter);
+        var c = GetImpliedTypeConstraint(bv, dd.BaseType, reporter);
         if (dd.Var != null) {
           c = Expression.CreateAnd(c, new Translator(reporter).Substitute(dd.Constraint, dd.Var, Expression.CreateIdentExpr(bv)));
         }
@@ -9778,17 +9766,14 @@ namespace Microsoft.Dafny
       Type argType = new InferredTypeProxy();
 
       IndexableTypeProxy expectedType = new IndexableTypeProxy(domainType, elementType, argType, true, true, true);
-      if (!UnifyTypes(e.Seq.Type, expectedType)) {
-        reporter.Error(MessageSource.Resolver, e, "sequence/array/multiset/map selection requires a sequence, array, multiset, or map (got {0})", e.Seq.Type);
+      if (!ConstrainTypes(e.Seq.Type, expectedType, e, "sequence/array/multiset/map selection requires a sequence, array, multiset, or map (got {0})", e.Seq.Type)) {
         seqErr = true;
       }
       if (!e.SelectOne)  // require sequence or array
       {
         if (!allowNonUnitArraySelection) {
           // require seq
-          if (!UnifyTypes(expectedType, new SeqType(new InferredTypeProxy()))) {
-            reporter.Error(MessageSource.Resolver, e, "selection requires a sequence (got {0})", e.Seq.Type);
-          }
+          ConstrainTypes(expectedType, new SeqType(new InferredTypeProxy()), e, "selection requires a sequence (got {0})", e.Seq.Type);
         } else {
           if (UnifyTypes(expectedType, new MapType(true, new InferredTypeProxy(), new InferredTypeProxy()))) {
             reporter.Error(MessageSource.Resolver, e, "cannot multiselect a map (got {0} as map type)", e.Seq.Type);
@@ -9800,17 +9785,13 @@ namespace Microsoft.Dafny
       if (e.E0 != null) {
         ResolveExpression(e.E0, opts);
         Contract.Assert(e.E0.Type != null);  // follows from postcondition of ResolveExpression
-        if (!UnifyTypes(e.E0.Type, domainType)) {
-          reporter.Error(MessageSource.Resolver, e.E0, "sequence/array/multiset/map selection requires {1} indices (got {0})", e.E0.Type, domainType);
-        }
+        ConstrainTypes(e.E0.Type, domainType, e.E0, "sequence/array/multiset/map selection requires {1} indices (got {0})", e.E0.Type, domainType);
       }
       if (e.E1 != null) {
         ResolveExpression(e.E1, opts);
         Contract.Assert(e.E1.Type != null);  // follows from postcondition of ResolveExpression
         var domType = e.E0 == null ? domainType : new OperationTypeProxy(true, false, false, false, false, false);  // reuse 'domainType' if .E0 did not use it; otherwise, create a new proxy to allow .E1 to be any integer-based numeric type, independent of the integer-based numeric type used by .E0
-        if (!UnifyTypes(e.E1.Type, domType)) {
-          reporter.Error(MessageSource.Resolver, e.E1, "sequence/array/multiset/map selection requires {1} indices (got {0})", e.E1.Type, domType);
-        }
+        ConstrainTypes(e.E1.Type, domType, e.E1, "sequence/array/multiset/map selection requires {1} indices (got {0})", e.E1.Type, domType);
       }
       if (!seqErr) {
         if (e.SelectOne) {
-- 
cgit v1.2.3


From 2196e226c6a1c1cca5cb70b8dbdd89088751c525 Mon Sep 17 00:00:00 2001
From: Michael Lowell Roberts <mirobert@microsoft.com>
Date: Thu, 17 Sep 2015 15:00:02 -0700
Subject: Only print extraneous comments if asked.

---
 Source/Dafny/DafnyOptions.cs |  785 +++++----
 Source/Dafny/Printer.cs      | 4020 +++++++++++++++++++++---------------------
 2 files changed, 2403 insertions(+), 2402 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index 08e53d5c..dd25e3c4 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -1,392 +1,393 @@
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Text;
-using System.Diagnostics.Contracts;
-using Bpl = Microsoft.Boogie;
-
-namespace Microsoft.Dafny
-{
-  public class DafnyOptions : Bpl.CommandLineOptions
-  {
-    private ErrorReporter errorReporter;
-
-    public DafnyOptions(ErrorReporter errorReporter = null)
-      : base("Dafny", "Dafny program verifier") {
-        this.errorReporter = errorReporter;
-        SetZ3ExecutableName();
-    }
-
-    public override string VersionNumber {
-      get {
-        return System.Diagnostics.FileVersionInfo.GetVersionInfo(System.Reflection.Assembly.GetExecutingAssembly().Location).FileVersion
-#if ENABLE_IRONDAFNY
-          + "[IronDafny]"
-#endif
-          ;
-      }
-    }
-    public override string VersionSuffix {
-      get {
-        return " version " + VersionNumber + ", Copyright (c) 2003-2015, Microsoft.";
-      }
-    }
-
-    private static DafnyOptions clo;
-    public static DafnyOptions O {
-      get { return clo; }
-    }
-
-    public static void Install(DafnyOptions options) {
-      Contract.Requires(options != null);
-      clo = options;
-      Bpl.CommandLineOptions.Install(options);
-    }
-
-    public bool UnicodeOutput = false;
-    public bool DisallowSoundnessCheating = false;
-    public bool Dafnycc = false;
-    public int Induction = 3;
-    public int InductionHeuristic = 6;
-    public string DafnyPrelude = null;
-    public string DafnyPrintFile = null;
-    public enum PrintModes { Everything, NoIncludes, NoGhost };
-    public PrintModes PrintMode;
-    public bool DafnyVerify = true;
-    public string DafnyPrintResolvedFile = null;
-    public bool Compile = true;
-    public bool ForceCompile = false;
-    public bool RunAfterCompile = false;
-    public bool SpillTargetCode = false;
-    public bool DisallowIncludes = false;
-    public bool DisableNLarith = false;
-    public string AutoReqPrintFile = null;
-    public bool ignoreAutoReq = false;
-    public bool AllowGlobals = false;
-    public bool CountVerificationErrors = true;
-    public bool Optimize = false;
-    public bool AutoTriggers = false;
-    public bool PrintTooltips = false;
-    public bool PrintStats = false;
-    public bool PrintFunctionCallGraph = false;
-    public bool WarnShadowing = false;
-    public bool IronDafny = 
-#if ENABLE_IRONDAFNY 
-      true
-#else
-      false
-#endif
-    ;
-
-    protected override bool ParseOption(string name, Bpl.CommandLineOptionEngine.CommandLineParseState ps) {
-      var args = ps.args;  // convenient synonym
-
-      switch (name) {
-        case "dprelude":
-          if (ps.ConfirmArgumentCount(1)) {
-            DafnyPrelude = args[ps.i];
-          }
-          return true;
-
-        case "dprint":
-          if (ps.ConfirmArgumentCount(1)) {
-            DafnyPrintFile = args[ps.i];
-          }
-          return true;
-
-        case "printMode":
-          if (ps.ConfirmArgumentCount(1)) {
-            if (args[ps.i].Equals("Everything")) {
-              PrintMode = PrintModes.Everything;
-            }
-            else if (args[ps.i].Equals("NoIncludes"))
-            {
-                PrintMode = PrintModes.NoIncludes;
-            }
-            else if (args[ps.i].Equals("NoGhost"))
-            {
-                PrintMode = PrintModes.NoGhost;
-            }
-            else
-            {
-                throw new Exception("Invalid value for printMode");
-            }
-          }
-          return true;
-
-        case "rprint":
-          if (ps.ConfirmArgumentCount(1)) {
-            DafnyPrintResolvedFile = args[ps.i];
-          }
-          return true;
-
-        case "compile": {
-            int compile = 0;
-            if (ps.GetNumericArgument(ref compile, 4)) {
-              // convert option to two booleans
-              Compile = compile != 0;
-              ForceCompile = compile == 2;
-              RunAfterCompile = compile == 3;
-            }
-            return true;
-          }
-
-        case "dafnyVerify":
-            {
-                int verify = 0;
-                if (ps.GetNumericArgument(ref verify, 2)) {
-                    DafnyVerify = verify != 0; // convert to boolean
-                }
-                return true;
-            }
-
-        case "spillTargetCode": {
-            int spill = 0;
-            if (ps.GetNumericArgument(ref spill, 2)) {
-              SpillTargetCode = spill != 0;  // convert to a boolean
-            }
-            return true;
-          }
-
-        case "dafnycc":
-          Dafnycc = true;
-          Induction = 0;
-          Compile = false;
-          UseAbstractInterpretation = false; // /noinfer
-          return true;
-
-        case "noCheating": {
-            int cheat = 0; // 0 is default, allows cheating
-            if (ps.GetNumericArgument(ref cheat, 2)) {
-              DisallowSoundnessCheating = cheat == 1;
-            }
-            return true;
-          }
-
-        case "induction":
-          ps.GetNumericArgument(ref Induction, 4);
-          return true;
-
-        case "inductionHeuristic":
-          ps.GetNumericArgument(ref InductionHeuristic, 7);
-          return true;
-
-        case "noIncludes":
-          DisallowIncludes = true;
-          return true;
-
-        case "noNLarith":
-          DisableNLarith = true;
-          this.AddZ3Option("NL_ARITH=false");
-          return true;
-
-        case "autoReqPrint":
-          if (ps.ConfirmArgumentCount(1)) {
-              AutoReqPrintFile = args[ps.i];
-          }
-          return true;
-
-        case "noAutoReq":
-          ignoreAutoReq = true;
-          return true;
-
-        case "allowGlobals":
-          AllowGlobals = true;
-          return true;
-        
-        case "stats":
-          PrintStats = true;
-          return true;
-
-        case "funcCallGraph":
-          PrintFunctionCallGraph = true;
-          return true;
-
-        case "warnShadowing":
-          WarnShadowing = true;
-          return true;
-
-        case "countVerificationErrors": {
-          int countErrors = 1; // defaults to reporting verification errors
-          if (ps.GetNumericArgument(ref countErrors, 2)) {
-            CountVerificationErrors = countErrors == 1;
-          }
-          return true;
-        }
-
-        case "printTooltips":
-          PrintTooltips = true;
-          return true;
-
-        case "autoTriggers": {
-            int autoTriggers = 0;
-            if (ps.GetNumericArgument(ref autoTriggers, 2)) {
-              AutoTriggers = autoTriggers == 1;
-            }
-            return true;
-          }
-
-        case "optimize": {
-            Optimize = true;
-            return true;
-        }
-
-        case "noIronDafny": {
-            IronDafny = false;
-            return true;
-        }
-
-        case "ironDafny": {
-            IronDafny = true;
-            return true;
-        }
-
-        default:
-          break;
-      }
-      // not a Dafny-specific option, so defer to superclass
-      return base.ParseOption(name, ps);
-    }
-
-    public override void ApplyDefaultOptions() {
-      base.ApplyDefaultOptions();
-
-      // expand macros in filenames, now that LogPrefix is fully determined
-      ExpandFilename(ref DafnyPrelude, LogPrefix, FileTimestamp);
-      ExpandFilename(ref DafnyPrintFile, LogPrefix, FileTimestamp);
-    }
-
-    public override void AttributeUsage() {
-      // TODO: provide attribute help here
-    }
-
-    
-    /// <summary>
-    /// Dafny comes with it's own copy of z3, to save new users the trouble of having to install extra dependency. 
-    /// For this to work, Dafny makes the Z3ExecutablePath point to the path were Z3 is put by our release script.
-    /// For developers though (and people getting this from source), it's convenient to be able to run right away, 
-    /// so we vendor a Windows version.
-    /// </summary>
-    private void SetZ3ExecutableName() {
-      var platform = (int)System.Environment.OSVersion.Platform;
-
-      // http://www.mono-project.com/docs/faq/technical/
-      var isUnix = platform == 4 || platform == 128;
-      
-      var z3binName = isUnix ? "z3" : "z3.exe";
-      var dafnyBinDir = System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location);
-      var z3BinDir = System.IO.Path.Combine(dafnyBinDir, "z3", "bin");
-      var z3BinPath = System.IO.Path.Combine(z3BinDir, z3binName);
-
-      if (!System.IO.File.Exists(z3BinPath) && !isUnix) {
-        // This is most likely a Windows user running from source without downloading z3 
-        // separately; this is ok, since we vendor z3.exe.
-        z3BinPath = System.IO.Path.Combine(dafnyBinDir, z3binName);
-      }
-      
-      if (!System.IO.File.Exists(z3BinPath) && errorReporter != null) {
-        var tok = new Bpl.Token(1, 1) { filename = "*** " };
-        errorReporter.Warning(MessageSource.Other, tok, "Could not find '{0}' in '{1}'.{2}Downloading and extracting a Z3 distribution to Dafny's 'Binaries' folder would solve this issue; for now, we'll rely on Boogie to find Z3.", 
-          z3binName, z3BinDir, System.Environment.NewLine);
-      } else {
-        Z3ExecutablePath = z3BinPath;
-      }
-    }
-
-    public override void Usage() {
-      Console.WriteLine(@"  ---- Dafny options ---------------------------------------------------------
-
-  Multiple .dfy files supplied on the command line are concatenated into one
-  Dafny program.
-
-  /dprelude:<file>
-                choose Dafny prelude file
-  /dprint:<file>
-                print Dafny program after parsing it
-                (use - as <file> to print to console)
-  /printMode:<Everything|NoIncludes|NoGhost>
-                NoIncludes disables printing of {:verify false} methods incorporated via the
-                include mechanism, as well as datatypes and fields included from other files.
-                NoGhost disables printing of functions, ghost methods, and proof statements in
-                implementation methods.  It also disables anything NoIncludes disables.
-  /rprint:<file>
-                print Dafny program after resolving it
-                (use - as <file> to print to console)
-  /dafnyVerify:<n>
-                0 - stop after typechecking
-                1 - continue on to translation, verification, and compilation
-  /compile:<n>  0 - do not compile Dafny program
-                1 (default) - upon successful verification of the Dafny
-                    program, compile Dafny program to .NET assembly
-                    Program.exe (if the program has a Main method) or
-                    Program.dll (othewise), where Program.dfy is the name
-                    of the last .dfy file on the command line
-                2 - always attempt to compile Dafny program to C# program
-                    out.cs, regardless of verification outcome
-                3 - if there is a Main method and there are no verification
-                    errors, compiles program in memory (i.e., does not write
-                    an output file) and runs it
-  /spillTargetCode:<n>
-                0 (default) - don't write the compiled Dafny program (but
-                    still compile it, if /compile indicates to do so)
-                1 - write the compiled Dafny program as a .cs file
-  /dafnycc      Disable features not supported by DafnyCC
-  /noCheating:<n>
-                0 (default) - allow assume statements and free invariants
-                1 - treat all assumptions as asserts, and drop free.
-  /induction:<n>
-                0 - never do induction, not even when attributes request it
-                1 - only apply induction when attributes request it
-                2 - apply induction as requested (by attributes) and also
-                    for heuristically chosen quantifiers
-                3 (default) - apply induction as requested, and for
-                    heuristically chosen quantifiers and lemmas
-  /inductionHeuristic:<n>
-                0 - least discriminating induction heuristic (that is, lean
-                    toward applying induction more often)
-                1,2,3,4,5 - levels in between, ordered as follows as far as
-                    how discriminating they are:  0 < 1 < 2 < (3,4) < 5 < 6
-                6 (default) - most discriminating
-  /noIncludes   Ignore include directives
-  /noNLarith    Reduce Z3's knowledge of non-linear arithmetic (*,/,%).
-                Results in more manual work, but also produces more predictable behavior.
-  /autoReqPrint:<file>
-                Print out requirements that were automatically generated by autoReq.
-  /noAutoReq    Ignore autoReq attributes
-  /allowGlobals Allow the implicit class '_default' to contain fields, instance functions,
-                and instance methods.  These class members are declared at the module scope,
-                outside of explicit classes.  This command-line option is provided to simplify
-                a transition from the behavior in the language prior to version 1.9.3, from
-                which point onward all functions and methods declared at the module scope are
-                implicitly static and fields declarations are not allowed at the module scope.
-  /countVerificationErrors:<n>
-                0 - If preprocessing succeeds, set exit code to 0 regardless of the number
-                    of verification errors.
-                1 (default) - If preprocessing succeeds, set exit code to the number of
-                              verification errors.
-  /autoTriggers:<n>
-                0 (default) - Do not generate {:trigger} annotations for user-level quantifiers.
-                1 - Add a {:trigger} to each user-level quantifier. Existing
-                              annotations are preserved.
-  /optimize     Produce optimized C# code, meaning:
-                  - selects optimized C# prelude by passing 
-                    /define:DAFNY_USE_SYSTEM_COLLECTIONS_IMMUTABLE to csc.exe (requires 
-                    System.Collections.Immutable.dll in the source directory to successfully 
-                    compile).
-                  - passes /optimize flag to csc.exe.
-  /stats        Print interesting statistics about the Dafny files supplied.
-  /funcCallGraph Print out the function call graph.  Format is: func,mod=callee*
-  /warnShadowing  Emits a warning if the name of a declared variable caused another variable
-                to be shadowed
-  /ironDafny    Enable experimental features needed to support Ironclad/Ironfleet. Use of
-                these features may cause your code to become incompatible with future
-                releases of Dafny.
-  /noIronDafny  Disable Ironclad/Ironfleet features, if enabled by default.
-  /printTooltips    
-                Dump additional positional information (displayed as mouse-over tooltips by 
-                the VS plugin) to stdout as 'Info' messages.
-");
-      base.Usage();  // also print the Boogie options
-    }
-  }
-}
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Diagnostics.Contracts;
+using Bpl = Microsoft.Boogie;
+
+namespace Microsoft.Dafny
+{
+  public class DafnyOptions : Bpl.CommandLineOptions
+  {
+    private ErrorReporter errorReporter;
+
+    public DafnyOptions(ErrorReporter errorReporter = null)
+      : base("Dafny", "Dafny program verifier") {
+        this.errorReporter = errorReporter;
+        SetZ3ExecutableName();
+    }
+
+    public override string VersionNumber {
+      get {
+        return System.Diagnostics.FileVersionInfo.GetVersionInfo(System.Reflection.Assembly.GetExecutingAssembly().Location).FileVersion
+#if ENABLE_IRONDAFNY
+          + "[IronDafny]"
+#endif
+          ;
+      }
+    }
+    public override string VersionSuffix {
+      get {
+        return " version " + VersionNumber + ", Copyright (c) 2003-2015, Microsoft.";
+      }
+    }
+
+    private static DafnyOptions clo;
+    public static DafnyOptions O {
+      get { return clo; }
+    }
+
+    public static void Install(DafnyOptions options) {
+      Contract.Requires(options != null);
+      clo = options;
+      Bpl.CommandLineOptions.Install(options);
+    }
+
+    public bool UnicodeOutput = false;
+    public bool DisallowSoundnessCheating = false;
+    public bool Dafnycc = false;
+    public int Induction = 3;
+    public int InductionHeuristic = 6;
+    public string DafnyPrelude = null;
+    public string DafnyPrintFile = null;
+    public enum PrintModes { Everything, NoIncludes, NoGhost };
+    public PrintModes PrintMode = PrintModes.Everything;  // Default to printing everything
+    public bool DafnyVerify = true;
+    public string DafnyPrintResolvedFile = null;
+    public bool Compile = true;
+    public bool ForceCompile = false;
+    public bool RunAfterCompile = false;
+    public bool SpillTargetCode = false;
+    public bool DisallowIncludes = false;
+    public bool DisableNLarith = false;
+    public string AutoReqPrintFile = null;
+    public bool ignoreAutoReq = false;
+    public bool AllowGlobals = false;
+    public bool CountVerificationErrors = true;
+    public bool Optimize = false;
+    public bool AutoTriggers = false;
+    public bool PrintTooltips = false;
+    public bool PrintStats = false;
+    public bool PrintFunctionCallGraph = false;
+    public bool WarnShadowing = false;
+    public bool IronDafny = 
+#if ENABLE_IRONDAFNY 
+      true
+#else
+      false
+#endif
+    ;
+
+    protected override bool ParseOption(string name, Bpl.CommandLineOptionEngine.CommandLineParseState ps) {
+      var args = ps.args;  // convenient synonym
+
+      switch (name) {
+        case "dprelude":
+          if (ps.ConfirmArgumentCount(1)) {
+            DafnyPrelude = args[ps.i];
+          }
+          return true;
+
+        case "dprint":
+          if (ps.ConfirmArgumentCount(1)) {
+            DafnyPrintFile = args[ps.i];
+          }
+          return true;
+
+        case "printMode":
+          if (ps.ConfirmArgumentCount(1)) {
+            if (args[ps.i].Equals("Everything")) {
+              PrintMode = PrintModes.Everything;
+            }
+            else if (args[ps.i].Equals("NoIncludes"))
+            {
+                PrintMode = PrintModes.NoIncludes;
+            }
+            else if (args[ps.i].Equals("NoGhost"))
+            {
+                PrintMode = PrintModes.NoGhost;
+            }
+            else
+            {
+                throw new Exception("Invalid value for printMode");
+            }
+          }
+          return true;
+
+        case "rprint":
+          if (ps.ConfirmArgumentCount(1)) {
+            DafnyPrintResolvedFile = args[ps.i];
+          }
+          return true;
+
+        case "compile": {
+            int compile = 0;
+            if (ps.GetNumericArgument(ref compile, 4)) {
+              // convert option to two booleans
+              Compile = compile != 0;
+              ForceCompile = compile == 2;
+              RunAfterCompile = compile == 3;
+            }
+            return true;
+          }
+
+        case "dafnyVerify":
+            {
+                int verify = 0;
+                if (ps.GetNumericArgument(ref verify, 2)) {
+                    DafnyVerify = verify != 0; // convert to boolean
+                }
+                return true;
+            }
+
+        case "spillTargetCode": {
+            int spill = 0;
+            if (ps.GetNumericArgument(ref spill, 2)) {
+              SpillTargetCode = spill != 0;  // convert to a boolean
+            }
+            return true;
+          }
+
+        case "dafnycc":
+          Dafnycc = true;
+          Induction = 0;
+          Compile = false;
+          UseAbstractInterpretation = false; // /noinfer
+          return true;
+
+        case "noCheating": {
+            int cheat = 0; // 0 is default, allows cheating
+            if (ps.GetNumericArgument(ref cheat, 2)) {
+              DisallowSoundnessCheating = cheat == 1;
+            }
+            return true;
+          }
+
+        case "induction":
+          ps.GetNumericArgument(ref Induction, 4);
+          return true;
+
+        case "inductionHeuristic":
+          ps.GetNumericArgument(ref InductionHeuristic, 7);
+          return true;
+
+        case "noIncludes":
+          DisallowIncludes = true;
+          return true;
+
+        case "noNLarith":
+          DisableNLarith = true;
+          this.AddZ3Option("NL_ARITH=false");
+          return true;
+
+        case "autoReqPrint":
+          if (ps.ConfirmArgumentCount(1)) {
+              AutoReqPrintFile = args[ps.i];
+          }
+          return true;
+
+        case "noAutoReq":
+          ignoreAutoReq = true;
+          return true;
+
+        case "allowGlobals":
+          AllowGlobals = true;
+          return true;
+        
+        case "stats":
+          PrintStats = true;
+          return true;
+
+        case "funcCallGraph":
+          PrintFunctionCallGraph = true;
+          return true;
+
+        case "warnShadowing":
+          WarnShadowing = true;
+          return true;
+
+        case "countVerificationErrors": {
+          int countErrors = 1; // defaults to reporting verification errors
+          if (ps.GetNumericArgument(ref countErrors, 2)) {
+            CountVerificationErrors = countErrors == 1;
+          }
+          return true;
+        }
+
+        case "printTooltips":
+          PrintTooltips = true;
+          return true;
+
+        case "autoTriggers": {
+            int autoTriggers = 0;
+            if (ps.GetNumericArgument(ref autoTriggers, 2)) {
+              AutoTriggers = autoTriggers == 1;
+            }
+            return true;
+          }
+
+        case "optimize": {
+            Optimize = true;
+            return true;
+        }
+
+        case "noIronDafny": {
+            IronDafny = false;
+            return true;
+        }
+
+        case "ironDafny": {
+            IronDafny = true;
+            return true;
+        }
+
+        default:
+          break;
+      }
+      // not a Dafny-specific option, so defer to superclass
+      return base.ParseOption(name, ps);
+    }
+
+    public override void ApplyDefaultOptions() {
+      base.ApplyDefaultOptions();
+
+      // expand macros in filenames, now that LogPrefix is fully determined
+      ExpandFilename(ref DafnyPrelude, LogPrefix, FileTimestamp);
+      ExpandFilename(ref DafnyPrintFile, LogPrefix, FileTimestamp);
+    }
+
+    public override void AttributeUsage() {
+      // TODO: provide attribute help here
+    }
+
+    
+    /// <summary>
+    /// Dafny comes with it's own copy of z3, to save new users the trouble of having to install extra dependency. 
+    /// For this to work, Dafny makes the Z3ExecutablePath point to the path were Z3 is put by our release script.
+    /// For developers though (and people getting this from source), it's convenient to be able to run right away, 
+    /// so we vendor a Windows version.
+    /// </summary>
+    private void SetZ3ExecutableName() {
+      var platform = (int)System.Environment.OSVersion.Platform;
+
+      // http://www.mono-project.com/docs/faq/technical/
+      var isUnix = platform == 4 || platform == 128;
+      
+      var z3binName = isUnix ? "z3" : "z3.exe";
+      var dafnyBinDir = System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location);
+      var z3BinDir = System.IO.Path.Combine(dafnyBinDir, "z3", "bin");
+      var z3BinPath = System.IO.Path.Combine(z3BinDir, z3binName);
+
+      if (!System.IO.File.Exists(z3BinPath) && !isUnix) {
+        // This is most likely a Windows user running from source without downloading z3 
+        // separately; this is ok, since we vendor z3.exe.
+        z3BinPath = System.IO.Path.Combine(dafnyBinDir, z3binName);
+      }
+      
+      if (!System.IO.File.Exists(z3BinPath) && errorReporter != null) {
+        var tok = new Bpl.Token(1, 1) { filename = "*** " };
+        errorReporter.Warning(MessageSource.Other, tok, "Could not find '{0}' in '{1}'.{2}Downloading and extracting a Z3 distribution to Dafny's 'Binaries' folder would solve this issue; for now, we'll rely on Boogie to find Z3.", 
+          z3binName, z3BinDir, System.Environment.NewLine);
+      } else {
+        Z3ExecutablePath = z3BinPath;
+      }
+    }
+
+    public override void Usage() {
+      Console.WriteLine(@"  ---- Dafny options ---------------------------------------------------------
+
+  Multiple .dfy files supplied on the command line are concatenated into one
+  Dafny program.
+
+  /dprelude:<file>
+                choose Dafny prelude file
+  /dprint:<file>
+                print Dafny program after parsing it
+                (use - as <file> to print to console)
+  /printMode:<Everything|NoIncludes|NoGhost>
+                Everything is the default.
+                NoIncludes disables printing of {:verify false} methods incorporated via the
+                include mechanism, as well as datatypes and fields included from other files.
+                NoGhost disables printing of functions, ghost methods, and proof statements in
+                implementation methods.  It also disables anything NoIncludes disables.
+  /rprint:<file>
+                print Dafny program after resolving it
+                (use - as <file> to print to console)
+  /dafnyVerify:<n>
+                0 - stop after typechecking
+                1 - continue on to translation, verification, and compilation
+  /compile:<n>  0 - do not compile Dafny program
+                1 (default) - upon successful verification of the Dafny
+                    program, compile Dafny program to .NET assembly
+                    Program.exe (if the program has a Main method) or
+                    Program.dll (othewise), where Program.dfy is the name
+                    of the last .dfy file on the command line
+                2 - always attempt to compile Dafny program to C# program
+                    out.cs, regardless of verification outcome
+                3 - if there is a Main method and there are no verification
+                    errors, compiles program in memory (i.e., does not write
+                    an output file) and runs it
+  /spillTargetCode:<n>
+                0 (default) - don't write the compiled Dafny program (but
+                    still compile it, if /compile indicates to do so)
+                1 - write the compiled Dafny program as a .cs file
+  /dafnycc      Disable features not supported by DafnyCC
+  /noCheating:<n>
+                0 (default) - allow assume statements and free invariants
+                1 - treat all assumptions as asserts, and drop free.
+  /induction:<n>
+                0 - never do induction, not even when attributes request it
+                1 - only apply induction when attributes request it
+                2 - apply induction as requested (by attributes) and also
+                    for heuristically chosen quantifiers
+                3 (default) - apply induction as requested, and for
+                    heuristically chosen quantifiers and lemmas
+  /inductionHeuristic:<n>
+                0 - least discriminating induction heuristic (that is, lean
+                    toward applying induction more often)
+                1,2,3,4,5 - levels in between, ordered as follows as far as
+                    how discriminating they are:  0 < 1 < 2 < (3,4) < 5 < 6
+                6 (default) - most discriminating
+  /noIncludes   Ignore include directives
+  /noNLarith    Reduce Z3's knowledge of non-linear arithmetic (*,/,%).
+                Results in more manual work, but also produces more predictable behavior.
+  /autoReqPrint:<file>
+                Print out requirements that were automatically generated by autoReq.
+  /noAutoReq    Ignore autoReq attributes
+  /allowGlobals Allow the implicit class '_default' to contain fields, instance functions,
+                and instance methods.  These class members are declared at the module scope,
+                outside of explicit classes.  This command-line option is provided to simplify
+                a transition from the behavior in the language prior to version 1.9.3, from
+                which point onward all functions and methods declared at the module scope are
+                implicitly static and fields declarations are not allowed at the module scope.
+  /countVerificationErrors:<n>
+                0 - If preprocessing succeeds, set exit code to 0 regardless of the number
+                    of verification errors.
+                1 (default) - If preprocessing succeeds, set exit code to the number of
+                              verification errors.
+  /autoTriggers:<n>
+                0 (default) - Do not generate {:trigger} annotations for user-level quantifiers.
+                1 - Add a {:trigger} to each user-level quantifier. Existing
+                              annotations are preserved.
+  /optimize     Produce optimized C# code, meaning:
+                  - selects optimized C# prelude by passing 
+                    /define:DAFNY_USE_SYSTEM_COLLECTIONS_IMMUTABLE to csc.exe (requires 
+                    System.Collections.Immutable.dll in the source directory to successfully 
+                    compile).
+                  - passes /optimize flag to csc.exe.
+  /stats        Print interesting statistics about the Dafny files supplied.
+  /funcCallGraph Print out the function call graph.  Format is: func,mod=callee*
+  /warnShadowing  Emits a warning if the name of a declared variable caused another variable
+                to be shadowed
+  /ironDafny    Enable experimental features needed to support Ironclad/Ironfleet. Use of
+                these features may cause your code to become incompatible with future
+                releases of Dafny.
+  /noIronDafny  Disable Ironclad/Ironfleet features, if enabled by default.
+  /printTooltips    
+                Dump additional positional information (displayed as mouse-over tooltips by 
+                the VS plugin) to stdout as 'Info' messages.
+");
+      base.Usage();  // also print the Boogie options
+    }
+  }
+}
diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index ce8b54bb..e242c8bb 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -1,2010 +1,2010 @@
-//-----------------------------------------------------------------------------
-//
-// Copyright (C) Microsoft Corporation.  All Rights Reserved.
-//
-//-----------------------------------------------------------------------------
-using System;
-using System.IO;
-using System.Collections.Generic;
-using System.Diagnostics.Contracts;
-using System.Numerics;
-using System.Linq;
-using Bpl = Microsoft.Boogie;
-
-namespace Microsoft.Dafny {
-  public class Printer {
-    TextWriter wr;
-    DafnyOptions.PrintModes printMode;
-
-    [ContractInvariantMethod]
-    void ObjectInvariant()
-    {
-      Contract.Invariant(wr!=null);
-    }
-
-    public Printer(TextWriter wr, DafnyOptions.PrintModes printMode = DafnyOptions.PrintModes.Everything) {
-      Contract.Requires(wr != null);
-      this.wr = wr;
-      this.printMode = printMode;
-    }
-
-    public static string ExprToString(Expression expr)
-    {
-      Contract.Requires(expr != null);
-      using (var wr = new System.IO.StringWriter()) {
-        var pr = new Printer(wr);
-        pr.PrintExpression(expr, false);
-        return wr.ToString();
-      }
-    }
-
-    public static string GuardToString(Expression expr) {
-      using (var wr = new System.IO.StringWriter()) {
-        var pr = new Printer(wr);
-        pr.PrintGuard(expr);
-        return wr.ToString();
-      }
-    }
-
-    public static string ExtendedExprToString(Expression expr) {
-      Contract.Requires(expr != null);
-      using (var wr = new System.IO.StringWriter()) {
-        var pr = new Printer(wr);
-        pr.PrintExtendedExpr(expr, 0, true, false);
-        return wr.ToString();
-      }
-    }
-
-    public static string FrameExprListToString(List<FrameExpression> fexprs) {
-      Contract.Requires(fexprs != null);
-      using (var wr = new System.IO.StringWriter()) {
-        var pr = new Printer(wr);
-        pr.PrintFrameExpressionList(fexprs);
-        return wr.ToString();
-      }
-    }
-
-    public static string StatementToString(Statement stmt) {
-      Contract.Requires(stmt != null);
-      using (var wr = new System.IO.StringWriter()) {
-        var pr = new Printer(wr);
-        pr.PrintStatement(stmt, 0);
-        return ToStringWithoutNewline(wr);
-      }
-    }
-
-    public static string IteratorClassToString(IteratorDecl iter) {
-      Contract.Requires(iter != null);
-      using (var wr = new System.IO.StringWriter()) {
-        var pr = new Printer(wr);
-        pr.PrintIteratorClass(iter, 0, null);
-        return ToStringWithoutNewline(wr);
-      }
-    }
-
-    public static string IteratorSignatureToString(IteratorDecl iter) {
-      Contract.Requires(iter != null);
-      using (var wr = new System.IO.StringWriter()) {
-        var pr = new Printer(wr);
-        pr.PrintIteratorSignature(iter, 0);
-        return ToStringWithoutNewline(wr);
-      }
-    }
-
-    public static string FunctionSignatureToString(Function f) {
-      Contract.Requires(f != null);
-      using (var wr = new System.IO.StringWriter()) {
-        var pr = new Printer(wr);
-        pr.PrintFunction(f, 0, true);
-        return ToStringWithoutNewline(wr);
-      }
-    }
-
-    public static string MethodSignatureToString(Method m) {
-      Contract.Requires(m != null);
-      using (var wr = new System.IO.StringWriter()) {
-        var pr = new Printer(wr);
-        pr.PrintMethod(m, 0, true);
-        return ToStringWithoutNewline(wr);
-      }
-    }
-
-    public static string OneAttributeToString(Attributes a, string nameSubstitution = null) {
-      Contract.Requires(a != null);
-      using (var wr = new System.IO.StringWriter()) {
-        var pr = new Printer(wr);
-        pr.PrintOneAttribute(a, nameSubstitution);
-        return ToStringWithoutNewline(wr);
-      }
-    }
-
-    public static string ToStringWithoutNewline(System.IO.StringWriter wr) {
-      Contract.Requires(wr != null);
-      var sb = wr.GetStringBuilder();
-      var len = sb.Length;
-      while (len > 0 && (sb[len - 1] == '\n' || sb[len - 1] == '\r')) {
-        len--;
-      }
-      return sb.ToString(0, len);
-    }
-
-    public void PrintProgram(Program prog) {
-      Contract.Requires(prog != null);
-      if (Bpl.CommandLineOptions.Clo.ShowEnv != Bpl.CommandLineOptions.ShowEnvironment.Never) {
-        wr.WriteLine("// " + Bpl.CommandLineOptions.Clo.Version);
-        wr.WriteLine("// " + Bpl.CommandLineOptions.Clo.Environment);
-      }
-      wr.WriteLine("// {0}", prog.Name);
-      if (DafnyOptions.O.DafnyPrintResolvedFile != null) {
-        wr.WriteLine();
-        wr.WriteLine("/*");
-        PrintModuleDefinition(prog.BuiltIns.SystemModule, 0, Path.GetFullPath(DafnyOptions.O.DafnyPrintResolvedFile));
-        wr.WriteLine("*/");
-      }
-      wr.WriteLine();
-      PrintCallGraph(prog.DefaultModuleDef, 0);
-      PrintTopLevelDecls(prog.DefaultModuleDef.TopLevelDecls, 0, Path.GetFullPath(prog.FullName));
-      wr.Flush();
-    }
-
-    public void PrintCallGraph(ModuleDefinition module, int indent) {
-      Contract.Requires(module != null);
-      Contract.Requires(0 <= indent);
-      if (DafnyOptions.O.DafnyPrintResolvedFile != null) {
-        // print call graph
-        Indent(indent); wr.WriteLine("/* CALL GRAPH for module {0}:", module.Name);
-        var SCCs = module.CallGraph.TopologicallySortedComponents();
-        SCCs.Reverse();
-        foreach (var clbl in SCCs) {
-          Indent(indent); wr.WriteLine(" * SCC at height {0}:", module.CallGraph.GetSCCRepresentativeId(clbl));
-          var r = module.CallGraph.GetSCC(clbl);
-          foreach (var m in r) {
-            Indent(indent); wr.WriteLine(" *   {0}", m.NameRelativeToModule);
-          }
-        }
-        Indent(indent); wr.WriteLine(" */");
-      }
-    }
-
-    public void PrintTopLevelDecls(List<TopLevelDecl> decls, int indent, string fileBeingPrinted) {
-      Contract.Requires(decls!= null);
-      int i = 0;
-      foreach (TopLevelDecl d in decls) {
-        Contract.Assert(d != null);
-        if (PrintModeSkipGeneral(d.tok, fileBeingPrinted)) { continue; }
-        if (d is OpaqueTypeDecl) {
-          var at = (OpaqueTypeDecl)d;
-          if (i++ != 0) { wr.WriteLine(); }
-          Indent(indent);
-          PrintClassMethodHelper("type", at.Attributes, at.Name, new List<TypeParameter>());
-          wr.Write(EqualitySupportSuffix(at.EqualitySupport));
-          wr.WriteLine();
-        } else if (d is NewtypeDecl) {
-          var dd = (NewtypeDecl)d;
-          if (i++ != 0) { wr.WriteLine(); }
-          Indent(indent);
-          PrintClassMethodHelper("newtype", dd.Attributes, dd.Name, new List<TypeParameter>());
-          wr.Write(" = ");
-          if (dd.Var == null) {
-            PrintType(dd.BaseType);
-          } else {
-            wr.Write(dd.Var.DisplayName);
-            if (!(dd.Var.Type is TypeProxy) || DafnyOptions.O.DafnyPrintResolvedFile != null) {
-              wr.Write(": ");
-              PrintType(dd.BaseType);
-            }
-            wr.Write(" | ");
-            PrintExpression(dd.Constraint, true);
-          }
-          wr.WriteLine();
-        } else if (d is TypeSynonymDecl) {
-          var syn = (TypeSynonymDecl)d;
-          if (i++ != 0) { wr.WriteLine(); }
-          Indent(indent);
-          PrintClassMethodHelper("type", syn.Attributes, syn.Name, syn.TypeArgs);
-          wr.Write(" = ");
-          PrintType(syn.Rhs);
-          wr.WriteLine();
-        } else if (d is DatatypeDecl) {
-          if (i++ != 0) { wr.WriteLine(); }
-          PrintDatatype((DatatypeDecl)d, indent);
-        } else if (d is IteratorDecl) {
-          var iter = (IteratorDecl)d;
-          PrintIteratorSignature(iter, indent);
-
-          if (iter.Body != null) {
-            Indent(indent);
-            PrintStatement(iter.Body, indent);
-            wr.WriteLine();
-          }
-
-          if (DafnyOptions.O.DafnyPrintResolvedFile != null) {
-            // also print the members that were created as part of the interpretation of the iterator
-            Contract.Assert(iter.Members.Count != 0);  // filled in during resolution
-            wr.WriteLine("/*---------- iterator members ----------");
-            PrintIteratorClass(iter, indent, fileBeingPrinted);
-            wr.WriteLine("---------- iterator members ----------*/");
-          }
-
-        } else if (d is ClassDecl) {
-          ClassDecl cl = (ClassDecl)d;
-          if (!cl.IsDefaultClass) {
-            if (i++ != 0) { wr.WriteLine(); }
-            PrintClass(cl, indent, fileBeingPrinted);
-          } else if (cl.Members.Count == 0) {
-            // print nothing
-          } else {
-            if (i++ != 0) { wr.WriteLine(); }
-            PrintMembers(cl.Members, indent, fileBeingPrinted);
-          }
-
-        } else if (d is ModuleDecl) {
-          wr.WriteLine();
-          Indent(indent);
-          if (d is LiteralModuleDecl) {
-            ModuleDefinition module = ((LiteralModuleDecl)d).ModuleDef;
-            PrintModuleDefinition(module, indent, fileBeingPrinted);
-          } else if (d is AliasModuleDecl) {
-            wr.Write("import"); if (((AliasModuleDecl)d).Opened) wr.Write(" opened");
-            wr.Write(" {0} ", ((AliasModuleDecl)d).Name);
-            wr.WriteLine("= {0}", Util.Comma(".", ((AliasModuleDecl)d).Path, id => id.val));
-          } else if (d is ModuleFacadeDecl) {
-            wr.Write("import"); if (((ModuleFacadeDecl)d).Opened) wr.Write(" opened");
-            wr.Write(" {0} ", ((ModuleFacadeDecl)d).Name);
-            wr.WriteLine("as {0}", Util.Comma(".", ((ModuleFacadeDecl)d).Path, id => id.val));
-          }
-
-        } else {
-          Contract.Assert(false);  // unexpected TopLevelDecl
-        }
-      }
-    }
-
-    void PrintModuleDefinition(ModuleDefinition module, int indent, string fileBeingPrinted) {
-      Contract.Requires(module != null);
-      Contract.Requires(0 <= indent);
-      if (module.IsAbstract) {
-        wr.Write("abstract ");
-      }
-      wr.Write("module");
-      PrintAttributes(module.Attributes);
-      wr.Write(" {0} ", module.Name);
-      if (module.RefinementBaseName != null) {
-        wr.Write("refines {0} ", Util.Comma(".", module.RefinementBaseName, id => id.val));
-      }
-      if (module.TopLevelDecls.Count == 0) {
-        wr.WriteLine("{ }");
-      } else {
-        wr.WriteLine("{");
-        PrintCallGraph(module, indent + IndentAmount);
-        PrintTopLevelDecls(module.TopLevelDecls, indent + IndentAmount, fileBeingPrinted);
-        Indent(indent);
-        wr.WriteLine("}");
-      }
-    }
-
-    void PrintIteratorSignature(IteratorDecl iter, int indent) {
-      Indent(indent);
-      PrintClassMethodHelper("iterator", iter.Attributes, iter.Name, iter.TypeArgs);
-      if (iter.SignatureIsOmitted) {
-        wr.WriteLine(" ...");
-      } else {
-        PrintFormals(iter.Ins);
-        if (iter.Outs.Count != 0) {
-          if (iter.Ins.Count + iter.Outs.Count <= 3) {
-            wr.Write(" yields ");
-          } else {
-            wr.WriteLine();
-            Indent(indent + 2 * IndentAmount);
-            wr.Write("yields ");
-          }
-          PrintFormals(iter.Outs);
-        }
-        wr.WriteLine();
-      }
-
-      int ind = indent + IndentAmount;
-      PrintSpec("requires", iter.Requires, ind);
-      if (iter.Reads.Expressions != null) {
-        PrintFrameSpecLine("reads", iter.Reads.Expressions, ind, iter.Reads.HasAttributes() ? iter.Reads.Attributes : null);
-      }
-      if (iter.Modifies.Expressions != null) {
-        PrintFrameSpecLine("modifies", iter.Modifies.Expressions, ind, iter.Modifies.HasAttributes() ? iter.Modifies.Attributes : null);
-      }
-      PrintSpec("yield requires", iter.YieldRequires, ind);
-      PrintSpec("yield ensures", iter.YieldEnsures, ind);
-      PrintSpec("ensures", iter.Ensures, ind);
-      PrintDecreasesSpec(iter.Decreases, ind);
-    }
-
-    private void PrintIteratorClass(IteratorDecl iter, int indent, string fileBeingPrinted) {
-      PrintClassMethodHelper("class", null, iter.Name, iter.TypeArgs);
-      wr.WriteLine(" {");
-      PrintMembers(iter.Members, indent + IndentAmount, fileBeingPrinted);
-      Indent(indent); wr.WriteLine("}");
-    }
-
-    public void PrintClass(ClassDecl c, int indent, string fileBeingPrinted) {
-      Contract.Requires(c != null);
-      Indent(indent);
-      PrintClassMethodHelper((c is TraitDecl) ? "trait" : "class", c.Attributes, c.Name, c.TypeArgs);
-      string sep = " extends ";
-      foreach (var trait in c.TraitsTyp) {
-        wr.Write(sep);
-        PrintType(trait);
-        sep = ", ";
-      }
-      if (c.Members.Count == 0) {
-        wr.WriteLine(" { }");
-      } else {
-        wr.WriteLine(" {");
-        PrintMembers(c.Members, indent + IndentAmount, fileBeingPrinted);
-        Indent(indent);
-        wr.WriteLine("}");
-      }
-    }
-
-    public void PrintMembers(List<MemberDecl> members, int indent, string fileBeingPrinted)
-    {
-      Contract.Requires(members != null);
-
-      int state = 0;  // 0 - no members yet; 1 - previous member was a field; 2 - previous member was non-field
-      foreach (MemberDecl m in members) {
-        if (PrintModeSkipGeneral(m.tok, fileBeingPrinted)) { continue; }
-        if (m is Method) {
-          if (state != 0) { wr.WriteLine(); }
-          PrintMethod((Method)m, indent, false);
-          var com = m as FixpointLemma;
-          if (com != null && com.PrefixLemma != null) {
-            Indent(indent); wr.WriteLine("/***");
-            PrintMethod(com.PrefixLemma, indent, false);
-            Indent(indent); wr.WriteLine("***/");
-          }
-          state = 2;
-        } else if (m is Field) {
-          if (state == 2) { wr.WriteLine(); }
-          PrintField((Field)m, indent);
-          state = 1;
-        } else if (m is Function) {
-          if (state != 0) { wr.WriteLine(); }
-          PrintFunction((Function)m, indent, false);
-          var fixp = m as FixpointPredicate;
-          if (fixp != null && fixp.PrefixPredicate != null) {
-            Indent(indent); wr.WriteLine("/***");
-            PrintFunction(fixp.PrefixPredicate, indent, false);
-            Indent(indent); wr.WriteLine("***/");
-          }
-          state = 2;
-        } else {
-          Contract.Assert(false); throw new cce.UnreachableException();  // unexpected member
-        }
-      }
-    }
-
-    /// <summary>
-    /// Prints no space before "kind", but does print a space before "attrs" and "name".
-    /// </summary>
-    void PrintClassMethodHelper(string kind, Attributes attrs, string name, List<TypeParameter> typeArgs) {
-      Contract.Requires(kind != null);
-      Contract.Requires(name != null);
-      Contract.Requires(typeArgs != null);
-      if (kind.Length != 0) {
-        wr.Write(kind);
-      }
-
-      PrintAttributes(attrs);
-
-      wr.Write(" {0}", name);
-      PrintTypeParams(typeArgs);
-    }
-
-    private void PrintTypeParams(List<TypeParameter> typeArgs) {
-      Contract.Requires(typeArgs != null);
-      if (typeArgs.Count != 0) {
-        wr.Write("<" +
-                 Util.Comma(", ", typeArgs,
-                   tp => tp.Name + EqualitySupportSuffix(tp.EqualitySupport))
-                 + ">");
-      }
-    }
-
-    private void PrintTypeInstantiation(List<Type> typeArgs) {
-      Contract.Requires(typeArgs == null || typeArgs.Count != 0);
-      if (typeArgs != null) {
-        wr.Write("<{0}>", Util.Comma(",", typeArgs, ty => ty.ToString()));
-      }
-    }
-
-    public void PrintDatatype(DatatypeDecl dt, int indent) {
-      Contract.Requires(dt != null);
-      Indent(indent);
-      PrintClassMethodHelper(dt is IndDatatypeDecl ? "datatype" : "codatatype", dt.Attributes, dt.Name, dt.TypeArgs);
-      wr.Write(" =");
-      string sep = "";
-      foreach (DatatypeCtor ctor in dt.Ctors) {
-        wr.Write(sep);
-        PrintClassMethodHelper("", ctor.Attributes, ctor.Name, new List<TypeParameter>());
-        if (ctor.Formals.Count != 0) {
-          PrintFormals(ctor.Formals);
-        }
-        sep = " |";
-      }
-      wr.WriteLine();
-    }
-
-    /// <summary>
-    /// Prints a space before each attribute.
-    /// </summary>
-    public void PrintAttributes(Attributes a) {
-      if (a != null) {
-        PrintAttributes(a.Prev);
-        wr.Write(" ");
-        PrintOneAttribute(a);
-      }
-    }
-    public void PrintOneAttribute(Attributes a, string nameSubstitution = null) {
-      Contract.Requires(a != null);
-      var name = nameSubstitution ?? a.Name;
-      var usAttribute = name.StartsWith("_");
-      wr.Write("{1}{{:{0}", name, usAttribute ? "/*" : "");
-      if (a.Args != null) {
-        PrintAttributeArgs(a.Args, false);
-      }
-      wr.Write("}}{0}", usAttribute ? "*/" : "");
-    }
-
-    public void PrintAttributeArgs(List<Expression> args, bool isFollowedBySemicolon) {
-      Contract.Requires(args != null);
-      string prefix = " ";
-      foreach (var arg in args) {
-        Contract.Assert(arg != null);
-        wr.Write(prefix);
-        prefix = ", ";
-        PrintExpression(arg, isFollowedBySemicolon);
-      }
-    }
-
-    public void PrintField(Field field, int indent) {
-      Contract.Requires(field != null);
-      Indent(indent);
-      if (field.IsGhost) {
-        wr.Write("ghost ");
-      }
-      wr.Write("var");
-      PrintAttributes(field.Attributes);
-      wr.Write(" {0}: ", field.Name);
-      PrintType(field.Type);
-      if (field.IsUserMutable) {
-        // nothing more to say
-      } else if (field.IsMutable) {
-        wr.Write("  // non-assignable");
-      } else {
-        wr.Write("  // immutable");
-      }
-      wr.WriteLine();
-    }
-
-    public void PrintFunction(Function f, int indent, bool printSignatureOnly) {
-      Contract.Requires(f != null);
-
-      if (PrintModeSkipFunctionOrMethod(f.IsGhost, f.Attributes, f.Name)) { return; }
-      var isPredicate = f is Predicate || f is PrefixPredicate;
-      Indent(indent);
-      string k = isPredicate ? "predicate" : f is InductivePredicate ? "inductive predicate" : f is CoPredicate ? "copredicate" : "function";
-      if (f.IsProtected) { k = "protected " + k; }
-      if (f.HasStaticKeyword) { k = "static " + k; }
-      if (!f.IsGhost) { k += " method"; }
-      PrintClassMethodHelper(k, f.Attributes, f.Name, f.TypeArgs);
-      if (f.SignatureIsOmitted) {
-        wr.WriteLine(" ...");
-      } else {
-        PrintFormals(f.Formals, f.Name);
-        if (!isPredicate) {
-          wr.Write(": ");
-          PrintType(f.ResultType);
-        }
-        wr.WriteLine();
-      }
-
-      int ind = indent + IndentAmount;
-      PrintSpec("requires", f.Req, ind);
-      PrintFrameSpecLine("reads", f.Reads, ind, null);
-      PrintSpec("ensures", f.Ens, ind);
-      PrintDecreasesSpec(f.Decreases, ind);
-      if (f.Body != null && !printSignatureOnly) {
-        Indent(indent);
-        wr.WriteLine("{");
-        PrintExtendedExpr(f.Body, ind, true, false);
-        Indent(indent);
-        wr.WriteLine("}");
-      }
-    }
-
-    // ----------------------------- PrintMethod -----------------------------
-
-    const int IndentAmount = 2; // The amount of indent for each new scope
-    const string BunchaSpaces = "                                ";
-    void Indent(int amount)
-    {
-      Contract.Requires(0 <= amount);
-
-      while (0 < amount) {
-        wr.Write(BunchaSpaces.Substring(0, amount));
-        amount -= BunchaSpaces.Length;
-      }
-    }
-
-    private bool PrintModeSkipFunctionOrMethod(bool IsGhost, Attributes attributes, string name)
-    {
-      if (printMode == DafnyOptions.PrintModes.NoGhost && IsGhost)
-          { return true; }
-      if (printMode == DafnyOptions.PrintModes.NoIncludes || printMode == DafnyOptions.PrintModes.NoGhost)
-      {
-          bool verify = true;
-          if (Attributes.ContainsBool(attributes, "verify", ref verify) && !verify)
-          { return true; }
-          if (name.Contains("INTERNAL") || name.StartsWith("reveal_"))
-          { return true; }
-      }
-      return false;
-    }
-
-    private bool PrintModeSkipGeneral(Bpl.IToken tok, string fileBeingPrinted)
-    {
-        return (printMode == DafnyOptions.PrintModes.NoIncludes || printMode == DafnyOptions.PrintModes.NoGhost)
-               && (tok.filename != null && fileBeingPrinted != null && Path.GetFullPath(tok.filename) != fileBeingPrinted);
-    }
-
-    public void PrintMethod(Method method, int indent, bool printSignatureOnly) {
-      Contract.Requires(method != null);
-
-      if (PrintModeSkipFunctionOrMethod(method.IsGhost, method.Attributes, method.Name)) { return; }
-      Indent(indent);
-      string k = method is Constructor ? "constructor" :
-        method is InductiveLemma ? "inductive lemma" :
-        method is CoLemma ? "colemma" :
-        method is Lemma ? "lemma" :
-        "method";
-      if (method.HasStaticKeyword) { k = "static " + k; }
-      if (method.IsGhost && !(method is Lemma) && !(method is FixpointLemma)) { k = "ghost " + k; }
-      string nm = method is Constructor && !((Constructor)method).HasName ? "" : method.Name;
-      PrintClassMethodHelper(k, method.Attributes, nm, method.TypeArgs);
-      if (method.SignatureIsOmitted) {
-        wr.WriteLine(" ...");
-      } else {
-        PrintFormals(method.Ins, method.Name);
-        if (method.Outs.Count != 0) {
-          if (method.Ins.Count + method.Outs.Count <= 3) {
-            wr.Write(" returns ");
-          } else {
-            wr.WriteLine();
-            Indent(indent + 2 * IndentAmount);
-            wr.Write("returns ");
-          }
-          PrintFormals(method.Outs);
-        }
-        wr.WriteLine();
-      }
-
-      int ind = indent + IndentAmount;
-      PrintSpec("requires", method.Req, ind);
-      if (method.Mod.Expressions != null)
-      {
-        PrintFrameSpecLine("modifies", method.Mod.Expressions, ind, method.Mod.HasAttributes() ? method.Mod.Attributes : null);
-      }
-      PrintSpec("ensures", method.Ens, ind);
-      PrintDecreasesSpec(method.Decreases, ind);
-
-      if (method.Body != null && !printSignatureOnly) {
-        Indent(indent);
-        PrintStatement(method.Body, indent);
-        wr.WriteLine();
-      }
-    }
-
-    internal void PrintFormals(List<Formal> ff, string name = null) {
-      Contract.Requires(ff != null);
-      if (name != null && name.EndsWith("#")) {
-        wr.Write("[");
-        PrintFormal(ff[0]);
-        wr.Write("]");
-        ff = new List<Formal>(ff.Skip(1));
-      }
-      wr.Write("(");
-      string sep = "";
-      foreach (Formal f in ff) {
-        Contract.Assert(f != null);
-        wr.Write(sep);
-        sep = ", ";
-        PrintFormal(f);
-      }
-      wr.Write(")");
-    }
-
-    void PrintFormal(Formal f) {
-      Contract.Requires(f != null);
-      if (f.IsGhost) {
-        wr.Write("ghost ");
-      }
-      if (f.HasName) {
-        wr.Write("{0}: ", f.DisplayName);
-      }
-      PrintType(f.Type);
-    }
-
-    internal void PrintSpec(string kind, List<Expression> ee, int indent) {
-      Contract.Requires(kind != null);
-      Contract.Requires(ee != null);
-      foreach (Expression e in ee) {
-        Contract.Assert(e != null);
-        Indent(indent);
-        wr.Write("{0} ", kind);
-        PrintExpression(e, true);
-        wr.WriteLine();
-      }
-    }
-
-    internal void PrintDecreasesSpec(Specification<Expression> decs, int indent, bool newLine = true) {
-      Contract.Requires(decs != null);
-      if (printMode == DafnyOptions.PrintModes.NoGhost) { return; }
-      if (decs.Expressions != null && decs.Expressions.Count != 0) {
-        Indent(indent);
-        wr.Write("decreases");
-        if (decs.HasAttributes())
-        {
-          PrintAttributes(decs.Attributes);
-        }
-        wr.Write(" ");
-        PrintExpressionList(decs.Expressions, true);
-        if (newLine) {
-          wr.WriteLine();
-        } else {
-          wr.Write(" ");
-        }
-      }
-    }
-
-    internal void PrintFrameSpecLine(string kind, List<FrameExpression/*!*/> ee, int indent, Attributes attrs, bool newLine = true) {
-      Contract.Requires(kind != null);
-      Contract.Requires(cce.NonNullElements(ee));
-      if (ee != null && ee.Count != 0) {
-        Indent(indent);
-        wr.Write("{0}", kind);
-        if (attrs != null) {
-          PrintAttributes(attrs);
-        }
-        wr.Write(" ");
-        PrintFrameExpressionList(ee);
-        if (newLine) {
-          wr.WriteLine();
-        } else {
-          wr.Write(" ");
-        }
-      }
-    }
-
-    internal void PrintSpec(string kind, List<MaybeFreeExpression> ee, int indent, bool newLine = true) {
-      Contract.Requires(kind != null);
-      Contract.Requires(ee != null);
-      if (printMode == DafnyOptions.PrintModes.NoGhost) { return; }
-      foreach (MaybeFreeExpression e in ee)
-      {
-        Contract.Assert(e != null);
-        Indent(indent);
-        wr.Write("{0}{1}", e.IsFree ? "free " : "", kind);
-
-        if (e.HasAttributes())
-        {
-          PrintAttributes(e.Attributes);
-        }
-
-        wr.Write(" ");
-        PrintExpression(e.E, true);
-        if (newLine) {
-          wr.WriteLine();
-        } else {
-          wr.Write(" ");
-        }
-      }
-    }
-
-    // ----------------------------- PrintType -----------------------------
-
-    public void PrintType(Type ty) {
-      Contract.Requires(ty != null);
-      wr.Write(ty.ToString());
-    }
-
-    public void PrintType(string prefix, Type ty) {
-      Contract.Requires(prefix != null);
-      Contract.Requires(ty != null);
-      string s = ty.ToString();
-      if (s != "?") {
-        wr.Write("{0}{1}", prefix, s);
-      }
-    }
-
-    string EqualitySupportSuffix(TypeParameter.EqualitySupportValue es) {
-      if (es == TypeParameter.EqualitySupportValue.Required ||
-        (es == TypeParameter.EqualitySupportValue.InferredRequired && DafnyOptions.O.DafnyPrintResolvedFile != null)) {
-        return "(==)";
-      } else {
-        return "";
-      }
-    }
-
-    // ----------------------------- PrintStatement -----------------------------
-
-    /// <summary>
-    /// Prints from the current position of the current line.
-    /// If the statement requires several lines, subsequent lines are indented at "indent".
-    /// No newline is printed after the statement.
-    /// </summary>
-    public void PrintStatement(Statement stmt, int indent) {
-      Contract.Requires(stmt != null);
-
-      if (stmt.IsGhost && printMode == DafnyOptions.PrintModes.NoGhost) { return; }
-      for (LList<Label> label = stmt.Labels; label != null; label = label.Next) {
-        if (label.Data.Name != null) {
-          wr.WriteLine("label {0}:", label.Data.Name);
-          Indent(indent);
-        }
-      }
-
-      if (stmt is PredicateStmt) {
-        if (printMode == DafnyOptions.PrintModes.NoGhost) { return; }
-        Expression expr = ((PredicateStmt)stmt).Expr;
-        wr.Write(stmt is AssertStmt ? "assert" : "assume");
-        if (stmt.Attributes != null) {
-          PrintAttributes(stmt.Attributes);
-        }
-        wr.Write(" ");
-        PrintExpression(expr, true);
-        wr.Write(";");
-
-      } else if (stmt is PrintStmt) {
-        PrintStmt s = (PrintStmt)stmt;
-        wr.Write("print");
-        PrintAttributeArgs(s.Args, true);
-        wr.Write(";");
-
-      } else if (stmt is BreakStmt) {
-        BreakStmt s = (BreakStmt)stmt;
-        if (s.TargetLabel != null) {
-          wr.Write("break {0};", s.TargetLabel);
-        } else {
-          string sep = "";
-          for (int i = 0; i < s.BreakCount; i++) {
-            wr.Write("{0}break", sep);
-            sep = " ";
-          }
-          wr.Write(";");
-        }
-
-      } else if (stmt is ProduceStmt) {
-        var s = (ProduceStmt) stmt;
-        wr.Write(s is YieldStmt ? "yield" : "return");
-        if (s.rhss != null) {
-          var sep = " ";
-          foreach (var rhs in s.rhss) {
-            wr.Write(sep);
-            PrintRhs(rhs);
-            sep = ", ";
-          }
-        }
-          wr.Write(";");
-
-      } else if (stmt is AssignStmt) {
-        AssignStmt s = (AssignStmt)stmt;
-        PrintExpression(s.Lhs, true);
-        wr.Write(" := ");
-        PrintRhs(s.Rhs);
-        wr.Write(";");
-
-      } else if (stmt is BlockStmt) {
-        wr.WriteLine("{");
-        int ind = indent + IndentAmount;
-        foreach (Statement s in ((BlockStmt)stmt).Body) {
-          Indent(ind);
-          PrintStatement(s, ind);
-          wr.WriteLine();
-        }
-        Indent(indent);
-        wr.Write("}");
-
-      } else if (stmt is IfStmt) {
-        IfStmt s = (IfStmt)stmt;
-        PrintIfStatement(indent, s, false);
-
-      } else if (stmt is AlternativeStmt) {
-        var s = (AlternativeStmt)stmt;
-        wr.WriteLine("if {");
-        PrintAlternatives(indent, s.Alternatives);
-        Indent(indent);
-        wr.Write("}");
-
-      } else if (stmt is WhileStmt) {
-        WhileStmt s = (WhileStmt)stmt;
-        PrintWhileStatement(indent, s, false, false);
-
-      } else if (stmt is AlternativeLoopStmt) {
-        var s = (AlternativeLoopStmt)stmt;
-        wr.WriteLine("while");
-        PrintSpec("invariant", s.Invariants, indent + IndentAmount);
-        PrintDecreasesSpec(s.Decreases, indent + IndentAmount);
-
-        Indent(indent);
-        wr.WriteLine("{");
-        PrintAlternatives(indent, s.Alternatives);
-        Indent(indent);
-        wr.Write("}");
-
-      } else if (stmt is ForallStmt) {
-        var s = (ForallStmt)stmt;
-        wr.Write("forall");
-        if (s.BoundVars.Count != 0) {
-          wr.Write(" ");
-          PrintQuantifierDomain(s.BoundVars, s.Attributes, s.Range);
-        }
-        if (s.Ens.Count == 0) {
-          wr.Write(" ");
-        } else {
-          wr.WriteLine();
-          PrintSpec("ensures", s.Ens, indent + IndentAmount, s.Body != null);
-          Indent(indent);
-        }
-        if (s.Body != null) {
-          PrintStatement(s.Body, indent);
-        }
-
-      } else if (stmt is ModifyStmt) {
-        var s = (ModifyStmt)stmt;
-        PrintModifyStmt(indent, s, false);
-
-      } else if (stmt is CalcStmt) {
-        CalcStmt s = (CalcStmt)stmt;
-        if (printMode == DafnyOptions.PrintModes.NoGhost) { return; }   // Calcs don't get a "ghost" attribute, but they are.
-        wr.Write("calc ");
-        if (!s.Op.Equals(CalcStmt.DefaultOp)) {
-          PrintCalcOp(s.Op);
-          wr.Write(" ");
-        }
-        wr.WriteLine("{");
-        int lineInd = indent + IndentAmount;
-        int lineCount = s.Lines.Count == 0 ? 0 : s.Lines.Count - 1;  // if nonempty, .Lines always contains a duplicated last line
-        // The number of op/hints is commonly one less than the number of lines, but
-        // it can also equal the number of lines for empty calc's and for calc's with
-        // a dangling hint.
-        int hintCount = s.Lines.Count != 0 && s.Hints.Last().Body.Count == 0 ? lineCount - 1 : lineCount;
-        for (var i = 0; i < lineCount; i++) {
-          var e = s.Lines[i];
-          var op = s.StepOps[i];
-          var h = s.Hints[i];
-          // print the line
-          Indent(lineInd);
-          PrintExpression(e, true, lineInd);
-          wr.WriteLine(";");
-          if (i == hintCount) {
-            break;
-          }
-          // print the operator, if any
-          if (!s.Op.Equals(op)) {
-            Indent(indent);  // this lines up with the "calc"
-            PrintCalcOp(op);
-            wr.WriteLine();
-          }
-          // print the hints
-          foreach (var st in h.Body) {
-            Indent(lineInd);
-            PrintStatement(st, lineInd);
-            wr.WriteLine();
-          }
-        }
-        Indent(indent);
-        wr.Write("}");
-
-      } else if (stmt is MatchStmt) {
-        MatchStmt s = (MatchStmt)stmt;
-        wr.Write("match ");
-        PrintExpression(s.Source, false);
-        if (s.UsesOptionalBraces) {
-          wr.Write(" {");
-        }
-        int caseInd = indent + (s.UsesOptionalBraces ? IndentAmount : 0);
-        foreach (MatchCaseStmt mc in s.Cases) {
-          wr.WriteLine();
-          Indent(caseInd);
-          wr.Write("case {0}", mc.Id);
-          PrintMatchCaseArgument(mc);
-          wr.Write(" =>");
-          foreach (Statement bs in mc.Body) {
-            wr.WriteLine();
-            Indent(caseInd + IndentAmount);
-            PrintStatement(bs, caseInd + IndentAmount);
-          }
-        }
-        if (s.UsesOptionalBraces) {
-          wr.WriteLine();
-          Indent(indent);
-          wr.Write("}");
-        }
-
-      } else if (stmt is ConcreteUpdateStatement) {
-        var s = (ConcreteUpdateStatement)stmt;
-        string sep = "";
-        foreach (var lhs in s.Lhss) {
-          wr.Write(sep);
-          PrintExpression(lhs, true);
-          sep = ", ";
-        }
-        PrintUpdateRHS(s);
-        wr.Write(";");
-
-      } else if (stmt is VarDeclStmt) {
-        var s = (VarDeclStmt)stmt;
-        if (s.Locals.Exists(v => v.IsGhost) && printMode == DafnyOptions.PrintModes.NoGhost) { return; }
-        if (s.Locals.Exists(v => v.IsGhost)) {
-          wr.Write("ghost ");
-        }
-        wr.Write("var");
-        string sep = "";
-        foreach (var local in s.Locals) {
-          wr.Write(sep);
-          if (local.Attributes != null) {
-            PrintAttributes(local.Attributes);
-          }
-          wr.Write(" {0}", local.DisplayName);
-          PrintType(": ", local.OptionalType);
-          sep = ",";
-        }
-        if (s.Update != null) {
-          PrintUpdateRHS(s.Update);
-        }
-        wr.Write(";");
-
-      } else if (stmt is SkeletonStatement) {
-        var s = (SkeletonStatement)stmt;
-        if (s.S == null) {
-          wr.Write("...;");
-        } else if (s.S is AssertStmt) {
-          Contract.Assert(s.ConditionOmitted);
-          wr.Write("assert ...;");
-        } else if (s.S is AssumeStmt) {
-          Contract.Assert(s.ConditionOmitted);
-          wr.Write("assume ...;");
-        } else if (s.S is IfStmt) {
-          PrintIfStatement(indent, (IfStmt)s.S, s.ConditionOmitted);
-        } else if (s.S is WhileStmt) {
-          PrintWhileStatement(indent, (WhileStmt)s.S, s.ConditionOmitted, s.BodyOmitted);
-        } else if (s.S is ModifyStmt) {
-          PrintModifyStmt(indent, (ModifyStmt)s.S, true);
-        } else {
-          Contract.Assert(false); throw new cce.UnreachableException();  // unexpected skeleton statement
-        }
-
-      } else {
-        Contract.Assert(false); throw new cce.UnreachableException();  // unexpected statement
-      }
-    }
-
-    private void PrintModifyStmt(int indent, ModifyStmt s, bool omitFrame) {
-      Contract.Requires(0 <= indent);
-      Contract.Requires(s != null);
-      Contract.Requires(!omitFrame || s.Mod.Expressions.Count == 0);
-
-      wr.Write("modify");
-      PrintAttributes(s.Mod.Attributes);
-      wr.Write(" ");
-      if (omitFrame) {
-        wr.Write("...");
-      } else {
-        PrintFrameExpressionList(s.Mod.Expressions);
-      }
-      if (s.Body != null) {
-        // There's a possible syntactic ambiguity, namely if the frame is empty (more precisely,
-        // if s.Mod.Expressions.Count is 0).  Since the statement was parsed at some point, this
-        // situation can occur only if the modify statement inherited its frame by refinement
-        // and we're printing the post-resolve AST.  In this special case, print an explicit
-        // empty set as the frame.
-        if (s.Mod.Expressions.Count == 0) {
-          wr.Write(" {}");
-        }
-        wr.Write(" ");
-        PrintStatement(s.Body, indent);
-      } else {
-        wr.Write(";");
-      }
-    }
-
-    /// <summary>
-    /// Does not print LHS
-    /// </summary>
-    void PrintUpdateRHS(ConcreteUpdateStatement s) {
-      Contract.Requires(s != null);
-      if (s is UpdateStmt) {
-        var update = (UpdateStmt)s;
-        if (update.Lhss.Count != 0) {
-          wr.Write(" := ");
-        }
-        var sep = "";
-        foreach (var rhs in update.Rhss) {
-          wr.Write(sep);
-          PrintRhs(rhs);
-          sep = ", ";
-        }
-      } else if (s is AssignSuchThatStmt) {
-        var update = (AssignSuchThatStmt)s;
-        wr.Write(" :| ");
-        if (update.AssumeToken != null) {
-          wr.Write("assume ");
-        }
-        PrintExpression(update.Expr, true);
-      } else {
-        Contract.Assert(s == null);  // otherwise, unknown type
-      }
-    }
-
-    void PrintIfStatement(int indent, IfStmt s, bool omitGuard) {
-      while (true) {
-        if (omitGuard) {
-          wr.Write("if ... ");
-        } else {
-          wr.Write("if ");
-          PrintGuard(s.Guard);
-          wr.Write(" ");
-        }
-        PrintStatement(s.Thn, indent);
-        if (s.Els == null) {
-          break;
-        }
-        wr.Write(" else ");
-        if (s.Els is IfStmt) {
-          s = (IfStmt)s.Els;
-        } else {
-          PrintStatement(s.Els, indent);
-          break;
-        }
-      }
-    }
-
-    void PrintWhileStatement(int indent, WhileStmt s, bool omitGuard, bool omitBody) {
-      Contract.Requires(0 <= indent);
-      if (omitGuard) {
-        wr.WriteLine("while ...");
-      } else {
-        wr.Write("while ");
-        PrintGuard(s.Guard);
-        wr.WriteLine();
-      }
-
-      PrintSpec("invariant", s.Invariants, indent + IndentAmount, s.Body != null || omitBody || (s.Decreases.Expressions != null && s.Decreases.Expressions.Count != 0) || (s.Mod.Expressions != null && s.Mod.Expressions.Count != 0));
-      PrintDecreasesSpec(s.Decreases, indent + IndentAmount, s.Body != null || omitBody || (s.Mod.Expressions != null && s.Mod.Expressions.Count != 0));
-      if (s.Mod.Expressions != null) {
-        PrintFrameSpecLine("modifies", s.Mod.Expressions, indent + IndentAmount, s.Mod.HasAttributes() ? s.Mod.Attributes : null, s.Body != null || omitBody);
-      }
-      Indent(indent);
-      if (omitBody) {
-        wr.WriteLine("...;");
-      } else if (s.Body != null) {
-        PrintStatement(s.Body, indent);
-      }
-    }
-
-    void PrintAlternatives(int indent, List<GuardedAlternative> alternatives) {
-      int caseInd = indent + IndentAmount;
-      foreach (var alternative in alternatives) {
-        Indent(caseInd);
-        wr.Write("case ");
-        PrintExpression(alternative.Guard, false);
-        wr.WriteLine(" =>");
-        foreach (Statement s in alternative.Body) {
-          Indent(caseInd + IndentAmount);
-          PrintStatement(s, caseInd + IndentAmount);
-          wr.WriteLine();
-        }
-      }
-    }
-
-    void PrintRhs(AssignmentRhs rhs) {
-      Contract.Requires(rhs != null);
-      if (rhs is ExprRhs) {
-        PrintExpression(((ExprRhs)rhs).Expr, true);
-      } else if (rhs is HavocRhs) {
-        wr.Write("*");
-      } else if (rhs is TypeRhs) {
-        TypeRhs t = (TypeRhs)rhs;
-        wr.Write("new ");
-        if (t.ArrayDimensions != null) {
-          PrintType(t.EType);
-          string s = "[";
-          foreach (Expression dim in t.ArrayDimensions) {
-            Contract.Assume(dim != null);
-            wr.Write(s);
-            PrintExpression(dim, false);
-            s = ", ";
-          }
-          wr.Write("]");
-        } else if (t.Arguments == null) {
-          PrintType(t.EType);
-        } else {
-          PrintType(t.Path);
-          wr.Write("(");
-          PrintExpressionList(t.Arguments, false);
-          wr.Write(")");
-        }
-      } else {
-        Contract.Assert(false); throw new cce.UnreachableException();  // unexpected RHS
-      }
-
-      if (rhs.HasAttributes())
-      {
-        PrintAttributes(rhs.Attributes);
-      }
-    }
-
-    void PrintGuard(Expression guard) {
-      if (guard == null) {
-        wr.Write("*");
-      } else {
-        PrintExpression(guard, false);
-      }
-    }
-
-    void PrintCalcOp(CalcStmt.CalcOp op) {
-      Contract.Requires(op != null);
-      wr.Write(op.ToString());
-      if (op is CalcStmt.TernaryCalcOp) {
-        wr.Write("[");
-        PrintExpression(((CalcStmt.TernaryCalcOp) op).Index, false);
-        wr.Write("]");
-      }
-    }
-
-    // ----------------------------- PrintExpression -----------------------------
-
-    /// <summary>
-    /// PrintExtendedExpr prints an expression, but formats top-level if-then-else and match expressions across several lines.
-    /// Its intended use is thus to print the body of a function.
-    /// </summary>
-    public void PrintExtendedExpr(Expression expr, int indent, bool isRightmost, bool endWithCloseParen) {
-      Contract.Requires(expr != null);
-      if (expr is ITEExpr) {
-        Indent(indent);
-        while (true) {
-          var ite = (ITEExpr)expr;
-          wr.Write("if ");
-          PrintExpression(ite.Test, false);
-          wr.WriteLine(" then");
-          PrintExtendedExpr(ite.Thn, indent + IndentAmount, true, false);
-          expr = ite.Els;
-          if (expr is ITEExpr) {
-            Indent(indent);  wr.Write("else ");
-          } else {
-            Indent(indent);  wr.WriteLine("else");
-            Indent(indent + IndentAmount);
-            PrintExpression(expr, isRightmost, false);
-            wr.WriteLine(endWithCloseParen ? ")" : "");
-            return;
-          }
-        }
-      } else if (expr is MatchExpr) {
-        var e = (MatchExpr)expr;
-        Indent(indent);
-        var parensNeeded = !isRightmost && !e.UsesOptionalBraces;
-        if (parensNeeded) { wr.Write("("); }
-        wr.Write("match ");
-        PrintExpression(e.Source, isRightmost && e.Cases.Count == 0, false);
-        if (e.UsesOptionalBraces) { wr.WriteLine(" {"); }
-        else if (parensNeeded && e.Cases.Count == 0) { wr.WriteLine(")"); }
-        else { wr.WriteLine(); }
-        int i = 0;
-        int ind = indent + (e.UsesOptionalBraces ? IndentAmount : 0);
-        foreach (var mc in e.Cases) {
-          bool isLastCase = i == e.Cases.Count - 1;
-          Indent(ind);
-          wr.Write("case {0}", mc.Id);
-          PrintMatchCaseArgument(mc);          
-          wr.WriteLine(" =>");
-          PrintExtendedExpr(mc.Body, ind + IndentAmount, isLastCase, isLastCase && (parensNeeded || endWithCloseParen));
-          i++;
-        }
-        if (e.UsesOptionalBraces) {
-          Indent(indent);
-          wr.WriteLine("}");
-        }
-      } else if (expr is LetExpr) {
-        var e = (LetExpr)expr;
-        Indent(indent);
-        wr.Write("var ");
-        string sep = "";
-        foreach (var lhs in e.LHSs) {
-          wr.Write(sep);
-          PrintCasePattern(lhs);
-          sep = ", ";
-        }
-        if (e.Exact) {
-          wr.Write(" := ");
-        } else {
-          wr.Write(" :| ");
-        }
-        PrintExpressionList(e.RHSs, true);
-        wr.WriteLine(";");
-        PrintExtendedExpr(e.Body, indent, isRightmost, endWithCloseParen);
-
-      } else if (expr is ParensExpression) {
-        PrintExtendedExpr(((ParensExpression)expr).E, indent, isRightmost, endWithCloseParen);
-      } else {
-        Indent(indent);
-        PrintExpression(expr, false, indent);
-        wr.WriteLine(endWithCloseParen ? ")" : "");
-      }
-    }
-
-    public void PrintMatchCaseArgument(MatchCase mc) {
-      if (mc.Arguments != null) {
-        if (mc.Arguments.Count != 0) {
-          string sep = "(";
-          foreach (BoundVar bv in mc.Arguments) {
-            wr.Write("{0}{1}", sep, bv.DisplayName);
-            if (bv.Type is NonProxyType) {
-              wr.Write(": {0}", bv.Type);
-            }
-            sep = ", ";
-          }
-          wr.Write(")");
-        }
-      } else {
-        Contract.Assert(mc.CasePatterns != null);
-        if (mc.CasePatterns.Count != 0) {
-          string sep = "(";
-          foreach (var cp in mc.CasePatterns) {
-            wr.Write(sep);
-            PrintCasePattern(cp);
-            sep = ", ";
-          }
-          wr.Write(")");
-        }
-      }
-    }
-
-    public void PrintExpression(Expression expr, bool isFollowedBySemicolon) {
-      Contract.Requires(expr != null);
-      PrintExpr(expr, 0, false, true, isFollowedBySemicolon, -1);
-    }
-
-    public void PrintExpression(Expression expr, bool isRightmost, bool isFollowedBySemicolon) {
-      Contract.Requires(expr != null);
-      PrintExpr(expr, 0, false, isRightmost, isFollowedBySemicolon, -1);
-    }
-
-    /// <summary>
-    /// An indent of -1 means print the entire expression on one line.
-    /// </summary>
-    public void PrintExpression(Expression expr, bool isFollowedBySemicolon, int indent) {
-      Contract.Requires(expr != null);
-      PrintExpr(expr, 0, false, true, isFollowedBySemicolon, indent);
-    }
-
-    private bool ParensNeeded(int opBindingStrength, int contextBindingStrength, bool fragileContext) {
-      return opBindingStrength < contextBindingStrength ||
-             (fragileContext && opBindingStrength == contextBindingStrength);
-    }
-
-    /// <summary>
-    /// An indent of -1 means print the entire expression on one line.
-    /// </summary>
-    void PrintExpr(Expression expr, int contextBindingStrength, bool fragileContext, bool isRightmost, bool isFollowedBySemicolon, int indent, int resolv_count = 2)
-    {
-      Contract.Requires(-1 <= indent);
-      Contract.Requires(expr != null);
-
-      /* When debugging:
-      if (resolv_count > 0 && expr.Resolved != null) {
-        PrintExpr(expr.Resolved, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent, resolv_count - 1);
-        return;
-      }
-      */
-
-      if (expr is StaticReceiverExpr) {
-        StaticReceiverExpr e = (StaticReceiverExpr)expr;
-        wr.Write(e.Type);
-      } else if (expr is LiteralExpr) {
-        LiteralExpr e = (LiteralExpr)expr;
-        if (e.Value == null) {
-          wr.Write("null");
-        } else if (e.Value is bool) {
-          wr.Write((bool)e.Value ? "true" : "false");
-        } else if (e is CharLiteralExpr) {
-          wr.Write("'{0}'", (string)e.Value);
-        } else if (e is StringLiteralExpr) {
-          var str = (StringLiteralExpr)e;
-          wr.Write("{0}\"{1}\"", str.IsVerbatim ? "@" : "", (string)e.Value);
-        } else if (e.Value is Basetypes.BigDec) {
-          Basetypes.BigDec dec = (Basetypes.BigDec)e.Value;
-          wr.Write((dec.Mantissa >= 0) ? "" : "-");
-          string s = BigInteger.Abs(dec.Mantissa).ToString();
-          int digits = s.Length;
-          if (dec.Exponent >= 0) {
-            wr.Write("{0}{1}.0", s, new string('0', dec.Exponent));
-          } else {
-            int exp = -dec.Exponent;
-            if (exp < digits) {
-              int intDigits = digits - exp;
-              int fracDigits = digits - intDigits;
-              wr.Write("{0}.{1}", s.Substring(0, intDigits), s.Substring(intDigits, fracDigits));
-            } else {
-              int fracDigits = digits;
-              wr.Write("0.{0}{1}", new string('0', exp - fracDigits), s.Substring(0, fracDigits));
-            }
-          }
-        } else {
-          wr.Write((BigInteger)e.Value);
-        }
-
-      } else if (expr is ThisExpr) {
-        wr.Write("this");
-
-      } else if (expr is IdentifierExpr) {
-        wr.Write(((IdentifierExpr)expr).Name);
-
-      } else if (expr is DatatypeValue) {
-        var dtv = (DatatypeValue)expr;
-        bool printParens;
-        if (dtv.MemberName == BuiltIns.TupleTypeCtorName) {
-          // we're looking at a tuple, whose printed constructor name is essentially the empty string
-          printParens = true;
-        } else {
-          wr.Write("{0}.{1}", dtv.DatatypeName, dtv.MemberName);
-          printParens = dtv.Arguments.Count != 0;
-        }
-        if (printParens) {
-          wr.Write("(");
-          PrintExpressionList(dtv.Arguments, false);
-          wr.Write(")");
-        }
-
-      } else if (expr is DisplayExpression) {
-        DisplayExpression e = (DisplayExpression)expr;
-        if (e is MultiSetDisplayExpr) {
-          wr.Write("multiset");
-        } else if (e is SetDisplayExpr && !((SetDisplayExpr)e).Finite) {
-          wr.Write("iset");
-        }
-        wr.Write(e is SetDisplayExpr || e is MultiSetDisplayExpr ? "{" : "[");
-        PrintExpressionList(e.Elements, false);
-        wr.Write(e is SetDisplayExpr || e is MultiSetDisplayExpr ? "}" : "]");
-
-      } else if (expr is MapDisplayExpr) {
-        MapDisplayExpr e = (MapDisplayExpr)expr;
-        wr.Write(e.Finite ? "map" : "imap");
-        wr.Write("[");
-        PrintExpressionPairList(e.Elements);
-        wr.Write("]");
-
-      } else if (expr is NameSegment) {
-        var e = (NameSegment)expr;
-        wr.Write(e.Name);
-        PrintTypeInstantiation(e.OptTypeArguments);
-
-      } else if (expr is ExprDotName) {
-        var e = (ExprDotName)expr;
-        // determine if parens are needed
-        int opBindingStrength = 0x70;
-        bool parensNeeded = !e.Lhs.IsImplicit && // KRML: I think that this never holds
-          ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
-
-        if (parensNeeded) { wr.Write("("); }
-        if (!e.Lhs.IsImplicit) {
-          PrintExpr(e.Lhs, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
-          wr.Write(".");
-        }
-        wr.Write(e.SuffixName);
-        PrintTypeInstantiation(e.OptTypeArguments);
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is ApplySuffix) {
-        var e = (ApplySuffix)expr;
-        // determine if parens are needed
-        int opBindingStrength = 0x70;
-        bool parensNeeded = !e.Lhs.IsImplicit &&  // KRML: I think that this never holds
-          ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
-
-        if (parensNeeded) { wr.Write("("); }
-        if (ParensMayMatter(e.Lhs)) {
-          wr.Write("(");
-          PrintExpression(e.Lhs, false);
-          wr.Write(")");
-        } else {
-          PrintExpr(e.Lhs, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
-        }
-        wr.Write("(");
-        PrintExpressionList(e.Args, false);
-        wr.Write(")");
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is MemberSelectExpr) {
-        MemberSelectExpr e = (MemberSelectExpr)expr;
-        // determine if parens are needed
-        int opBindingStrength = 0x70;
-        bool parensNeeded = !e.Obj.IsImplicit &&
-          ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
-
-        if (parensNeeded) { wr.Write("("); }
-        if (!(e.Obj.IsImplicit)) {
-          PrintExpr(e.Obj, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
-          wr.Write(".");
-        }
-        wr.Write(e.MemberName);
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is SeqSelectExpr) {
-        SeqSelectExpr e = (SeqSelectExpr)expr;
-        // determine if parens are needed
-        int opBindingStrength = 0x70;
-        bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
-
-        if (parensNeeded) { wr.Write("("); }
-        PrintExpr(e.Seq, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent);
-        wr.Write("[");
-        if (e.SelectOne) {
-          Contract.Assert( e.E0 != null);
-          PrintExpression(e.E0, false);
-        } else {
-          if (e.E0 != null) {
-            PrintExpression(e.E0, false);
-          }
-          wr.Write(e.E0 != null && e.E1 != null ? " .. " : "..");
-          if (e.E1 != null) {
-            PrintExpression(e.E1, false);
-          }
-        }
-        wr.Write("]");
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is MultiSelectExpr) {
-        MultiSelectExpr e = (MultiSelectExpr)expr;
-        // determine if parens are needed
-        int opBindingStrength = 0x70;
-        bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
-
-        if (parensNeeded) { wr.Write("("); }
-        PrintExpr(e.Array, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent);
-        string prefix = "[";
-        foreach (Expression idx in e.Indices) {
-          Contract.Assert(idx != null);
-          wr.Write(prefix);
-          PrintExpression(idx, false);
-          prefix = ", ";
-        }
-        wr.Write("]");
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is SeqUpdateExpr) {
-        SeqUpdateExpr e = (SeqUpdateExpr)expr;
-        if (e.ResolvedUpdateExpr != null)
-        {
-          PrintExpr(e.ResolvedUpdateExpr, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent);
-        }
-        else
-        {
-          // determine if parens are needed
-          int opBindingStrength = 0x70;
-          bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
-
-          if (parensNeeded) { wr.Write("("); }
-          PrintExpr(e.Seq, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent);
-          wr.Write("[");
-          PrintExpression(e.Index, false);
-          wr.Write(" := ");
-          PrintExpression(e.Value, false);
-          wr.Write("]");
-          if (parensNeeded) { wr.Write(")"); }
-        }
-      } else if (expr is ApplyExpr) {
-        var e = (ApplyExpr)expr;
-        // determine if parens are needed
-        int opBindingStrength = 0x70;
-        bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
-
-        if (parensNeeded) { wr.Write("("); }
-
-        PrintExpr(e.Function, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
-        wr.Write("(");
-        PrintExpressionList(e.Args, false);
-        wr.Write(")");
-
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is FunctionCallExpr) {
-        var e = (FunctionCallExpr)expr;
-        // determine if parens are needed
-        int opBindingStrength = 0x70;
-        bool parensNeeded = !(e.Receiver.IsImplicit) &&
-          ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
-
-        if (parensNeeded) { wr.Write("("); }
-        if (!e.Receiver.IsImplicit) {
-          PrintExpr(e.Receiver, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
-          wr.Write(".");
-        }
-        wr.Write(e.Name);
-        /* When debugging, this is nice to have:
-        if (e.TypeArgumentSubstitutions.Count > 0) {
-          wr.Write("[");
-          wr.Write(Util.Comma(",", e.TypeArgumentSubstitutions, kv => kv.Key.FullName() + "->" + kv.Value));
-          wr.Write("]");
-        }
-        */
-        if (e.OpenParen == null && e.Args.Count == 0) {
-        } else {
-          PrintActualArguments(e.Args, e.Name);
-        }
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is OldExpr) {
-        wr.Write("old(");
-        PrintExpression(((OldExpr)expr).E, false);
-        wr.Write(")");
-
-      } else if (expr is MultiSetFormingExpr) {
-        wr.Write("multiset(");
-        PrintExpression(((MultiSetFormingExpr)expr).E, false);
-        wr.Write(")");
-
-      } else if (expr is UnaryOpExpr) {
-        var e = (UnaryOpExpr)expr;
-        if (e.Op == UnaryOpExpr.Opcode.Cardinality) {
-          wr.Write("|");
-          PrintExpression(e.E, false);
-          wr.Write("|");
-        } else if (e.Op == UnaryOpExpr.Opcode.Fresh) {
-          wr.Write("fresh(");
-          PrintExpression(e.E, false);
-          wr.Write(")");
-        } else {
-          // Prefix operator.
-          // determine if parens are needed
-          string op;
-          int opBindingStrength;
-          switch (e.Op) {
-            case UnaryOpExpr.Opcode.Not:
-              op = "!";  opBindingStrength = 0x60;  break;
-            default:
-              Contract.Assert(false); throw new cce.UnreachableException();  // unexpected unary opcode
-          }
-          bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
-
-          bool containsNestedNot = e.E is ParensExpression &&
-                                ((ParensExpression)e.E).E is UnaryExpr &&
-                                ((UnaryOpExpr)((ParensExpression)e.E).E).Op == UnaryOpExpr.Opcode.Not;
-
-          if (parensNeeded) { wr.Write("("); }
-          wr.Write(op);
-          PrintExpr(e.E, opBindingStrength, containsNestedNot, parensNeeded || isRightmost, !parensNeeded && isFollowedBySemicolon, -1);
-          if (parensNeeded) { wr.Write(")"); }
-        }
-
-      } else if (expr is ConversionExpr) {
-        var e = (ConversionExpr)expr;
-        PrintType(e.ToType);
-        wr.Write("(");
-        PrintExpression(e.E, false);
-        wr.Write(")");
-
-      } else if (expr is BinaryExpr) {
-        BinaryExpr e = (BinaryExpr)expr;
-        // determine if parens are needed
-        int opBindingStrength;
-        bool fragileLeftContext = false;  // false means "allow same binding power on left without parens"
-        bool fragileRightContext = false;  // false means "allow same binding power on right without parens"
-        switch (e.Op)
-        {
-          case BinaryExpr.Opcode.Add:
-            opBindingStrength = 0x40; break;
-          case BinaryExpr.Opcode.Sub:
-            opBindingStrength = 0x40; fragileRightContext = true; break;
-          case BinaryExpr.Opcode.Mul:
-            opBindingStrength = 0x50; break;
-          case BinaryExpr.Opcode.Div:
-          case BinaryExpr.Opcode.Mod:
-            opBindingStrength = 0x50; fragileRightContext = true; break;
-          case BinaryExpr.Opcode.Eq:
-          case BinaryExpr.Opcode.Neq:
-          case BinaryExpr.Opcode.Gt:
-          case BinaryExpr.Opcode.Ge:
-          case BinaryExpr.Opcode.Lt:
-          case BinaryExpr.Opcode.Le:
-          case BinaryExpr.Opcode.Disjoint:
-          case BinaryExpr.Opcode.In:
-          case BinaryExpr.Opcode.NotIn:
-            opBindingStrength = 0x30; fragileLeftContext = fragileRightContext = true; break;
-          case BinaryExpr.Opcode.And:
-            opBindingStrength = 0x20; break;
-          case BinaryExpr.Opcode.Or:
-            opBindingStrength = 0x21; break;
-          case BinaryExpr.Opcode.Imp:
-            opBindingStrength = 0x10; fragileLeftContext = true; break;
-          case BinaryExpr.Opcode.Exp:
-            opBindingStrength = 0x11; fragileRightContext = true; break;
-          case BinaryExpr.Opcode.Iff:
-            opBindingStrength = 0x08; break;
-          default:
-            Contract.Assert(false); throw new cce.UnreachableException();  // unexpected binary operator
-        }
-        int opBS = opBindingStrength & 0xF8;
-        int ctxtBS = contextBindingStrength & 0xF8;
-        bool parensNeeded = opBS < ctxtBS ||
-          (opBS == ctxtBS && (opBindingStrength != contextBindingStrength || fragileContext));
-
-        string op = BinaryExpr.OpcodeString(e.Op);
-        if (parensNeeded) { wr.Write("("); }
-        var sem = !parensNeeded && isFollowedBySemicolon;
-        if (0 <= indent && e.Op == BinaryExpr.Opcode.And) {
-          PrintExpr(e.E0, opBindingStrength, fragileLeftContext, false, sem, indent);
-          wr.WriteLine(" {0}", op);
-          Indent(indent);
-          PrintExpr(e.E1, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, indent);
-        } else if (0 <= indent && e.Op == BinaryExpr.Opcode.Imp) {
-          PrintExpr(e.E0, opBindingStrength, fragileLeftContext, false, sem, indent);
-          wr.WriteLine(" {0}", op);
-          int ind = indent + IndentAmount;
-          Indent(ind);
-          PrintExpr(e.E1, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, ind);
-        } else if (0 <= indent && e.Op == BinaryExpr.Opcode.Exp) {
-          PrintExpr(e.E1, opBindingStrength, fragileLeftContext, false, sem, indent);
-          wr.WriteLine(" {0}", op);
-          int ind = indent + IndentAmount;
-          Indent(ind);
-          PrintExpr(e.E0, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, ind);
-        } else if (e.Op == BinaryExpr.Opcode.Exp) {
-          PrintExpr(e.E1, opBindingStrength, fragileLeftContext, false, sem, -1);
-          wr.Write(" {0} ", op);
-          PrintExpr(e.E0, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, -1);
-        } else {
-          PrintExpr(e.E0, opBindingStrength, fragileLeftContext, false, sem, -1);
-          wr.Write(" {0} ", op);
-          PrintExpr(e.E1, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, -1);
-        }
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is TernaryExpr) {
-        var e = (TernaryExpr)expr;
-        switch (e.Op) {
-          case TernaryExpr.Opcode.PrefixEqOp:
-          case TernaryExpr.Opcode.PrefixNeqOp:
-            var opBindingStrength = 0x30;
-            var fragileLeftContext = true;
-            var fragileRightContext = true;
-
-            int opBS = opBindingStrength & 0xF8;
-            int ctxtBS = contextBindingStrength & 0xF8;
-            bool parensNeeded = opBS < ctxtBS ||
-              (opBS == ctxtBS && (opBindingStrength != contextBindingStrength || fragileContext));
-
-            if (parensNeeded) { wr.Write("("); }
-            var sem = !parensNeeded && isFollowedBySemicolon;
-            PrintExpr(e.E1, opBindingStrength, fragileLeftContext, false, sem, -1);
-            wr.Write(" {0}#[", e.Op == TernaryExpr.Opcode.PrefixEqOp ? "==" : "!=");
-            PrintExpression(e.E0, false);
-            wr.Write("] ");
-            PrintExpr(e.E2, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, -1);
-            if (parensNeeded) { wr.Write(")"); }
-            break;
-          default:
-            Contract.Assert(false);  // unexpected ternary operator
-            break;
-        }
-
-      } else if (expr is ChainingExpression) {
-        var e = (ChainingExpression)expr;
-        // determine if parens are needed
-        int opBindingStrength = 0x30;
-        int opBS = opBindingStrength & 0xF8;
-        int ctxtBS = contextBindingStrength & 0xF8;
-        bool parensNeeded = opBS < ctxtBS ||
-          (opBS == ctxtBS && (opBindingStrength != contextBindingStrength || fragileContext));
-
-        if (parensNeeded) { wr.Write("("); }
-        var sem = !parensNeeded && isFollowedBySemicolon;
-        PrintExpr(e.Operands[0], opBindingStrength, true, false, sem, -1);
-        for (int i = 0; i < e.Operators.Count; i++) {
-          string op = BinaryExpr.OpcodeString(e.Operators[i]);
-          if (e.PrefixLimits[i] == null) {
-            wr.Write(" {0} ", op);
-          } else {
-            wr.Write(" {0}#[", op);
-            PrintExpression(e.PrefixLimits[i], false);
-            wr.Write("] ");
-          }
-          PrintExpr(e.Operands[i+1], opBindingStrength, true, i == e.Operators.Count - 1 && (parensNeeded || isRightmost), sem, -1);
-        }
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is LetExpr) {
-        var e = (LetExpr)expr;
-        bool parensNeeded = !isRightmost;
-        if (parensNeeded) { wr.Write("("); }
-        wr.Write("var ");
-        string sep = "";
-        foreach (var lhs in e.LHSs) {
-          wr.Write(sep);
-          PrintCasePattern(lhs);
-          sep = ", ";
-        }
-        if (e.Exact) {
-          wr.Write(" := ");
-        } else {
-          wr.Write(" :| ");
-        }
-        PrintExpressionList(e.RHSs, true);
-        wr.Write("; ");
-        PrintExpression(e.Body, !parensNeeded && isFollowedBySemicolon);
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is QuantifierExpr) {
-        QuantifierExpr e = (QuantifierExpr)expr;
-
-        if (DafnyOptions.O.DafnyPrintResolvedFile != null && e.SplitQuantifier != null) {
-          PrintExpr(e.SplitQuantifierExpression, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent, resolv_count);
-          return;
-        }
-
-        bool parensNeeded = !isRightmost;
-        if (parensNeeded) { wr.Write("("); }
-        wr.Write(e is ForallExpr ? "forall" : "exists");
-        PrintTypeParams(e.TypeArgs); // new!
-        wr.Write(" ");
-        PrintQuantifierDomain(e.BoundVars, e.Attributes, e.Range);
-        wr.Write(" :: ");
-        if (0 <= indent) {
-          int ind = indent + IndentAmount;
-          wr.WriteLine();
-          Indent(ind);
-          PrintExpression(e.Term, !parensNeeded && isFollowedBySemicolon, ind);
-        } else {
-          PrintExpression(e.Term, !parensNeeded && isFollowedBySemicolon);
-        }
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is NamedExpr) {
-        var e = (NamedExpr)expr;
-        wr.Write("expr {0}: ", e.Name);
-        PrintExpression(e.Body, isFollowedBySemicolon);
-
-       } else if (expr is SetComprehension) {
-        var e = (SetComprehension)expr;
-        bool parensNeeded = !isRightmost;
-        if (parensNeeded) { wr.Write("("); }
-        wr.Write("set ");
-        string sep = "";
-        foreach (BoundVar bv in e.BoundVars) {
-          wr.Write("{0}{1}", sep, bv.DisplayName);
-          sep = ", ";
-          PrintType(": ", bv.Type);
-        }
-        PrintAttributes(e.Attributes);
-        wr.Write(" | ");
-        PrintExpression(e.Range, !parensNeeded && isFollowedBySemicolon);
-        if (!e.TermIsImplicit) {
-          wr.Write(" :: ");
-          PrintExpression(e.Term, !parensNeeded && isFollowedBySemicolon);
-        }
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is MapComprehension) {
-        var e = (MapComprehension)expr;
-        bool parensNeeded = !isRightmost;
-        if (parensNeeded) { wr.Write("("); }
-        wr.Write(e.Finite ? "map " : "imap ");
-        string sep = "";
-        foreach (BoundVar bv in e.BoundVars) {
-          wr.Write("{0}{1}", sep, bv.DisplayName);
-          sep = ", ";
-          PrintType(": ", bv.Type);
-        }
-        PrintAttributes(e.Attributes);
-        wr.Write(" | ");
-        PrintExpression(e.Range, !parensNeeded && isFollowedBySemicolon);
-        wr.Write(" :: ");
-        PrintExpression(e.Term, !parensNeeded && isFollowedBySemicolon);
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is LambdaExpr) {
-        var e = (LambdaExpr)expr;
-        bool parensNeeded = !isRightmost;
-        if (parensNeeded) { wr.Write("("); }
-        var skipSignatureParens = e.BoundVars.Count == 1 && e.BoundVars[0].Type is InferredTypeProxy;
-        if (!skipSignatureParens) { wr.Write("("); }
-        wr.Write(Util.Comma(", ", e.BoundVars, bv => bv.DisplayName + (bv.Type is InferredTypeProxy ? "" : ": " + bv.Type)));
-        if (!skipSignatureParens) { wr.Write(")"); }
-        if (e.Range != null) {
-          wr.Write(" requires ");
-          PrintExpression(e.Range, false);
-        }
-        foreach (var read in e.Reads) {
-          wr.Write(" reads ");
-          PrintExpression(read.E, false);
-        }
-        wr.Write(e.OneShot ? " -> " : " => ");
-        PrintExpression(e.Body, isFollowedBySemicolon);
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is WildcardExpr) {
-        wr.Write("*");
-
-      } else if (expr is StmtExpr) {
-        var e = (StmtExpr)expr;
-        bool parensNeeded;
-        if (e.S is AssertStmt || e.S is AssumeStmt || e.S is CalcStmt) {
-          parensNeeded = !isRightmost;
-        } else {
-          parensNeeded = !isRightmost || isFollowedBySemicolon;
-        }
-        if (parensNeeded) { wr.Write("("); }
-        int ind = indent < 0 ? IndentAmount : indent;  // if the expression was to be printed on one line, instead print the .S part at indentation IndentAmount (not pretty, but something)
-        PrintStatement(e.S, ind);
-        wr.Write(" ");
-        PrintExpression(e.E, !parensNeeded && isFollowedBySemicolon);
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is ITEExpr) {
-        ITEExpr ite = (ITEExpr)expr;
-        bool parensNeeded = !isRightmost;
-        if (parensNeeded) { wr.Write("("); }
-        wr.Write("if ");
-        PrintExpression(ite.Test, false);
-        wr.Write(" then ");
-        PrintExpression(ite.Thn, false);
-        wr.Write(" else ");
-        PrintExpression(ite.Els, !parensNeeded && isFollowedBySemicolon);
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is ParensExpression) {
-        var e = (ParensExpression)expr;
-        // printing of parentheses is done optimally, not according to the parentheses in the given program
-        PrintExpr(e.E, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent);
-
-      } else if (expr is NegationExpression) {
-        var e = (NegationExpression)expr;
-        string op = "-";
-        int opBindingStrength = 0x60;
-        bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
-
-        bool containsNestedNegation = e.E is ParensExpression && ((ParensExpression)e.E).E is NegationExpression;
-
-        if (parensNeeded) { wr.Write("("); }
-        wr.Write(op);
-        PrintExpr(e.E, opBindingStrength, containsNestedNegation, parensNeeded || isRightmost, !parensNeeded && isFollowedBySemicolon, -1);
-        if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is MatchExpr) {
-        var e = (MatchExpr)expr;
-        var parensNeeded = !isRightmost && !e.UsesOptionalBraces;
-        if (parensNeeded) { wr.Write("("); }
-        wr.Write("match ");
-        PrintExpression(e.Source, isRightmost && e.Cases.Count == 0, !parensNeeded && isFollowedBySemicolon);
-        if (e.UsesOptionalBraces) { wr.Write(" {"); }
-        int i = 0;
-        foreach (var mc in e.Cases) {
-          bool isLastCase = i == e.Cases.Count - 1;
-          wr.Write(" case {0}", mc.Id);
-          PrintMatchCaseArgument(mc);
-          wr.Write(" => ");
-          PrintExpression(mc.Body, isRightmost && isLastCase, !parensNeeded && isFollowedBySemicolon);
-          i++;
-        }
-        if (e.UsesOptionalBraces) { wr.Write(" }"); }
-        else if (parensNeeded) { wr.Write(")"); }
-
-      } else if (expr is BoxingCastExpr) {
-        // this is not expected for a parsed program, but we may be called for /trace purposes in the translator
-        var e = (BoxingCastExpr)expr;
-        PrintExpr(e.E, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent);
-      } else if (expr is Translator.BoogieWrapper) {
-        wr.Write("[BoogieWrapper]");  // this is somewhat unexpected, but we can get here if the /trace switch is used, so it seems best to cover this case here
-      } else {
-        Contract.Assert(false); throw new cce.UnreachableException();  // unexpected expression
-      }
-    }
-
-    bool ParensMayMatter(Expression expr) {
-      Contract.Requires(expr != null);
-      int parenPairs = 0;
-      for (; expr is ParensExpression; parenPairs++) {
-        expr = ((ParensExpression)expr).E;
-      }
-      // If the program were resolved, we could be more precise than the following (in particular, looking
-      // to see if expr denotes a MemberSelectExpr of a member that is a Function.
-      return parenPairs != 0 && (expr is NameSegment || expr is ExprDotName);
-    }
-
-    void PrintCasePattern(CasePattern pat) {
-      Contract.Requires(pat != null);
-      var v = pat.Var;
-      if (v != null) {
-        wr.Write(v.DisplayName);
-        if (v.Type is NonProxyType || DafnyOptions.O.DafnyPrintResolvedFile != null) {
-          PrintType(": ", v.Type);
-        }
-      } else {
-        wr.Write(pat.Id);
-        if (pat.Arguments != null) {
-          wr.Write("(");
-          var sep = "";
-          foreach (var arg in pat.Arguments) {
-            wr.Write(sep);
-            PrintCasePattern(arg);
-            sep = ", ";
-          }
-          wr.Write(")");
-        }
-      }
-    }
-
-    private void PrintQuantifierDomain(List<BoundVar> boundVars, Attributes attrs, Expression range) {
-      Contract.Requires(boundVars != null);
-      string sep = "";
-      foreach (BoundVar bv in boundVars) {
-        wr.Write("{0}{1}", sep, bv.DisplayName);
-        PrintType(": ", bv.Type);
-        sep = ", ";
-      }
-      PrintAttributes(attrs);
-      if (range != null) {
-        wr.Write(" | ");
-        PrintExpression(range, false);
-      }
-    }
-
-    void PrintActualArguments(List<Expression> args, string name) {
-      Contract.Requires(args != null);
-      Contract.Requires(name != null);
-      if (name.EndsWith("#")) {
-        wr.Write("[");
-        PrintExpression(args[0], false);
-        wr.Write("]");
-        args = new List<Expression>(args.Skip(1));
-      }
-      wr.Write("(");
-      PrintExpressionList(args, false);
-      wr.Write(")");
-    }
-
-    void PrintExpressionList(List<Expression> exprs, bool isFollowedBySemicolon) {
-      Contract.Requires(exprs != null);
-      string sep = "";
-      foreach (Expression e in exprs) {
-        Contract.Assert(e != null);
-        wr.Write(sep);
-        sep = ", ";
-        PrintExpression(e, isFollowedBySemicolon);
-      }
-    }
-    void PrintExpressionPairList(List<ExpressionPair> exprs) {
-      Contract.Requires(exprs != null);
-      string sep = "";
-      foreach (ExpressionPair p in exprs) {
-        Contract.Assert(p != null);
-        wr.Write(sep);
-        sep = ", ";
-        PrintExpression(p.A, false);
-        wr.Write(":=");
-        PrintExpression(p.B, false);
-      }
-    }
-
-    void PrintFrameExpressionList(List<FrameExpression/*!*/>/*!*/ fexprs) {
-      Contract.Requires(fexprs != null);
-      string sep = "";
-      foreach (FrameExpression fe in fexprs) {
-        Contract.Assert(fe != null);
-        wr.Write(sep);
-        sep = ", ";
-        PrintExpression(fe.E, true);
-        if (fe.FieldName != null) {
-          wr.Write("`{0}", fe.FieldName);
-        }
-      }
-    }
-  }
-}
+//-----------------------------------------------------------------------------
+//
+// Copyright (C) Microsoft Corporation.  All Rights Reserved.
+//
+//-----------------------------------------------------------------------------
+using System;
+using System.IO;
+using System.Collections.Generic;
+using System.Diagnostics.Contracts;
+using System.Numerics;
+using System.Linq;
+using Bpl = Microsoft.Boogie;
+
+namespace Microsoft.Dafny {
+  public class Printer {
+    TextWriter wr;
+    DafnyOptions.PrintModes printMode;
+
+    [ContractInvariantMethod]
+    void ObjectInvariant()
+    {
+      Contract.Invariant(wr!=null);
+    }
+
+    public Printer(TextWriter wr, DafnyOptions.PrintModes printMode = DafnyOptions.PrintModes.Everything) {
+      Contract.Requires(wr != null);
+      this.wr = wr;
+      this.printMode = printMode;
+    }
+
+    public static string ExprToString(Expression expr)
+    {
+      Contract.Requires(expr != null);
+      using (var wr = new System.IO.StringWriter()) {
+        var pr = new Printer(wr);
+        pr.PrintExpression(expr, false);
+        return wr.ToString();
+      }
+    }
+
+    public static string GuardToString(Expression expr) {
+      using (var wr = new System.IO.StringWriter()) {
+        var pr = new Printer(wr);
+        pr.PrintGuard(expr);
+        return wr.ToString();
+      }
+    }
+
+    public static string ExtendedExprToString(Expression expr) {
+      Contract.Requires(expr != null);
+      using (var wr = new System.IO.StringWriter()) {
+        var pr = new Printer(wr);
+        pr.PrintExtendedExpr(expr, 0, true, false);
+        return wr.ToString();
+      }
+    }
+
+    public static string FrameExprListToString(List<FrameExpression> fexprs) {
+      Contract.Requires(fexprs != null);
+      using (var wr = new System.IO.StringWriter()) {
+        var pr = new Printer(wr);
+        pr.PrintFrameExpressionList(fexprs);
+        return wr.ToString();
+      }
+    }
+
+    public static string StatementToString(Statement stmt) {
+      Contract.Requires(stmt != null);
+      using (var wr = new System.IO.StringWriter()) {
+        var pr = new Printer(wr);
+        pr.PrintStatement(stmt, 0);
+        return ToStringWithoutNewline(wr);
+      }
+    }
+
+    public static string IteratorClassToString(IteratorDecl iter) {
+      Contract.Requires(iter != null);
+      using (var wr = new System.IO.StringWriter()) {
+        var pr = new Printer(wr);
+        pr.PrintIteratorClass(iter, 0, null);
+        return ToStringWithoutNewline(wr);
+      }
+    }
+
+    public static string IteratorSignatureToString(IteratorDecl iter) {
+      Contract.Requires(iter != null);
+      using (var wr = new System.IO.StringWriter()) {
+        var pr = new Printer(wr);
+        pr.PrintIteratorSignature(iter, 0);
+        return ToStringWithoutNewline(wr);
+      }
+    }
+
+    public static string FunctionSignatureToString(Function f) {
+      Contract.Requires(f != null);
+      using (var wr = new System.IO.StringWriter()) {
+        var pr = new Printer(wr);
+        pr.PrintFunction(f, 0, true);
+        return ToStringWithoutNewline(wr);
+      }
+    }
+
+    public static string MethodSignatureToString(Method m) {
+      Contract.Requires(m != null);
+      using (var wr = new System.IO.StringWriter()) {
+        var pr = new Printer(wr);
+        pr.PrintMethod(m, 0, true);
+        return ToStringWithoutNewline(wr);
+      }
+    }
+
+    public static string OneAttributeToString(Attributes a, string nameSubstitution = null) {
+      Contract.Requires(a != null);
+      using (var wr = new System.IO.StringWriter()) {
+        var pr = new Printer(wr);
+        pr.PrintOneAttribute(a, nameSubstitution);
+        return ToStringWithoutNewline(wr);
+      }
+    }
+
+    public static string ToStringWithoutNewline(System.IO.StringWriter wr) {
+      Contract.Requires(wr != null);
+      var sb = wr.GetStringBuilder();
+      var len = sb.Length;
+      while (len > 0 && (sb[len - 1] == '\n' || sb[len - 1] == '\r')) {
+        len--;
+      }
+      return sb.ToString(0, len);
+    }
+
+    public void PrintProgram(Program prog) {
+      Contract.Requires(prog != null);
+      if (Bpl.CommandLineOptions.Clo.ShowEnv != Bpl.CommandLineOptions.ShowEnvironment.Never) {
+        wr.WriteLine("// " + Bpl.CommandLineOptions.Clo.Version);
+        wr.WriteLine("// " + Bpl.CommandLineOptions.Clo.Environment);
+      }
+      wr.WriteLine("// {0}", prog.Name);
+      if (DafnyOptions.O.DafnyPrintResolvedFile != null && DafnyOptions.O.PrintMode == DafnyOptions.PrintModes.Everything) {
+        wr.WriteLine();
+        wr.WriteLine("/*");
+        PrintModuleDefinition(prog.BuiltIns.SystemModule, 0, Path.GetFullPath(DafnyOptions.O.DafnyPrintResolvedFile));
+        wr.WriteLine("*/");
+      }
+      wr.WriteLine();
+      PrintCallGraph(prog.DefaultModuleDef, 0);
+      PrintTopLevelDecls(prog.DefaultModuleDef.TopLevelDecls, 0, Path.GetFullPath(prog.FullName));
+      wr.Flush();
+    }
+
+    public void PrintCallGraph(ModuleDefinition module, int indent) {
+      Contract.Requires(module != null);
+      Contract.Requires(0 <= indent);
+      if (DafnyOptions.O.DafnyPrintResolvedFile != null && DafnyOptions.O.PrintMode == DafnyOptions.PrintModes.Everything) {
+         // print call graph
+        Indent(indent); wr.WriteLine("/* CALL GRAPH for module {0}:", module.Name);
+        var SCCs = module.CallGraph.TopologicallySortedComponents();
+        SCCs.Reverse();
+        foreach (var clbl in SCCs) {
+          Indent(indent); wr.WriteLine(" * SCC at height {0}:", module.CallGraph.GetSCCRepresentativeId(clbl));
+          var r = module.CallGraph.GetSCC(clbl);
+          foreach (var m in r) {
+            Indent(indent); wr.WriteLine(" *   {0}", m.NameRelativeToModule);
+          }
+        }
+        Indent(indent); wr.WriteLine(" */");
+      }
+    }
+
+    public void PrintTopLevelDecls(List<TopLevelDecl> decls, int indent, string fileBeingPrinted) {
+      Contract.Requires(decls!= null);
+      int i = 0;
+      foreach (TopLevelDecl d in decls) {
+        Contract.Assert(d != null);
+        if (PrintModeSkipGeneral(d.tok, fileBeingPrinted)) { continue; }
+        if (d is OpaqueTypeDecl) {
+          var at = (OpaqueTypeDecl)d;
+          if (i++ != 0) { wr.WriteLine(); }
+          Indent(indent);
+          PrintClassMethodHelper("type", at.Attributes, at.Name, new List<TypeParameter>());
+          wr.Write(EqualitySupportSuffix(at.EqualitySupport));
+          wr.WriteLine();
+        } else if (d is NewtypeDecl) {
+          var dd = (NewtypeDecl)d;
+          if (i++ != 0) { wr.WriteLine(); }
+          Indent(indent);
+          PrintClassMethodHelper("newtype", dd.Attributes, dd.Name, new List<TypeParameter>());
+          wr.Write(" = ");
+          if (dd.Var == null) {
+            PrintType(dd.BaseType);
+          } else {
+            wr.Write(dd.Var.DisplayName);
+            if (!(dd.Var.Type is TypeProxy) || DafnyOptions.O.DafnyPrintResolvedFile != null) {
+              wr.Write(": ");
+              PrintType(dd.BaseType);
+            }
+            wr.Write(" | ");
+            PrintExpression(dd.Constraint, true);
+          }
+          wr.WriteLine();
+        } else if (d is TypeSynonymDecl) {
+          var syn = (TypeSynonymDecl)d;
+          if (i++ != 0) { wr.WriteLine(); }
+          Indent(indent);
+          PrintClassMethodHelper("type", syn.Attributes, syn.Name, syn.TypeArgs);
+          wr.Write(" = ");
+          PrintType(syn.Rhs);
+          wr.WriteLine();
+        } else if (d is DatatypeDecl) {
+          if (i++ != 0) { wr.WriteLine(); }
+          PrintDatatype((DatatypeDecl)d, indent);
+        } else if (d is IteratorDecl) {
+          var iter = (IteratorDecl)d;
+          PrintIteratorSignature(iter, indent);
+
+          if (iter.Body != null) {
+            Indent(indent);
+            PrintStatement(iter.Body, indent);
+            wr.WriteLine();
+          }
+
+          if (DafnyOptions.O.DafnyPrintResolvedFile != null) {
+            // also print the members that were created as part of the interpretation of the iterator
+            Contract.Assert(iter.Members.Count != 0);  // filled in during resolution
+            wr.WriteLine("/*---------- iterator members ----------");
+            PrintIteratorClass(iter, indent, fileBeingPrinted);
+            wr.WriteLine("---------- iterator members ----------*/");
+          }
+
+        } else if (d is ClassDecl) {
+          ClassDecl cl = (ClassDecl)d;
+          if (!cl.IsDefaultClass) {
+            if (i++ != 0) { wr.WriteLine(); }
+            PrintClass(cl, indent, fileBeingPrinted);
+          } else if (cl.Members.Count == 0) {
+            // print nothing
+          } else {
+            if (i++ != 0) { wr.WriteLine(); }
+            PrintMembers(cl.Members, indent, fileBeingPrinted);
+          }
+
+        } else if (d is ModuleDecl) {
+          wr.WriteLine();
+          Indent(indent);
+          if (d is LiteralModuleDecl) {
+            ModuleDefinition module = ((LiteralModuleDecl)d).ModuleDef;
+            PrintModuleDefinition(module, indent, fileBeingPrinted);
+          } else if (d is AliasModuleDecl) {
+            wr.Write("import"); if (((AliasModuleDecl)d).Opened) wr.Write(" opened");
+            wr.Write(" {0} ", ((AliasModuleDecl)d).Name);
+            wr.WriteLine("= {0}", Util.Comma(".", ((AliasModuleDecl)d).Path, id => id.val));
+          } else if (d is ModuleFacadeDecl) {
+            wr.Write("import"); if (((ModuleFacadeDecl)d).Opened) wr.Write(" opened");
+            wr.Write(" {0} ", ((ModuleFacadeDecl)d).Name);
+            wr.WriteLine("as {0}", Util.Comma(".", ((ModuleFacadeDecl)d).Path, id => id.val));
+          }
+
+        } else {
+          Contract.Assert(false);  // unexpected TopLevelDecl
+        }
+      }
+    }
+
+    void PrintModuleDefinition(ModuleDefinition module, int indent, string fileBeingPrinted) {
+      Contract.Requires(module != null);
+      Contract.Requires(0 <= indent);
+      if (module.IsAbstract) {
+        wr.Write("abstract ");
+      }
+      wr.Write("module");
+      PrintAttributes(module.Attributes);
+      wr.Write(" {0} ", module.Name);
+      if (module.RefinementBaseName != null) {
+        wr.Write("refines {0} ", Util.Comma(".", module.RefinementBaseName, id => id.val));
+      }
+      if (module.TopLevelDecls.Count == 0) {
+        wr.WriteLine("{ }");
+      } else {
+        wr.WriteLine("{");
+        PrintCallGraph(module, indent + IndentAmount);
+        PrintTopLevelDecls(module.TopLevelDecls, indent + IndentAmount, fileBeingPrinted);
+        Indent(indent);
+        wr.WriteLine("}");
+      }
+    }
+
+    void PrintIteratorSignature(IteratorDecl iter, int indent) {
+      Indent(indent);
+      PrintClassMethodHelper("iterator", iter.Attributes, iter.Name, iter.TypeArgs);
+      if (iter.SignatureIsOmitted) {
+        wr.WriteLine(" ...");
+      } else {
+        PrintFormals(iter.Ins);
+        if (iter.Outs.Count != 0) {
+          if (iter.Ins.Count + iter.Outs.Count <= 3) {
+            wr.Write(" yields ");
+          } else {
+            wr.WriteLine();
+            Indent(indent + 2 * IndentAmount);
+            wr.Write("yields ");
+          }
+          PrintFormals(iter.Outs);
+        }
+        wr.WriteLine();
+      }
+
+      int ind = indent + IndentAmount;
+      PrintSpec("requires", iter.Requires, ind);
+      if (iter.Reads.Expressions != null) {
+        PrintFrameSpecLine("reads", iter.Reads.Expressions, ind, iter.Reads.HasAttributes() ? iter.Reads.Attributes : null);
+      }
+      if (iter.Modifies.Expressions != null) {
+        PrintFrameSpecLine("modifies", iter.Modifies.Expressions, ind, iter.Modifies.HasAttributes() ? iter.Modifies.Attributes : null);
+      }
+      PrintSpec("yield requires", iter.YieldRequires, ind);
+      PrintSpec("yield ensures", iter.YieldEnsures, ind);
+      PrintSpec("ensures", iter.Ensures, ind);
+      PrintDecreasesSpec(iter.Decreases, ind);
+    }
+
+    private void PrintIteratorClass(IteratorDecl iter, int indent, string fileBeingPrinted) {
+      PrintClassMethodHelper("class", null, iter.Name, iter.TypeArgs);
+      wr.WriteLine(" {");
+      PrintMembers(iter.Members, indent + IndentAmount, fileBeingPrinted);
+      Indent(indent); wr.WriteLine("}");
+    }
+
+    public void PrintClass(ClassDecl c, int indent, string fileBeingPrinted) {
+      Contract.Requires(c != null);
+      Indent(indent);
+      PrintClassMethodHelper((c is TraitDecl) ? "trait" : "class", c.Attributes, c.Name, c.TypeArgs);
+      string sep = " extends ";
+      foreach (var trait in c.TraitsTyp) {
+        wr.Write(sep);
+        PrintType(trait);
+        sep = ", ";
+      }
+      if (c.Members.Count == 0) {
+        wr.WriteLine(" { }");
+      } else {
+        wr.WriteLine(" {");
+        PrintMembers(c.Members, indent + IndentAmount, fileBeingPrinted);
+        Indent(indent);
+        wr.WriteLine("}");
+      }
+    }
+
+    public void PrintMembers(List<MemberDecl> members, int indent, string fileBeingPrinted)
+    {
+      Contract.Requires(members != null);
+
+      int state = 0;  // 0 - no members yet; 1 - previous member was a field; 2 - previous member was non-field
+      foreach (MemberDecl m in members) {
+        if (PrintModeSkipGeneral(m.tok, fileBeingPrinted)) { continue; }
+        if (m is Method) {
+          if (state != 0) { wr.WriteLine(); }
+          PrintMethod((Method)m, indent, false);
+          var com = m as FixpointLemma;
+          if (com != null && com.PrefixLemma != null) {
+            Indent(indent); wr.WriteLine("/***");
+            PrintMethod(com.PrefixLemma, indent, false);
+            Indent(indent); wr.WriteLine("***/");
+          }
+          state = 2;
+        } else if (m is Field) {
+          if (state == 2) { wr.WriteLine(); }
+          PrintField((Field)m, indent);
+          state = 1;
+        } else if (m is Function) {
+          if (state != 0) { wr.WriteLine(); }
+          PrintFunction((Function)m, indent, false);
+          var fixp = m as FixpointPredicate;
+          if (fixp != null && fixp.PrefixPredicate != null) {
+            Indent(indent); wr.WriteLine("/***");
+            PrintFunction(fixp.PrefixPredicate, indent, false);
+            Indent(indent); wr.WriteLine("***/");
+          }
+          state = 2;
+        } else {
+          Contract.Assert(false); throw new cce.UnreachableException();  // unexpected member
+        }
+      }
+    }
+
+    /// <summary>
+    /// Prints no space before "kind", but does print a space before "attrs" and "name".
+    /// </summary>
+    void PrintClassMethodHelper(string kind, Attributes attrs, string name, List<TypeParameter> typeArgs) {
+      Contract.Requires(kind != null);
+      Contract.Requires(name != null);
+      Contract.Requires(typeArgs != null);
+      if (kind.Length != 0) {
+        wr.Write(kind);
+      }
+
+      PrintAttributes(attrs);
+
+      wr.Write(" {0}", name);
+      PrintTypeParams(typeArgs);
+    }
+
+    private void PrintTypeParams(List<TypeParameter> typeArgs) {
+      Contract.Requires(typeArgs != null);
+      if (typeArgs.Count != 0) {
+        wr.Write("<" +
+                 Util.Comma(", ", typeArgs,
+                   tp => tp.Name + EqualitySupportSuffix(tp.EqualitySupport))
+                 + ">");
+      }
+    }
+
+    private void PrintTypeInstantiation(List<Type> typeArgs) {
+      Contract.Requires(typeArgs == null || typeArgs.Count != 0);
+      if (typeArgs != null) {
+        wr.Write("<{0}>", Util.Comma(",", typeArgs, ty => ty.ToString()));
+      }
+    }
+
+    public void PrintDatatype(DatatypeDecl dt, int indent) {
+      Contract.Requires(dt != null);
+      Indent(indent);
+      PrintClassMethodHelper(dt is IndDatatypeDecl ? "datatype" : "codatatype", dt.Attributes, dt.Name, dt.TypeArgs);
+      wr.Write(" =");
+      string sep = "";
+      foreach (DatatypeCtor ctor in dt.Ctors) {
+        wr.Write(sep);
+        PrintClassMethodHelper("", ctor.Attributes, ctor.Name, new List<TypeParameter>());
+        if (ctor.Formals.Count != 0) {
+          PrintFormals(ctor.Formals);
+        }
+        sep = " |";
+      }
+      wr.WriteLine();
+    }
+
+    /// <summary>
+    /// Prints a space before each attribute.
+    /// </summary>
+    public void PrintAttributes(Attributes a) {
+      if (a != null) {
+        PrintAttributes(a.Prev);
+        wr.Write(" ");
+        PrintOneAttribute(a);
+      }
+    }
+    public void PrintOneAttribute(Attributes a, string nameSubstitution = null) {
+      Contract.Requires(a != null);
+      var name = nameSubstitution ?? a.Name;
+      var usAttribute = name.StartsWith("_");
+      wr.Write("{1}{{:{0}", name, usAttribute ? "/*" : "");
+      if (a.Args != null) {
+        PrintAttributeArgs(a.Args, false);
+      }
+      wr.Write("}}{0}", usAttribute ? "*/" : "");
+    }
+
+    public void PrintAttributeArgs(List<Expression> args, bool isFollowedBySemicolon) {
+      Contract.Requires(args != null);
+      string prefix = " ";
+      foreach (var arg in args) {
+        Contract.Assert(arg != null);
+        wr.Write(prefix);
+        prefix = ", ";
+        PrintExpression(arg, isFollowedBySemicolon);
+      }
+    }
+
+    public void PrintField(Field field, int indent) {
+      Contract.Requires(field != null);
+      Indent(indent);
+      if (field.IsGhost) {
+        wr.Write("ghost ");
+      }
+      wr.Write("var");
+      PrintAttributes(field.Attributes);
+      wr.Write(" {0}: ", field.Name);
+      PrintType(field.Type);
+      if (field.IsUserMutable) {
+        // nothing more to say
+      } else if (field.IsMutable) {
+        wr.Write("  // non-assignable");
+      } else {
+        wr.Write("  // immutable");
+      }
+      wr.WriteLine();
+    }
+
+    public void PrintFunction(Function f, int indent, bool printSignatureOnly) {
+      Contract.Requires(f != null);
+
+      if (PrintModeSkipFunctionOrMethod(f.IsGhost, f.Attributes, f.Name)) { return; }
+      var isPredicate = f is Predicate || f is PrefixPredicate;
+      Indent(indent);
+      string k = isPredicate ? "predicate" : f is InductivePredicate ? "inductive predicate" : f is CoPredicate ? "copredicate" : "function";
+      if (f.IsProtected) { k = "protected " + k; }
+      if (f.HasStaticKeyword) { k = "static " + k; }
+      if (!f.IsGhost) { k += " method"; }
+      PrintClassMethodHelper(k, f.Attributes, f.Name, f.TypeArgs);
+      if (f.SignatureIsOmitted) {
+        wr.WriteLine(" ...");
+      } else {
+        PrintFormals(f.Formals, f.Name);
+        if (!isPredicate) {
+          wr.Write(": ");
+          PrintType(f.ResultType);
+        }
+        wr.WriteLine();
+      }
+
+      int ind = indent + IndentAmount;
+      PrintSpec("requires", f.Req, ind);
+      PrintFrameSpecLine("reads", f.Reads, ind, null);
+      PrintSpec("ensures", f.Ens, ind);
+      PrintDecreasesSpec(f.Decreases, ind);
+      if (f.Body != null && !printSignatureOnly) {
+        Indent(indent);
+        wr.WriteLine("{");
+        PrintExtendedExpr(f.Body, ind, true, false);
+        Indent(indent);
+        wr.WriteLine("}");
+      }
+    }
+
+    // ----------------------------- PrintMethod -----------------------------
+
+    const int IndentAmount = 2; // The amount of indent for each new scope
+    const string BunchaSpaces = "                                ";
+    void Indent(int amount)
+    {
+      Contract.Requires(0 <= amount);
+
+      while (0 < amount) {
+        wr.Write(BunchaSpaces.Substring(0, amount));
+        amount -= BunchaSpaces.Length;
+      }
+    }
+
+    private bool PrintModeSkipFunctionOrMethod(bool IsGhost, Attributes attributes, string name)
+    {
+      if (printMode == DafnyOptions.PrintModes.NoGhost && IsGhost)
+          { return true; }
+      if (printMode == DafnyOptions.PrintModes.NoIncludes || printMode == DafnyOptions.PrintModes.NoGhost)
+      {
+          bool verify = true;
+          if (Attributes.ContainsBool(attributes, "verify", ref verify) && !verify)
+          { return true; }
+          if (name.Contains("INTERNAL") || name.StartsWith("reveal_"))
+          { return true; }
+      }
+      return false;
+    }
+
+    private bool PrintModeSkipGeneral(Bpl.IToken tok, string fileBeingPrinted)
+    {
+        return (printMode == DafnyOptions.PrintModes.NoIncludes || printMode == DafnyOptions.PrintModes.NoGhost)
+               && (tok.filename != null && fileBeingPrinted != null && Path.GetFullPath(tok.filename) != fileBeingPrinted);
+    }
+
+    public void PrintMethod(Method method, int indent, bool printSignatureOnly) {
+      Contract.Requires(method != null);
+
+      if (PrintModeSkipFunctionOrMethod(method.IsGhost, method.Attributes, method.Name)) { return; }
+      Indent(indent);
+      string k = method is Constructor ? "constructor" :
+        method is InductiveLemma ? "inductive lemma" :
+        method is CoLemma ? "colemma" :
+        method is Lemma ? "lemma" :
+        "method";
+      if (method.HasStaticKeyword) { k = "static " + k; }
+      if (method.IsGhost && !(method is Lemma) && !(method is FixpointLemma)) { k = "ghost " + k; }
+      string nm = method is Constructor && !((Constructor)method).HasName ? "" : method.Name;
+      PrintClassMethodHelper(k, method.Attributes, nm, method.TypeArgs);
+      if (method.SignatureIsOmitted) {
+        wr.WriteLine(" ...");
+      } else {
+        PrintFormals(method.Ins, method.Name);
+        if (method.Outs.Count != 0) {
+          if (method.Ins.Count + method.Outs.Count <= 3) {
+            wr.Write(" returns ");
+          } else {
+            wr.WriteLine();
+            Indent(indent + 2 * IndentAmount);
+            wr.Write("returns ");
+          }
+          PrintFormals(method.Outs);
+        }
+        wr.WriteLine();
+      }
+
+      int ind = indent + IndentAmount;
+      PrintSpec("requires", method.Req, ind);
+      if (method.Mod.Expressions != null)
+      {
+        PrintFrameSpecLine("modifies", method.Mod.Expressions, ind, method.Mod.HasAttributes() ? method.Mod.Attributes : null);
+      }
+      PrintSpec("ensures", method.Ens, ind);
+      PrintDecreasesSpec(method.Decreases, ind);
+
+      if (method.Body != null && !printSignatureOnly) {
+        Indent(indent);
+        PrintStatement(method.Body, indent);
+        wr.WriteLine();
+      }
+    }
+
+    internal void PrintFormals(List<Formal> ff, string name = null) {
+      Contract.Requires(ff != null);
+      if (name != null && name.EndsWith("#")) {
+        wr.Write("[");
+        PrintFormal(ff[0]);
+        wr.Write("]");
+        ff = new List<Formal>(ff.Skip(1));
+      }
+      wr.Write("(");
+      string sep = "";
+      foreach (Formal f in ff) {
+        Contract.Assert(f != null);
+        wr.Write(sep);
+        sep = ", ";
+        PrintFormal(f);
+      }
+      wr.Write(")");
+    }
+
+    void PrintFormal(Formal f) {
+      Contract.Requires(f != null);
+      if (f.IsGhost) {
+        wr.Write("ghost ");
+      }
+      if (f.HasName) {
+        wr.Write("{0}: ", f.DisplayName);
+      }
+      PrintType(f.Type);
+    }
+
+    internal void PrintSpec(string kind, List<Expression> ee, int indent) {
+      Contract.Requires(kind != null);
+      Contract.Requires(ee != null);
+      foreach (Expression e in ee) {
+        Contract.Assert(e != null);
+        Indent(indent);
+        wr.Write("{0} ", kind);
+        PrintExpression(e, true);
+        wr.WriteLine();
+      }
+    }
+
+    internal void PrintDecreasesSpec(Specification<Expression> decs, int indent, bool newLine = true) {
+      Contract.Requires(decs != null);
+      if (printMode == DafnyOptions.PrintModes.NoGhost) { return; }
+      if (decs.Expressions != null && decs.Expressions.Count != 0) {
+        Indent(indent);
+        wr.Write("decreases");
+        if (decs.HasAttributes())
+        {
+          PrintAttributes(decs.Attributes);
+        }
+        wr.Write(" ");
+        PrintExpressionList(decs.Expressions, true);
+        if (newLine) {
+          wr.WriteLine();
+        } else {
+          wr.Write(" ");
+        }
+      }
+    }
+
+    internal void PrintFrameSpecLine(string kind, List<FrameExpression/*!*/> ee, int indent, Attributes attrs, bool newLine = true) {
+      Contract.Requires(kind != null);
+      Contract.Requires(cce.NonNullElements(ee));
+      if (ee != null && ee.Count != 0) {
+        Indent(indent);
+        wr.Write("{0}", kind);
+        if (attrs != null) {
+          PrintAttributes(attrs);
+        }
+        wr.Write(" ");
+        PrintFrameExpressionList(ee);
+        if (newLine) {
+          wr.WriteLine();
+        } else {
+          wr.Write(" ");
+        }
+      }
+    }
+
+    internal void PrintSpec(string kind, List<MaybeFreeExpression> ee, int indent, bool newLine = true) {
+      Contract.Requires(kind != null);
+      Contract.Requires(ee != null);
+      if (printMode == DafnyOptions.PrintModes.NoGhost) { return; }
+      foreach (MaybeFreeExpression e in ee)
+      {
+        Contract.Assert(e != null);
+        Indent(indent);
+        wr.Write("{0}{1}", e.IsFree ? "free " : "", kind);
+
+        if (e.HasAttributes())
+        {
+          PrintAttributes(e.Attributes);
+        }
+
+        wr.Write(" ");
+        PrintExpression(e.E, true);
+        if (newLine) {
+          wr.WriteLine();
+        } else {
+          wr.Write(" ");
+        }
+      }
+    }
+
+    // ----------------------------- PrintType -----------------------------
+
+    public void PrintType(Type ty) {
+      Contract.Requires(ty != null);
+      wr.Write(ty.ToString());
+    }
+
+    public void PrintType(string prefix, Type ty) {
+      Contract.Requires(prefix != null);
+      Contract.Requires(ty != null);
+      string s = ty.ToString();
+      if (s != "?") {
+        wr.Write("{0}{1}", prefix, s);
+      }
+    }
+
+    string EqualitySupportSuffix(TypeParameter.EqualitySupportValue es) {
+      if (es == TypeParameter.EqualitySupportValue.Required ||
+        (es == TypeParameter.EqualitySupportValue.InferredRequired && DafnyOptions.O.DafnyPrintResolvedFile != null)) {
+        return "(==)";
+      } else {
+        return "";
+      }
+    }
+
+    // ----------------------------- PrintStatement -----------------------------
+
+    /// <summary>
+    /// Prints from the current position of the current line.
+    /// If the statement requires several lines, subsequent lines are indented at "indent".
+    /// No newline is printed after the statement.
+    /// </summary>
+    public void PrintStatement(Statement stmt, int indent) {
+      Contract.Requires(stmt != null);
+
+      if (stmt.IsGhost && printMode == DafnyOptions.PrintModes.NoGhost) { return; }
+      for (LList<Label> label = stmt.Labels; label != null; label = label.Next) {
+        if (label.Data.Name != null) {
+          wr.WriteLine("label {0}:", label.Data.Name);
+          Indent(indent);
+        }
+      }
+
+      if (stmt is PredicateStmt) {
+        if (printMode == DafnyOptions.PrintModes.NoGhost) { return; }
+        Expression expr = ((PredicateStmt)stmt).Expr;
+        wr.Write(stmt is AssertStmt ? "assert" : "assume");
+        if (stmt.Attributes != null) {
+          PrintAttributes(stmt.Attributes);
+        }
+        wr.Write(" ");
+        PrintExpression(expr, true);
+        wr.Write(";");
+
+      } else if (stmt is PrintStmt) {
+        PrintStmt s = (PrintStmt)stmt;
+        wr.Write("print");
+        PrintAttributeArgs(s.Args, true);
+        wr.Write(";");
+
+      } else if (stmt is BreakStmt) {
+        BreakStmt s = (BreakStmt)stmt;
+        if (s.TargetLabel != null) {
+          wr.Write("break {0};", s.TargetLabel);
+        } else {
+          string sep = "";
+          for (int i = 0; i < s.BreakCount; i++) {
+            wr.Write("{0}break", sep);
+            sep = " ";
+          }
+          wr.Write(";");
+        }
+
+      } else if (stmt is ProduceStmt) {
+        var s = (ProduceStmt) stmt;
+        wr.Write(s is YieldStmt ? "yield" : "return");
+        if (s.rhss != null) {
+          var sep = " ";
+          foreach (var rhs in s.rhss) {
+            wr.Write(sep);
+            PrintRhs(rhs);
+            sep = ", ";
+          }
+        }
+          wr.Write(";");
+
+      } else if (stmt is AssignStmt) {
+        AssignStmt s = (AssignStmt)stmt;
+        PrintExpression(s.Lhs, true);
+        wr.Write(" := ");
+        PrintRhs(s.Rhs);
+        wr.Write(";");
+
+      } else if (stmt is BlockStmt) {
+        wr.WriteLine("{");
+        int ind = indent + IndentAmount;
+        foreach (Statement s in ((BlockStmt)stmt).Body) {
+          Indent(ind);
+          PrintStatement(s, ind);
+          wr.WriteLine();
+        }
+        Indent(indent);
+        wr.Write("}");
+
+      } else if (stmt is IfStmt) {
+        IfStmt s = (IfStmt)stmt;
+        PrintIfStatement(indent, s, false);
+
+      } else if (stmt is AlternativeStmt) {
+        var s = (AlternativeStmt)stmt;
+        wr.WriteLine("if {");
+        PrintAlternatives(indent, s.Alternatives);
+        Indent(indent);
+        wr.Write("}");
+
+      } else if (stmt is WhileStmt) {
+        WhileStmt s = (WhileStmt)stmt;
+        PrintWhileStatement(indent, s, false, false);
+
+      } else if (stmt is AlternativeLoopStmt) {
+        var s = (AlternativeLoopStmt)stmt;
+        wr.WriteLine("while");
+        PrintSpec("invariant", s.Invariants, indent + IndentAmount);
+        PrintDecreasesSpec(s.Decreases, indent + IndentAmount);
+
+        Indent(indent);
+        wr.WriteLine("{");
+        PrintAlternatives(indent, s.Alternatives);
+        Indent(indent);
+        wr.Write("}");
+
+      } else if (stmt is ForallStmt) {
+        var s = (ForallStmt)stmt;
+        wr.Write("forall");
+        if (s.BoundVars.Count != 0) {
+          wr.Write(" ");
+          PrintQuantifierDomain(s.BoundVars, s.Attributes, s.Range);
+        }
+        if (s.Ens.Count == 0) {
+          wr.Write(" ");
+        } else {
+          wr.WriteLine();
+          PrintSpec("ensures", s.Ens, indent + IndentAmount, s.Body != null);
+          Indent(indent);
+        }
+        if (s.Body != null) {
+          PrintStatement(s.Body, indent);
+        }
+
+      } else if (stmt is ModifyStmt) {
+        var s = (ModifyStmt)stmt;
+        PrintModifyStmt(indent, s, false);
+
+      } else if (stmt is CalcStmt) {
+        CalcStmt s = (CalcStmt)stmt;
+        if (printMode == DafnyOptions.PrintModes.NoGhost) { return; }   // Calcs don't get a "ghost" attribute, but they are.
+        wr.Write("calc ");
+        if (!s.Op.Equals(CalcStmt.DefaultOp)) {
+          PrintCalcOp(s.Op);
+          wr.Write(" ");
+        }
+        wr.WriteLine("{");
+        int lineInd = indent + IndentAmount;
+        int lineCount = s.Lines.Count == 0 ? 0 : s.Lines.Count - 1;  // if nonempty, .Lines always contains a duplicated last line
+        // The number of op/hints is commonly one less than the number of lines, but
+        // it can also equal the number of lines for empty calc's and for calc's with
+        // a dangling hint.
+        int hintCount = s.Lines.Count != 0 && s.Hints.Last().Body.Count == 0 ? lineCount - 1 : lineCount;
+        for (var i = 0; i < lineCount; i++) {
+          var e = s.Lines[i];
+          var op = s.StepOps[i];
+          var h = s.Hints[i];
+          // print the line
+          Indent(lineInd);
+          PrintExpression(e, true, lineInd);
+          wr.WriteLine(";");
+          if (i == hintCount) {
+            break;
+          }
+          // print the operator, if any
+          if (!s.Op.Equals(op)) {
+            Indent(indent);  // this lines up with the "calc"
+            PrintCalcOp(op);
+            wr.WriteLine();
+          }
+          // print the hints
+          foreach (var st in h.Body) {
+            Indent(lineInd);
+            PrintStatement(st, lineInd);
+            wr.WriteLine();
+          }
+        }
+        Indent(indent);
+        wr.Write("}");
+
+      } else if (stmt is MatchStmt) {
+        MatchStmt s = (MatchStmt)stmt;
+        wr.Write("match ");
+        PrintExpression(s.Source, false);
+        if (s.UsesOptionalBraces) {
+          wr.Write(" {");
+        }
+        int caseInd = indent + (s.UsesOptionalBraces ? IndentAmount : 0);
+        foreach (MatchCaseStmt mc in s.Cases) {
+          wr.WriteLine();
+          Indent(caseInd);
+          wr.Write("case {0}", mc.Id);
+          PrintMatchCaseArgument(mc);
+          wr.Write(" =>");
+          foreach (Statement bs in mc.Body) {
+            wr.WriteLine();
+            Indent(caseInd + IndentAmount);
+            PrintStatement(bs, caseInd + IndentAmount);
+          }
+        }
+        if (s.UsesOptionalBraces) {
+          wr.WriteLine();
+          Indent(indent);
+          wr.Write("}");
+        }
+
+      } else if (stmt is ConcreteUpdateStatement) {
+        var s = (ConcreteUpdateStatement)stmt;
+        string sep = "";
+        foreach (var lhs in s.Lhss) {
+          wr.Write(sep);
+          PrintExpression(lhs, true);
+          sep = ", ";
+        }
+        PrintUpdateRHS(s);
+        wr.Write(";");
+
+      } else if (stmt is VarDeclStmt) {
+        var s = (VarDeclStmt)stmt;
+        if (s.Locals.Exists(v => v.IsGhost) && printMode == DafnyOptions.PrintModes.NoGhost) { return; }
+        if (s.Locals.Exists(v => v.IsGhost)) {
+          wr.Write("ghost ");
+        }
+        wr.Write("var");
+        string sep = "";
+        foreach (var local in s.Locals) {
+          wr.Write(sep);
+          if (local.Attributes != null) {
+            PrintAttributes(local.Attributes);
+          }
+          wr.Write(" {0}", local.DisplayName);
+          PrintType(": ", local.OptionalType);
+          sep = ",";
+        }
+        if (s.Update != null) {
+          PrintUpdateRHS(s.Update);
+        }
+        wr.Write(";");
+
+      } else if (stmt is SkeletonStatement) {
+        var s = (SkeletonStatement)stmt;
+        if (s.S == null) {
+          wr.Write("...;");
+        } else if (s.S is AssertStmt) {
+          Contract.Assert(s.ConditionOmitted);
+          wr.Write("assert ...;");
+        } else if (s.S is AssumeStmt) {
+          Contract.Assert(s.ConditionOmitted);
+          wr.Write("assume ...;");
+        } else if (s.S is IfStmt) {
+          PrintIfStatement(indent, (IfStmt)s.S, s.ConditionOmitted);
+        } else if (s.S is WhileStmt) {
+          PrintWhileStatement(indent, (WhileStmt)s.S, s.ConditionOmitted, s.BodyOmitted);
+        } else if (s.S is ModifyStmt) {
+          PrintModifyStmt(indent, (ModifyStmt)s.S, true);
+        } else {
+          Contract.Assert(false); throw new cce.UnreachableException();  // unexpected skeleton statement
+        }
+
+      } else {
+        Contract.Assert(false); throw new cce.UnreachableException();  // unexpected statement
+      }
+    }
+
+    private void PrintModifyStmt(int indent, ModifyStmt s, bool omitFrame) {
+      Contract.Requires(0 <= indent);
+      Contract.Requires(s != null);
+      Contract.Requires(!omitFrame || s.Mod.Expressions.Count == 0);
+
+      wr.Write("modify");
+      PrintAttributes(s.Mod.Attributes);
+      wr.Write(" ");
+      if (omitFrame) {
+        wr.Write("...");
+      } else {
+        PrintFrameExpressionList(s.Mod.Expressions);
+      }
+      if (s.Body != null) {
+        // There's a possible syntactic ambiguity, namely if the frame is empty (more precisely,
+        // if s.Mod.Expressions.Count is 0).  Since the statement was parsed at some point, this
+        // situation can occur only if the modify statement inherited its frame by refinement
+        // and we're printing the post-resolve AST.  In this special case, print an explicit
+        // empty set as the frame.
+        if (s.Mod.Expressions.Count == 0) {
+          wr.Write(" {}");
+        }
+        wr.Write(" ");
+        PrintStatement(s.Body, indent);
+      } else {
+        wr.Write(";");
+      }
+    }
+
+    /// <summary>
+    /// Does not print LHS
+    /// </summary>
+    void PrintUpdateRHS(ConcreteUpdateStatement s) {
+      Contract.Requires(s != null);
+      if (s is UpdateStmt) {
+        var update = (UpdateStmt)s;
+        if (update.Lhss.Count != 0) {
+          wr.Write(" := ");
+        }
+        var sep = "";
+        foreach (var rhs in update.Rhss) {
+          wr.Write(sep);
+          PrintRhs(rhs);
+          sep = ", ";
+        }
+      } else if (s is AssignSuchThatStmt) {
+        var update = (AssignSuchThatStmt)s;
+        wr.Write(" :| ");
+        if (update.AssumeToken != null) {
+          wr.Write("assume ");
+        }
+        PrintExpression(update.Expr, true);
+      } else {
+        Contract.Assert(s == null);  // otherwise, unknown type
+      }
+    }
+
+    void PrintIfStatement(int indent, IfStmt s, bool omitGuard) {
+      while (true) {
+        if (omitGuard) {
+          wr.Write("if ... ");
+        } else {
+          wr.Write("if ");
+          PrintGuard(s.Guard);
+          wr.Write(" ");
+        }
+        PrintStatement(s.Thn, indent);
+        if (s.Els == null) {
+          break;
+        }
+        wr.Write(" else ");
+        if (s.Els is IfStmt) {
+          s = (IfStmt)s.Els;
+        } else {
+          PrintStatement(s.Els, indent);
+          break;
+        }
+      }
+    }
+
+    void PrintWhileStatement(int indent, WhileStmt s, bool omitGuard, bool omitBody) {
+      Contract.Requires(0 <= indent);
+      if (omitGuard) {
+        wr.WriteLine("while ...");
+      } else {
+        wr.Write("while ");
+        PrintGuard(s.Guard);
+        wr.WriteLine();
+      }
+
+      PrintSpec("invariant", s.Invariants, indent + IndentAmount, s.Body != null || omitBody || (s.Decreases.Expressions != null && s.Decreases.Expressions.Count != 0) || (s.Mod.Expressions != null && s.Mod.Expressions.Count != 0));
+      PrintDecreasesSpec(s.Decreases, indent + IndentAmount, s.Body != null || omitBody || (s.Mod.Expressions != null && s.Mod.Expressions.Count != 0));
+      if (s.Mod.Expressions != null) {
+        PrintFrameSpecLine("modifies", s.Mod.Expressions, indent + IndentAmount, s.Mod.HasAttributes() ? s.Mod.Attributes : null, s.Body != null || omitBody);
+      }
+      Indent(indent);
+      if (omitBody) {
+        wr.WriteLine("...;");
+      } else if (s.Body != null) {
+        PrintStatement(s.Body, indent);
+      }
+    }
+
+    void PrintAlternatives(int indent, List<GuardedAlternative> alternatives) {
+      int caseInd = indent + IndentAmount;
+      foreach (var alternative in alternatives) {
+        Indent(caseInd);
+        wr.Write("case ");
+        PrintExpression(alternative.Guard, false);
+        wr.WriteLine(" =>");
+        foreach (Statement s in alternative.Body) {
+          Indent(caseInd + IndentAmount);
+          PrintStatement(s, caseInd + IndentAmount);
+          wr.WriteLine();
+        }
+      }
+    }
+
+    void PrintRhs(AssignmentRhs rhs) {
+      Contract.Requires(rhs != null);
+      if (rhs is ExprRhs) {
+        PrintExpression(((ExprRhs)rhs).Expr, true);
+      } else if (rhs is HavocRhs) {
+        wr.Write("*");
+      } else if (rhs is TypeRhs) {
+        TypeRhs t = (TypeRhs)rhs;
+        wr.Write("new ");
+        if (t.ArrayDimensions != null) {
+          PrintType(t.EType);
+          string s = "[";
+          foreach (Expression dim in t.ArrayDimensions) {
+            Contract.Assume(dim != null);
+            wr.Write(s);
+            PrintExpression(dim, false);
+            s = ", ";
+          }
+          wr.Write("]");
+        } else if (t.Arguments == null) {
+          PrintType(t.EType);
+        } else {
+          PrintType(t.Path);
+          wr.Write("(");
+          PrintExpressionList(t.Arguments, false);
+          wr.Write(")");
+        }
+      } else {
+        Contract.Assert(false); throw new cce.UnreachableException();  // unexpected RHS
+      }
+
+      if (rhs.HasAttributes())
+      {
+        PrintAttributes(rhs.Attributes);
+      }
+    }
+
+    void PrintGuard(Expression guard) {
+      if (guard == null) {
+        wr.Write("*");
+      } else {
+        PrintExpression(guard, false);
+      }
+    }
+
+    void PrintCalcOp(CalcStmt.CalcOp op) {
+      Contract.Requires(op != null);
+      wr.Write(op.ToString());
+      if (op is CalcStmt.TernaryCalcOp) {
+        wr.Write("[");
+        PrintExpression(((CalcStmt.TernaryCalcOp) op).Index, false);
+        wr.Write("]");
+      }
+    }
+
+    // ----------------------------- PrintExpression -----------------------------
+
+    /// <summary>
+    /// PrintExtendedExpr prints an expression, but formats top-level if-then-else and match expressions across several lines.
+    /// Its intended use is thus to print the body of a function.
+    /// </summary>
+    public void PrintExtendedExpr(Expression expr, int indent, bool isRightmost, bool endWithCloseParen) {
+      Contract.Requires(expr != null);
+      if (expr is ITEExpr) {
+        Indent(indent);
+        while (true) {
+          var ite = (ITEExpr)expr;
+          wr.Write("if ");
+          PrintExpression(ite.Test, false);
+          wr.WriteLine(" then");
+          PrintExtendedExpr(ite.Thn, indent + IndentAmount, true, false);
+          expr = ite.Els;
+          if (expr is ITEExpr) {
+            Indent(indent);  wr.Write("else ");
+          } else {
+            Indent(indent);  wr.WriteLine("else");
+            Indent(indent + IndentAmount);
+            PrintExpression(expr, isRightmost, false);
+            wr.WriteLine(endWithCloseParen ? ")" : "");
+            return;
+          }
+        }
+      } else if (expr is MatchExpr) {
+        var e = (MatchExpr)expr;
+        Indent(indent);
+        var parensNeeded = !isRightmost && !e.UsesOptionalBraces;
+        if (parensNeeded) { wr.Write("("); }
+        wr.Write("match ");
+        PrintExpression(e.Source, isRightmost && e.Cases.Count == 0, false);
+        if (e.UsesOptionalBraces) { wr.WriteLine(" {"); }
+        else if (parensNeeded && e.Cases.Count == 0) { wr.WriteLine(")"); }
+        else { wr.WriteLine(); }
+        int i = 0;
+        int ind = indent + (e.UsesOptionalBraces ? IndentAmount : 0);
+        foreach (var mc in e.Cases) {
+          bool isLastCase = i == e.Cases.Count - 1;
+          Indent(ind);
+          wr.Write("case {0}", mc.Id);
+          PrintMatchCaseArgument(mc);          
+          wr.WriteLine(" =>");
+          PrintExtendedExpr(mc.Body, ind + IndentAmount, isLastCase, isLastCase && (parensNeeded || endWithCloseParen));
+          i++;
+        }
+        if (e.UsesOptionalBraces) {
+          Indent(indent);
+          wr.WriteLine("}");
+        }
+      } else if (expr is LetExpr) {
+        var e = (LetExpr)expr;
+        Indent(indent);
+        wr.Write("var ");
+        string sep = "";
+        foreach (var lhs in e.LHSs) {
+          wr.Write(sep);
+          PrintCasePattern(lhs);
+          sep = ", ";
+        }
+        if (e.Exact) {
+          wr.Write(" := ");
+        } else {
+          wr.Write(" :| ");
+        }
+        PrintExpressionList(e.RHSs, true);
+        wr.WriteLine(";");
+        PrintExtendedExpr(e.Body, indent, isRightmost, endWithCloseParen);
+
+      } else if (expr is ParensExpression) {
+        PrintExtendedExpr(((ParensExpression)expr).E, indent, isRightmost, endWithCloseParen);
+      } else {
+        Indent(indent);
+        PrintExpression(expr, false, indent);
+        wr.WriteLine(endWithCloseParen ? ")" : "");
+      }
+    }
+
+    public void PrintMatchCaseArgument(MatchCase mc) {
+      if (mc.Arguments != null) {
+        if (mc.Arguments.Count != 0) {
+          string sep = "(";
+          foreach (BoundVar bv in mc.Arguments) {
+            wr.Write("{0}{1}", sep, bv.DisplayName);
+            if (bv.Type is NonProxyType) {
+              wr.Write(": {0}", bv.Type);
+            }
+            sep = ", ";
+          }
+          wr.Write(")");
+        }
+      } else {
+        Contract.Assert(mc.CasePatterns != null);
+        if (mc.CasePatterns.Count != 0) {
+          string sep = "(";
+          foreach (var cp in mc.CasePatterns) {
+            wr.Write(sep);
+            PrintCasePattern(cp);
+            sep = ", ";
+          }
+          wr.Write(")");
+        }
+      }
+    }
+
+    public void PrintExpression(Expression expr, bool isFollowedBySemicolon) {
+      Contract.Requires(expr != null);
+      PrintExpr(expr, 0, false, true, isFollowedBySemicolon, -1);
+    }
+
+    public void PrintExpression(Expression expr, bool isRightmost, bool isFollowedBySemicolon) {
+      Contract.Requires(expr != null);
+      PrintExpr(expr, 0, false, isRightmost, isFollowedBySemicolon, -1);
+    }
+
+    /// <summary>
+    /// An indent of -1 means print the entire expression on one line.
+    /// </summary>
+    public void PrintExpression(Expression expr, bool isFollowedBySemicolon, int indent) {
+      Contract.Requires(expr != null);
+      PrintExpr(expr, 0, false, true, isFollowedBySemicolon, indent);
+    }
+
+    private bool ParensNeeded(int opBindingStrength, int contextBindingStrength, bool fragileContext) {
+      return opBindingStrength < contextBindingStrength ||
+             (fragileContext && opBindingStrength == contextBindingStrength);
+    }
+
+    /// <summary>
+    /// An indent of -1 means print the entire expression on one line.
+    /// </summary>
+    void PrintExpr(Expression expr, int contextBindingStrength, bool fragileContext, bool isRightmost, bool isFollowedBySemicolon, int indent, int resolv_count = 2)
+    {
+      Contract.Requires(-1 <= indent);
+      Contract.Requires(expr != null);
+
+      /* When debugging:
+      if (resolv_count > 0 && expr.Resolved != null) {
+        PrintExpr(expr.Resolved, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent, resolv_count - 1);
+        return;
+      }
+      */
+
+      if (expr is StaticReceiverExpr) {
+        StaticReceiverExpr e = (StaticReceiverExpr)expr;
+        wr.Write(e.Type);
+      } else if (expr is LiteralExpr) {
+        LiteralExpr e = (LiteralExpr)expr;
+        if (e.Value == null) {
+          wr.Write("null");
+        } else if (e.Value is bool) {
+          wr.Write((bool)e.Value ? "true" : "false");
+        } else if (e is CharLiteralExpr) {
+          wr.Write("'{0}'", (string)e.Value);
+        } else if (e is StringLiteralExpr) {
+          var str = (StringLiteralExpr)e;
+          wr.Write("{0}\"{1}\"", str.IsVerbatim ? "@" : "", (string)e.Value);
+        } else if (e.Value is Basetypes.BigDec) {
+          Basetypes.BigDec dec = (Basetypes.BigDec)e.Value;
+          wr.Write((dec.Mantissa >= 0) ? "" : "-");
+          string s = BigInteger.Abs(dec.Mantissa).ToString();
+          int digits = s.Length;
+          if (dec.Exponent >= 0) {
+            wr.Write("{0}{1}.0", s, new string('0', dec.Exponent));
+          } else {
+            int exp = -dec.Exponent;
+            if (exp < digits) {
+              int intDigits = digits - exp;
+              int fracDigits = digits - intDigits;
+              wr.Write("{0}.{1}", s.Substring(0, intDigits), s.Substring(intDigits, fracDigits));
+            } else {
+              int fracDigits = digits;
+              wr.Write("0.{0}{1}", new string('0', exp - fracDigits), s.Substring(0, fracDigits));
+            }
+          }
+        } else {
+          wr.Write((BigInteger)e.Value);
+        }
+
+      } else if (expr is ThisExpr) {
+        wr.Write("this");
+
+      } else if (expr is IdentifierExpr) {
+        wr.Write(((IdentifierExpr)expr).Name);
+
+      } else if (expr is DatatypeValue) {
+        var dtv = (DatatypeValue)expr;
+        bool printParens;
+        if (dtv.MemberName == BuiltIns.TupleTypeCtorName) {
+          // we're looking at a tuple, whose printed constructor name is essentially the empty string
+          printParens = true;
+        } else {
+          wr.Write("{0}.{1}", dtv.DatatypeName, dtv.MemberName);
+          printParens = dtv.Arguments.Count != 0;
+        }
+        if (printParens) {
+          wr.Write("(");
+          PrintExpressionList(dtv.Arguments, false);
+          wr.Write(")");
+        }
+
+      } else if (expr is DisplayExpression) {
+        DisplayExpression e = (DisplayExpression)expr;
+        if (e is MultiSetDisplayExpr) {
+          wr.Write("multiset");
+        } else if (e is SetDisplayExpr && !((SetDisplayExpr)e).Finite) {
+          wr.Write("iset");
+        }
+        wr.Write(e is SetDisplayExpr || e is MultiSetDisplayExpr ? "{" : "[");
+        PrintExpressionList(e.Elements, false);
+        wr.Write(e is SetDisplayExpr || e is MultiSetDisplayExpr ? "}" : "]");
+
+      } else if (expr is MapDisplayExpr) {
+        MapDisplayExpr e = (MapDisplayExpr)expr;
+        wr.Write(e.Finite ? "map" : "imap");
+        wr.Write("[");
+        PrintExpressionPairList(e.Elements);
+        wr.Write("]");
+
+      } else if (expr is NameSegment) {
+        var e = (NameSegment)expr;
+        wr.Write(e.Name);
+        PrintTypeInstantiation(e.OptTypeArguments);
+
+      } else if (expr is ExprDotName) {
+        var e = (ExprDotName)expr;
+        // determine if parens are needed
+        int opBindingStrength = 0x70;
+        bool parensNeeded = !e.Lhs.IsImplicit && // KRML: I think that this never holds
+          ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
+
+        if (parensNeeded) { wr.Write("("); }
+        if (!e.Lhs.IsImplicit) {
+          PrintExpr(e.Lhs, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
+          wr.Write(".");
+        }
+        wr.Write(e.SuffixName);
+        PrintTypeInstantiation(e.OptTypeArguments);
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is ApplySuffix) {
+        var e = (ApplySuffix)expr;
+        // determine if parens are needed
+        int opBindingStrength = 0x70;
+        bool parensNeeded = !e.Lhs.IsImplicit &&  // KRML: I think that this never holds
+          ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
+
+        if (parensNeeded) { wr.Write("("); }
+        if (ParensMayMatter(e.Lhs)) {
+          wr.Write("(");
+          PrintExpression(e.Lhs, false);
+          wr.Write(")");
+        } else {
+          PrintExpr(e.Lhs, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
+        }
+        wr.Write("(");
+        PrintExpressionList(e.Args, false);
+        wr.Write(")");
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is MemberSelectExpr) {
+        MemberSelectExpr e = (MemberSelectExpr)expr;
+        // determine if parens are needed
+        int opBindingStrength = 0x70;
+        bool parensNeeded = !e.Obj.IsImplicit &&
+          ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
+
+        if (parensNeeded) { wr.Write("("); }
+        if (!(e.Obj.IsImplicit)) {
+          PrintExpr(e.Obj, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
+          wr.Write(".");
+        }
+        wr.Write(e.MemberName);
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is SeqSelectExpr) {
+        SeqSelectExpr e = (SeqSelectExpr)expr;
+        // determine if parens are needed
+        int opBindingStrength = 0x70;
+        bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
+
+        if (parensNeeded) { wr.Write("("); }
+        PrintExpr(e.Seq, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent);
+        wr.Write("[");
+        if (e.SelectOne) {
+          Contract.Assert( e.E0 != null);
+          PrintExpression(e.E0, false);
+        } else {
+          if (e.E0 != null) {
+            PrintExpression(e.E0, false);
+          }
+          wr.Write(e.E0 != null && e.E1 != null ? " .. " : "..");
+          if (e.E1 != null) {
+            PrintExpression(e.E1, false);
+          }
+        }
+        wr.Write("]");
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is MultiSelectExpr) {
+        MultiSelectExpr e = (MultiSelectExpr)expr;
+        // determine if parens are needed
+        int opBindingStrength = 0x70;
+        bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
+
+        if (parensNeeded) { wr.Write("("); }
+        PrintExpr(e.Array, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent);
+        string prefix = "[";
+        foreach (Expression idx in e.Indices) {
+          Contract.Assert(idx != null);
+          wr.Write(prefix);
+          PrintExpression(idx, false);
+          prefix = ", ";
+        }
+        wr.Write("]");
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is SeqUpdateExpr) {
+        SeqUpdateExpr e = (SeqUpdateExpr)expr;
+        if (e.ResolvedUpdateExpr != null)
+        {
+          PrintExpr(e.ResolvedUpdateExpr, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent);
+        }
+        else
+        {
+          // determine if parens are needed
+          int opBindingStrength = 0x70;
+          bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
+
+          if (parensNeeded) { wr.Write("("); }
+          PrintExpr(e.Seq, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent);
+          wr.Write("[");
+          PrintExpression(e.Index, false);
+          wr.Write(" := ");
+          PrintExpression(e.Value, false);
+          wr.Write("]");
+          if (parensNeeded) { wr.Write(")"); }
+        }
+      } else if (expr is ApplyExpr) {
+        var e = (ApplyExpr)expr;
+        // determine if parens are needed
+        int opBindingStrength = 0x70;
+        bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
+
+        if (parensNeeded) { wr.Write("("); }
+
+        PrintExpr(e.Function, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
+        wr.Write("(");
+        PrintExpressionList(e.Args, false);
+        wr.Write(")");
+
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is FunctionCallExpr) {
+        var e = (FunctionCallExpr)expr;
+        // determine if parens are needed
+        int opBindingStrength = 0x70;
+        bool parensNeeded = !(e.Receiver.IsImplicit) &&
+          ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
+
+        if (parensNeeded) { wr.Write("("); }
+        if (!e.Receiver.IsImplicit) {
+          PrintExpr(e.Receiver, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
+          wr.Write(".");
+        }
+        wr.Write(e.Name);
+        /* When debugging, this is nice to have:
+        if (e.TypeArgumentSubstitutions.Count > 0) {
+          wr.Write("[");
+          wr.Write(Util.Comma(",", e.TypeArgumentSubstitutions, kv => kv.Key.FullName() + "->" + kv.Value));
+          wr.Write("]");
+        }
+        */
+        if (e.OpenParen == null && e.Args.Count == 0) {
+        } else {
+          PrintActualArguments(e.Args, e.Name);
+        }
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is OldExpr) {
+        wr.Write("old(");
+        PrintExpression(((OldExpr)expr).E, false);
+        wr.Write(")");
+
+      } else if (expr is MultiSetFormingExpr) {
+        wr.Write("multiset(");
+        PrintExpression(((MultiSetFormingExpr)expr).E, false);
+        wr.Write(")");
+
+      } else if (expr is UnaryOpExpr) {
+        var e = (UnaryOpExpr)expr;
+        if (e.Op == UnaryOpExpr.Opcode.Cardinality) {
+          wr.Write("|");
+          PrintExpression(e.E, false);
+          wr.Write("|");
+        } else if (e.Op == UnaryOpExpr.Opcode.Fresh) {
+          wr.Write("fresh(");
+          PrintExpression(e.E, false);
+          wr.Write(")");
+        } else {
+          // Prefix operator.
+          // determine if parens are needed
+          string op;
+          int opBindingStrength;
+          switch (e.Op) {
+            case UnaryOpExpr.Opcode.Not:
+              op = "!";  opBindingStrength = 0x60;  break;
+            default:
+              Contract.Assert(false); throw new cce.UnreachableException();  // unexpected unary opcode
+          }
+          bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
+
+          bool containsNestedNot = e.E is ParensExpression &&
+                                ((ParensExpression)e.E).E is UnaryExpr &&
+                                ((UnaryOpExpr)((ParensExpression)e.E).E).Op == UnaryOpExpr.Opcode.Not;
+
+          if (parensNeeded) { wr.Write("("); }
+          wr.Write(op);
+          PrintExpr(e.E, opBindingStrength, containsNestedNot, parensNeeded || isRightmost, !parensNeeded && isFollowedBySemicolon, -1);
+          if (parensNeeded) { wr.Write(")"); }
+        }
+
+      } else if (expr is ConversionExpr) {
+        var e = (ConversionExpr)expr;
+        PrintType(e.ToType);
+        wr.Write("(");
+        PrintExpression(e.E, false);
+        wr.Write(")");
+
+      } else if (expr is BinaryExpr) {
+        BinaryExpr e = (BinaryExpr)expr;
+        // determine if parens are needed
+        int opBindingStrength;
+        bool fragileLeftContext = false;  // false means "allow same binding power on left without parens"
+        bool fragileRightContext = false;  // false means "allow same binding power on right without parens"
+        switch (e.Op)
+        {
+          case BinaryExpr.Opcode.Add:
+            opBindingStrength = 0x40; break;
+          case BinaryExpr.Opcode.Sub:
+            opBindingStrength = 0x40; fragileRightContext = true; break;
+          case BinaryExpr.Opcode.Mul:
+            opBindingStrength = 0x50; break;
+          case BinaryExpr.Opcode.Div:
+          case BinaryExpr.Opcode.Mod:
+            opBindingStrength = 0x50; fragileRightContext = true; break;
+          case BinaryExpr.Opcode.Eq:
+          case BinaryExpr.Opcode.Neq:
+          case BinaryExpr.Opcode.Gt:
+          case BinaryExpr.Opcode.Ge:
+          case BinaryExpr.Opcode.Lt:
+          case BinaryExpr.Opcode.Le:
+          case BinaryExpr.Opcode.Disjoint:
+          case BinaryExpr.Opcode.In:
+          case BinaryExpr.Opcode.NotIn:
+            opBindingStrength = 0x30; fragileLeftContext = fragileRightContext = true; break;
+          case BinaryExpr.Opcode.And:
+            opBindingStrength = 0x20; break;
+          case BinaryExpr.Opcode.Or:
+            opBindingStrength = 0x21; break;
+          case BinaryExpr.Opcode.Imp:
+            opBindingStrength = 0x10; fragileLeftContext = true; break;
+          case BinaryExpr.Opcode.Exp:
+            opBindingStrength = 0x11; fragileRightContext = true; break;
+          case BinaryExpr.Opcode.Iff:
+            opBindingStrength = 0x08; break;
+          default:
+            Contract.Assert(false); throw new cce.UnreachableException();  // unexpected binary operator
+        }
+        int opBS = opBindingStrength & 0xF8;
+        int ctxtBS = contextBindingStrength & 0xF8;
+        bool parensNeeded = opBS < ctxtBS ||
+          (opBS == ctxtBS && (opBindingStrength != contextBindingStrength || fragileContext));
+
+        string op = BinaryExpr.OpcodeString(e.Op);
+        if (parensNeeded) { wr.Write("("); }
+        var sem = !parensNeeded && isFollowedBySemicolon;
+        if (0 <= indent && e.Op == BinaryExpr.Opcode.And) {
+          PrintExpr(e.E0, opBindingStrength, fragileLeftContext, false, sem, indent);
+          wr.WriteLine(" {0}", op);
+          Indent(indent);
+          PrintExpr(e.E1, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, indent);
+        } else if (0 <= indent && e.Op == BinaryExpr.Opcode.Imp) {
+          PrintExpr(e.E0, opBindingStrength, fragileLeftContext, false, sem, indent);
+          wr.WriteLine(" {0}", op);
+          int ind = indent + IndentAmount;
+          Indent(ind);
+          PrintExpr(e.E1, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, ind);
+        } else if (0 <= indent && e.Op == BinaryExpr.Opcode.Exp) {
+          PrintExpr(e.E1, opBindingStrength, fragileLeftContext, false, sem, indent);
+          wr.WriteLine(" {0}", op);
+          int ind = indent + IndentAmount;
+          Indent(ind);
+          PrintExpr(e.E0, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, ind);
+        } else if (e.Op == BinaryExpr.Opcode.Exp) {
+          PrintExpr(e.E1, opBindingStrength, fragileLeftContext, false, sem, -1);
+          wr.Write(" {0} ", op);
+          PrintExpr(e.E0, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, -1);
+        } else {
+          PrintExpr(e.E0, opBindingStrength, fragileLeftContext, false, sem, -1);
+          wr.Write(" {0} ", op);
+          PrintExpr(e.E1, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, -1);
+        }
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is TernaryExpr) {
+        var e = (TernaryExpr)expr;
+        switch (e.Op) {
+          case TernaryExpr.Opcode.PrefixEqOp:
+          case TernaryExpr.Opcode.PrefixNeqOp:
+            var opBindingStrength = 0x30;
+            var fragileLeftContext = true;
+            var fragileRightContext = true;
+
+            int opBS = opBindingStrength & 0xF8;
+            int ctxtBS = contextBindingStrength & 0xF8;
+            bool parensNeeded = opBS < ctxtBS ||
+              (opBS == ctxtBS && (opBindingStrength != contextBindingStrength || fragileContext));
+
+            if (parensNeeded) { wr.Write("("); }
+            var sem = !parensNeeded && isFollowedBySemicolon;
+            PrintExpr(e.E1, opBindingStrength, fragileLeftContext, false, sem, -1);
+            wr.Write(" {0}#[", e.Op == TernaryExpr.Opcode.PrefixEqOp ? "==" : "!=");
+            PrintExpression(e.E0, false);
+            wr.Write("] ");
+            PrintExpr(e.E2, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, -1);
+            if (parensNeeded) { wr.Write(")"); }
+            break;
+          default:
+            Contract.Assert(false);  // unexpected ternary operator
+            break;
+        }
+
+      } else if (expr is ChainingExpression) {
+        var e = (ChainingExpression)expr;
+        // determine if parens are needed
+        int opBindingStrength = 0x30;
+        int opBS = opBindingStrength & 0xF8;
+        int ctxtBS = contextBindingStrength & 0xF8;
+        bool parensNeeded = opBS < ctxtBS ||
+          (opBS == ctxtBS && (opBindingStrength != contextBindingStrength || fragileContext));
+
+        if (parensNeeded) { wr.Write("("); }
+        var sem = !parensNeeded && isFollowedBySemicolon;
+        PrintExpr(e.Operands[0], opBindingStrength, true, false, sem, -1);
+        for (int i = 0; i < e.Operators.Count; i++) {
+          string op = BinaryExpr.OpcodeString(e.Operators[i]);
+          if (e.PrefixLimits[i] == null) {
+            wr.Write(" {0} ", op);
+          } else {
+            wr.Write(" {0}#[", op);
+            PrintExpression(e.PrefixLimits[i], false);
+            wr.Write("] ");
+          }
+          PrintExpr(e.Operands[i+1], opBindingStrength, true, i == e.Operators.Count - 1 && (parensNeeded || isRightmost), sem, -1);
+        }
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is LetExpr) {
+        var e = (LetExpr)expr;
+        bool parensNeeded = !isRightmost;
+        if (parensNeeded) { wr.Write("("); }
+        wr.Write("var ");
+        string sep = "";
+        foreach (var lhs in e.LHSs) {
+          wr.Write(sep);
+          PrintCasePattern(lhs);
+          sep = ", ";
+        }
+        if (e.Exact) {
+          wr.Write(" := ");
+        } else {
+          wr.Write(" :| ");
+        }
+        PrintExpressionList(e.RHSs, true);
+        wr.Write("; ");
+        PrintExpression(e.Body, !parensNeeded && isFollowedBySemicolon);
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is QuantifierExpr) {
+        QuantifierExpr e = (QuantifierExpr)expr;
+
+        if (DafnyOptions.O.DafnyPrintResolvedFile != null && e.SplitQuantifier != null) {
+          PrintExpr(e.SplitQuantifierExpression, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent, resolv_count);
+          return;
+        }
+
+        bool parensNeeded = !isRightmost;
+        if (parensNeeded) { wr.Write("("); }
+        wr.Write(e is ForallExpr ? "forall" : "exists");
+        PrintTypeParams(e.TypeArgs); // new!
+        wr.Write(" ");
+        PrintQuantifierDomain(e.BoundVars, e.Attributes, e.Range);
+        wr.Write(" :: ");
+        if (0 <= indent) {
+          int ind = indent + IndentAmount;
+          wr.WriteLine();
+          Indent(ind);
+          PrintExpression(e.Term, !parensNeeded && isFollowedBySemicolon, ind);
+        } else {
+          PrintExpression(e.Term, !parensNeeded && isFollowedBySemicolon);
+        }
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is NamedExpr) {
+        var e = (NamedExpr)expr;
+        wr.Write("expr {0}: ", e.Name);
+        PrintExpression(e.Body, isFollowedBySemicolon);
+
+       } else if (expr is SetComprehension) {
+        var e = (SetComprehension)expr;
+        bool parensNeeded = !isRightmost;
+        if (parensNeeded) { wr.Write("("); }
+        wr.Write("set ");
+        string sep = "";
+        foreach (BoundVar bv in e.BoundVars) {
+          wr.Write("{0}{1}", sep, bv.DisplayName);
+          sep = ", ";
+          PrintType(": ", bv.Type);
+        }
+        PrintAttributes(e.Attributes);
+        wr.Write(" | ");
+        PrintExpression(e.Range, !parensNeeded && isFollowedBySemicolon);
+        if (!e.TermIsImplicit) {
+          wr.Write(" :: ");
+          PrintExpression(e.Term, !parensNeeded && isFollowedBySemicolon);
+        }
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is MapComprehension) {
+        var e = (MapComprehension)expr;
+        bool parensNeeded = !isRightmost;
+        if (parensNeeded) { wr.Write("("); }
+        wr.Write(e.Finite ? "map " : "imap ");
+        string sep = "";
+        foreach (BoundVar bv in e.BoundVars) {
+          wr.Write("{0}{1}", sep, bv.DisplayName);
+          sep = ", ";
+          PrintType(": ", bv.Type);
+        }
+        PrintAttributes(e.Attributes);
+        wr.Write(" | ");
+        PrintExpression(e.Range, !parensNeeded && isFollowedBySemicolon);
+        wr.Write(" :: ");
+        PrintExpression(e.Term, !parensNeeded && isFollowedBySemicolon);
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is LambdaExpr) {
+        var e = (LambdaExpr)expr;
+        bool parensNeeded = !isRightmost;
+        if (parensNeeded) { wr.Write("("); }
+        var skipSignatureParens = e.BoundVars.Count == 1 && e.BoundVars[0].Type is InferredTypeProxy;
+        if (!skipSignatureParens) { wr.Write("("); }
+        wr.Write(Util.Comma(", ", e.BoundVars, bv => bv.DisplayName + (bv.Type is InferredTypeProxy ? "" : ": " + bv.Type)));
+        if (!skipSignatureParens) { wr.Write(")"); }
+        if (e.Range != null) {
+          wr.Write(" requires ");
+          PrintExpression(e.Range, false);
+        }
+        foreach (var read in e.Reads) {
+          wr.Write(" reads ");
+          PrintExpression(read.E, false);
+        }
+        wr.Write(e.OneShot ? " -> " : " => ");
+        PrintExpression(e.Body, isFollowedBySemicolon);
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is WildcardExpr) {
+        wr.Write("*");
+
+      } else if (expr is StmtExpr) {
+        var e = (StmtExpr)expr;
+        bool parensNeeded;
+        if (e.S is AssertStmt || e.S is AssumeStmt || e.S is CalcStmt) {
+          parensNeeded = !isRightmost;
+        } else {
+          parensNeeded = !isRightmost || isFollowedBySemicolon;
+        }
+        if (parensNeeded) { wr.Write("("); }
+        int ind = indent < 0 ? IndentAmount : indent;  // if the expression was to be printed on one line, instead print the .S part at indentation IndentAmount (not pretty, but something)
+        PrintStatement(e.S, ind);
+        wr.Write(" ");
+        PrintExpression(e.E, !parensNeeded && isFollowedBySemicolon);
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is ITEExpr) {
+        ITEExpr ite = (ITEExpr)expr;
+        bool parensNeeded = !isRightmost;
+        if (parensNeeded) { wr.Write("("); }
+        wr.Write("if ");
+        PrintExpression(ite.Test, false);
+        wr.Write(" then ");
+        PrintExpression(ite.Thn, false);
+        wr.Write(" else ");
+        PrintExpression(ite.Els, !parensNeeded && isFollowedBySemicolon);
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is ParensExpression) {
+        var e = (ParensExpression)expr;
+        // printing of parentheses is done optimally, not according to the parentheses in the given program
+        PrintExpr(e.E, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent);
+
+      } else if (expr is NegationExpression) {
+        var e = (NegationExpression)expr;
+        string op = "-";
+        int opBindingStrength = 0x60;
+        bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
+
+        bool containsNestedNegation = e.E is ParensExpression && ((ParensExpression)e.E).E is NegationExpression;
+
+        if (parensNeeded) { wr.Write("("); }
+        wr.Write(op);
+        PrintExpr(e.E, opBindingStrength, containsNestedNegation, parensNeeded || isRightmost, !parensNeeded && isFollowedBySemicolon, -1);
+        if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is MatchExpr) {
+        var e = (MatchExpr)expr;
+        var parensNeeded = !isRightmost && !e.UsesOptionalBraces;
+        if (parensNeeded) { wr.Write("("); }
+        wr.Write("match ");
+        PrintExpression(e.Source, isRightmost && e.Cases.Count == 0, !parensNeeded && isFollowedBySemicolon);
+        if (e.UsesOptionalBraces) { wr.Write(" {"); }
+        int i = 0;
+        foreach (var mc in e.Cases) {
+          bool isLastCase = i == e.Cases.Count - 1;
+          wr.Write(" case {0}", mc.Id);
+          PrintMatchCaseArgument(mc);
+          wr.Write(" => ");
+          PrintExpression(mc.Body, isRightmost && isLastCase, !parensNeeded && isFollowedBySemicolon);
+          i++;
+        }
+        if (e.UsesOptionalBraces) { wr.Write(" }"); }
+        else if (parensNeeded) { wr.Write(")"); }
+
+      } else if (expr is BoxingCastExpr) {
+        // this is not expected for a parsed program, but we may be called for /trace purposes in the translator
+        var e = (BoxingCastExpr)expr;
+        PrintExpr(e.E, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent);
+      } else if (expr is Translator.BoogieWrapper) {
+        wr.Write("[BoogieWrapper]");  // this is somewhat unexpected, but we can get here if the /trace switch is used, so it seems best to cover this case here
+      } else {
+        Contract.Assert(false); throw new cce.UnreachableException();  // unexpected expression
+      }
+    }
+
+    bool ParensMayMatter(Expression expr) {
+      Contract.Requires(expr != null);
+      int parenPairs = 0;
+      for (; expr is ParensExpression; parenPairs++) {
+        expr = ((ParensExpression)expr).E;
+      }
+      // If the program were resolved, we could be more precise than the following (in particular, looking
+      // to see if expr denotes a MemberSelectExpr of a member that is a Function.
+      return parenPairs != 0 && (expr is NameSegment || expr is ExprDotName);
+    }
+
+    void PrintCasePattern(CasePattern pat) {
+      Contract.Requires(pat != null);
+      var v = pat.Var;
+      if (v != null) {
+        wr.Write(v.DisplayName);
+        if (v.Type is NonProxyType || DafnyOptions.O.DafnyPrintResolvedFile != null) {
+          PrintType(": ", v.Type);
+        }
+      } else {
+        wr.Write(pat.Id);
+        if (pat.Arguments != null) {
+          wr.Write("(");
+          var sep = "";
+          foreach (var arg in pat.Arguments) {
+            wr.Write(sep);
+            PrintCasePattern(arg);
+            sep = ", ";
+          }
+          wr.Write(")");
+        }
+      }
+    }
+
+    private void PrintQuantifierDomain(List<BoundVar> boundVars, Attributes attrs, Expression range) {
+      Contract.Requires(boundVars != null);
+      string sep = "";
+      foreach (BoundVar bv in boundVars) {
+        wr.Write("{0}{1}", sep, bv.DisplayName);
+        PrintType(": ", bv.Type);
+        sep = ", ";
+      }
+      PrintAttributes(attrs);
+      if (range != null) {
+        wr.Write(" | ");
+        PrintExpression(range, false);
+      }
+    }
+
+    void PrintActualArguments(List<Expression> args, string name) {
+      Contract.Requires(args != null);
+      Contract.Requires(name != null);
+      if (name.EndsWith("#")) {
+        wr.Write("[");
+        PrintExpression(args[0], false);
+        wr.Write("]");
+        args = new List<Expression>(args.Skip(1));
+      }
+      wr.Write("(");
+      PrintExpressionList(args, false);
+      wr.Write(")");
+    }
+
+    void PrintExpressionList(List<Expression> exprs, bool isFollowedBySemicolon) {
+      Contract.Requires(exprs != null);
+      string sep = "";
+      foreach (Expression e in exprs) {
+        Contract.Assert(e != null);
+        wr.Write(sep);
+        sep = ", ";
+        PrintExpression(e, isFollowedBySemicolon);
+      }
+    }
+    void PrintExpressionPairList(List<ExpressionPair> exprs) {
+      Contract.Requires(exprs != null);
+      string sep = "";
+      foreach (ExpressionPair p in exprs) {
+        Contract.Assert(p != null);
+        wr.Write(sep);
+        sep = ", ";
+        PrintExpression(p.A, false);
+        wr.Write(":=");
+        PrintExpression(p.B, false);
+      }
+    }
+
+    void PrintFrameExpressionList(List<FrameExpression/*!*/>/*!*/ fexprs) {
+      Contract.Requires(fexprs != null);
+      string sep = "";
+      foreach (FrameExpression fe in fexprs) {
+        Contract.Assert(fe != null);
+        wr.Write(sep);
+        sep = ", ";
+        PrintExpression(fe.E, true);
+        if (fe.FieldName != null) {
+          wr.Write("`{0}", fe.FieldName);
+        }
+      }
+    }
+  }
+}
-- 
cgit v1.2.3


From 4685709c25b5f22c51b6419c4898a689e8ffb4f9 Mon Sep 17 00:00:00 2001
From: Bryan Parno <parno@microsoft.com>
Date: Thu, 17 Sep 2015 15:30:39 -0700
Subject: Fix a check that occasionally led to an out of bounds exception in
 the extension

---
 Binaries/dafny                            | Bin 315 -> 19456 bytes
 Source/DafnyExtension/IdentifierTagger.cs |   2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Binaries/dafny b/Binaries/dafny
index 889ebc81..05fa3203 100755
Binary files a/Binaries/dafny and b/Binaries/dafny differ
diff --git a/Source/DafnyExtension/IdentifierTagger.cs b/Source/DafnyExtension/IdentifierTagger.cs
index 5b70329d..d638cb6c 100644
--- a/Source/DafnyExtension/IdentifierTagger.cs
+++ b/Source/DafnyExtension/IdentifierTagger.cs
@@ -77,7 +77,7 @@ namespace DafnyLanguage
       int start = entire.Start;
       int end = entire.End;
       foreach (var r in _regions) {
-        if (0 <= r.Length && r.Start <= end && start <= r.Start + r.Length) {
+        if (0 <= r.Length && r.Start >= start && r.Start + r.Length <= end) {
           DafnyTokenKind kind;
           switch (r.Kind) {
             case IdRegion.OccurrenceKind.Use:
-- 
cgit v1.2.3


From 800885b4d7d0164803c0c2f117b78c65479283f9 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Sun, 20 Sep 2015 21:51:42 -0700
Subject: Preliminary refactoring of ghost-statement computations to after type
 checking

---
 Source/Dafny/DafnyAst.cs                     |  84 +++--
 Source/Dafny/Resolver.cs                     | 478 +++++++++++++++++++++++----
 Test/dafny0/AssumptionVariables0.dfy         |   8 +-
 Test/dafny0/AssumptionVariables0.dfy.expect  |   5 +-
 Test/dafny0/ParallelResolveErrors.dfy        |   4 +-
 Test/dafny0/ParallelResolveErrors.dfy.expect |   5 +-
 Test/dafny0/ResolutionErrors.dfy             |  16 +-
 Test/dafny0/ResolutionErrors.dfy.expect      |  13 +-
 Test/dafny0/TypeTests.dfy.expect             |   2 +-
 9 files changed, 495 insertions(+), 120 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 9bff2038..83db732e 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -1655,7 +1655,7 @@ namespace Microsoft.Dafny {
                                               // it is abstract). Otherwise, it points to that definition.
     public ModuleSignature CompileSignature = null; // This is the version of the signature that should be used at compile time.
     public ModuleSignature Refines = null;
-    public bool IsGhost = false;
+    public bool IsAbstract = false;
     public ModuleSignature() {}
 
     public bool FindSubmodule(string name, out ModuleSignature pp) {
@@ -3461,7 +3461,23 @@ namespace Microsoft.Dafny {
       Contract.Invariant(EndTok != null);
     }
 
+#if OLD_GHOST_HANDLING
     public bool IsGhost;  // filled in by resolution
+#else
+    public static bool ReadyToDealWithGhostField = true;
+    private bool izzaGhost;
+    public bool IsGhost {
+      get {
+        Contract.Requires(ReadyToDealWithGhostField);
+        return izzaGhost;
+      }
+      set {
+        Contract.Requires(ReadyToDealWithGhostField);
+        izzaGhost = value;
+      }
+    }
+    public bool C_IsGhost;  // new ghost computation
+#endif
 
     public Statement(IToken tok, IToken endTok, Attributes attrs) {
       Contract.Requires(tok != null);
@@ -4051,18 +4067,42 @@ namespace Microsoft.Dafny {
     /// This method assumes "lhs" has been successfully resolved.
     /// </summary>
     public static bool LhsIsToGhost(Expression lhs) {
+      Contract.Requires(lhs != null);
+      return LhsIsToGhost_Which(lhs) == NonGhostKind.IsGhost;
+    }
+    public enum NonGhostKind { IsGhost, Variable, Field, ArrayElement }
+    public static string NonGhostKind_To_String(NonGhostKind gk) {
+      Contract.Requires(gk != NonGhostKind.IsGhost);
+      switch (gk) {
+        case NonGhostKind.Variable: return "non-ghost variable";
+        case NonGhostKind.Field: return "non-ghost field";
+        case NonGhostKind.ArrayElement: return "array element";
+        default:
+          Contract.Assume(false);  // unexpected NonGhostKind
+          throw new cce.UnreachableException();  // please compiler
+      }
+    }
+    /// <summary>
+    /// This method assumes "lhs" has been successfully resolved.
+    /// </summary>
+    public static NonGhostKind LhsIsToGhost_Which(Expression lhs) {
       Contract.Requires(lhs != null);
       lhs = lhs.Resolved;
       if (lhs is IdentifierExpr) {
         var x = (IdentifierExpr)lhs;
-        return x.Var.IsGhost;
+        if (!x.Var.IsGhost) {
+          return NonGhostKind.Variable;
+        }
       } else if (lhs is MemberSelectExpr) {
         var x = (MemberSelectExpr)lhs;
-        return x.Member.IsGhost;
+        if (!x.Member.IsGhost) {
+          return NonGhostKind.Field;
+        }
       } else {
         // LHS denotes an array element, which is always non-ghost
-        return false;
+        return NonGhostKind.ArrayElement;
       }
+      return NonGhostKind.IsGhost;
     }
   }
 
@@ -7741,24 +7781,6 @@ namespace Microsoft.Dafny {
 
   public class BottomUpVisitor
   {
-    public void Visit(Expression expr) {
-      Contract.Requires(expr != null);
-      // recursively visit all subexpressions and all substatements
-      expr.SubExpressions.Iter(Visit);
-      if (expr is StmtExpr) {
-        // a StmtExpr also has a sub-statement
-        var e = (StmtExpr)expr;
-        Visit(e.S);
-      }
-      VisitOneExpr(expr);
-    }
-    public void Visit(Statement stmt) {
-      Contract.Requires(stmt != null);
-      // recursively visit all subexpressions and all substatements
-      stmt.SubExpressions.Iter(Visit);
-      stmt.SubStatements.Iter(Visit);
-      VisitOneStmt(stmt);
-    }
     public void Visit(IEnumerable<Expression> exprs) {
       exprs.Iter(Visit);
     }
@@ -7801,6 +7823,24 @@ namespace Microsoft.Dafny {
       if (function.Body != null) { Visit(function.Body); }
       //TODO More?
     }
+    public void Visit(Expression expr) {
+      Contract.Requires(expr != null);
+      // recursively visit all subexpressions and all substatements
+      expr.SubExpressions.Iter(Visit);
+      if (expr is StmtExpr) {
+        // a StmtExpr also has a sub-statement
+        var e = (StmtExpr)expr;
+        Visit(e.S);
+      }
+      VisitOneExpr(expr);
+    }
+    public void Visit(Statement stmt) {
+      Contract.Requires(stmt != null);
+      // recursively visit all subexpressions and all substatements
+      stmt.SubExpressions.Iter(Visit);
+      stmt.SubStatements.Iter(Visit);
+      VisitOneStmt(stmt);
+    }
     protected virtual void VisitOneExpr(Expression expr) {
       Contract.Requires(expr != null);
       // by default, do nothing
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 66f8f449..57a42c73 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -345,7 +345,7 @@ namespace Microsoft.Dafny
                       "module " + Util.Comma(".", abs.CompilePath, x => x.val) + " must be a refinement of "
                       + Util.Comma(".", abs.Path, x => x.val));
                   }
-                  abs.Signature.IsGhost = compileSig.IsGhost;
+                  abs.Signature.IsAbstract = compileSig.IsAbstract;
                   // always keep the ghost information, to supress a spurious error message when the compile module isn't actually a refinement
                 }
               }
@@ -835,14 +835,14 @@ namespace Microsoft.Dafny
       foreach (var kv in m.StaticMembers) {
         info.StaticMembers[kv.Key] = kv.Value;
       }
-      info.IsGhost = m.IsGhost;
+      info.IsAbstract = m.IsAbstract;
       return info;
     }
     ModuleSignature RegisterTopLevelDecls(ModuleDefinition moduleDef, bool useImports) {
       Contract.Requires(moduleDef != null);
       var sig = new ModuleSignature();
       sig.ModuleDef = moduleDef;
-      sig.IsGhost = moduleDef.IsAbstract;
+      sig.IsAbstract = moduleDef.IsAbstract;
       List<TopLevelDecl> declarations = moduleDef.TopLevelDecls;
 
       // First go through and add anything from the opened imports
@@ -1195,7 +1195,7 @@ namespace Microsoft.Dafny
       var sig = RegisterTopLevelDecls(mod, false);
       sig.Refines = p.Refines;
       sig.CompileSignature = p;
-      sig.IsGhost = p.IsGhost;
+      sig.IsAbstract = p.IsAbstract;
       sig.ExclusiveRefinement = p.ExclusiveRefinement;
       mods.Add(mod);
       ResolveModuleDefinition(mod, sig);
@@ -1279,7 +1279,7 @@ namespace Microsoft.Dafny
         } else if (d is ModuleDecl) {
           var decl = (ModuleDecl)d;
           if (!def.IsAbstract) {
-            if (decl.Signature.IsGhost)
+            if (decl.Signature.IsAbstract)
               {
                 if (!(def.IsDefaultModule)) // _module is allowed to contain abstract modules, but not be abstract itself. Note this presents a challenge to
                                             // trusted verification, as toplevels can't be trusted if they invoke abstract module members.
@@ -1400,43 +1400,7 @@ namespace Microsoft.Dafny
           ResolveClassMemberBodies(cl);
         }
         allTypeParameters.PopMarker();
-        SolveAllTypeConstraints();
-      }
-
-      if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
-        foreach (var e in needFiniteBoundsChecks_SetComprehension) {
-          CheckTypeInference(e.Range);  // we need to resolve operators before the call to DiscoverBounds
-          List<BoundVar> missingBounds;
-          e.Bounds = DiscoverBestBounds_MultipleVars(e.BoundVars, e.Range, true, true, out missingBounds);
-          if (missingBounds.Count != 0) {
-            e.MissingBounds = missingBounds;
-            if (e.Finite) {
-              foreach (var bv in e.MissingBounds) {
-              reporter.Error(MessageSource.Resolver, e, "a set comprehension must produce a finite set, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
-              }
-            }
-          }
-        }
-        foreach (var e in needFiniteBoundsChecks_LetSuchThatExpr) {
-          Contract.Assert(!e.Exact);  // only let-such-that expressions are ever added to the list
-          Contract.Assert(e.RHSs.Count == 1);  // if we got this far, the resolver will have checked this condition successfully
-          var constraint = e.RHSs[0];
-          CheckTypeInference(constraint);  // we need to resolve operators before the call to DiscoverBounds
-          List<IVariable> missingBounds;
-          var vars = new List<IVariable>(e.BoundVars);
-          var bestBounds = DiscoverBestBounds_MultipleVars(vars, constraint, true, false, out missingBounds);
-          if (missingBounds.Count != 0) {
-            e.Constraint_MissingBounds = missingBounds;
-            foreach (var bv in e.Constraint_MissingBounds) {
-              reporter.Error(MessageSource.Resolver, e, "a non-ghost let-such-that constraint must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
-            }
-          } else {
-            e.Constraint_Bounds = bestBounds;
-          }
-        }
       }
-      needFiniteBoundsChecks_SetComprehension.Clear();
-      needFiniteBoundsChecks_LetSuchThatExpr.Clear();
 
       Dictionary<string, NativeType> nativeTypeMap = new Dictionary<string, NativeType>();
       foreach (var nativeType in NativeTypes) {
@@ -1546,6 +1510,42 @@ namespace Microsoft.Dafny
         }
       }
 
+      if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
+        // At this point, it is necessary to know for each statement and expression if it is ghost or not
+        foreach (var e in needFiniteBoundsChecks_SetComprehension) {
+          CheckTypeInference(e.Range);  // we need to resolve operators before the call to DiscoverBounds
+          List<BoundVar> missingBounds;
+          e.Bounds = DiscoverBestBounds_MultipleVars(e.BoundVars, e.Range, true, true, out missingBounds);
+          if (missingBounds.Count != 0) {
+            e.MissingBounds = missingBounds;
+            if (e.Finite) {
+              foreach (var bv in e.MissingBounds) {
+                reporter.Error(MessageSource.Resolver, e, "a set comprehension must produce a finite set, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
+              }
+            }
+          }
+        }
+        foreach (var e in needFiniteBoundsChecks_LetSuchThatExpr) {
+          Contract.Assert(!e.Exact);  // only let-such-that expressions are ever added to the list
+          Contract.Assert(e.RHSs.Count == 1);  // if we got this far, the resolver will have checked this condition successfully
+          var constraint = e.RHSs[0];
+          CheckTypeInference(constraint);  // we need to resolve operators before the call to DiscoverBounds
+          List<IVariable> missingBounds;
+          var vars = new List<IVariable>(e.BoundVars);
+          var bestBounds = DiscoverBestBounds_MultipleVars(vars, constraint, true, false, out missingBounds);
+          if (missingBounds.Count != 0) {
+            e.Constraint_MissingBounds = missingBounds;
+            foreach (var bv in e.Constraint_MissingBounds) {
+              reporter.Error(MessageSource.Resolver, e, "a non-ghost let-such-that constraint must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
+            }
+          } else {
+            e.Constraint_Bounds = bestBounds;
+          }
+        }
+      }
+      needFiniteBoundsChecks_SetComprehension.Clear();
+      needFiniteBoundsChecks_LetSuchThatExpr.Clear();
+
       if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
         // fill in the postconditions and bodies of prefix lemmas
         foreach (var com in ModuleDefinition.AllFixpointLemmas(declarations)) {
@@ -2972,6 +2972,294 @@ namespace Microsoft.Dafny
 
     #endregion CheckEqualityTypes
 
+    // ------------------------------------------------------------------------------------------------------
+    // ----- ComputeGhostInterest ---------------------------------------------------------------------------
+    // ------------------------------------------------------------------------------------------------------
+    #region ComputeGhostInterest
+    public void ComputeGhostInterest(Statement stmt, ICodeContext codeContext) {
+      Contract.Requires(stmt != null);
+      Contract.Requires(codeContext != null);
+      var visitor = new GhostInterest_Visitor(codeContext, this);
+      visitor.Visit(stmt, codeContext.IsGhost);
+    }
+    class GhostInterest_Visitor
+    {
+      readonly ICodeContext codeContext;
+      readonly Resolver resolver;
+      public GhostInterest_Visitor(ICodeContext codeContext, Resolver resolver) {
+        Contract.Requires(codeContext != null);
+        Contract.Requires(resolver != null);
+        this.codeContext = codeContext;
+        this.resolver = resolver;
+      }
+      protected void Error(Statement stmt, string msg, params object[] msgArgs) {
+        Contract.Requires(stmt != null);
+        Contract.Requires(msg != null);
+        Contract.Requires(msgArgs != null);
+        resolver.reporter.Error(MessageSource.Resolver, stmt, msg, msgArgs);
+      }
+      protected void Error(Expression expr, string msg, params object[] msgArgs) {
+        Contract.Requires(expr != null);
+        Contract.Requires(msg != null);
+        Contract.Requires(msgArgs != null);
+        resolver.reporter.Error(MessageSource.Resolver, expr, msg, msgArgs);
+      }
+      protected void Error(IToken tok, string msg, params object[] msgArgs) {
+        Contract.Requires(tok != null);
+        Contract.Requires(msg != null);
+        Contract.Requires(msgArgs != null);
+        resolver.reporter.Error(MessageSource.Resolver, tok, msg, msgArgs);
+      }
+      /// <summary>
+      /// This method does three things:
+      /// 0. Reports an error if "mustBeErasable" and the statement assigns to a non-ghost field
+      /// 1. Reports an error if the statement assigns to a non-ghost field and the right-hand side
+      ///    depends on a ghost.
+      /// 2. Sets to "true" the .IsGhost field of the statement if it should be erased during compilation.
+      ///    In that case, substatements should be visited with "mustBeErasable".
+      /// Note that the method called by a StmtExpr must be ghost; however, this is checked elsewhere.  For
+      /// this reason, it is not necessary to visit all subexpressions, unless the subexpression
+      /// matter for the ghost checking/recording of "stmt".
+      /// Note, it is important to set the statement's ghost status before descending into its sub-statements,
+      /// because break statements look at the ghost status of its enclosing statements.
+      /// </summary>
+      public void Visit(Statement stmt, bool mustBeErasable) {
+        Contract.Assume(!codeContext.IsGhost || mustBeErasable);  // (this is really a precondition) codeContext.IsGhost ==> mustBeErasable
+        stmt.IsGhost = false;  // DEBUG
+
+        if (stmt is PredicateStmt) {
+          stmt.C_IsGhost = true;
+
+        } else if (stmt is PrintStmt) {
+          var s = (PrintStmt)stmt;
+          if (mustBeErasable) {
+            Error(stmt, "print statement is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
+          } else {
+            s.Args.Iter(resolver.CheckIsNonGhost);
+          }
+
+        } else if (stmt is BreakStmt) {
+          var s = (BreakStmt)stmt;
+          if (mustBeErasable) {
+            if (!s.TargetStmt.C_IsGhost && !resolver.inSpecOnlyContext[s.TargetStmt]) {  // TODO: inSpecOnlyContext should probably move from Resolver to GhostInterest_Visitor
+              var targetIsLoop = s.TargetStmt is WhileStmt || s.TargetStmt is AlternativeLoopStmt;
+              Error(stmt, "ghost-context break statement is not allowed to break out of non-ghost " + (targetIsLoop ? "loop" : "structure"));
+            }
+          }
+
+        } else if (stmt is ProduceStmt) {
+          var s = (ProduceStmt)stmt;
+          var kind = stmt is YieldStmt ? "yield" : "return";
+          if (mustBeErasable && !codeContext.IsGhost) {
+            Error(stmt, "{0} statement is not allowed in this context (because it is guarded by a specification-only expression)", kind);
+          }
+          if (s.hiddenUpdate != null) {
+            Visit(s.hiddenUpdate, mustBeErasable);
+          }
+
+        } else if (stmt is AssignSuchThatStmt) {
+          var s = (AssignSuchThatStmt)stmt;
+          s.C_IsGhost = mustBeErasable || s.AssumeToken != null || s.Lhss.Any(AssignStmt.LhsIsToGhost);
+          if (mustBeErasable && !codeContext.IsGhost) {
+            foreach (var lhs in s.Lhss) {
+              var gk = AssignStmt.LhsIsToGhost_Which(lhs);
+              if (gk != AssignStmt.NonGhostKind.IsGhost) {
+                Error(lhs, "cannot assign to {0} in a ghost context", AssignStmt.NonGhostKind_To_String(gk));
+              }
+            }
+          } else if (!mustBeErasable && s.AssumeToken == null && resolver.UsesSpecFeatures(s.Expr)) {
+            foreach (var lhs in s.Lhss) {
+              var gk = AssignStmt.LhsIsToGhost_Which(lhs);
+              if (gk != AssignStmt.NonGhostKind.IsGhost) {
+                Error(lhs, "{0} cannot be assigned a value that depends on a ghost", AssignStmt.NonGhostKind_To_String(gk));
+              }
+            }
+          }
+
+        } else if (stmt is UpdateStmt) {
+          var s = (UpdateStmt)stmt;
+          s.ResolvedStatements.Iter(ss => Visit(ss, mustBeErasable));
+          s.C_IsGhost = s.ResolvedStatements.All(ss => ss.C_IsGhost);
+
+        } else if (stmt is VarDeclStmt) {
+          var s = (VarDeclStmt)stmt;
+          if (mustBeErasable) {
+            foreach (var local in s.Locals) {
+              // a local variable in a specification-only context might as well be ghost
+              local.IsGhost = true;
+            }
+          }
+          foreach (var local in s.Locals) {
+            if (Attributes.Contains(local.Attributes, "assumption")) {
+              if (!local.IsGhost) {
+                Error(local.Tok, "assumption variable must be ghost");
+              }
+            }
+          }
+          s.C_IsGhost = (s.Update == null || s.Update.C_IsGhost) && s.Locals.All(v => v.IsGhost);
+          if (s.Update != null) {
+            Visit(s.Update, mustBeErasable);
+          }
+
+        } else if (stmt is AssignStmt) {
+          var s = (AssignStmt)stmt;
+          var lhs = s.Lhs.Resolved;
+          var gk = AssignStmt.LhsIsToGhost_Which(lhs);
+          if (gk == AssignStmt.NonGhostKind.IsGhost) {
+            s.C_IsGhost = true;
+          } else if (gk == AssignStmt.NonGhostKind.Variable && codeContext.IsGhost) {
+            // cool
+          } else if (mustBeErasable) {
+            Error(stmt, "Assignment to {0} is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)",
+              AssignStmt.NonGhostKind_To_String(gk));
+          } else if (s.Rhs is ExprRhs) {
+            var rhs = (ExprRhs)s.Rhs;
+            resolver.CheckIsNonGhost(rhs.Expr);
+          } else if (s.Rhs is HavocRhs) {
+            // cool
+          } else {
+            var rhs = (TypeRhs)s.Rhs;
+            if (rhs.ArrayDimensions != null) {
+              foreach (var dim in rhs.ArrayDimensions) {
+                resolver.CheckIsNonGhost(dim);
+              }
+            }
+            if (rhs.InitCall != null) {
+              foreach (var arg in rhs.InitCall.Args) {
+                resolver.CheckIsNonGhost(arg);
+              }
+            }
+          }
+
+        } else if (stmt is CallStmt) {
+          var s = (CallStmt)stmt;
+          var callee = s.Method;
+          Contract.Assert(callee != null);  // follows from the invariant of CallStmt
+          s.C_IsGhost = callee.IsGhost;
+          // check in-parameters
+          if (mustBeErasable) {
+            if (!s.C_IsGhost) {
+              Error(s, "only ghost methods can be called from this context");
+            }
+          } else {
+            resolver.CheckIsNonGhost(s.Receiver);
+            int j;
+            if (!callee.IsGhost) {
+              j = 0;
+              foreach (var e in s.Args) {
+                Contract.Assume(j < callee.Ins.Count);  // this should have already been checked by the resolver
+                if (!callee.Ins[j].IsGhost) {
+                  resolver.CheckIsNonGhost(e);
+                }
+                j++;
+              }
+            }
+            j = 0;
+            foreach (var e in s.Lhs) {
+              var resolvedLhs = e.Resolved;
+              if (callee.IsGhost || callee.Outs[j].IsGhost) {
+                // LHS must denote a ghost
+                if (resolvedLhs is IdentifierExpr) {
+                  var ll = (IdentifierExpr)resolvedLhs;
+                  if (!ll.Var.IsGhost) {
+                    if (ll is AutoGhostIdentifierExpr && ll.Var is LocalVariable) {
+                      // the variable was actually declared in this statement, so auto-declare it as ghost
+                      ((LocalVariable)ll.Var).MakeGhost();
+                    } else {
+                      Error(s, "actual out-parameter {0} is required to be a ghost variable", j);
+                    }
+                  }
+                } else if (resolvedLhs is MemberSelectExpr) {
+                  var ll = (MemberSelectExpr)resolvedLhs;
+                  if (!ll.Member.IsGhost) {
+                    Error(s, "actual out-parameter {0} is required to be a ghost field", j);
+                  }
+                } else {
+                  // this is an array update, and arrays are always non-ghost
+                  Error(s, "actual out-parameter {0} is required to be a ghost variable", j);
+                }
+              }
+              j++;
+            }
+          }
+
+        } else if (stmt is BlockStmt) {
+          var s = (BlockStmt)stmt;
+          s.Body.Iter(ss => Visit(ss, mustBeErasable));
+          s.C_IsGhost = s.Body.All(ss => ss.C_IsGhost);  // mark the block statement as ghost if all its substatements are ghost
+
+        } else if (stmt is IfStmt) {
+          var s = (IfStmt)stmt;
+          s.C_IsGhost = mustBeErasable || (s.Guard != null && resolver.UsesSpecFeatures(s.Guard));
+          Visit(s.Thn, s.C_IsGhost);
+          if (s.Els != null) {
+            Visit(s.Els, s.C_IsGhost);
+          }
+          // if both branches were all ghost, then we can mark the enclosing statement as ghost as well
+          s.C_IsGhost = s.C_IsGhost || (s.Thn.C_IsGhost && (s.Els == null || s.Els.C_IsGhost));
+
+        } else if (stmt is AlternativeStmt) {
+          var s = (AlternativeStmt)stmt;
+          s.C_IsGhost = mustBeErasable || s.Alternatives.Exists(alt => resolver.UsesSpecFeatures(alt.Guard));
+          s.Alternatives.Iter(alt => alt.Body.Iter(ss => Visit(ss, s.C_IsGhost)));
+          s.C_IsGhost = s.C_IsGhost || s.Alternatives.All(alt => alt.Body.All(ss => ss.C_IsGhost));
+
+        } else if (stmt is WhileStmt) {
+          var s = (WhileStmt)stmt;
+          s.C_IsGhost = mustBeErasable || (s.Guard != null && resolver.UsesSpecFeatures(s.Guard));
+          if (s.Body != null) {
+            Visit(s.Body, s.C_IsGhost);
+          }
+          s.C_IsGhost = s.C_IsGhost || s.Body == null || (!s.Decreases.Expressions.Exists(e => e is WildcardExpr) && s.Body.C_IsGhost);
+
+        } else if (stmt is AlternativeLoopStmt) {
+          var s = (AlternativeLoopStmt)stmt;
+          s.C_IsGhost = mustBeErasable || s.Alternatives.Exists(alt => resolver.UsesSpecFeatures(alt.Guard));
+          s.Alternatives.Iter(alt => alt.Body.Iter(ss => Visit(ss, s.C_IsGhost)));
+          s.C_IsGhost = s.C_IsGhost || (!s.Decreases.Expressions.Exists(e => e is WildcardExpr) && s.Alternatives.All(alt => alt.Body.All(ss => ss.C_IsGhost)));
+
+        } else if (stmt is ForallStmt) {
+          var s = (ForallStmt)stmt;
+          s.C_IsGhost = mustBeErasable || s.Kind != ForallStmt.ParBodyKind.Assign || resolver.UsesSpecFeatures(s.Range);
+          if (s.Body != null) {
+            Visit(s.Body, s.C_IsGhost);
+          }
+          s.C_IsGhost = s.C_IsGhost || s.Body == null || s.Body.C_IsGhost;
+
+        } else if (stmt is ModifyStmt) {
+          var s = (ModifyStmt)stmt;
+          if (s.Body != null) {
+            Visit(s.Body, mustBeErasable);
+          }
+          s.C_IsGhost = mustBeErasable;
+
+        } else if (stmt is CalcStmt) {
+          var s = (CalcStmt)stmt;
+          s.C_IsGhost = true;
+          foreach (var h in s.Hints) {
+            Visit(h, true);
+          }
+
+        } else if (stmt is MatchStmt) {
+          var s = (MatchStmt)stmt;
+          var mbe = mustBeErasable || resolver.UsesSpecFeatures(s.Source);
+          s.Cases.Iter(kase => kase.Body.Iter(ss => Visit(ss, mbe)));
+          s.C_IsGhost = mbe || s.Cases.All(kase => kase.Body.All(ss => ss.C_IsGhost));
+
+        } else if (stmt is SkeletonStatement) {
+          var s = (SkeletonStatement)stmt;
+          if (s.S != null) {
+            Visit(s.S, mustBeErasable);
+          }
+
+        } else {
+          Contract.Assert(false); throw new cce.UnreachableException();
+        }
+        stmt.IsGhost = stmt.C_IsGhost;  // DEBUG
+      }
+    }
+    #endregion
+
     // ------------------------------------------------------------------------------------------------------
     // ----- FillInDefaultLoopDecreases ---------------------------------------------------------------------
     // ------------------------------------------------------------------------------------------------------
@@ -3601,22 +3889,14 @@ namespace Microsoft.Dafny
       // order does not matter much for resolution, so resolve them in reverse order
       foreach (var attr in attrs.AsEnumerable()) {
         if (attr.Args != null) {
-          ResolveAttributeArgs(attr.Args, opts, true);
-        }
-      }
-    }
-
-    void ResolveAttributeArgs(List<Expression> args, ResolveOpts opts, bool allowGhosts) {
-      Contract.Requires(args != null);
-      foreach (var arg in args) {
-        Contract.Assert(arg != null);
-        int prevErrors = reporter.Count(ErrorLevel.Error);
-        ResolveExpression(arg, opts);
-        if (!allowGhosts) {
-          CheckIsNonGhost(arg);
-        }
-        if (prevErrors == reporter.Count(ErrorLevel.Error)) {
-          CheckTypeInference(arg);
+          foreach (var arg in attr.Args) {
+            Contract.Assert(arg != null);
+            int prevErrors = reporter.Count(ErrorLevel.Error);
+            ResolveExpression(arg, opts);
+            if (prevErrors == reporter.Count(ErrorLevel.Error)) {
+              CheckTypeInference(arg);
+            }
+          }
         }
       }
     }
@@ -3718,9 +3998,11 @@ namespace Microsoft.Dafny
         ResolveExpression(r, new ResolveOpts(f, false, true));
         // any type is fine
       }
+      SolveAllTypeConstraints();
       if (f.Body != null) {
         var prevErrorCount = reporter.Count(ErrorLevel.Error);
         ResolveExpression(f.Body, new ResolveOpts(f, false));
+        SolveAllTypeConstraints();
         if (!f.IsGhost && prevErrorCount == reporter.Count(ErrorLevel.Error)) {
           CheckIsNonGhost(f.Body);
         }
@@ -3852,6 +4134,7 @@ namespace Microsoft.Dafny
           Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
           ConstrainTypes(e.E.Type, Type.Bool, e.E, "Postcondition must be a boolean (got {0})", e.E.Type);
         }
+        SolveAllTypeConstraints();
 
         // Resolve body
         if (m.Body != null) {
@@ -3862,8 +4145,12 @@ namespace Microsoft.Dafny
             var k = com.PrefixLemma.Ins[0];
             scope.Push(k.Name, k);  // we expect no name conflict for _k
           }
-          var codeContext = m;
-          ResolveBlockStatement(m.Body, m.IsGhost, codeContext);
+          var prevErrorCount = reporter.Count(ErrorLevel.Error);
+          ResolveBlockStatement(m.Body, m.IsGhost, m);
+          SolveAllTypeConstraints();
+          if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
+            ComputeGhostInterest(m.Body, m);
+          }
         }
 
         // attributes are allowed to mention both in- and out-parameters (including the implicit _k, for colemmas)
@@ -3982,6 +4269,9 @@ namespace Microsoft.Dafny
       // Resolve body
       if (iter.Body != null) {
         ResolveBlockStatement(iter.Body, false, iter);
+        if (reporter.Count(ErrorLevel.Error) == postSpecErrorCount) {
+          ComputeGhostInterest(iter.Body, iter);
+        }
       }
 
       currentClass = null;
@@ -4834,11 +5124,15 @@ namespace Microsoft.Dafny
         ConstrainTypes(s.Expr.Type, Type.Bool, s.Expr, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Expr.Type);
 
       } else if (stmt is PrintStmt) {
-        PrintStmt s = (PrintStmt)stmt;
-        ResolveAttributeArgs(s.Args, new ResolveOpts(codeContext, false, specContextOnly), false);
+        var s = (PrintStmt)stmt;
+        var opts = new ResolveOpts(codeContext, false, specContextOnly);
+        s.Args.Iter(e => ResolveExpression(e, opts));
+#if OLD_GHOST_HANDLING
+        ResolveAttributeArgs(s.Args, new ResolveOpts(codeContext, false, specContextOnly));
         if (specContextOnly) {
           reporter.Error(MessageSource.Resolver, stmt, "print statement is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
         }
+#endif
 
       } else if (stmt is BreakStmt) {
         var s = (BreakStmt)stmt;
@@ -4848,10 +5142,12 @@ namespace Microsoft.Dafny
             reporter.Error(MessageSource.Resolver, s, "break label is undefined or not in scope: {0}", s.TargetLabel);
           } else {
             s.TargetStmt = target;
+#if OLD_GHOST_HANDLING
             bool targetIsLoop = target is WhileStmt || target is AlternativeLoopStmt;
             if (specContextOnly && !s.TargetStmt.IsGhost && !inSpecOnlyContext[s.TargetStmt]) {
               reporter.Error(MessageSource.Resolver, stmt, "ghost-context break statement is not allowed to break out of non-ghost " + (targetIsLoop ? "loop" : "structure"));
             }
+#endif
           }
         } else {
           if (loopStack.Count < s.BreakCount) {
@@ -4863,9 +5159,11 @@ namespace Microsoft.Dafny
               target.Labels = new LList<Label>(new Label(target.Tok, null), null);
             }
             s.TargetStmt = target;
+#if OLD_GHOST_HANDLING
             if (specContextOnly && !target.IsGhost && !inSpecOnlyContext[target]) {
               reporter.Error(MessageSource.Resolver, stmt, "ghost-context break statement is not allowed to break out of non-ghost loop");
             }
+#endif
           }
         }
 
@@ -4875,8 +5173,10 @@ namespace Microsoft.Dafny
           reporter.Error(MessageSource.Resolver, stmt, "yield statement is allowed only in iterators");
         } else if (stmt is ReturnStmt && !(codeContext is Method)) {
           reporter.Error(MessageSource.Resolver, stmt, "return statement is allowed only in method");
+#if OLD_GHOST_HANDLING
         } else if (specContextOnly && !codeContext.IsGhost) {
           reporter.Error(MessageSource.Resolver, stmt, "{0} statement is not allowed in this context (because it is guarded by a specification-only expression)", kind);
+#endif
         }
         var s = (ProduceStmt)stmt;
         if (s.rhss != null) {
@@ -4935,10 +5235,12 @@ namespace Microsoft.Dafny
         foreach (var local in s.Locals) {
           ResolveType(local.Tok, local.OptionalType, codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
           local.type = local.OptionalType;
+#if OLD_GHOST_HANDLING
           if (specContextOnly) {
             // a local variable in a specification-only context might as well be ghost
             local.IsGhost = true;
           }
+#endif
         }
         // Resolve the UpdateStmt, if any
         if (s.Update is UpdateStmt) {
@@ -4979,10 +5281,12 @@ namespace Microsoft.Dafny
             {
               reporter.Error(MessageSource.Resolver, local.Tok, "assumption variable can only be declared in a method");
             }
-            if (!local.IsGhost)
+#if OLD_GHOST_HANDLING
+            if (!specContextOnly && !local.IsGhost)
             {
               reporter.Error(MessageSource.Resolver, local.Tok, "assumption variable must be ghost");
             }
+#endif
             if (!(local.Type.IsBoolType))
             {
               reporter.Error(MessageSource.Resolver, s, "assumption variable must be of type 'bool'");
@@ -5006,9 +5310,11 @@ namespace Microsoft.Dafny
           } else {
             lvalueIsGhost = var.IsGhost || codeContext.IsGhost;
             CheckIsLvalue(lhs, codeContext);
+#if OLD_GHOST_HANDLING
             if (!lvalueIsGhost && specContextOnly) {
               reporter.Error(MessageSource.Resolver, stmt, "Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
             }
+#endif
 
             var localVar = var as LocalVariable;
             if (localVar != null && currentMethod != null && Attributes.Contains(localVar.Attributes, "assumption"))
@@ -5034,6 +5340,7 @@ namespace Microsoft.Dafny
           var fse = (MemberSelectExpr)lhs;
           if (fse.Member != null) {  // otherwise, an error was reported above
             lvalueIsGhost = fse.Member.IsGhost;
+#if OLD_GHOST_HANDLING
             if (!lvalueIsGhost) {
               if (specContextOnly) {
                 reporter.Error(MessageSource.Resolver, stmt, "Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
@@ -5045,6 +5352,7 @@ namespace Microsoft.Dafny
                 }
               }
             }
+#endif
             CheckIsLvalue(fse, codeContext);
           }
         } else if (lhs is SeqSelectExpr) {
@@ -5052,16 +5360,20 @@ namespace Microsoft.Dafny
           // LHS is fine, provided the "sequence" is really an array
           if (lhsResolvedSuccessfully) {
             Contract.Assert(slhs.Seq.Type != null);
+#if OLD_GHOST_HANDLING
             if (specContextOnly) {
               reporter.Error(MessageSource.Resolver, stmt, "Assignment to array element is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
             }
+#endif
             CheckIsLvalue(slhs, codeContext);
           }
 
         } else if (lhs is MultiSelectExpr) {
+#if OLD_GHOST_HANDLING
           if (specContextOnly) {
             reporter.Error(MessageSource.Resolver, stmt, "Assignment to array element is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
           }
+#endif
           CheckIsLvalue(lhs, codeContext);
 
         } else {
@@ -5073,14 +5385,17 @@ namespace Microsoft.Dafny
         if (s.Rhs is ExprRhs) {
           ExprRhs rr = (ExprRhs)s.Rhs;
           ResolveExpression(rr.Expr, new ResolveOpts(codeContext, true, specContextOnly));
+#if OLD_GHOST_HANDLING
           if (!lvalueIsGhost) {
             CheckIsNonGhost(rr.Expr);
           }
+#endif
           Contract.Assert(rr.Expr.Type != null);  // follows from postcondition of ResolveExpression
           ConstrainTypes(lhsType, rr.Expr.Type, stmt, "RHS (of type {0}) not assignable to LHS (of type {1})", rr.Expr.Type, lhsType);
         } else if (s.Rhs is TypeRhs) {
           TypeRhs rr = (TypeRhs)s.Rhs;
           Type t = ResolveTypeRhs(rr, stmt, lvalueIsGhost, codeContext);
+#if OLD_GHOST_HANDLING
           if (!lvalueIsGhost) {
             if (rr.ArrayDimensions != null) {
               foreach (var dim in rr.ArrayDimensions) {
@@ -5093,6 +5408,7 @@ namespace Microsoft.Dafny
               }
             }
           }
+#endif
           ConstrainTypes(lhsType, t, stmt, "type {0} is not assignable to LHS (of type {1})", t, lhsType);
         } else if (s.Rhs is HavocRhs) {
           // nothing else to do
@@ -5909,9 +6225,11 @@ namespace Microsoft.Dafny
         var ec = reporter.Count(ErrorLevel.Error);
         ResolveExpression(lhs, new ResolveOpts(codeContext, true, specContextOnly));
         if (ec == reporter.Count(ErrorLevel.Error)) {
+#if OLD_GHOST_HANDLING
           if (update == null && specContextOnly && !AssignStmt.LhsIsToGhost(lhs) && !codeContext.IsGhost) {
             reporter.Error(MessageSource.Resolver, lhs, "cannot assign to non-ghost variable in a ghost context");
           }
+#endif
           if (lhs is SeqSelectExpr && !((SeqSelectExpr)lhs).SelectOne) {
             reporter.Error(MessageSource.Resolver, lhs, "cannot assign to a range of array elements (try the 'forall' statement)");
           }
@@ -6058,8 +6376,10 @@ namespace Microsoft.Dafny
       ResolveExpression(s.Expr, new ResolveOpts(codeContext, true, specContextOnly));
       ConstrainTypes(s.Expr.Type, Type.Bool, s.Expr, "type of RHS of assign-such-that statement must be boolean (got {0})", s.Expr.Type);
       if (ec == reporter.Count(ErrorLevel.Error) && !s.IsGhost && s.AssumeToken == null && !specContextOnly) {
+#if OLD_GHOST_HANDLING
         CheckIsNonGhost(s.Expr);
 
+#endif
         CheckTypeInference(s.Expr);  // we need to resolve operators before the call to DiscoverBoundsAux
         List<IVariable> missingBounds;
         var bestBounds = DiscoverBestBounds_MultipleVars(varLhss, s.Expr, true, false, out missingBounds);
@@ -6141,9 +6461,11 @@ namespace Microsoft.Dafny
         bool allowGhost = s.IsGhost || callee.Ins.Count <= j || callee.Ins[j].IsGhost;
         var ec = reporter.Count(ErrorLevel.Error);
         ResolveExpression(e, new ResolveOpts(codeContext, true, allowGhost));
+#if OLD_GHOST_HANDLING
         if (ec == reporter.Count(ErrorLevel.Error) && !allowGhost) {
           CheckIsNonGhost(e);
         }
+#endif
         j++;
       }
 
@@ -6181,6 +6503,7 @@ namespace Microsoft.Dafny
           if (!ConstrainTypes(lhs.Type, st, s, "incorrect type of method out-parameter {0} (expected {1}, got {2})", i, st, lhs.Type)) {
           } else {
             var resolvedLhs = lhs.Resolved;
+#if OLD_GHOST_HANDLING
             if (!specContextOnly && (s.IsGhost || callee.Outs[i].IsGhost)) {
               // LHS must denote a ghost
               if (resolvedLhs is IdentifierExpr) {
@@ -6203,6 +6526,7 @@ namespace Microsoft.Dafny
                 reporter.Error(MessageSource.Resolver, s, "actual out-parameter {0} is required to be a ghost variable", i);
               }
             }
+#endif
             // LHS must denote a mutable field.
             CheckIsLvalue(resolvedLhs, codeContext);
           }
@@ -9155,7 +9479,7 @@ namespace Microsoft.Dafny
           return;
         }
       } else if (expr is NamedExpr) {
-        if (!moduleInfo.IsGhost)
+        if (!moduleInfo.IsAbstract)
           CheckIsNonGhost(((NamedExpr)expr).Body);
         return;
       } else if (expr is ChainingExpression) {
@@ -9967,8 +10291,15 @@ namespace Microsoft.Dafny
         IdentifierExpr e = (IdentifierExpr)expr;
         return cce.NonNull(e.Var).IsGhost;
       } else if (expr is DatatypeValue) {
-        DatatypeValue dtv = (DatatypeValue)expr;
-        return dtv.Arguments.Exists(arg => UsesSpecFeatures(arg));
+        var e = (DatatypeValue)expr;
+        // check all NON-ghost arguments
+        // note that if resolution is successful, then |e.Arguments| == |e.Ctor.Formals|
+        for (int i = 0; i < e.Arguments.Count; i++) {
+          if (!e.Ctor.Formals[i].IsGhost && UsesSpecFeatures(e.Arguments[i])) {
+            return true;
+          }
+        }
+        return false;
       } else if (expr is DisplayExpression) {
         DisplayExpression e = (DisplayExpression)expr;
         return e.Elements.Exists(ee => UsesSpecFeatures(ee));
@@ -9996,11 +10327,20 @@ namespace Microsoft.Dafny
                UsesSpecFeatures(e.Index) ||
                UsesSpecFeatures(e.Value);
       } else if (expr is FunctionCallExpr) {
-        FunctionCallExpr e = (FunctionCallExpr)expr;
-        if (cce.NonNull(e.Function).IsGhost) {
+        var e = (FunctionCallExpr)expr;
+        if (e.Function.IsGhost) {
           return true;
         }
-        return e.Args.Exists(arg => UsesSpecFeatures(arg));
+        // check all NON-ghost arguments
+        if (UsesSpecFeatures(e.Receiver)) {
+          return true;
+        }
+        for (int i = 0; i < e.Function.Formals.Count; i++) {
+          if (!e.Function.Formals[i].IsGhost && UsesSpecFeatures(e.Args[i])) {
+            return true;
+          }
+        }
+        return false;
       } else if (expr is ApplyExpr) {
         ApplyExpr e = (ApplyExpr)expr;
         return UsesSpecFeatures(e.Function) || e.Args.Exists(UsesSpecFeatures);
@@ -10041,7 +10381,7 @@ namespace Microsoft.Dafny
           return true;  // let-such-that is always ghost
         }
       } else if (expr is NamedExpr) {
-        return moduleInfo.IsGhost ? false : UsesSpecFeatures(((NamedExpr)expr).Body);
+        return moduleInfo.IsAbstract ? false : UsesSpecFeatures(((NamedExpr)expr).Body);
       } else if (expr is ComprehensionExpr) {
         var q = expr as QuantifierExpr;
         Contract.Assert(q == null || q.SplitQuantifier == null); // No split quantifiers during resolution
diff --git a/Test/dafny0/AssumptionVariables0.dfy b/Test/dafny0/AssumptionVariables0.dfy
index a3e23b73..b9acc522 100644
--- a/Test/dafny0/AssumptionVariables0.dfy
+++ b/Test/dafny0/AssumptionVariables0.dfy
@@ -6,7 +6,7 @@ method test0(x: int)
   ghost var {:assumption} a0 := false;  // error
   ghost var a1, {:assumption} a2 := true, false;  // error
   ghost var {:assumption} a3: bool;
-  var {:assumption} a4;  // 2 errors
+  ghost var {:assumption} a4;  // error: type must be bool
 
   a0 := a0 && (0 < x);
 
@@ -54,7 +54,7 @@ method test2()
 
       if (false)
       {
-        var {:assumption} a0: bool;  // error
+        ghost var {:assumption} a0: bool;
 
         if (false)
         {
@@ -73,3 +73,7 @@ method test2()
     }
   }
 }
+
+method test3() {
+  var {:assumption} a: bool;  // error: assumption variable must be ghost
+}
diff --git a/Test/dafny0/AssumptionVariables0.dfy.expect b/Test/dafny0/AssumptionVariables0.dfy.expect
index f2d43fe1..16572961 100644
--- a/Test/dafny0/AssumptionVariables0.dfy.expect
+++ b/Test/dafny0/AssumptionVariables0.dfy.expect
@@ -1,14 +1,13 @@
 AssumptionVariables0.dfy(6,29): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a0 && <boolean expression>"
 AssumptionVariables0.dfy(7,33): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a2 && <boolean expression>"
-AssumptionVariables0.dfy(9,20): Error: assumption variable must be ghost
 AssumptionVariables0.dfy(9,2): Error: assumption variable must be of type 'bool'
 AssumptionVariables0.dfy(15,5): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a3 && <boolean expression>"
 AssumptionVariables0.dfy(17,5): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a3 && <boolean expression>"
 AssumptionVariables0.dfy(27,5): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a0 && <boolean expression>"
 AssumptionVariables0.dfy(31,5): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a0 && <boolean expression>"
 AssumptionVariables0.dfy(53,9): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a0 && <boolean expression>"
-AssumptionVariables0.dfy(57,26): Error: assumption variable must be ghost
 AssumptionVariables0.dfy(61,37): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a0 && <boolean expression>"
 AssumptionVariables0.dfy(61,10): Error: assumption variable must be of type 'bool'
 AssumptionVariables0.dfy(69,15): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a0 && <boolean expression>"
-13 resolution/type errors detected in AssumptionVariables0.dfy
+AssumptionVariables0.dfy(78,20): Error: assumption variable must be ghost
+12 resolution/type errors detected in AssumptionVariables0.dfy
diff --git a/Test/dafny0/ParallelResolveErrors.dfy b/Test/dafny0/ParallelResolveErrors.dfy
index 5e01f019..61956651 100644
--- a/Test/dafny0/ParallelResolveErrors.dfy
+++ b/Test/dafny0/ParallelResolveErrors.dfy
@@ -40,8 +40,8 @@ method M0(IS: set<int>)
   {
     var x := i;
     x := x + 1;
-    y := 18;  // (this statement is not allowed, since y is declared outside the forall, but that check happens only if the first resolution pass of the forall statement passes, which it doesn't in this case because of the next line)
-    z := 20;  // error: assigning to a non-ghost variable inside a ghost forall block
+    y := 18;  // error: assigning to a (ghost) variable inside a ghost forall block
+    z := 20;  // error: assigning to a (non-ghost) variable inside a ghost forall block
   }
 
   forall (i | 0 <= i)
diff --git a/Test/dafny0/ParallelResolveErrors.dfy.expect b/Test/dafny0/ParallelResolveErrors.dfy.expect
index 7305bfce..00030994 100644
--- a/Test/dafny0/ParallelResolveErrors.dfy.expect
+++ b/Test/dafny0/ParallelResolveErrors.dfy.expect
@@ -1,7 +1,8 @@
 ParallelResolveErrors.dfy(10,9): Error: Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
 ParallelResolveErrors.dfy(21,4): Error: LHS of assignment must denote a mutable variable
 ParallelResolveErrors.dfy(26,6): Error: body of forall statement is attempting to update a variable declared outside the forall statement
-ParallelResolveErrors.dfy(44,6): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ParallelResolveErrors.dfy(43,6): Error: body of forall statement is attempting to update a variable declared outside the forall statement
+ParallelResolveErrors.dfy(44,6): Error: body of forall statement is attempting to update a variable declared outside the forall statement
 ParallelResolveErrors.dfy(56,13): Error: new allocation not supported in forall statements
 ParallelResolveErrors.dfy(61,13): Error: new allocation not allowed in ghost context
 ParallelResolveErrors.dfy(62,13): Error: new allocation not allowed in ghost context
@@ -19,4 +20,4 @@ ParallelResolveErrors.dfy(96,24): Error: break label is undefined or not in scop
 ParallelResolveErrors.dfy(107,9): Error: the body of the enclosing forall statement is not allowed to update heap locations
 ParallelResolveErrors.dfy(115,29): Error: the body of the enclosing forall statement is not allowed to update heap locations, so any call must be to a method with an empty modifies clause
 ParallelResolveErrors.dfy(120,29): Error: the body of the enclosing forall statement is not allowed to update heap locations, so any call must be to a method with an empty modifies clause
-21 resolution/type errors detected in ParallelResolveErrors.dfy
+22 resolution/type errors detected in ParallelResolveErrors.dfy
diff --git a/Test/dafny0/ResolutionErrors.dfy b/Test/dafny0/ResolutionErrors.dfy
index 1354e533..5f0b22a2 100644
--- a/Test/dafny0/ResolutionErrors.dfy
+++ b/Test/dafny0/ResolutionErrors.dfy
@@ -195,7 +195,7 @@ class GhostTests {
       decreases 112 - n;
     {
       label MyStructure: {
-        if (k % 17 == 0) { break MyStructure; }  // error: break from ghost to non-ghost point
+//KRML(ghost)        if (k % 17 == 0) { break MyStructure; }  // error: break from ghost to non-ghost point
         k := k + 1;
       }
       label MyOtherStructure:
@@ -218,7 +218,7 @@ class GhostTests {
               case true => break LoopLabel1;  // fine
             }
           } else if (m % 101 == 0) {
-            break break;  // error: break out of non-ghost loop from ghost context
+//KRML(ghost)            break break;  // error: break out of non-ghost loop from ghost context
           }
           m := m + 3;
         }
@@ -232,14 +232,14 @@ class GhostTests {
           } else if (*) {
             break break break;  // error: tries to break out of more loop levels than there are
           } else if (*) {
-            break break;  // fine, since this is not a ghost context
+//KRML(ghost)            break break;  // fine, since this is not a ghost context
           } else if (k == 67) {
-            break break;  // error, because this is a ghost context
+//KRML(ghost)            break break;  // error, because this is a ghost context
           }
           q := q + 1;
         }
       } else if (n == t) {
-        return;  // error: this is a ghost context trying to return from a non-ghost method
+//KRML(ghost)        return;  // error: this is a ghost context trying to return from a non-ghost method
       }
       n := n + 1;
       p := p + 1;
@@ -310,7 +310,7 @@ method DatatypeDestructors(d: DTD_List) {
       assert d.DTD_Cons? == d.Car;  // type error
       assert d == DTD_Cons(hd, tl, 5);
       ghost var g0 := d.g;  // fine
-      var g1 := d.g;  // error: cannot use ghost member in non-ghost code
+//KRML(ghost)      var g1 := d.g;  // error: cannot use ghost member in non-ghost code
   }
 }
 
@@ -383,7 +383,7 @@ method TestCalc(m: int, n: int, a: bool, b: bool)
   }
   calc {
     n + m;
-    { print n + m; } // error: non-ghost statements are not allowed in hints
+//KRML(ghost)    { print n + m; } // error: non-ghost statements are not allowed in hints
     m + n;
   }
 }
@@ -543,7 +543,7 @@ method LetSuchThat(ghost z: int, n: nat)
   var x: int;
   x := var y :| y < 0; y;  // fine for the resolver (but would give a verification error for not being deterministic)
 
-  x := var y :| y < z; y;  // error: contraint depend on ghost (z)
+//KRML(ghost)  x := var y :| y < z; y;  // error: contraint depend on ghost (z)
 
   x := var w :| w == 2*w; w;  // fine (even for the verifier, this one)
   x := var w := 2*w; w;  // error: the 'w' in the RHS of the assignment is not in scope
diff --git a/Test/dafny0/ResolutionErrors.dfy.expect b/Test/dafny0/ResolutionErrors.dfy.expect
index b5c93ac1..8debdbf9 100644
--- a/Test/dafny0/ResolutionErrors.dfy.expect
+++ b/Test/dafny0/ResolutionErrors.dfy.expect
@@ -21,14 +21,12 @@ ResolutionErrors.dfy(642,21): Error: the type of this variable is underspecified
 ResolutionErrors.dfy(680,13): Error: calls to methods with side-effects are not allowed inside a hint
 ResolutionErrors.dfy(690,17): Error: only ghost methods can be called from this context
 ResolutionErrors.dfy(693,15): Error: 'decreases *' is not allowed on ghost loops
-ResolutionErrors.dfy(704,11): Error: Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
 ResolutionErrors.dfy(704,11): Error: a hint is not allowed to update heap locations
 ResolutionErrors.dfy(705,16): Error: a hint is not allowed to update heap locations
 ResolutionErrors.dfy(706,13): Error: calls to methods with side-effects are not allowed inside a hint
 ResolutionErrors.dfy(709,14): Error: a while statement used inside a hint is not allowed to have a modifies clause
 ResolutionErrors.dfy(728,17): Error: only ghost methods can be called from this context
 ResolutionErrors.dfy(731,15): Error: 'decreases *' is not allowed on ghost loops
-ResolutionErrors.dfy(736,11): Error: Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
 ResolutionErrors.dfy(736,11): Error: a hint is not allowed to update heap locations
 ResolutionErrors.dfy(737,16): Error: a hint is not allowed to update heap locations
 ResolutionErrors.dfy(738,4): Error: calls to methods with side-effects are not allowed inside a hint
@@ -126,11 +124,7 @@ ResolutionErrors.dfy(141,21): Error: ghost variables are allowed only in specifi
 ResolutionErrors.dfy(142,35): Error: ghost variables are allowed only in specification contexts
 ResolutionErrors.dfy(151,10): Error: only ghost methods can be called from this context
 ResolutionErrors.dfy(157,16): Error: 'decreases *' is not allowed on ghost loops
-ResolutionErrors.dfy(198,27): Error: ghost-context break statement is not allowed to break out of non-ghost structure
-ResolutionErrors.dfy(221,12): Error: ghost-context break statement is not allowed to break out of non-ghost loop
 ResolutionErrors.dfy(233,12): Error: trying to break out of more loop levels than there are enclosing loops
-ResolutionErrors.dfy(237,12): Error: ghost-context break statement is not allowed to break out of non-ghost loop
-ResolutionErrors.dfy(242,8): Error: return statement is not allowed in this context (because it is guarded by a specification-only expression)
 ResolutionErrors.dfy(408,11): Error: calls to methods with side-effects are not allowed inside a hint
 ResolutionErrors.dfy(410,14): Error: a hint is not allowed to update heap locations
 ResolutionErrors.dfy(412,10): Error: a hint is not allowed to update a variable declared outside the hint
@@ -170,7 +164,6 @@ ResolutionErrors.dfy(294,9): Error: a constructor is allowed to be called only w
 ResolutionErrors.dfy(308,16): Error: arguments must have the same type (got int and DTD_List)
 ResolutionErrors.dfy(309,16): Error: arguments must have the same type (got DTD_List and int)
 ResolutionErrors.dfy(310,25): Error: arguments must have the same type (got bool and int)
-ResolutionErrors.dfy(313,18): Error: ghost fields are allowed only in specification contexts
 ResolutionErrors.dfy(322,15): Error: ghost variables are allowed only in specification contexts
 ResolutionErrors.dfy(347,5): Error: incorrect type of method in-parameter 1 (expected GenericClass<int>, got GenericClass<bool>)
 ResolutionErrors.dfy(359,18): Error: incorrect type of datatype constructor argument (found GList<_T0>, expected GList<int>)
@@ -182,10 +175,8 @@ ResolutionErrors.dfy(376,10): Error: first argument to ==> must be of type bool
 ResolutionErrors.dfy(376,10): Error: second argument to ==> must be of type bool (instead got int)
 ResolutionErrors.dfy(381,10): Error: first argument to ==> must be of type bool (instead got int)
 ResolutionErrors.dfy(381,10): Error: second argument to ==> must be of type bool (instead got int)
-ResolutionErrors.dfy(386,6): Error: print statement is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
 ResolutionErrors.dfy(470,7): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(476,12): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(546,20): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(476,2): Error: non-ghost variable cannot be assigned a value that depends on a ghost
 ResolutionErrors.dfy(549,18): Error: unresolved identifier: w
 ResolutionErrors.dfy(656,11): Error: lemmas are not allowed to have modifies clauses
 ResolutionErrors.dfy(918,9): Error: unresolved identifier: s
@@ -200,4 +191,4 @@ ResolutionErrors.dfy(1106,8): Error: new cannot be applied to a trait
 ResolutionErrors.dfy(1127,13): Error: first argument to / must be of numeric type (instead got set<bool>)
 ResolutionErrors.dfy(1134,18): Error: a call to a possibly non-terminating method is allowed only if the calling method is also declared (with 'decreases *') to be possibly non-terminating
 ResolutionErrors.dfy(1149,14): Error: a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating
-202 resolution/type errors detected in ResolutionErrors.dfy
+193 resolution/type errors detected in ResolutionErrors.dfy
diff --git a/Test/dafny0/TypeTests.dfy.expect b/Test/dafny0/TypeTests.dfy.expect
index 500b1af9..8206fd43 100644
--- a/Test/dafny0/TypeTests.dfy.expect
+++ b/Test/dafny0/TypeTests.dfy.expect
@@ -56,7 +56,7 @@ TypeTests.dfy(151,13): Error: sorry, cannot instantiate type parameter with a su
 TypeTests.dfy(152,2): Error: sorry, cannot instantiate type parameter with a subrange type
 TypeTests.dfy(153,16): Error: sorry, cannot instantiate type parameter with a subrange type
 TypeTests.dfy(154,14): Error: sorry, cannot instantiate type parameter with a subrange type
-TypeTests.dfy(177,15): Error: ghost variables are allowed only in specification contexts
+TypeTests.dfy(177,5): Error: non-ghost variable cannot be assigned a value that depends on a ghost
 TypeTests.dfy(187,4): Error: cannot assign to non-ghost variable in a ghost context
 TypeTests.dfy(188,7): Error: cannot assign to non-ghost variable in a ghost context
 TypeTests.dfy(21,9): Error: because of cyclic dependencies among constructor argument types, no instances of datatype 'NeverendingList' can be constructed
-- 
cgit v1.2.3


From 045c50afc6261beeb83ab4a2f70e597157c9d796 Mon Sep 17 00:00:00 2001
From: Michael Lowell Roberts <mirobert@microsoft.com>
Date: Mon, 21 Sep 2015 13:51:16 -0700
Subject: merged IronDafny updates. two unit tests related to traits do not
 pass if ENABLE_IRONDAFNY is defined but this isn't critical and will be
 addressed shortly.

---
 Source/Dafny/Cloner.cs                |  28 +++---
 Source/Dafny/Compiler.cs              | 152 +++++++++++++++++++++------------
 Source/Dafny/DafnyAst.cs              | 130 +++++++++++++++++++---------
 Source/Dafny/DafnyPipeline.csproj     |  10 +--
 Source/Dafny/RefinementTransformer.cs |  18 ++--
 Source/Dafny/Resolver.cs              | 156 +++++++++++++++++++++++++++++-----
 Source/Dafny/Translator.cs            |  68 ++++++++-------
 7 files changed, 388 insertions(+), 174 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index dd2eed69..7046f9a4 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -40,7 +40,7 @@ namespace Microsoft.Dafny
       } else if (d is TypeSynonymDecl) {
         var dd = (TypeSynonymDecl)d;
         var tps = dd.TypeArgs.ConvertAll(CloneTypeParam);
-        return new TypeSynonymDecl(Tok(dd.tok), dd.Name, tps, m, CloneType(dd.Rhs), CloneAttributes(dd.Attributes));
+        return new TypeSynonymDecl(Tok(dd.tok), dd.Name, tps, m, CloneType(dd.Rhs), CloneAttributes(dd.Attributes), dd);
       } else if (d is NewtypeDecl) {
         var dd = (NewtypeDecl)d;
         if (dd.Var == null) {
@@ -61,7 +61,7 @@ namespace Microsoft.Dafny
         var dd = (CoDatatypeDecl)d;
         var tps = dd.TypeArgs.ConvertAll(CloneTypeParam);
         var ctors = dd.Ctors.ConvertAll(CloneCtor);
-        var dt = new CoDatatypeDecl(Tok(dd.tok), dd.Name, m, tps, ctors, CloneAttributes(dd.Attributes));
+        var dt = new CoDatatypeDecl(Tok(dd.tok), dd.Name, m, tps, ctors, CloneAttributes(dd.Attributes), dd);
         return dt;
       } else if (d is IteratorDecl) {
         var dd = (IteratorDecl)d;
@@ -97,7 +97,7 @@ namespace Microsoft.Dafny
               var dd = (TraitDecl)d;
               var tps = dd.TypeArgs.ConvertAll(CloneTypeParam);
               var mm = dd.Members.ConvertAll(CloneMember);
-              var cl = new TraitDecl(Tok(dd.tok), dd.Name, m, tps, mm, CloneAttributes(dd.Attributes));
+              var cl = new TraitDecl(Tok(dd.tok), dd.Name, m, tps, mm, CloneAttributes(dd.Attributes), dd);
               return cl;
           }
       }
@@ -106,7 +106,7 @@ namespace Microsoft.Dafny
         var tps = dd.TypeArgs.ConvertAll(CloneTypeParam);
         var mm = dd.Members.ConvertAll(CloneMember);
         if (d is DefaultClassDecl) {
-          return new DefaultClassDecl(m, mm);
+          return new DefaultClassDecl(m, mm, ((DefaultClassDecl)d));
         } else {
           return new ClassDecl(Tok(dd.tok), dd.Name, m, tps, mm, CloneAttributes(dd.Attributes), dd.TraitsTyp.ConvertAll(CloneType), dd);
         }
@@ -137,7 +137,7 @@ namespace Microsoft.Dafny
     }
 
     public DatatypeCtor CloneCtor(DatatypeCtor ct) {
-      return new DatatypeCtor(Tok(ct.tok), ct.Name, ct.Formals.ConvertAll(CloneFormal), CloneAttributes(ct.Attributes));
+      return new DatatypeCtor(Tok(ct.tok), ct.Name, ct.Formals.ConvertAll(CloneFormal), CloneAttributes(ct.Attributes), ct);
     }
 
     public TypeParameter CloneTypeParam(TypeParameter tp) {
@@ -641,16 +641,16 @@ namespace Microsoft.Dafny
 
       if (f is Predicate) {
         return new Predicate(Tok(f.tok), newName, f.HasStaticKeyword, f.IsProtected, f.IsGhost, tps, formals,
-          req, reads, ens, decreases, body, Predicate.BodyOriginKind.OriginalOrInherited, CloneAttributes(f.Attributes), null);
+          req, reads, ens, decreases, body, Predicate.BodyOriginKind.OriginalOrInherited, CloneAttributes(f.Attributes), null, f);
       } else if (f is InductivePredicate) {
         return new InductivePredicate(Tok(f.tok), newName, f.HasStaticKeyword, f.IsProtected, tps, formals,
-          req, reads, ens, body, CloneAttributes(f.Attributes), null);
+          req, reads, ens, body, CloneAttributes(f.Attributes), null, f);
       } else if (f is CoPredicate) {
         return new CoPredicate(Tok(f.tok), newName, f.HasStaticKeyword, f.IsProtected, tps, formals,
-          req, reads, ens, body, CloneAttributes(f.Attributes), null);
+          req, reads, ens, body, CloneAttributes(f.Attributes), null, f);
       } else {
         return new Function(Tok(f.tok), newName, f.HasStaticKeyword, f.IsProtected, f.IsGhost, tps, formals, CloneType(f.ResultType),
-          req, reads, ens, decreases, body, CloneAttributes(f.Attributes), null);
+          req, reads, ens, decreases, body, CloneAttributes(f.Attributes), null, f);
       }
     }
 
@@ -668,19 +668,19 @@ namespace Microsoft.Dafny
       var body = CloneBlockStmt(m.Body);
       if (m is Constructor) {
         return new Constructor(Tok(m.tok), m.Name, tps, ins,
-          req, mod, ens, decreases, body, CloneAttributes(m.Attributes), null);
+          req, mod, ens, decreases, body, CloneAttributes(m.Attributes), null, m);
       } else if (m is InductiveLemma) {
         return new InductiveLemma(Tok(m.tok), m.Name, m.HasStaticKeyword, tps, ins, m.Outs.ConvertAll(CloneFormal),
-          req, mod, ens, decreases, body, CloneAttributes(m.Attributes), null);
+          req, mod, ens, decreases, body, CloneAttributes(m.Attributes), null, m);
       } else if (m is CoLemma) {
         return new CoLemma(Tok(m.tok), m.Name, m.HasStaticKeyword, tps, ins, m.Outs.ConvertAll(CloneFormal),
-          req, mod, ens, decreases, body, CloneAttributes(m.Attributes), null);
+          req, mod, ens, decreases, body, CloneAttributes(m.Attributes), null, m);
       } else if (m is Lemma) {
         return new Lemma(Tok(m.tok), m.Name, m.HasStaticKeyword, tps, ins, m.Outs.ConvertAll(CloneFormal),
-          req, mod, ens, decreases, body, CloneAttributes(m.Attributes), null);
+          req, mod, ens, decreases, body, CloneAttributes(m.Attributes), null, m);
       } else {
         return new Method(Tok(m.tok), m.Name, m.HasStaticKeyword, m.IsGhost, tps, ins, m.Outs.ConvertAll(CloneFormal),
-          req, mod, ens, decreases, body, CloneAttributes(m.Attributes), null);
+          req, mod, ens, decreases, body, CloneAttributes(m.Attributes), null, m);
       }
     }
     public virtual IToken Tok(IToken tok) {
diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 477acabf..123433bc 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -102,7 +102,11 @@ namespace Microsoft.Dafny {
         }
         int indent = 0;
         if (!m.IsDefaultModule) {
-          wr.WriteLine("namespace @{0} {{", m.CompileName);
+          var m_prime = m;
+          while (DafnyOptions.O.IronDafny && m_prime.ClonedFrom != null) {
+            m_prime = m.ClonedFrom;
+          }
+          wr.WriteLine("namespace @{0} {{", m_prime.CompileName);
           indent += IndentAmount;
         }
         foreach (TopLevelDecl d in m.TopLevelDecls) {
@@ -687,11 +691,18 @@ namespace Microsoft.Dafny {
       return formal.HasName ? formal.CompileName : "_a" + i;
     }
 
+    string DtName(DatatypeDecl decl) {
+        var d = (TopLevelDecl)decl;
+        while (DafnyOptions.O.IronDafny && d.ClonedFrom != null) {
+          d = (TopLevelDecl)d.ClonedFrom;
+        }
+      return d.Module.IsDefaultModule ? d.CompileName : d.FullCompileName;
+    }
     string DtCtorName(DatatypeCtor ctor) {
       Contract.Requires(ctor != null);
       Contract.Ensures(Contract.Result<string>() != null);
 
-      return ctor.EnclosingDatatype.FullCompileName + "_" + ctor.CompileName;
+      return DtName(ctor.EnclosingDatatype) + "_" + ctor.CompileName;
     }
     string DtCtorDeclartionName(DatatypeCtor ctor) {
       Contract.Requires(ctor != null);
@@ -1123,61 +1134,78 @@ namespace Microsoft.Dafny {
       Contract.Requires(type != null);
       Contract.Ensures(Contract.Result<string>() != null);
 
-      type = type.NormalizeExpand();
-      if (type is TypeProxy) {
+      var xType = type.NormalizeExpand();
+      if (xType is TypeProxy) {
         // unresolved proxy; just treat as ref, since no particular type information is apparently needed for this type
         return "object";
       }
 
-      if (type is BoolType) {
+      if (xType is BoolType) {
         return "bool";
-      } else if (type is CharType) {
+      } else if (xType is CharType) {
         return "char";
-      } else if (type is IntType) {
+      } else if (xType is IntType) {
         return "BigInteger";
-      } else if (type is RealType) {
+      } else if (xType is RealType) {
         return "Dafny.BigRational";
-      } else if (type.AsNewtype != null) {
-        NativeType nativeType = type.AsNewtype.NativeType;
+      } else if (xType.AsNewtype != null) {
+        NativeType nativeType = xType.AsNewtype.NativeType;
         if (nativeType != null) {
           return nativeType.Name;
         }
-        return TypeName(type.AsNewtype.BaseType);
-      } else if (type is ObjectType) {
+        return TypeName(xType.AsNewtype.BaseType);
+      } else if (xType is ObjectType) {
         return "object";
-      } else if (type.IsArrayType) {
-        ArrayClassDecl at = type.AsArrayType;
+      } else if (xType.IsArrayType) {
+        ArrayClassDecl at = xType.AsArrayType;
         Contract.Assert(at != null);  // follows from type.IsArrayType
-        Type elType = UserDefinedType.ArrayElementType(type);
+        Type elType = UserDefinedType.ArrayElementType(xType);
         string name = TypeName(elType) + "[";
         for (int i = 1; i < at.Dims; i++) {
           name += ",";
         }
         return name + "]";
-      } else if (type is UserDefinedType) {
-        var udt = (UserDefinedType)type;
-        return TypeName_UDT(udt.FullCompileName, udt.TypeArgs);
-      } else if (type is SetType) {
-        Type argType = ((SetType)type).Arg;
+      } else if (xType is UserDefinedType) {
+        var udt = (UserDefinedType)xType;
+        var s = udt.FullCompileName;
+        var rc = udt.ResolvedClass;
+        if (DafnyOptions.O.IronDafny && 
+            !(xType is ArrowType) &&
+            rc != null &&
+            rc.Module != null &&
+            !rc.Module.IsDefaultModule) {
+          while (rc.ClonedFrom != null || rc.ExclusiveRefinement != null) {
+            if (rc.ClonedFrom != null) {
+              rc = (TopLevelDecl)rc.ClonedFrom;
+            } else {
+              Contract.Assert(rc.ExclusiveRefinement != null);
+              rc = rc.ExclusiveRefinement;
+            }
+          }
+          s = rc.FullCompileName;
+        }
+        return TypeName_UDT(s, udt.TypeArgs);
+      } else if (xType is SetType) {
+        Type argType = ((SetType)xType).Arg;
         if (argType is ObjectType) {
           Error("compilation of set<object> is not supported; consider introducing a ghost");
         }
         return DafnySetClass + "<" + TypeName(argType) + ">";
-      } else if (type is SeqType) {
-        Type argType = ((SeqType)type).Arg;
+      } else if (xType is SeqType) {
+        Type argType = ((SeqType)xType).Arg;
         if (argType is ObjectType) {
           Error("compilation of seq<object> is not supported; consider introducing a ghost");
         }
         return DafnySeqClass + "<" + TypeName(argType) + ">";
-      } else if (type is MultiSetType) {
-        Type argType = ((MultiSetType)type).Arg;
+      } else if (xType is MultiSetType) {
+        Type argType = ((MultiSetType)xType).Arg;
         if (argType is ObjectType) {
           Error("compilation of seq<object> is not supported; consider introducing a ghost");
         }
         return DafnyMultiSetClass + "<" + TypeName(argType) + ">";
-      } else if (type is MapType) {
-        Type domType = ((MapType)type).Domain;
-        Type ranType = ((MapType)type).Range;
+      } else if (xType is MapType) {
+        Type domType = ((MapType)xType).Domain;
+        Type ranType = ((MapType)xType).Range;
         if (domType is ObjectType || ranType is ObjectType) {
           Error("compilation of map<object, _> or map<_, object> is not supported; consider introducing a ghost");
         }
@@ -1218,36 +1246,52 @@ namespace Microsoft.Dafny {
       Contract.Requires(type != null);
       Contract.Ensures(Contract.Result<string>() != null);
 
-      type = type.NormalizeExpand();
-      if (type is TypeProxy) {
+      var xType = type.NormalizeExpand();
+      if (xType is TypeProxy) {
         // unresolved proxy; just treat as ref, since no particular type information is apparently needed for this type
         return "null";
       }
 
-      if (type is BoolType) {
+      if (xType is BoolType) {
         return "false";
-      } else if (type is CharType) {
+      } else if (xType is CharType) {
         return "'D'";
-      } else if (type is IntType) {
+      } else if (xType is IntType) {
         return "BigInteger.Zero";
-      } else if (type is RealType) {
+      } else if (xType is RealType) {
         return "Dafny.BigRational.ZERO";
-      } else if (type.AsNewtype != null) {
-        if (type.AsNewtype.NativeType != null) {
+      } else if (xType.AsNewtype != null) {
+        if (xType.AsNewtype.NativeType != null) {
           return "0";
         }
-        return DefaultValue(type.AsNewtype.BaseType);
-      } else if (type.IsRefType) {
-        return string.Format("({0})null", TypeName(type));
-      } else if (type.IsDatatype) {
-        UserDefinedType udt = (UserDefinedType)type;
-        string s = "@" + udt.FullCompileName;
+        return DefaultValue(xType.AsNewtype.BaseType);
+      } else if (xType.IsRefType) {
+        return string.Format("({0})null", TypeName(xType));
+      } else if (xType.IsDatatype) {
+        var udt = (UserDefinedType)xType;
+        var s = "@" + udt.FullCompileName;
+        var rc = udt.ResolvedClass;
+        if (DafnyOptions.O.IronDafny && 
+            !(xType is ArrowType) &&
+            rc != null &&
+            rc.Module != null &&
+            !rc.Module.IsDefaultModule) {
+          while (rc.ClonedFrom != null || rc.ExclusiveRefinement != null) {
+            if (rc.ClonedFrom != null) {
+              rc = (TopLevelDecl)rc.ClonedFrom;
+            } else {
+              Contract.Assert(rc.ExclusiveRefinement != null);
+              rc = rc.ExclusiveRefinement;
+            }
+          }
+          s = "@" + rc.FullCompileName;
+        }
         if (udt.TypeArgs.Count != 0) {
           s += "<" + TypeNames(udt.TypeArgs) + ">";
         }
         return string.Format("new {0}()", s);
-      } else if (type.IsTypeParameter) {
-        var udt = (UserDefinedType)type;
+      } else if (xType.IsTypeParameter) {
+        var udt = (UserDefinedType)xType;
         string s = "default(@" + udt.FullCompileName;
         if (udt.TypeArgs.Count != 0)
         {
@@ -1255,15 +1299,15 @@ namespace Microsoft.Dafny {
         }
         s += ")";
         return s;
-      } else if (type is SetType) {
-        return DafnySetClass + "<" + TypeName(((SetType)type).Arg) + ">.Empty";
-      } else if (type is MultiSetType) {
-        return DafnyMultiSetClass + "<" + TypeName(((MultiSetType)type).Arg) + ">.Empty";
-      } else if (type is SeqType) {
-        return DafnySeqClass + "<" + TypeName(((SeqType)type).Arg) + ">.Empty";
-      } else if (type is MapType) {
-        return TypeName(type)+".Empty";
-      } else if (type is ArrowType) {
+      } else if (xType is SetType) {
+        return DafnySetClass + "<" + TypeName(((SetType)xType).Arg) + ">.Empty";
+      } else if (xType is MultiSetType) {
+        return DafnyMultiSetClass + "<" + TypeName(((MultiSetType)xType).Arg) + ">.Empty";
+      } else if (xType is SeqType) {
+        return DafnySeqClass + "<" + TypeName(((SeqType)xType).Arg) + ">.Empty";
+      } else if (xType is MapType) {
+        return TypeName(xType)+".Empty";
+      } else if (xType is ArrowType) {
         return "null";
       } else {
         Contract.Assert(false); throw new cce.UnreachableException();  // unexpected type
@@ -2387,7 +2431,7 @@ namespace Microsoft.Dafny {
         Contract.Assert(dtv.Ctor != null);  // since dtv has been successfully resolved
         var typeParams = dtv.InferredTypeArgs.Count == 0 ? "" : string.Format("<{0}>", TypeNames(dtv.InferredTypeArgs));
 
-        wr.Write("new {0}{1}(", dtv.Ctor.EnclosingDatatype.FullCompileName, typeParams);
+        wr.Write("new {0}{1}(", DtName(dtv.Ctor.EnclosingDatatype), typeParams);
         if (!dtv.IsCoCall) {
           // For an ordinary constructor (that is, one that does not guard any co-recursive calls), generate:
           //   new Dt_Cons<T>( args )
@@ -2857,7 +2901,7 @@ namespace Microsoft.Dafny {
             var b = (ComprehensionExpr.DatatypeBoundedPool)bound;
             wr.Write("Dafny.Helpers.QuantDatatype(");
 
-            wr.Write("{0}.AllSingletonConstructors, ", b.Decl.FullCompileName);
+            wr.Write("{0}.AllSingletonConstructors, ", DtName(b.Decl));
           } else {
             Contract.Assert(false); throw new cce.UnreachableException();  // unexpected BoundedPool type
           }
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 9bff2038..600f7473 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -183,7 +183,7 @@ namespace Microsoft.Dafny {
           null, null, null);
         readsIS.Function = reads;  // just so we can really claim the member declarations are resolved
         readsIS.TypeArgumentSubstitutions = Util.Dict(tps, tys);  // ditto
-        var arrowDecl = new ArrowTypeDecl(tps, req, reads, SystemModule, DontCompile());
+        var arrowDecl = new ArrowTypeDecl(tps, req, reads, SystemModule, DontCompile(), null);
         arrowTypeDecls.Add(arity, arrowDecl);
         SystemModule.TopLevelDecls.Add(arrowDecl);
       }
@@ -431,16 +431,33 @@ namespace Microsoft.Dafny {
         var pt = type as TypeProxy;
         if (pt != null && pt.T != null) {
           type = pt.T;
-        } else {
+          continue;
+        }
           var syn = type.AsTypeSynonym;
           if (syn != null) {
             var udt = (UserDefinedType)type;  // correctness of cast follows from the AsTypeSynonym != null test.
             // Instantiate with the actual type arguments
             type = syn.RhsWithArgument(udt.TypeArgs);
+          continue;
+        }
+        if (DafnyOptions.O.IronDafny && type is UserDefinedType) {
+          var rc = ((UserDefinedType)type).ResolvedClass;
+          if (rc != null) {
+            while (rc.ClonedFrom != null || rc.ExclusiveRefinement != null) {
+              if (rc.ClonedFrom != null) {
+                rc = (TopLevelDecl)rc.ClonedFrom;
           } else {
-            return type;
+                Contract.Assert(rc.ExclusiveRefinement != null);
+                rc = rc.ExclusiveRefinement;
+              }
+            }
+          }
+          if (rc is TypeSynonymDecl) {
+            type = ((TypeSynonymDecl)rc).Rhs;
+            continue;
           }
         }
+        return type;
       }
     }
 
@@ -1030,7 +1047,11 @@ namespace Microsoft.Dafny {
     public string FullCompanionCompileName {
       get {
         Contract.Requires(ResolvedClass is TraitDecl);
-        var s = ResolvedClass.Module.IsDefaultModule ? "" : ResolvedClass.Module.CompileName + ".";
+          var m = ResolvedClass.Module;
+          while (DafnyOptions.O.IronDafny && m.ClonedFrom != null) {
+            m = m.ClonedFrom;
+          }
+        var s = m.IsDefaultModule ? "" : m.CompileName + ".";
         return s + "@_Companion_" + CompileName;
       }
     }
@@ -1802,6 +1823,16 @@ namespace Microsoft.Dafny {
       }
     }
 
+    public string RefinementCompileName {
+      get {
+        if (ExclusiveRefinement != null) {
+          return this.ExclusiveRefinement.RefinementCompileName;
+        } else {
+          return this.CompileName;
+        }
+      }
+    }
+
     /// <summary>
     /// Determines if "a" and "b" are in the same strongly connected component of the call graph, that is,
     /// if "a" and "b" are mutually recursive.
@@ -1946,6 +1977,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(cce.NonNullElements(typeArgs));
       Module = module;
       TypeArgs = typeArgs;
+      ExclusiveRefinement = null;
     }
 
     public string FullName {
@@ -1958,6 +1990,13 @@ namespace Microsoft.Dafny {
         return Module.CompileName + "." + CompileName;
       }
     }
+
+    public string FullSanitizedRefinementName {
+      get {
+        return Module.RefinementCompileName + "." + CompileName;
+      }
+    }
+
     public string FullNameInContext(ModuleDefinition context) {
       if (Module == context) {
         return Name;
@@ -1974,6 +2013,7 @@ namespace Microsoft.Dafny {
         }
       }
     }
+    public TopLevelDecl ExclusiveRefinement { get; set; }
   }
 
   public class TraitDecl : ClassDecl
@@ -1981,8 +2021,8 @@ namespace Microsoft.Dafny {
     public override string WhatKind { get { return "trait"; } }
     public bool IsParent { set; get; }
     public TraitDecl(IToken tok, string name, ModuleDefinition module,
-      List<TypeParameter> typeArgs, [Captured] List<MemberDecl> members, Attributes attributes)
-      : base(tok, name, module, typeArgs, members, attributes, null) { }
+      List<TypeParameter> typeArgs, [Captured] List<MemberDecl> members, Attributes attributes, TraitDecl clonedFrom = null)
+      : base(tok, name, module, typeArgs, members, attributes, null, clonedFrom) { }
   }
 
   public class ClassDecl : TopLevelDecl {
@@ -2024,8 +2064,8 @@ namespace Microsoft.Dafny {
   }
 
   public class DefaultClassDecl : ClassDecl {
-    public DefaultClassDecl(ModuleDefinition module, [Captured] List<MemberDecl> members)
-      : base(Token.NoToken, "_default", module, new List<TypeParameter>(), members, null, null) {
+    public DefaultClassDecl(ModuleDefinition module, [Captured] List<MemberDecl> members, DefaultClassDecl clonedFrom = null)
+      : base(Token.NoToken, "_default", module, new List<TypeParameter>(), members, null, null, clonedFrom) {
       Contract.Requires(module != null);
       Contract.Requires(cce.NonNullElements(members));
     }
@@ -2058,9 +2098,9 @@ namespace Microsoft.Dafny {
     public readonly Function Requires;
     public readonly Function Reads;
 
-    public ArrowTypeDecl(List<TypeParameter> tps, Function req, Function reads, ModuleDefinition module, Attributes attributes)
+    public ArrowTypeDecl(List<TypeParameter> tps, Function req, Function reads, ModuleDefinition module, Attributes attributes, ArrowTypeDecl clonedFrom)
       : base(Token.NoToken, ArrowType.ArrowTypeName(tps.Count - 1), module, tps,
-             new List<MemberDecl> { req, reads }, attributes, null) {
+             new List<MemberDecl> { req, reads }, attributes, null, clonedFrom) {
       Contract.Requires(tps != null && 1 <= tps.Count);
       Contract.Requires(req != null);
       Contract.Requires(reads != null);
@@ -2186,8 +2226,8 @@ namespace Microsoft.Dafny {
     public CoDatatypeDecl SscRepr;  // filled in during resolution
 
     public CoDatatypeDecl(IToken tok, string name, ModuleDefinition module, List<TypeParameter> typeArgs,
-      [Captured] List<DatatypeCtor> ctors, Attributes attributes)
-      : base(tok, name, module, typeArgs, ctors, attributes) {
+      [Captured] List<DatatypeCtor> ctors, Attributes attributes, CoDatatypeDecl clonedFrom = null)
+      : base(tok, name, module, typeArgs, ctors, attributes, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(module != null);
@@ -2214,8 +2254,8 @@ namespace Microsoft.Dafny {
     public SpecialField QueryField;  // filled in during resolution
     public List<DatatypeDestructor> Destructors = new List<DatatypeDestructor>();  // contents filled in during resolution; includes both implicit (not mentionable in source) and explicit destructors
 
-    public DatatypeCtor(IToken tok, string name, [Captured] List<Formal> formals, Attributes attributes)
-      : base(tok, name, attributes, null) {
+    public DatatypeCtor(IToken tok, string name, [Captured] List<Formal> formals, Attributes attributes, DatatypeCtor clonedFrom = null)
+      : base(tok, name, attributes, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(cce.NonNullElements(formals));
@@ -2426,8 +2466,8 @@ namespace Microsoft.Dafny {
     public readonly bool IsGhost;
     public TopLevelDecl EnclosingClass;  // filled in during resolution
     public MemberDecl RefinementBase;  // filled in during the pre-resolution refinement transformation; null if the member is new here
-    public MemberDecl(IToken tok, string name, bool hasStaticKeyword, bool isGhost, Attributes attributes)
-      : base(tok, name, attributes, null) {
+    public MemberDecl(IToken tok, string name, bool hasStaticKeyword, bool isGhost, Attributes attributes, Declaration clonedFrom = null)
+      : base(tok, name, attributes, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       HasStaticKeyword = hasStaticKeyword;
@@ -2452,6 +2492,14 @@ namespace Microsoft.Dafny {
         return EnclosingClass.FullSanitizedName + "." + CompileName;
       }
     }
+    public string FullSanitizedRefinementName {
+      get {
+        Contract.Requires(EnclosingClass != null);
+        Contract.Ensures(Contract.Result<string>() != null);
+
+        return EnclosingClass.FullSanitizedRefinementName + "." + CompileName;
+      }
+    }
     public string FullNameInContext(ModuleDefinition context) {
       Contract.Requires(EnclosingClass != null);
       Contract.Ensures(Contract.Result<string>() != null);
@@ -2658,8 +2706,8 @@ namespace Microsoft.Dafny {
   {
     public override string WhatKind { get { return "type synonym"; } }
     public readonly Type Rhs;
-    public TypeSynonymDecl(IToken tok, string name, List<TypeParameter> typeArgs, ModuleDefinition module, Type rhs, Attributes attributes)
-      : base(tok, name, module, typeArgs, attributes) {
+    public TypeSynonymDecl(IToken tok, string name, List<TypeParameter> typeArgs, ModuleDefinition module, Type rhs, Attributes attributes, TypeSynonymDecl clonedFrom = null)
+      : base(tok, name, module, typeArgs, attributes, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(typeArgs != null);
@@ -3043,8 +3091,8 @@ namespace Microsoft.Dafny {
     public Function(IToken tok, string name, bool hasStaticKeyword, bool isProtected, bool isGhost,
                     List<TypeParameter> typeArgs, List<Formal> formals, Type resultType,
                     List<Expression> req, List<FrameExpression> reads, List<Expression> ens, Specification<Expression> decreases,
-                    Expression body, Attributes attributes, IToken signatureEllipsis)
-      : base(tok, name, hasStaticKeyword, isGhost, attributes) {
+                    Expression body, Attributes attributes, IToken signatureEllipsis, Declaration clonedFrom = null)
+      : base(tok, name, hasStaticKeyword, isGhost, attributes, clonedFrom) {
 
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
@@ -3099,8 +3147,8 @@ namespace Microsoft.Dafny {
     public Predicate(IToken tok, string name, bool hasStaticKeyword, bool isProtected, bool isGhost,
                      List<TypeParameter> typeArgs, List<Formal> formals,
                      List<Expression> req, List<FrameExpression> reads, List<Expression> ens, Specification<Expression> decreases,
-                     Expression body, BodyOriginKind bodyOrigin, Attributes attributes, IToken signatureEllipsis)
-      : base(tok, name, hasStaticKeyword, isProtected, isGhost, typeArgs, formals, new BoolType(), req, reads, ens, decreases, body, attributes, signatureEllipsis) {
+                     Expression body, BodyOriginKind bodyOrigin, Attributes attributes, IToken signatureEllipsis, Declaration clonedFrom = null)
+      : base(tok, name, hasStaticKeyword, isProtected, isGhost, typeArgs, formals, new BoolType(), req, reads, ens, decreases, body, attributes, signatureEllipsis, clonedFrom) {
       Contract.Requires(bodyOrigin == Predicate.BodyOriginKind.OriginalOrInherited || body != null);
       BodyOrigin = bodyOrigin;
     }
@@ -3118,7 +3166,7 @@ namespace Microsoft.Dafny {
                      List<TypeParameter> typeArgs, Formal k, List<Formal> formals,
                      List<Expression> req, List<FrameExpression> reads, List<Expression> ens, Specification<Expression> decreases,
                      Expression body, Attributes attributes, FixpointPredicate fixpointPred)
-      : base(tok, name, hasStaticKeyword, isProtected, true, typeArgs, formals, new BoolType(), req, reads, ens, decreases, body, attributes, null) {
+      : base(tok, name, hasStaticKeyword, isProtected, true, typeArgs, formals, new BoolType(), req, reads, ens, decreases, body, attributes, null, null) {
       Contract.Requires(k != null);
       Contract.Requires(fixpointPred != null);
       Contract.Requires(formals != null && 1 <= formals.Count && formals[0] == k);
@@ -3135,9 +3183,9 @@ namespace Microsoft.Dafny {
     public FixpointPredicate(IToken tok, string name, bool hasStaticKeyword, bool isProtected,
                              List<TypeParameter> typeArgs, List<Formal> formals,
                              List<Expression> req, List<FrameExpression> reads, List<Expression> ens,
-                             Expression body, Attributes attributes, IToken signatureEllipsis)
+                             Expression body, Attributes attributes, IToken signatureEllipsis, Declaration clonedFrom = null)
       : base(tok, name, hasStaticKeyword, isProtected, true, typeArgs, formals, new BoolType(),
-             req, reads, ens, new Specification<Expression>(new List<Expression>(), null), body, attributes, signatureEllipsis) {
+             req, reads, ens, new Specification<Expression>(new List<Expression>(), null), body, attributes, signatureEllipsis, clonedFrom) {
     }
 
     /// <summary>
@@ -3176,9 +3224,9 @@ namespace Microsoft.Dafny {
     public InductivePredicate(IToken tok, string name, bool hasStaticKeyword, bool isProtected,
                               List<TypeParameter> typeArgs, List<Formal> formals,
                               List<Expression> req, List<FrameExpression> reads, List<Expression> ens,
-                              Expression body, Attributes attributes, IToken signatureEllipsis)
+                              Expression body, Attributes attributes, IToken signatureEllipsis, Declaration clonedFrom = null)
       : base(tok, name, hasStaticKeyword, isProtected, typeArgs, formals,
-             req, reads, ens, body, attributes, signatureEllipsis) {
+             req, reads, ens, body, attributes, signatureEllipsis, clonedFrom) {
     }
   }
 
@@ -3188,9 +3236,9 @@ namespace Microsoft.Dafny {
     public CoPredicate(IToken tok, string name, bool hasStaticKeyword, bool isProtected,
                        List<TypeParameter> typeArgs, List<Formal> formals,
                        List<Expression> req, List<FrameExpression> reads, List<Expression> ens,
-                       Expression body, Attributes attributes, IToken signatureEllipsis)
+                       Expression body, Attributes attributes, IToken signatureEllipsis, Declaration clonedFrom = null)
       : base(tok, name, hasStaticKeyword, isProtected, typeArgs, formals,
-             req, reads, ens, body, attributes, signatureEllipsis) {
+             req, reads, ens, body, attributes, signatureEllipsis, clonedFrom) {
     }
   }
 
@@ -3232,8 +3280,8 @@ namespace Microsoft.Dafny {
                   [Captured] List<MaybeFreeExpression> ens,
                   [Captured] Specification<Expression> decreases,
                   [Captured] BlockStmt body,
-                  Attributes attributes, IToken signatureEllipsis)
-      : base(tok, name, hasStaticKeyword, isGhost, attributes) {
+                  Attributes attributes, IToken signatureEllipsis, Declaration clonedFrom = null)
+      : base(tok, name, hasStaticKeyword, isGhost, attributes, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(cce.NonNullElements(typeArgs));
@@ -3305,8 +3353,8 @@ namespace Microsoft.Dafny {
                  [Captured] List<MaybeFreeExpression> ens,
                  [Captured] Specification<Expression> decreases,
                  [Captured] BlockStmt body,
-                 Attributes attributes, IToken signatureEllipsis)
-      : base(tok, name, hasStaticKeyword, true, typeArgs, ins, outs, req, mod, ens, decreases, body, attributes, signatureEllipsis) {
+                 Attributes attributes, IToken signatureEllipsis, Declaration clonedFrom = null)
+      : base(tok, name, hasStaticKeyword, true, typeArgs, ins, outs, req, mod, ens, decreases, body, attributes, signatureEllipsis, clonedFrom) {
     }
   }
 
@@ -3320,8 +3368,8 @@ namespace Microsoft.Dafny {
                   [Captured] List<MaybeFreeExpression> ens,
                   [Captured] Specification<Expression> decreases,
                   [Captured] BlockStmt body,
-                  Attributes attributes, IToken signatureEllipsis)
-      : base(tok, name, false, false, typeArgs, ins, new List<Formal>(), req, mod, ens, decreases, body, attributes, signatureEllipsis) {
+                  Attributes attributes, IToken signatureEllipsis, Declaration clonedFrom = null)
+      : base(tok, name, false, false, typeArgs, ins, new List<Formal>(), req, mod, ens, decreases, body, attributes, signatureEllipsis, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(cce.NonNullElements(typeArgs));
@@ -3372,8 +3420,8 @@ namespace Microsoft.Dafny {
                          List<MaybeFreeExpression> ens,
                          Specification<Expression> decreases,
                          BlockStmt body,
-                         Attributes attributes, IToken signatureEllipsis)
-      : base(tok, name, hasStaticKeyword, true, typeArgs, ins, outs, req, mod, ens, decreases, body, attributes, signatureEllipsis) {
+                         Attributes attributes, IToken signatureEllipsis, Declaration clonedFrom)
+      : base(tok, name, hasStaticKeyword, true, typeArgs, ins, outs, req, mod, ens, decreases, body, attributes, signatureEllipsis, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(cce.NonNullElements(typeArgs));
@@ -3398,8 +3446,8 @@ namespace Microsoft.Dafny {
                           List<MaybeFreeExpression> ens,
                           Specification<Expression> decreases,
                           BlockStmt body,
-                          Attributes attributes, IToken signatureEllipsis)
-      : base(tok, name, hasStaticKeyword, typeArgs, ins, outs, req, mod, ens, decreases, body, attributes, signatureEllipsis) {
+                          Attributes attributes, IToken signatureEllipsis, Declaration clonedFrom = null)
+      : base(tok, name, hasStaticKeyword, typeArgs, ins, outs, req, mod, ens, decreases, body, attributes, signatureEllipsis, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(cce.NonNullElements(typeArgs));
@@ -3424,8 +3472,8 @@ namespace Microsoft.Dafny {
                    List<MaybeFreeExpression> ens,
                    Specification<Expression> decreases,
                    BlockStmt body,
-                   Attributes attributes, IToken signatureEllipsis)
-      : base(tok, name, hasStaticKeyword, typeArgs, ins, outs, req, mod, ens, decreases, body, attributes, signatureEllipsis) {
+                   Attributes attributes, IToken signatureEllipsis, Declaration clonedFrom = null)
+      : base(tok, name, hasStaticKeyword, typeArgs, ins, outs, req, mod, ens, decreases, body, attributes, signatureEllipsis, clonedFrom) {
       Contract.Requires(tok != null);
       Contract.Requires(name != null);
       Contract.Requires(cce.NonNullElements(typeArgs));
diff --git a/Source/Dafny/DafnyPipeline.csproj b/Source/Dafny/DafnyPipeline.csproj
index 13a1e53e..501a624c 100644
--- a/Source/Dafny/DafnyPipeline.csproj
+++ b/Source/Dafny/DafnyPipeline.csproj
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <PropertyGroup>
     <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
@@ -41,7 +41,7 @@
     <DebugType>full</DebugType>
     <Optimize>false</Optimize>
     <OutputPath>bin\Debug\</OutputPath>
-    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <DefineConstants>TRACE;DEBUG;NO_ENABLE_IRONDAFNY</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
     <CodeContractsEnableRuntimeChecking>False</CodeContractsEnableRuntimeChecking>
@@ -83,7 +83,7 @@
     <DebugType>pdbonly</DebugType>
     <Optimize>true</Optimize>
     <OutputPath>bin\Release\</OutputPath>
-    <DefineConstants>TRACE</DefineConstants>
+    <DefineConstants>TRACE;NO_ENABLE_IRONDAFNY</DefineConstants>
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
     <CodeAnalysisRuleSet>AllRules.ruleset</CodeAnalysisRuleSet>
@@ -91,7 +91,7 @@
   <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Checked|AnyCPU'">
     <DebugSymbols>true</DebugSymbols>
     <OutputPath>bin\Checked\</OutputPath>
-    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <DefineConstants>TRACE;DEBUG;NO_ENABLE_IRONDAFNY</DefineConstants>
     <DebugType>full</DebugType>
     <PlatformTarget>AnyCPU</PlatformTarget>
     <ErrorReport>prompt</ErrorReport>
@@ -199,4 +199,4 @@
   <Target Name="AfterBuild">
   </Target>
   -->
-</Project>
+</Project>
\ No newline at end of file
diff --git a/Source/Dafny/RefinementTransformer.cs b/Source/Dafny/RefinementTransformer.cs
index ba558ea6..24d1126f 100644
--- a/Source/Dafny/RefinementTransformer.cs
+++ b/Source/Dafny/RefinementTransformer.cs
@@ -547,16 +547,16 @@ namespace Microsoft.Dafny
 
       if (f is Predicate) {
         return new Predicate(tok, f.Name, f.HasStaticKeyword, f.IsProtected, isGhost, tps, formals,
-          req, reads, ens, decreases, body, bodyOrigin, refinementCloner.MergeAttributes(f.Attributes, moreAttributes), null);
+          req, reads, ens, decreases, body, bodyOrigin, refinementCloner.MergeAttributes(f.Attributes, moreAttributes), null, f);
       } else if (f is InductivePredicate) {
         return new InductivePredicate(tok, f.Name, f.HasStaticKeyword, f.IsProtected, tps, formals,
-          req, reads, ens, body, refinementCloner.MergeAttributes(f.Attributes, moreAttributes), null);
+          req, reads, ens, body, refinementCloner.MergeAttributes(f.Attributes, moreAttributes), null, f);
       } else if (f is CoPredicate) {
         return new CoPredicate(tok, f.Name, f.HasStaticKeyword, f.IsProtected, tps, formals,
-          req, reads, ens, body, refinementCloner.MergeAttributes(f.Attributes, moreAttributes), null);
+          req, reads, ens, body, refinementCloner.MergeAttributes(f.Attributes, moreAttributes), null, f);
       } else {
         return new Function(tok, f.Name, f.HasStaticKeyword, f.IsProtected, isGhost, tps, formals, refinementCloner.CloneType(f.ResultType),
-          req, reads, ens, decreases, body, refinementCloner.MergeAttributes(f.Attributes, moreAttributes), null);
+          req, reads, ens, decreases, body, refinementCloner.MergeAttributes(f.Attributes, moreAttributes), null, f);
       }
     }
 
@@ -581,19 +581,19 @@ namespace Microsoft.Dafny
       var body = newBody ?? refinementCloner.CloneBlockStmt(m.Body);
       if (m is Constructor) {
         return new Constructor(new RefinementToken(m.tok, moduleUnderConstruction), m.Name, tps, ins,
-          req, mod, ens, decreases, body, refinementCloner.MergeAttributes(m.Attributes, moreAttributes), null);
+          req, mod, ens, decreases, body, refinementCloner.MergeAttributes(m.Attributes, moreAttributes), null, m);
       } else if (m is InductiveLemma) {
         return new InductiveLemma(new RefinementToken(m.tok, moduleUnderConstruction), m.Name, m.HasStaticKeyword, tps, ins, m.Outs.ConvertAll(refinementCloner.CloneFormal),
-          req, mod, ens, decreases, body, refinementCloner.MergeAttributes(m.Attributes, moreAttributes), null);
+          req, mod, ens, decreases, body, refinementCloner.MergeAttributes(m.Attributes, moreAttributes), null, m);
       } else if (m is CoLemma) {
         return new CoLemma(new RefinementToken(m.tok, moduleUnderConstruction), m.Name, m.HasStaticKeyword, tps, ins, m.Outs.ConvertAll(refinementCloner.CloneFormal),
-          req, mod, ens, decreases, body, refinementCloner.MergeAttributes(m.Attributes, moreAttributes), null);
+          req, mod, ens, decreases, body, refinementCloner.MergeAttributes(m.Attributes, moreAttributes), null, m);
       } else if (m is Lemma) {
         return new Lemma(new RefinementToken(m.tok, moduleUnderConstruction), m.Name, m.HasStaticKeyword, tps, ins, m.Outs.ConvertAll(refinementCloner.CloneFormal),
-          req, mod, ens, decreases, body, refinementCloner.MergeAttributes(m.Attributes, moreAttributes), null);
+          req, mod, ens, decreases, body, refinementCloner.MergeAttributes(m.Attributes, moreAttributes), null, m);
       } else {
         return new Method(new RefinementToken(m.tok, moduleUnderConstruction), m.Name, m.HasStaticKeyword, m.IsGhost, tps, ins, m.Outs.ConvertAll(refinementCloner.CloneFormal),
-          req, mod, ens, decreases, body, refinementCloner.MergeAttributes(m.Attributes, moreAttributes), null);
+          req, mod, ens, decreases, body, refinementCloner.MergeAttributes(m.Attributes, moreAttributes), null, m);
       }
     }
 
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 899d0a3d..a2ae401a 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -853,9 +853,34 @@ namespace Microsoft.Dafny
               if (useImports || string.Equals(kv.Key, "_default", StringComparison.InvariantCulture)) {
                 TopLevelDecl d;
                 if (sig.TopLevels.TryGetValue(kv.Key, out d)) {
-                  if (DafnyOptions.O.IronDafny && kv.Value.ClonedFrom == d) {
+                  bool resolved = false;
+                  if (DafnyOptions.O.IronDafny) {
+                    // sometimes, we need to compare two type synonyms in order to come up with a decision regarding substitution.
+                    var aliased1 = Object.ReferenceEquals(kv.Value, d);
+                    if (!aliased1) {
+                      var a = d;
+                      while (a.ExclusiveRefinement != null) {
+                        a = a.ExclusiveRefinement;
+                      }
+                      var b = kv.Value;
+                      while (b.ExclusiveRefinement != null) {
+                        b = b.ExclusiveRefinement;
+                      }
+                      if (a is TypeSynonymDecl && b is TypeSynonymDecl) {
+                        aliased1 = UnifyTypes(((TypeSynonymDecl)a).Rhs, ((TypeSynonymDecl)b).Rhs);
+                      } else {
+                        aliased1 = Object.ReferenceEquals(a, b);
+                      }
+                    }
+                    if (aliased1 ||
+                      Object.ReferenceEquals(kv.Value.ClonedFrom, d) ||
+                      Object.ReferenceEquals(d.ClonedFrom, kv.Value) ||
+                      Object.ReferenceEquals(kv.Value.ExclusiveRefinement, d)) {
                     sig.TopLevels[kv.Key] = kv.Value;
-                  } else {
+                      resolved = true;
+                    }
+                  }
+                  if (!resolved) {
                     sig.TopLevels[kv.Key] = AmbiguousTopLevelDecl.Create(moduleDef, d, kv.Value);
                   }
                 } else {
@@ -872,7 +897,10 @@ namespace Microsoft.Dafny
               if (sig.Ctors.TryGetValue(kv.Key, out pair)) {
                 // The same ctor can be imported from two different imports (e.g "diamond" imports), in which case, 
                 // they are not duplicates.
-                if (kv.Value.Item1 != pair.Item1) {
+                if (!Object.ReferenceEquals(kv.Value.Item1, pair.Item1) &&
+                    (!DafnyOptions.O.IronDafny ||
+                        (!Object.ReferenceEquals(kv.Value.Item1.ClonedFrom, pair.Item1) &&
+                        !Object.ReferenceEquals(kv.Value.Item1, pair.Item1.ClonedFrom)))) {
                   // mark it as a duplicate
                   sig.Ctors[kv.Key] = new Tuple<DatatypeCtor, bool>(pair.Item1, true);
                 }
@@ -888,7 +916,48 @@ namespace Microsoft.Dafny
             foreach (var kv in s.StaticMembers) {
               MemberDecl md;
               if (sig.StaticMembers.TryGetValue(kv.Key, out md)) {
+                var resolved = false;
+                if (DafnyOptions.O.IronDafny) {
+                  var aliased0 = Object.ReferenceEquals(kv.Value, md) || Object.ReferenceEquals(kv.Value.ClonedFrom, md) || Object.ReferenceEquals(md.ClonedFrom, kv.Value);
+                  var aliased1 = aliased0;
+                  if (!aliased0) {
+                    var a = kv.Value.EnclosingClass;
+                    while (a != null && 
+                        (a.ExclusiveRefinement != null || a.ClonedFrom != null)) {
+                      if (a.ClonedFrom != null) {
+                        a = (TopLevelDecl)a.ClonedFrom;
+                      } else {
+                        Contract.Assert(a.ExclusiveRefinement != null);
+                        a = a.ExclusiveRefinement;
+                      }
+                    }
+                    var b = md.EnclosingClass;
+                    while (b != null && 
+                            (b.ExclusiveRefinement != null || b.ClonedFrom != null)) {
+                      if (b.ClonedFrom != null) {
+                        b = (TopLevelDecl)b.ClonedFrom;
+                      } else {
+                        Contract.Assert(b.ExclusiveRefinement != null);
+                        b = b.ExclusiveRefinement;
+                      }
+                    }
+                    aliased1 = Object.ReferenceEquals(a, b);
+                  }
+                  if (aliased0 || aliased1) {
+                    if (kv.Value.EnclosingClass != null && 
+                        md.EnclosingClass != null &&
+                        md.EnclosingClass.ExclusiveRefinement != null &&
+                        !Object.ReferenceEquals(
+                            kv.Value.EnclosingClass.ExclusiveRefinement, 
+                            md.EnclosingClass)) {
+                      sig.StaticMembers[kv.Key] = kv.Value;
+                    }
+                    resolved = true;
+                  }
+                }
+                if (!resolved) {
                 sig.StaticMembers[kv.Key] = AmbiguousMemberDecl.Create(moduleDef, md, kv.Value);
+                }
               } else {
                 // add new
                 sig.StaticMembers.Add(kv.Key, kv.Value);
@@ -1245,6 +1314,14 @@ namespace Microsoft.Dafny
 
       var typeRedirectionDependencies = new Graph<RedirectingTypeDecl>();
       foreach (TopLevelDecl d in declarations) {
+        if (DafnyOptions.O.IronDafny && d.Module.IsExclusiveRefinement) {
+          var refinementOf =
+            def.RefinementBase.TopLevelDecls.Find(
+              i => String.Equals(i.Name, d.Name, StringComparison.InvariantCulture));
+          if (refinementOf != null && refinementOf.ExclusiveRefinement == null) {
+            refinementOf.ExclusiveRefinement = d;
+          }      
+        }
         Contract.Assert(d != null);
         allTypeParameters.PushMarker();
         ResolveTypeParameters(d.TypeArgs, true, d);
@@ -1277,9 +1354,13 @@ namespace Microsoft.Dafny
           if (!def.IsAbstract) {
             if (decl.Signature.IsGhost)
               {
-                if (!(def.IsDefaultModule)) // _module is allowed to contain abstract modules, but not be abstract itself. Note this presents a challenge to
+                if (// _module is allowed to contain abstract modules, but not be abstract itself. Note this presents a challenge to
                                             // trusted verification, as toplevels can't be trusted if they invoke abstract module members.
-                  reporter.Error(MessageSource.Resolver, d.tok, "an abstract module can only be imported into other abstract modules, not a concrete one.");
+                    !def.IsDefaultModule 
+                    // [IronDafny] it's possbile for an abstract module to have an exclusive refinement, so it no longer makes sense to disallow this.
+                    && !DafnyOptions.O.IronDafny) 
+                                            
+                reporter.Error(MessageSource.Resolver, d.tok, "an abstract module can only be imported into other abstract modules, not a concrete one.");
               } else {
                 // physical modules are allowed everywhere
               }
@@ -4198,6 +4279,11 @@ namespace Microsoft.Dafny
               }
             } else if (d is NewtypeDecl) {
               var dd = (NewtypeDecl)d;
+              if (DafnyOptions.O.IronDafny) {
+                while (dd.ClonedFrom != null) {
+                  dd = (NewtypeDecl)d.ClonedFrom;
+                }
+              }
               var caller = context as ICallable;
               if (caller != null) {
                 caller.EnclosingModule.CallGraph.AddEdge(caller, dd);
@@ -4313,28 +4399,60 @@ namespace Microsoft.Dafny
                UnifyTypes(((MapType)a).Domain, ((MapType)b).Domain) && UnifyTypes(((MapType)a).Range, ((MapType)b).Range);
       } else if (a is SeqType) {
         return b is SeqType && UnifyTypes(((SeqType)a).Arg, ((SeqType)b).Arg);
-      } else if (a is UserDefinedType) {
-        if (!(b is UserDefinedType)) {
-          return false;
+      } else if (a is UserDefinedType || b is UserDefinedType) {
+        if (!(a is UserDefinedType) && b is UserDefinedType) {
+          var x = a;
+          a = b;
+          b = x;
         }
+
         var aa = (UserDefinedType)a;
         var rca = aa.ResolvedClass;
+        // traits are currently unfriendly to irondafny features.
+        if (DafnyOptions.O.IronDafny && !(rca is TraitDecl)) { 
+          if (rca != null) {
+            while (rca.ClonedFrom != null || rca.ExclusiveRefinement != null) {
+              if (rca.ClonedFrom != null) {
+                rca = (TopLevelDecl)rca.ClonedFrom;                
+              } else {
+                Contract.Assert(rca.ExclusiveRefinement != null);
+                rca = rca.ExclusiveRefinement;
+              }
+            }
+          }
+        }
+
+        if (!(b is UserDefinedType)) {
+          return DafnyOptions.O.IronDafny && rca is TypeSynonymDecl && UnifyTypes(((TypeSynonymDecl)rca).Rhs, b);
+        }
+
         var bb = (UserDefinedType)b;
         var rcb = bb.ResolvedClass;
-        if (DafnyOptions.O.IronDafny)
-        {
-          while (rca != null && rca.Module.IsAbstract && rca.ClonedFrom != null)
-          {
-            // todo: should ClonedFrom be a TopLevelDecl?
-            // todo: should ClonedFrom be moved to TopLevelDecl?
-            rca = (TopLevelDecl)rca.ClonedFrom;
+        // traits are currently unfriendly to irondafny features.
+        if (DafnyOptions.O.IronDafny && !(rca is TraitDecl) && !(rcb is TraitDecl)) {
+          if (rcb != null) {
+            while (rcb.ClonedFrom != null || rcb.ExclusiveRefinement != null) {
+              if (rcb.ClonedFrom != null) {
+                rcb = (TopLevelDecl)rcb.ClonedFrom;                
+              } else {
+                Contract.Assert(rcb.ExclusiveRefinement != null);
+                rcb = rcb.ExclusiveRefinement;
+              }
+            }
           }
-          while (rcb != null && rcb.Module.IsAbstract && rcb.ClonedFrom != null)
-          {
-            rcb = (TopLevelDecl)rcb.ClonedFrom;
+          if (rca is TypeSynonymDecl || rcb is TypeSynonymDecl) {
+            var aaa = a;
+            var bbb = b;
+            if (rca is TypeSynonymDecl) {
+              aaa = ((TypeSynonymDecl)rca).Rhs;
+            }
+            if (rcb is TypeSynonymDecl) {
+              bbb = ((TypeSynonymDecl)rcb).Rhs;
+          }
+            return UnifyTypes(aaa, bbb);
           }
         }
-        if (rca != null && rca == rcb) {
+        if (rca != null && Object.ReferenceEquals(rca, rcb)) {
           // these are both resolved class/datatype types
           Contract.Assert(aa.TypeArgs.Count == bb.TypeArgs.Count);
           bool successSoFar = true;
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 09ca32e0..af8225da 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -9246,41 +9246,41 @@ namespace Microsoft.Dafny {
       Contract.Requires(type != null);
       Contract.Ensures(Contract.Result<Bpl.Expr>() != null);
 
-      type = type.NormalizeExpand();
-
-      if (type is SetType) {
-        bool finite = ((SetType)type).Finite;
-        return FunctionCall(Token.NoToken, finite ? "TSet" : "TISet", predef.Ty, TypeToTy(((CollectionType)type).Arg));
-      } else if (type is MultiSetType) {
-        return FunctionCall(Token.NoToken, "TMultiSet", predef.Ty, TypeToTy(((CollectionType)type).Arg));
-      } else if (type is SeqType) {
-        return FunctionCall(Token.NoToken, "TSeq", predef.Ty, TypeToTy(((CollectionType)type).Arg));
-      } else if (type is MapType) {
-        bool finite = ((MapType)type).Finite;
+      var normType = type.NormalizeExpand();
+
+      if (normType is SetType) {
+        bool finite = ((SetType)normType).Finite;
+        return FunctionCall(Token.NoToken, finite ? "TSet" : "TISet", predef.Ty, TypeToTy(((CollectionType)normType).Arg));
+      } else if (normType is MultiSetType) {
+        return FunctionCall(Token.NoToken, "TMultiSet", predef.Ty, TypeToTy(((CollectionType)normType).Arg));
+      } else if (normType is SeqType) {
+        return FunctionCall(Token.NoToken, "TSeq", predef.Ty, TypeToTy(((CollectionType)normType).Arg));
+      } else if (normType is MapType) {
+        bool finite = ((MapType)normType).Finite;
         return FunctionCall(Token.NoToken, finite ? "TMap" : "TIMap", predef.Ty,
-          TypeToTy(((MapType)type).Domain),
-          TypeToTy(((MapType)type).Range));
-      } else if (type is BoolType) {
+          TypeToTy(((MapType)normType).Domain),
+          TypeToTy(((MapType)normType).Range));
+      } else if (normType is BoolType) {
         return new Bpl.IdentifierExpr(Token.NoToken, "TBool", predef.Ty);
-      } else if (type is CharType) {
+      } else if (normType is CharType) {
         return new Bpl.IdentifierExpr(Token.NoToken, "TChar", predef.Ty);
-      } else if (type is RealType) {
+      } else if (normType is RealType) {
         return new Bpl.IdentifierExpr(Token.NoToken, "TReal", predef.Ty);
-      } else if (type is NatType) {
+      } else if (normType is NatType) {
         // (Nat needs to come before Int)
         return new Bpl.IdentifierExpr(Token.NoToken, "TNat", predef.Ty);
-      } else if (type is IntType) {
+      } else if (normType is IntType) {
         return new Bpl.IdentifierExpr(Token.NoToken, "TInt", predef.Ty);
-      } else if (type.IsTypeParameter) {
-        return trTypeParam(type.AsTypeParameter, type.TypeArgs);
-      } else if (type is ObjectType) {
+      } else if (normType.IsTypeParameter) {
+        return trTypeParam(normType.AsTypeParameter, normType.TypeArgs);
+      } else if (normType is ObjectType) {
         return ClassTyCon(program.BuiltIns.ObjectDecl, new List<Bpl.Expr>());
-      } else if (type is UserDefinedType) {
+      } else if (normType is UserDefinedType) {
         // Classes, (co-)datatypes
-        var args = type.TypeArgs.ConvertAll(TypeToTy);
-        return ClassTyCon(((UserDefinedType)type), args);
-      } else if (type is ParamTypeProxy) {
-        return trTypeParam(((ParamTypeProxy)type).orig, null);
+        var args = normType.TypeArgs.ConvertAll(TypeToTy);
+        return ClassTyCon(((UserDefinedType)normType), args);
+      } else if (normType is ParamTypeProxy) {
+        return trTypeParam(((ParamTypeProxy)normType).orig, null);
       } else {
         Contract.Assert(false); throw new cce.UnreachableException();  // unexpected type
       }
@@ -9383,19 +9383,19 @@ namespace Microsoft.Dafny {
       Contract.Requires(etran != null);
       Contract.Requires(predef != null);
 
-      type = type.NormalizeExpand();
-      if (type is TypeProxy) {
+      var normType = type.NormalizeExpand();
+      if (normType is TypeProxy) {
         // Unresolved proxy
         // Omit where clause (in other places, unresolved proxies are treated as a reference type; we could do that here too, but
         // we might as well leave out the where clause altogether).
         return null;
       }
 
-      if (type is NatType) {
+      if (normType is NatType) {
         // nat:
         // 0 <= x
         return Bpl.Expr.Le(Bpl.Expr.Literal(0), x);
-      } else if (type is BoolType || type is IntType || type is RealType) {
+      } else if (normType is BoolType || normType is IntType || normType is RealType) {
         // nothing to do
         return null;
       /* } else if (type is ArrowType) {
@@ -9403,7 +9403,7 @@ namespace Microsoft.Dafny {
         return null;
         */
       } else {
-        return BplAnd(MkIs(x, type), MkIsAlloc(x, type, etran.HeapExpr));
+        return BplAnd(MkIs(x, normType), MkIsAlloc(x, normType, etran.HeapExpr));
       }
     }
 
@@ -11029,7 +11029,11 @@ namespace Microsoft.Dafny {
           }
 
           var ty = translator.TrType(e.Type);
-          var id = new Bpl.IdentifierExpr(e.tok, e.Function.FullSanitizedName, ty);
+          var name = e.Function.FullSanitizedName;
+          if (DafnyOptions.O.IronDafny) {
+            name = e.Function.FullSanitizedRefinementName;
+          }
+          var id = new Bpl.IdentifierExpr(e.tok, name, ty);
 
           bool argsAreLit;
           var args = FunctionInvocationArguments(e, layerArgument, out argsAreLit);
-- 
cgit v1.2.3


From 7134a276e9fb53a4c11e1ce9383b6676a7d50bc8 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Mon, 21 Sep 2015 20:01:10 -0700
Subject: Moved premature uses of .IsGhost for Statement's

---
 Source/Dafny/Resolver.cs | 166 ++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 128 insertions(+), 38 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 57a42c73..87379478 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -1314,6 +1314,7 @@ namespace Microsoft.Dafny
     }
 
     private readonly List<SetComprehension> needFiniteBoundsChecks_SetComprehension = new List<SetComprehension>();
+    private readonly List<AssignSuchThatStmt> needBoundsDiscovery_AssignSuchThatStmt = new List<AssignSuchThatStmt>();
     private readonly List<LetExpr> needFiniteBoundsChecks_LetSuchThatExpr = new List<LetExpr>();
     public int NFBC_Count {
       // provided just for the purpose of conveniently writing contracts for ResolveTopLevelDecl_Meat
@@ -1419,6 +1420,12 @@ namespace Microsoft.Dafny
           } else if (d is ClassDecl) {
             var cl = (ClassDecl)d;
             cl.Members.Iter(CheckTypeInference_Member);
+            foreach (var member in cl.Members) {
+              var m = member as Method;
+              if (m != null && m.Body != null) {
+                DetermineTailRecursion(m);
+              }
+            }
           } else if (d is NewtypeDecl) {
             var dd = (NewtypeDecl)d;
             bool? boolNativeType = null;
@@ -1525,6 +1532,23 @@ namespace Microsoft.Dafny
             }
           }
         }
+        foreach (AssignSuchThatStmt s in needBoundsDiscovery_AssignSuchThatStmt) {
+          Contract.Assert(!s.C_IsGhost);
+          var varLhss = new List<IVariable>();
+          foreach (var lhs in s.Lhss) {
+            var ide = (IdentifierExpr)lhs.Resolved;  // successful resolution above implies all LHS's are IdentifierExpr's
+            varLhss.Add(ide.Var);
+          }
+
+          List<IVariable> missingBounds;
+          var bestBounds = DiscoverBestBounds_MultipleVars(varLhss, s.Expr, true, false, out missingBounds);
+          if (missingBounds.Count != 0) {
+            s.MissingBounds = missingBounds;  // so that an error message can be produced during compilation
+          } else {
+            Contract.Assert(bestBounds != null);
+            s.Bounds = bestBounds;
+          }
+        }
         foreach (var e in needFiniteBoundsChecks_LetSuchThatExpr) {
           Contract.Assert(!e.Exact);  // only let-such-that expressions are ever added to the list
           Contract.Assert(e.RHSs.Count == 1);  // if we got this far, the resolver will have checked this condition successfully
@@ -2034,29 +2058,6 @@ namespace Microsoft.Dafny
         CheckTypeInference_Specification_Expr(m.Decreases);
         if (m.Body != null) {
           CheckTypeInference(m.Body);
-          bool tail = true;
-          bool hasTailRecursionPreference = Attributes.ContainsBool(m.Attributes, "tailrecursion", ref tail);
-          if (hasTailRecursionPreference && !tail) {
-            // the user specifically requested no tail recursion, so do nothing else
-          } else if (hasTailRecursionPreference && tail && m.IsGhost) {
-            reporter.Error(MessageSource.Resolver, m.tok, "tail recursion can be specified only for methods that will be compiled, not for ghost methods");
-          } else {
-            var module = m.EnclosingClass.Module;
-            var sccSize = module.CallGraph.GetSCCSize(m);
-            if (hasTailRecursionPreference && 2 <= sccSize) {
-              reporter.Error(MessageSource.Resolver, m.tok, "sorry, tail-call optimizations are not supported for mutually recursive methods");
-            } else if (hasTailRecursionPreference || sccSize == 1) {
-              CallStmt tailCall = null;
-              var status = CheckTailRecursive(m.Body.Body, m, ref tailCall, hasTailRecursionPreference);
-              if (status != TailRecursionStatus.NotTailRecursive) {
-                m.IsTailRecursive = true;
-                if (tailCall != null) {
-                  // this means there was at least one recursive call
-                  reporter.Info(MessageSource.Resolver, m.tok, "tail recursive");
-                }
-              }
-            }
-          }
         }
       } else if (member is Function) {
         var f = (Function)member;
@@ -2067,10 +2068,6 @@ namespace Microsoft.Dafny
         CheckTypeInference_Specification_Expr(f.Decreases);
         if (f.Body != null) {
           CheckTypeInference(f.Body);
-          bool tail = true;
-          if (Attributes.ContainsBool(f.Attributes, "tailrecursion", ref tail) && tail) {
-            reporter.Error(MessageSource.Resolver, f.tok, "sorry, tail-call functions are not supported");
-          }
         }
         if (errorCount == reporter.Count(ErrorLevel.Error) && f is FixpointPredicate) {
           var cop = (FixpointPredicate)f;
@@ -2078,6 +2075,7 @@ namespace Microsoft.Dafny
         }
       }
     }
+
     private void CheckTypeInference_MaybeFreeExpression(MaybeFreeExpression mfe) {
       Contract.Requires(mfe != null);
       foreach (var e in Attributes.SubExpressions(mfe.Attributes)) {
@@ -2300,6 +2298,41 @@ namespace Microsoft.Dafny
       return status;
     }
 
+    void DetermineTailRecursion(Function f) {
+      Contract.Requires(f != null);
+      bool tail = true;
+      if (Attributes.ContainsBool(f.Attributes, "tailrecursion", ref tail) && tail) {
+        reporter.Error(MessageSource.Resolver, f.tok, "sorry, tail-call functions are not supported");
+      }
+    }
+
+    void DetermineTailRecursion(Method m) {
+      Contract.Requires(m != null);
+      bool tail = true;
+      bool hasTailRecursionPreference = Attributes.ContainsBool(m.Attributes, "tailrecursion", ref tail);
+      if (hasTailRecursionPreference && !tail) {
+        // the user specifically requested no tail recursion, so do nothing else
+      } else if (hasTailRecursionPreference && tail && m.IsGhost) {
+        reporter.Error(MessageSource.Resolver, m.tok, "tail recursion can be specified only for methods that will be compiled, not for ghost methods");
+      } else {
+        var module = m.EnclosingClass.Module;
+        var sccSize = module.CallGraph.GetSCCSize(m);
+        if (hasTailRecursionPreference && 2 <= sccSize) {
+          reporter.Error(MessageSource.Resolver, m.tok, "sorry, tail-call optimizations are not supported for mutually recursive methods");
+        } else if (hasTailRecursionPreference || sccSize == 1) {
+          CallStmt tailCall = null;
+          var status = CheckTailRecursive(m.Body.Body, m, ref tailCall, hasTailRecursionPreference);
+          if (status != TailRecursionStatus.NotTailRecursive) {
+            m.IsTailRecursive = true;
+            if (tailCall != null) {
+              // this means there was at least one recursive call
+              reporter.Info(MessageSource.Resolver, m.tok, "tail recursive");
+            }
+          }
+        }
+      }
+    }
+
     /// <summary>
     /// See CheckTailRecursive(List Statement, ...), including its description of "tailCall".
     /// In the current implementation, "enclosingMethod" is not allowed to be a mutually recursive method.
@@ -3025,7 +3058,6 @@ namespace Microsoft.Dafny
       /// </summary>
       public void Visit(Statement stmt, bool mustBeErasable) {
         Contract.Assume(!codeContext.IsGhost || mustBeErasable);  // (this is really a precondition) codeContext.IsGhost ==> mustBeErasable
-        stmt.IsGhost = false;  // DEBUG
 
         if (stmt is PredicateStmt) {
           stmt.C_IsGhost = true;
@@ -3075,6 +3107,9 @@ namespace Microsoft.Dafny
               }
             }
           }
+          if (!s.C_IsGhost) {
+            resolver.needBoundsDiscovery_AssignSuchThatStmt.Add(s);
+          }
 
         } else if (stmt is UpdateStmt) {
           var s = (UpdateStmt)stmt;
@@ -3207,6 +3242,9 @@ namespace Microsoft.Dafny
         } else if (stmt is WhileStmt) {
           var s = (WhileStmt)stmt;
           s.C_IsGhost = mustBeErasable || (s.Guard != null && resolver.UsesSpecFeatures(s.Guard));
+          if (s.C_IsGhost && s.Decreases.Expressions.Exists(e => e is WildcardExpr)) {
+            Error(s, "'decreases *' is not allowed on ghost loops");
+          }
           if (s.Body != null) {
             Visit(s.Body, s.C_IsGhost);
           }
@@ -4010,6 +4048,7 @@ namespace Microsoft.Dafny
         ConstrainTypes(f.Body.Type, f.ResultType, f, "Function body type mismatch (expected {0}, got {1})", f.ResultType, f.Body.Type);
       }
       scope.PopMarker();
+      DetermineTailRecursion(f);
     }
 
     /// <summary>
@@ -4080,6 +4119,10 @@ namespace Microsoft.Dafny
     void ResolveMethod(Method m) {
       Contract.Requires(m != null);
 
+#if !OLD_GH
+      var oldx = Statement.ReadyToDealWithGhostField;
+      Statement.ReadyToDealWithGhostField = false;
+#endif
       try
       {
         currentMethod = m;
@@ -4149,6 +4192,7 @@ namespace Microsoft.Dafny
           ResolveBlockStatement(m.Body, m.IsGhost, m);
           SolveAllTypeConstraints();
           if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
+            Statement.ReadyToDealWithGhostField = true;
             ComputeGhostInterest(m.Body, m);
           }
         }
@@ -4162,6 +4206,9 @@ namespace Microsoft.Dafny
       finally
       {
         currentMethod = null;
+#if !OLD_GH
+        Statement.ReadyToDealWithGhostField = oldx;
+#endif
       }
     }
 
@@ -5118,7 +5165,9 @@ namespace Microsoft.Dafny
       }
       if (stmt is PredicateStmt) {
         PredicateStmt s = (PredicateStmt)stmt;
+#if OLD_GH
         s.IsGhost = true;
+#endif
         ResolveExpression(s.Expr, new ResolveOpts(codeContext, true, true));
         Contract.Assert(s.Expr.Type != null);  // follows from postcondition of ResolveExpression
         ConstrainTypes(s.Expr.Type, Type.Bool, s.Expr, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Expr.Type);
@@ -5270,9 +5319,11 @@ namespace Microsoft.Dafny
           ResolveConcreteUpdateStmt(s.Update, specContextOnly, codeContext);
         }
         // Update the VarDeclStmt's ghost status according to its components
+#if OLD_GH
         if (!s.IsGhost) {
           s.IsGhost = (s.Update == null || s.Update.IsGhost) && s.Locals.All(v => v.IsGhost);
         }
+#endif
         foreach (var local in s.Locals)
         {
           if (Attributes.Contains(local.Attributes, "assumption"))
@@ -5380,7 +5431,9 @@ namespace Microsoft.Dafny
           CheckIsLvalue(lhs, codeContext);
         }
 
+#if OLD_GH
         s.IsGhost = lvalueIsGhost;
+#endif
         Type lhsType = s.Lhs.Type;
         if (s.Rhs is ExprRhs) {
           ExprRhs rr = (ExprRhs)s.Rhs;
@@ -5424,9 +5477,11 @@ namespace Microsoft.Dafny
         var s = (BlockStmt)stmt;
         scope.PushMarker();
         ResolveBlockStatement(s, specContextOnly, codeContext);
+#if OLD_GH
         if (!s.IsGhost) {
           s.IsGhost = s.Body.All(ss => ss.IsGhost);  // mark the block statement as ghost if all its substatements are ghost
         }
+#endif
         scope.PopMarker();
 
       } else if (stmt is IfStmt) {
@@ -5442,22 +5497,29 @@ namespace Microsoft.Dafny
             branchesAreSpecOnly = UsesSpecFeatures(s.Guard);
           }
         }
+#if OLD_GH
         s.IsGhost = branchesAreSpecOnly;
+#endif
         ResolveStatement(s.Thn, branchesAreSpecOnly, codeContext);
         if (s.Els != null) {
           ResolveStatement(s.Els, branchesAreSpecOnly, codeContext);
         }
+#if OLD_GH
         if (!s.IsGhost && s.Thn.IsGhost && (s.Els == null || s.Els.IsGhost)) {
           // mark the entire 'if' statement as ghost if its branches are ghost
           s.IsGhost = true;
         }
+#endif
 
       } else if (stmt is AlternativeStmt) {
         var s = (AlternativeStmt)stmt;
-        s.IsGhost = ResolveAlternatives(s.Alternatives, specContextOnly, null, codeContext);
+        ResolveAlternatives(s.Alternatives, specContextOnly, null, codeContext);
+#if OLD_GH
+        s.IsGhost = g;
         if (!s.IsGhost) {
           s.IsGhost = s.Alternatives.All(alt => alt.Body.All(ss => ss.IsGhost));
         }
+#endif
 
       } else if (stmt is WhileStmt) {
         WhileStmt s = (WhileStmt)stmt;
@@ -5503,7 +5565,9 @@ namespace Microsoft.Dafny
             Translator.ComputeFreeVariables(fe.E, fvs);
           }
         }
+#if OLD_GH
         s.IsGhost = s.Body == null || bodyMustBeSpecOnly;
+#endif
         if (s.Body != null) {
           loopStack.Add(s);  // push
           if (s.Labels == null) {  // otherwise, "s" is already in "inSpecOnlyContext" map
@@ -5519,7 +5583,7 @@ namespace Microsoft.Dafny
 
       } else if (stmt is AlternativeLoopStmt) {
         var s = (AlternativeLoopStmt)stmt;
-        s.IsGhost = ResolveAlternatives(s.Alternatives, specContextOnly, s, codeContext);
+        ResolveAlternatives(s.Alternatives, specContextOnly, s, codeContext);
         foreach (MaybeFreeExpression inv in s.Invariants) {
           ResolveExpression(inv.E, new ResolveOpts(codeContext, true, true));
           Contract.Assert(inv.E.Type != null);  // follows from postcondition of ResolveExpression
@@ -5529,9 +5593,12 @@ namespace Microsoft.Dafny
         foreach (Expression e in s.Decreases.Expressions) {
           ResolveExpression(e, new ResolveOpts(codeContext, true, true));
           if (e is WildcardExpr) {
+#if OLD_GHOST_HANDLING
             if (s.IsGhost) {
               reporter.Error(MessageSource.Resolver, e, "'decreases *' is not allowed on ghost loops");
-            } else if (!codeContext.AllowsNontermination && !DafnyOptions.O.Dafnycc) {
+            } else
+#endif
+            if (!codeContext.AllowsNontermination && !DafnyOptions.O.Dafnycc) {
               reporter.Error(MessageSource.Resolver, e, "a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating");
             }
           }
@@ -5568,7 +5635,9 @@ namespace Microsoft.Dafny
             bodyMustBeSpecOnly = true;
           }
         }
+#if OLD_GH
         s.IsGhost = s.Body == null || bodyMustBeSpecOnly;
+#endif
 
         if (s.Body != null) {
           // clear the labels for the duration of checking the body, because break statements are not allowed to leave a forall statement
@@ -5631,12 +5700,16 @@ namespace Microsoft.Dafny
         if (s.Body != null) {
           ResolveBlockStatement(s.Body, specContextOnly, codeContext);
         }
+#if OLD_GH
         s.IsGhost = specContextOnly;
+#endif
 
       } else if (stmt is CalcStmt) {
         var prevErrorCount = reporter.Count(ErrorLevel.Error);
         CalcStmt s = (CalcStmt)stmt;
+#if OLD_GH
         s.IsGhost = true;
+#endif
         if (s.Lines.Count > 0) {
           var e0 = s.Lines.First();
           ResolveExpression(e0, new ResolveOpts(codeContext, true, true));
@@ -5726,7 +5799,9 @@ namespace Microsoft.Dafny
           subst.Add(dtd.TypeArgs[i], sourceType.TypeArgs[i]);
         }
       }
+#if OLD_GH
       s.IsGhost = bodyIsSpecOnly;
+#endif
 
       // convert CasePattern in MatchCaseExpr to BoundVar and flatten the MatchCaseExpr.
       Type type = new InferredTypeProxy();
@@ -5812,9 +5887,11 @@ namespace Microsoft.Dafny
         }
         Contract.Assert(memberNamesUsed.Count + s.MissingCases.Count == dtd.Ctors.Count);
       }
+#if OLD_GH
       if (!s.IsGhost) {
         s.IsGhost = s.Cases.All(cs => cs.Body.All(ss => ss.IsGhost));
       }
+#endif
     }
 
     /*
@@ -6351,7 +6428,9 @@ namespace Microsoft.Dafny
       foreach (var a in update.ResolvedStatements) {
         ResolveStatement(a, specContextOnly, codeContext);
       }
+#if OLD_GH
       update.IsGhost = update.ResolvedStatements.TrueForAll(ss => ss.IsGhost);
+#endif
     }
 
     private void ResolveAssignSuchThatStmt(AssignSuchThatStmt s, bool specContextOnly, ICodeContext codeContext) {
@@ -6371,15 +6450,16 @@ namespace Microsoft.Dafny
         }
       }
 
+#if OLD_GH
       s.IsGhost = s.Lhss.TrueForAll(AssignStmt.LhsIsToGhost);
+#endif
       var ec = reporter.Count(ErrorLevel.Error);
       ResolveExpression(s.Expr, new ResolveOpts(codeContext, true, specContextOnly));
       ConstrainTypes(s.Expr.Type, Type.Bool, s.Expr, "type of RHS of assign-such-that statement must be boolean (got {0})", s.Expr.Type);
-      if (ec == reporter.Count(ErrorLevel.Error) && !s.IsGhost && s.AssumeToken == null && !specContextOnly) {
 #if OLD_GHOST_HANDLING
+      if (ec == reporter.Count(ErrorLevel.Error) && !s.IsGhost && s.AssumeToken == null && !specContextOnly) {
         CheckIsNonGhost(s.Expr);
 
-#endif
         CheckTypeInference(s.Expr);  // we need to resolve operators before the call to DiscoverBoundsAux
         List<IVariable> missingBounds;
         var bestBounds = DiscoverBestBounds_MultipleVars(varLhss, s.Expr, true, false, out missingBounds);
@@ -6390,13 +6470,13 @@ namespace Microsoft.Dafny
           s.Bounds = bestBounds;
         }
       }
+#endif
     }
 
-    bool ResolveAlternatives(List<GuardedAlternative> alternatives, bool specContextOnly, AlternativeLoopStmt loopToCatchBreaks, ICodeContext codeContext) {
+    void ResolveAlternatives(List<GuardedAlternative> alternatives, bool specContextOnly, AlternativeLoopStmt loopToCatchBreaks, ICodeContext codeContext) {
       Contract.Requires(alternatives != null);
       Contract.Requires(codeContext != null);
 
-      bool isGhost = specContextOnly;
       // first, resolve the guards, which tells us whether or not the entire statement is a ghost statement
       foreach (var alternative in alternatives) {
         int prevErrorCount = reporter.Count(ErrorLevel.Error);
@@ -6404,9 +6484,11 @@ namespace Microsoft.Dafny
         Contract.Assert(alternative.Guard.Type != null);  // follows from postcondition of ResolveExpression
         bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
         ConstrainTypes(alternative.Guard.Type, Type.Bool, alternative.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, alternative.Guard.Type);
+#if OLD_GHOST_HANDLING
         if (!specContextOnly && successfullyResolved) {
           isGhost = isGhost || UsesSpecFeatures(alternative.Guard);
         }
+#endif
       }
 
       if (loopToCatchBreaks != null) {
@@ -6418,15 +6500,13 @@ namespace Microsoft.Dafny
       foreach (var alternative in alternatives) {
         scope.PushMarker();
         foreach (Statement ss in alternative.Body) {
-          ResolveStatement(ss, isGhost, codeContext);
+          ResolveStatement(ss, specContextOnly, codeContext);
         }
         scope.PopMarker();
       }
       if (loopToCatchBreaks != null) {
         loopStack.RemoveAt(loopStack.Count - 1);  // pop
       }
-
-      return isGhost;
     }
 
     /// <summary>
@@ -6443,7 +6523,9 @@ namespace Microsoft.Dafny
       if (!isInitCall && callee is Constructor) {
         reporter.Error(MessageSource.Resolver, s, "a constructor is allowed to be called only when an object is being allocated");
       }
+#if OLD_GH
       s.IsGhost = callee.IsGhost;
+#endif
       if (specContextOnly && !callee.IsGhost) {
         reporter.Error(MessageSource.Resolver, s, "only ghost methods can be called from this context");
       }
@@ -6453,13 +6535,21 @@ namespace Microsoft.Dafny
         Contract.Assume(lhs.Type != null);  // a sanity check that LHSs have already been resolved
       }
       // resolve arguments
+#if OLD_GH
       if (!s.IsGhost && s.Receiver.WasResolved()) {
         CheckIsNonGhost(s.Receiver);
       }
+#endif
       int j = 0;
       foreach (Expression e in s.Args) {
+#if OLD_GHOST_HANDLING
         bool allowGhost = s.IsGhost || callee.Ins.Count <= j || callee.Ins[j].IsGhost;
+#else
+        bool allowGhost = callee.Ins.Count <= j || callee.Ins[j].IsGhost;
+#endif
+#if OLD_GHOST_HANDLING
         var ec = reporter.Count(ErrorLevel.Error);
+#endif
         ResolveExpression(e, new ResolveOpts(codeContext, true, allowGhost));
 #if OLD_GHOST_HANDLING
         if (ec == reporter.Count(ErrorLevel.Error) && !allowGhost) {
-- 
cgit v1.2.3


From bd3dedcc023edb51d2a03619061bb03463821534 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Mon, 21 Sep 2015 21:25:55 -0700
Subject: Removed unused code (old code from previous ghost-statement handling)

---
 Source/Dafny/DafnyAst.cs |  16 ---
 Source/Dafny/Resolver.cs | 282 ++++++-----------------------------------------
 2 files changed, 31 insertions(+), 267 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 83db732e..2a98d5c2 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -3461,23 +3461,7 @@ namespace Microsoft.Dafny {
       Contract.Invariant(EndTok != null);
     }
 
-#if OLD_GHOST_HANDLING
     public bool IsGhost;  // filled in by resolution
-#else
-    public static bool ReadyToDealWithGhostField = true;
-    private bool izzaGhost;
-    public bool IsGhost {
-      get {
-        Contract.Requires(ReadyToDealWithGhostField);
-        return izzaGhost;
-      }
-      set {
-        Contract.Requires(ReadyToDealWithGhostField);
-        izzaGhost = value;
-      }
-    }
-    public bool C_IsGhost;  // new ghost computation
-#endif
 
     public Statement(IToken tok, IToken endTok, Attributes attrs) {
       Contract.Requires(tok != null);
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 87379478..d82d7d1f 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -1533,7 +1533,7 @@ namespace Microsoft.Dafny
           }
         }
         foreach (AssignSuchThatStmt s in needBoundsDiscovery_AssignSuchThatStmt) {
-          Contract.Assert(!s.C_IsGhost);
+          Contract.Assert(!s.IsGhost);
           var varLhss = new List<IVariable>();
           foreach (var lhs in s.Lhss) {
             var ide = (IdentifierExpr)lhs.Resolved;  // successful resolution above implies all LHS's are IdentifierExpr's
@@ -3060,7 +3060,7 @@ namespace Microsoft.Dafny
         Contract.Assume(!codeContext.IsGhost || mustBeErasable);  // (this is really a precondition) codeContext.IsGhost ==> mustBeErasable
 
         if (stmt is PredicateStmt) {
-          stmt.C_IsGhost = true;
+          stmt.IsGhost = true;
 
         } else if (stmt is PrintStmt) {
           var s = (PrintStmt)stmt;
@@ -3073,7 +3073,7 @@ namespace Microsoft.Dafny
         } else if (stmt is BreakStmt) {
           var s = (BreakStmt)stmt;
           if (mustBeErasable) {
-            if (!s.TargetStmt.C_IsGhost && !resolver.inSpecOnlyContext[s.TargetStmt]) {  // TODO: inSpecOnlyContext should probably move from Resolver to GhostInterest_Visitor
+            if (!s.TargetStmt.IsGhost && !resolver.inSpecOnlyContext[s.TargetStmt]) {  // TODO: inSpecOnlyContext should probably move from Resolver to GhostInterest_Visitor
               var targetIsLoop = s.TargetStmt is WhileStmt || s.TargetStmt is AlternativeLoopStmt;
               Error(stmt, "ghost-context break statement is not allowed to break out of non-ghost " + (targetIsLoop ? "loop" : "structure"));
             }
@@ -3091,7 +3091,7 @@ namespace Microsoft.Dafny
 
         } else if (stmt is AssignSuchThatStmt) {
           var s = (AssignSuchThatStmt)stmt;
-          s.C_IsGhost = mustBeErasable || s.AssumeToken != null || s.Lhss.Any(AssignStmt.LhsIsToGhost);
+          s.IsGhost = mustBeErasable || s.AssumeToken != null || s.Lhss.Any(AssignStmt.LhsIsToGhost);
           if (mustBeErasable && !codeContext.IsGhost) {
             foreach (var lhs in s.Lhss) {
               var gk = AssignStmt.LhsIsToGhost_Which(lhs);
@@ -3107,14 +3107,14 @@ namespace Microsoft.Dafny
               }
             }
           }
-          if (!s.C_IsGhost) {
+          if (!s.IsGhost) {
             resolver.needBoundsDiscovery_AssignSuchThatStmt.Add(s);
           }
 
         } else if (stmt is UpdateStmt) {
           var s = (UpdateStmt)stmt;
           s.ResolvedStatements.Iter(ss => Visit(ss, mustBeErasable));
-          s.C_IsGhost = s.ResolvedStatements.All(ss => ss.C_IsGhost);
+          s.IsGhost = s.ResolvedStatements.All(ss => ss.IsGhost);
 
         } else if (stmt is VarDeclStmt) {
           var s = (VarDeclStmt)stmt;
@@ -3131,7 +3131,7 @@ namespace Microsoft.Dafny
               }
             }
           }
-          s.C_IsGhost = (s.Update == null || s.Update.C_IsGhost) && s.Locals.All(v => v.IsGhost);
+          s.IsGhost = (s.Update == null || s.Update.IsGhost) && s.Locals.All(v => v.IsGhost);
           if (s.Update != null) {
             Visit(s.Update, mustBeErasable);
           }
@@ -3141,7 +3141,7 @@ namespace Microsoft.Dafny
           var lhs = s.Lhs.Resolved;
           var gk = AssignStmt.LhsIsToGhost_Which(lhs);
           if (gk == AssignStmt.NonGhostKind.IsGhost) {
-            s.C_IsGhost = true;
+            s.IsGhost = true;
           } else if (gk == AssignStmt.NonGhostKind.Variable && codeContext.IsGhost) {
             // cool
           } else if (mustBeErasable) {
@@ -3170,10 +3170,10 @@ namespace Microsoft.Dafny
           var s = (CallStmt)stmt;
           var callee = s.Method;
           Contract.Assert(callee != null);  // follows from the invariant of CallStmt
-          s.C_IsGhost = callee.IsGhost;
+          s.IsGhost = callee.IsGhost;
           // check in-parameters
           if (mustBeErasable) {
-            if (!s.C_IsGhost) {
+            if (!s.IsGhost) {
               Error(s, "only ghost methods can be called from this context");
             }
           } else {
@@ -3221,59 +3221,59 @@ namespace Microsoft.Dafny
         } else if (stmt is BlockStmt) {
           var s = (BlockStmt)stmt;
           s.Body.Iter(ss => Visit(ss, mustBeErasable));
-          s.C_IsGhost = s.Body.All(ss => ss.C_IsGhost);  // mark the block statement as ghost if all its substatements are ghost
+          s.IsGhost = s.Body.All(ss => ss.IsGhost);  // mark the block statement as ghost if all its substatements are ghost
 
         } else if (stmt is IfStmt) {
           var s = (IfStmt)stmt;
-          s.C_IsGhost = mustBeErasable || (s.Guard != null && resolver.UsesSpecFeatures(s.Guard));
-          Visit(s.Thn, s.C_IsGhost);
+          s.IsGhost = mustBeErasable || (s.Guard != null && resolver.UsesSpecFeatures(s.Guard));
+          Visit(s.Thn, s.IsGhost);
           if (s.Els != null) {
-            Visit(s.Els, s.C_IsGhost);
+            Visit(s.Els, s.IsGhost);
           }
           // if both branches were all ghost, then we can mark the enclosing statement as ghost as well
-          s.C_IsGhost = s.C_IsGhost || (s.Thn.C_IsGhost && (s.Els == null || s.Els.C_IsGhost));
+          s.IsGhost = s.IsGhost || (s.Thn.IsGhost && (s.Els == null || s.Els.IsGhost));
 
         } else if (stmt is AlternativeStmt) {
           var s = (AlternativeStmt)stmt;
-          s.C_IsGhost = mustBeErasable || s.Alternatives.Exists(alt => resolver.UsesSpecFeatures(alt.Guard));
-          s.Alternatives.Iter(alt => alt.Body.Iter(ss => Visit(ss, s.C_IsGhost)));
-          s.C_IsGhost = s.C_IsGhost || s.Alternatives.All(alt => alt.Body.All(ss => ss.C_IsGhost));
+          s.IsGhost = mustBeErasable || s.Alternatives.Exists(alt => resolver.UsesSpecFeatures(alt.Guard));
+          s.Alternatives.Iter(alt => alt.Body.Iter(ss => Visit(ss, s.IsGhost)));
+          s.IsGhost = s.IsGhost || s.Alternatives.All(alt => alt.Body.All(ss => ss.IsGhost));
 
         } else if (stmt is WhileStmt) {
           var s = (WhileStmt)stmt;
-          s.C_IsGhost = mustBeErasable || (s.Guard != null && resolver.UsesSpecFeatures(s.Guard));
-          if (s.C_IsGhost && s.Decreases.Expressions.Exists(e => e is WildcardExpr)) {
+          s.IsGhost = mustBeErasable || (s.Guard != null && resolver.UsesSpecFeatures(s.Guard));
+          if (s.IsGhost && s.Decreases.Expressions.Exists(e => e is WildcardExpr)) {
             Error(s, "'decreases *' is not allowed on ghost loops");
           }
           if (s.Body != null) {
-            Visit(s.Body, s.C_IsGhost);
+            Visit(s.Body, s.IsGhost);
           }
-          s.C_IsGhost = s.C_IsGhost || s.Body == null || (!s.Decreases.Expressions.Exists(e => e is WildcardExpr) && s.Body.C_IsGhost);
+          s.IsGhost = s.IsGhost || s.Body == null || (!s.Decreases.Expressions.Exists(e => e is WildcardExpr) && s.Body.IsGhost);
 
         } else if (stmt is AlternativeLoopStmt) {
           var s = (AlternativeLoopStmt)stmt;
-          s.C_IsGhost = mustBeErasable || s.Alternatives.Exists(alt => resolver.UsesSpecFeatures(alt.Guard));
-          s.Alternatives.Iter(alt => alt.Body.Iter(ss => Visit(ss, s.C_IsGhost)));
-          s.C_IsGhost = s.C_IsGhost || (!s.Decreases.Expressions.Exists(e => e is WildcardExpr) && s.Alternatives.All(alt => alt.Body.All(ss => ss.C_IsGhost)));
+          s.IsGhost = mustBeErasable || s.Alternatives.Exists(alt => resolver.UsesSpecFeatures(alt.Guard));
+          s.Alternatives.Iter(alt => alt.Body.Iter(ss => Visit(ss, s.IsGhost)));
+          s.IsGhost = s.IsGhost || (!s.Decreases.Expressions.Exists(e => e is WildcardExpr) && s.Alternatives.All(alt => alt.Body.All(ss => ss.IsGhost)));
 
         } else if (stmt is ForallStmt) {
           var s = (ForallStmt)stmt;
-          s.C_IsGhost = mustBeErasable || s.Kind != ForallStmt.ParBodyKind.Assign || resolver.UsesSpecFeatures(s.Range);
+          s.IsGhost = mustBeErasable || s.Kind != ForallStmt.ParBodyKind.Assign || resolver.UsesSpecFeatures(s.Range);
           if (s.Body != null) {
-            Visit(s.Body, s.C_IsGhost);
+            Visit(s.Body, s.IsGhost);
           }
-          s.C_IsGhost = s.C_IsGhost || s.Body == null || s.Body.C_IsGhost;
+          s.IsGhost = s.IsGhost || s.Body == null || s.Body.IsGhost;
 
         } else if (stmt is ModifyStmt) {
           var s = (ModifyStmt)stmt;
           if (s.Body != null) {
             Visit(s.Body, mustBeErasable);
           }
-          s.C_IsGhost = mustBeErasable;
+          s.IsGhost = mustBeErasable;
 
         } else if (stmt is CalcStmt) {
           var s = (CalcStmt)stmt;
-          s.C_IsGhost = true;
+          s.IsGhost = true;
           foreach (var h in s.Hints) {
             Visit(h, true);
           }
@@ -3282,7 +3282,7 @@ namespace Microsoft.Dafny
           var s = (MatchStmt)stmt;
           var mbe = mustBeErasable || resolver.UsesSpecFeatures(s.Source);
           s.Cases.Iter(kase => kase.Body.Iter(ss => Visit(ss, mbe)));
-          s.C_IsGhost = mbe || s.Cases.All(kase => kase.Body.All(ss => ss.C_IsGhost));
+          s.IsGhost = mbe || s.Cases.All(kase => kase.Body.All(ss => ss.IsGhost));
 
         } else if (stmt is SkeletonStatement) {
           var s = (SkeletonStatement)stmt;
@@ -3293,7 +3293,6 @@ namespace Microsoft.Dafny
         } else {
           Contract.Assert(false); throw new cce.UnreachableException();
         }
-        stmt.IsGhost = stmt.C_IsGhost;  // DEBUG
       }
     }
     #endregion
@@ -4119,10 +4118,6 @@ namespace Microsoft.Dafny
     void ResolveMethod(Method m) {
       Contract.Requires(m != null);
 
-#if !OLD_GH
-      var oldx = Statement.ReadyToDealWithGhostField;
-      Statement.ReadyToDealWithGhostField = false;
-#endif
       try
       {
         currentMethod = m;
@@ -4192,7 +4187,6 @@ namespace Microsoft.Dafny
           ResolveBlockStatement(m.Body, m.IsGhost, m);
           SolveAllTypeConstraints();
           if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
-            Statement.ReadyToDealWithGhostField = true;
             ComputeGhostInterest(m.Body, m);
           }
         }
@@ -4206,9 +4200,6 @@ namespace Microsoft.Dafny
       finally
       {
         currentMethod = null;
-#if !OLD_GH
-        Statement.ReadyToDealWithGhostField = oldx;
-#endif
       }
     }
 
@@ -5165,9 +5156,6 @@ namespace Microsoft.Dafny
       }
       if (stmt is PredicateStmt) {
         PredicateStmt s = (PredicateStmt)stmt;
-#if OLD_GH
-        s.IsGhost = true;
-#endif
         ResolveExpression(s.Expr, new ResolveOpts(codeContext, true, true));
         Contract.Assert(s.Expr.Type != null);  // follows from postcondition of ResolveExpression
         ConstrainTypes(s.Expr.Type, Type.Bool, s.Expr, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Expr.Type);
@@ -5176,12 +5164,6 @@ namespace Microsoft.Dafny
         var s = (PrintStmt)stmt;
         var opts = new ResolveOpts(codeContext, false, specContextOnly);
         s.Args.Iter(e => ResolveExpression(e, opts));
-#if OLD_GHOST_HANDLING
-        ResolveAttributeArgs(s.Args, new ResolveOpts(codeContext, false, specContextOnly));
-        if (specContextOnly) {
-          reporter.Error(MessageSource.Resolver, stmt, "print statement is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
-        }
-#endif
 
       } else if (stmt is BreakStmt) {
         var s = (BreakStmt)stmt;
@@ -5191,12 +5173,6 @@ namespace Microsoft.Dafny
             reporter.Error(MessageSource.Resolver, s, "break label is undefined or not in scope: {0}", s.TargetLabel);
           } else {
             s.TargetStmt = target;
-#if OLD_GHOST_HANDLING
-            bool targetIsLoop = target is WhileStmt || target is AlternativeLoopStmt;
-            if (specContextOnly && !s.TargetStmt.IsGhost && !inSpecOnlyContext[s.TargetStmt]) {
-              reporter.Error(MessageSource.Resolver, stmt, "ghost-context break statement is not allowed to break out of non-ghost " + (targetIsLoop ? "loop" : "structure"));
-            }
-#endif
           }
         } else {
           if (loopStack.Count < s.BreakCount) {
@@ -5208,11 +5184,6 @@ namespace Microsoft.Dafny
               target.Labels = new LList<Label>(new Label(target.Tok, null), null);
             }
             s.TargetStmt = target;
-#if OLD_GHOST_HANDLING
-            if (specContextOnly && !target.IsGhost && !inSpecOnlyContext[target]) {
-              reporter.Error(MessageSource.Resolver, stmt, "ghost-context break statement is not allowed to break out of non-ghost loop");
-            }
-#endif
           }
         }
 
@@ -5222,10 +5193,6 @@ namespace Microsoft.Dafny
           reporter.Error(MessageSource.Resolver, stmt, "yield statement is allowed only in iterators");
         } else if (stmt is ReturnStmt && !(codeContext is Method)) {
           reporter.Error(MessageSource.Resolver, stmt, "return statement is allowed only in method");
-#if OLD_GHOST_HANDLING
-        } else if (specContextOnly && !codeContext.IsGhost) {
-          reporter.Error(MessageSource.Resolver, stmt, "{0} statement is not allowed in this context (because it is guarded by a specification-only expression)", kind);
-#endif
         }
         var s = (ProduceStmt)stmt;
         if (s.rhss != null) {
@@ -5284,12 +5251,6 @@ namespace Microsoft.Dafny
         foreach (var local in s.Locals) {
           ResolveType(local.Tok, local.OptionalType, codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
           local.type = local.OptionalType;
-#if OLD_GHOST_HANDLING
-          if (specContextOnly) {
-            // a local variable in a specification-only context might as well be ghost
-            local.IsGhost = true;
-          }
-#endif
         }
         // Resolve the UpdateStmt, if any
         if (s.Update is UpdateStmt) {
@@ -5319,11 +5280,6 @@ namespace Microsoft.Dafny
           ResolveConcreteUpdateStmt(s.Update, specContextOnly, codeContext);
         }
         // Update the VarDeclStmt's ghost status according to its components
-#if OLD_GH
-        if (!s.IsGhost) {
-          s.IsGhost = (s.Update == null || s.Update.IsGhost) && s.Locals.All(v => v.IsGhost);
-        }
-#endif
         foreach (var local in s.Locals)
         {
           if (Attributes.Contains(local.Attributes, "assumption"))
@@ -5332,12 +5288,6 @@ namespace Microsoft.Dafny
             {
               reporter.Error(MessageSource.Resolver, local.Tok, "assumption variable can only be declared in a method");
             }
-#if OLD_GHOST_HANDLING
-            if (!specContextOnly && !local.IsGhost)
-            {
-              reporter.Error(MessageSource.Resolver, local.Tok, "assumption variable must be ghost");
-            }
-#endif
             if (!(local.Type.IsBoolType))
             {
               reporter.Error(MessageSource.Resolver, s, "assumption variable must be of type 'bool'");
@@ -5361,11 +5311,6 @@ namespace Microsoft.Dafny
           } else {
             lvalueIsGhost = var.IsGhost || codeContext.IsGhost;
             CheckIsLvalue(lhs, codeContext);
-#if OLD_GHOST_HANDLING
-            if (!lvalueIsGhost && specContextOnly) {
-              reporter.Error(MessageSource.Resolver, stmt, "Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
-            }
-#endif
 
             var localVar = var as LocalVariable;
             if (localVar != null && currentMethod != null && Attributes.Contains(localVar.Attributes, "assumption"))
@@ -5391,19 +5336,6 @@ namespace Microsoft.Dafny
           var fse = (MemberSelectExpr)lhs;
           if (fse.Member != null) {  // otherwise, an error was reported above
             lvalueIsGhost = fse.Member.IsGhost;
-#if OLD_GHOST_HANDLING
-            if (!lvalueIsGhost) {
-              if (specContextOnly) {
-                reporter.Error(MessageSource.Resolver, stmt, "Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
-              } else {
-                // It is now that we wish we would have resolved s.Lhs to not allow ghosts.  Too late, so we do
-                // the next best thing.
-                if (lhsResolvedSuccessfully && UsesSpecFeatures(fse.Obj)) {
-                  reporter.Error(MessageSource.Resolver, stmt, "Assignment to non-ghost field is not allowed to use specification-only expressions in the receiver");
-                }
-              }
-            }
-#endif
             CheckIsLvalue(fse, codeContext);
           }
         } else if (lhs is SeqSelectExpr) {
@@ -5411,57 +5343,25 @@ namespace Microsoft.Dafny
           // LHS is fine, provided the "sequence" is really an array
           if (lhsResolvedSuccessfully) {
             Contract.Assert(slhs.Seq.Type != null);
-#if OLD_GHOST_HANDLING
-            if (specContextOnly) {
-              reporter.Error(MessageSource.Resolver, stmt, "Assignment to array element is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
-            }
-#endif
             CheckIsLvalue(slhs, codeContext);
           }
 
         } else if (lhs is MultiSelectExpr) {
-#if OLD_GHOST_HANDLING
-          if (specContextOnly) {
-            reporter.Error(MessageSource.Resolver, stmt, "Assignment to array element is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
-          }
-#endif
           CheckIsLvalue(lhs, codeContext);
 
         } else {
           CheckIsLvalue(lhs, codeContext);
         }
 
-#if OLD_GH
-        s.IsGhost = lvalueIsGhost;
-#endif
         Type lhsType = s.Lhs.Type;
         if (s.Rhs is ExprRhs) {
           ExprRhs rr = (ExprRhs)s.Rhs;
           ResolveExpression(rr.Expr, new ResolveOpts(codeContext, true, specContextOnly));
-#if OLD_GHOST_HANDLING
-          if (!lvalueIsGhost) {
-            CheckIsNonGhost(rr.Expr);
-          }
-#endif
           Contract.Assert(rr.Expr.Type != null);  // follows from postcondition of ResolveExpression
           ConstrainTypes(lhsType, rr.Expr.Type, stmt, "RHS (of type {0}) not assignable to LHS (of type {1})", rr.Expr.Type, lhsType);
         } else if (s.Rhs is TypeRhs) {
           TypeRhs rr = (TypeRhs)s.Rhs;
           Type t = ResolveTypeRhs(rr, stmt, lvalueIsGhost, codeContext);
-#if OLD_GHOST_HANDLING
-          if (!lvalueIsGhost) {
-            if (rr.ArrayDimensions != null) {
-              foreach (var dim in rr.ArrayDimensions) {
-                CheckIsNonGhost(dim);
-              }
-            }
-            if (rr.InitCall != null) {
-              foreach (var arg in rr.InitCall.Args) {
-                CheckIsNonGhost(arg);
-              }
-            }
-          }
-#endif
           ConstrainTypes(lhsType, t, stmt, "type {0} is not assignable to LHS (of type {1})", t, lhsType);
         } else if (s.Rhs is HavocRhs) {
           // nothing else to do
@@ -5477,11 +5377,6 @@ namespace Microsoft.Dafny
         var s = (BlockStmt)stmt;
         scope.PushMarker();
         ResolveBlockStatement(s, specContextOnly, codeContext);
-#if OLD_GH
-        if (!s.IsGhost) {
-          s.IsGhost = s.Body.All(ss => ss.IsGhost);  // mark the block statement as ghost if all its substatements are ghost
-        }
-#endif
         scope.PopMarker();
 
       } else if (stmt is IfStmt) {
@@ -5497,29 +5392,14 @@ namespace Microsoft.Dafny
             branchesAreSpecOnly = UsesSpecFeatures(s.Guard);
           }
         }
-#if OLD_GH
-        s.IsGhost = branchesAreSpecOnly;
-#endif
         ResolveStatement(s.Thn, branchesAreSpecOnly, codeContext);
         if (s.Els != null) {
           ResolveStatement(s.Els, branchesAreSpecOnly, codeContext);
         }
-#if OLD_GH
-        if (!s.IsGhost && s.Thn.IsGhost && (s.Els == null || s.Els.IsGhost)) {
-          // mark the entire 'if' statement as ghost if its branches are ghost
-          s.IsGhost = true;
-        }
-#endif
 
       } else if (stmt is AlternativeStmt) {
         var s = (AlternativeStmt)stmt;
         ResolveAlternatives(s.Alternatives, specContextOnly, null, codeContext);
-#if OLD_GH
-        s.IsGhost = g;
-        if (!s.IsGhost) {
-          s.IsGhost = s.Alternatives.All(alt => alt.Body.All(ss => ss.IsGhost));
-        }
-#endif
 
       } else if (stmt is WhileStmt) {
         WhileStmt s = (WhileStmt)stmt;
@@ -5565,9 +5445,6 @@ namespace Microsoft.Dafny
             Translator.ComputeFreeVariables(fe.E, fvs);
           }
         }
-#if OLD_GH
-        s.IsGhost = s.Body == null || bodyMustBeSpecOnly;
-#endif
         if (s.Body != null) {
           loopStack.Add(s);  // push
           if (s.Labels == null) {  // otherwise, "s" is already in "inSpecOnlyContext" map
@@ -5593,11 +5470,6 @@ namespace Microsoft.Dafny
         foreach (Expression e in s.Decreases.Expressions) {
           ResolveExpression(e, new ResolveOpts(codeContext, true, true));
           if (e is WildcardExpr) {
-#if OLD_GHOST_HANDLING
-            if (s.IsGhost) {
-              reporter.Error(MessageSource.Resolver, e, "'decreases *' is not allowed on ghost loops");
-            } else
-#endif
             if (!codeContext.AllowsNontermination && !DafnyOptions.O.Dafnycc) {
               reporter.Error(MessageSource.Resolver, e, "a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating");
             }
@@ -5635,9 +5507,6 @@ namespace Microsoft.Dafny
             bodyMustBeSpecOnly = true;
           }
         }
-#if OLD_GH
-        s.IsGhost = s.Body == null || bodyMustBeSpecOnly;
-#endif
 
         if (s.Body != null) {
           // clear the labels for the duration of checking the body, because break statements are not allowed to leave a forall statement
@@ -5700,16 +5569,10 @@ namespace Microsoft.Dafny
         if (s.Body != null) {
           ResolveBlockStatement(s.Body, specContextOnly, codeContext);
         }
-#if OLD_GH
-        s.IsGhost = specContextOnly;
-#endif
 
       } else if (stmt is CalcStmt) {
         var prevErrorCount = reporter.Count(ErrorLevel.Error);
         CalcStmt s = (CalcStmt)stmt;
-#if OLD_GH
-        s.IsGhost = true;
-#endif
         if (s.Lines.Count > 0) {
           var e0 = s.Lines.First();
           ResolveExpression(e0, new ResolveOpts(codeContext, true, true));
@@ -5799,9 +5662,6 @@ namespace Microsoft.Dafny
           subst.Add(dtd.TypeArgs[i], sourceType.TypeArgs[i]);
         }
       }
-#if OLD_GH
-      s.IsGhost = bodyIsSpecOnly;
-#endif
 
       // convert CasePattern in MatchCaseExpr to BoundVar and flatten the MatchCaseExpr.
       Type type = new InferredTypeProxy();
@@ -5887,11 +5747,6 @@ namespace Microsoft.Dafny
         }
         Contract.Assert(memberNamesUsed.Count + s.MissingCases.Count == dtd.Ctors.Count);
       }
-#if OLD_GH
-      if (!s.IsGhost) {
-        s.IsGhost = s.Cases.All(cs => cs.Body.All(ss => ss.IsGhost));
-      }
-#endif
     }
 
     /*
@@ -6302,11 +6157,6 @@ namespace Microsoft.Dafny
         var ec = reporter.Count(ErrorLevel.Error);
         ResolveExpression(lhs, new ResolveOpts(codeContext, true, specContextOnly));
         if (ec == reporter.Count(ErrorLevel.Error)) {
-#if OLD_GHOST_HANDLING
-          if (update == null && specContextOnly && !AssignStmt.LhsIsToGhost(lhs) && !codeContext.IsGhost) {
-            reporter.Error(MessageSource.Resolver, lhs, "cannot assign to non-ghost variable in a ghost context");
-          }
-#endif
           if (lhs is SeqSelectExpr && !((SeqSelectExpr)lhs).SelectOne) {
             reporter.Error(MessageSource.Resolver, lhs, "cannot assign to a range of array elements (try the 'forall' statement)");
           }
@@ -6428,9 +6278,6 @@ namespace Microsoft.Dafny
       foreach (var a in update.ResolvedStatements) {
         ResolveStatement(a, specContextOnly, codeContext);
       }
-#if OLD_GH
-      update.IsGhost = update.ResolvedStatements.TrueForAll(ss => ss.IsGhost);
-#endif
     }
 
     private void ResolveAssignSuchThatStmt(AssignSuchThatStmt s, bool specContextOnly, ICodeContext codeContext) {
@@ -6450,27 +6297,9 @@ namespace Microsoft.Dafny
         }
       }
 
-#if OLD_GH
-      s.IsGhost = s.Lhss.TrueForAll(AssignStmt.LhsIsToGhost);
-#endif
       var ec = reporter.Count(ErrorLevel.Error);
       ResolveExpression(s.Expr, new ResolveOpts(codeContext, true, specContextOnly));
       ConstrainTypes(s.Expr.Type, Type.Bool, s.Expr, "type of RHS of assign-such-that statement must be boolean (got {0})", s.Expr.Type);
-#if OLD_GHOST_HANDLING
-      if (ec == reporter.Count(ErrorLevel.Error) && !s.IsGhost && s.AssumeToken == null && !specContextOnly) {
-        CheckIsNonGhost(s.Expr);
-
-        CheckTypeInference(s.Expr);  // we need to resolve operators before the call to DiscoverBoundsAux
-        List<IVariable> missingBounds;
-        var bestBounds = DiscoverBestBounds_MultipleVars(varLhss, s.Expr, true, false, out missingBounds);
-        if (missingBounds.Count != 0) {
-          s.MissingBounds = missingBounds;  // so that an error message can be produced during compilation
-        } else {
-          Contract.Assert(bestBounds != null);
-          s.Bounds = bestBounds;
-        }
-      }
-#endif
     }
 
     void ResolveAlternatives(List<GuardedAlternative> alternatives, bool specContextOnly, AlternativeLoopStmt loopToCatchBreaks, ICodeContext codeContext) {
@@ -6484,11 +6313,6 @@ namespace Microsoft.Dafny
         Contract.Assert(alternative.Guard.Type != null);  // follows from postcondition of ResolveExpression
         bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
         ConstrainTypes(alternative.Guard.Type, Type.Bool, alternative.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, alternative.Guard.Type);
-#if OLD_GHOST_HANDLING
-        if (!specContextOnly && successfullyResolved) {
-          isGhost = isGhost || UsesSpecFeatures(alternative.Guard);
-        }
-#endif
       }
 
       if (loopToCatchBreaks != null) {
@@ -6523,9 +6347,6 @@ namespace Microsoft.Dafny
       if (!isInitCall && callee is Constructor) {
         reporter.Error(MessageSource.Resolver, s, "a constructor is allowed to be called only when an object is being allocated");
       }
-#if OLD_GH
-      s.IsGhost = callee.IsGhost;
-#endif
       if (specContextOnly && !callee.IsGhost) {
         reporter.Error(MessageSource.Resolver, s, "only ghost methods can be called from this context");
       }
@@ -6535,27 +6356,10 @@ namespace Microsoft.Dafny
         Contract.Assume(lhs.Type != null);  // a sanity check that LHSs have already been resolved
       }
       // resolve arguments
-#if OLD_GH
-      if (!s.IsGhost && s.Receiver.WasResolved()) {
-        CheckIsNonGhost(s.Receiver);
-      }
-#endif
       int j = 0;
       foreach (Expression e in s.Args) {
-#if OLD_GHOST_HANDLING
-        bool allowGhost = s.IsGhost || callee.Ins.Count <= j || callee.Ins[j].IsGhost;
-#else
         bool allowGhost = callee.Ins.Count <= j || callee.Ins[j].IsGhost;
-#endif
-#if OLD_GHOST_HANDLING
-        var ec = reporter.Count(ErrorLevel.Error);
-#endif
         ResolveExpression(e, new ResolveOpts(codeContext, true, allowGhost));
-#if OLD_GHOST_HANDLING
-        if (ec == reporter.Count(ErrorLevel.Error) && !allowGhost) {
-          CheckIsNonGhost(e);
-        }
-#endif
         j++;
       }
 
@@ -6593,30 +6397,6 @@ namespace Microsoft.Dafny
           if (!ConstrainTypes(lhs.Type, st, s, "incorrect type of method out-parameter {0} (expected {1}, got {2})", i, st, lhs.Type)) {
           } else {
             var resolvedLhs = lhs.Resolved;
-#if OLD_GHOST_HANDLING
-            if (!specContextOnly && (s.IsGhost || callee.Outs[i].IsGhost)) {
-              // LHS must denote a ghost
-              if (resolvedLhs is IdentifierExpr) {
-                var ll = (IdentifierExpr)resolvedLhs;
-                if (!ll.Var.IsGhost) {
-                  if (ll is AutoGhostIdentifierExpr && ll.Var is LocalVariable) {
-                    // the variable was actually declared in this statement, so auto-declare it as ghost
-                    ((LocalVariable)ll.Var).MakeGhost();
-                  } else {
-                    reporter.Error(MessageSource.Resolver, s, "actual out-parameter {0} is required to be a ghost variable", i);
-                  }
-                }
-              } else if (resolvedLhs is MemberSelectExpr) {
-                var ll = (MemberSelectExpr)resolvedLhs;
-                if (!ll.Member.IsGhost) {
-                  reporter.Error(MessageSource.Resolver, s, "actual out-parameter {0} is required to be a ghost field", i);
-                }
-              } else {
-                // this is an array update, and arrays are always non-ghost
-                reporter.Error(MessageSource.Resolver, s, "actual out-parameter {0} is required to be a ghost variable", i);
-              }
-            }
-#endif
             // LHS must denote a mutable field.
             CheckIsLvalue(resolvedLhs, codeContext);
           }
-- 
cgit v1.2.3


From c5c25c54a86ed70c40b7a7ce5b2b9ddd54792c11 Mon Sep 17 00:00:00 2001
From: Michael Lowell Roberts <mirobert@microsoft.com>
Date: Tue, 22 Sep 2015 13:08:21 -0700
Subject: fix for warnings related to deprecated z3 options (please update to
 the latest revision of z3).

---
 Source/Dafny/DafnyOptions.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index dd25e3c4..59d0eb2c 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -177,7 +177,7 @@ namespace Microsoft.Dafny
 
         case "noNLarith":
           DisableNLarith = true;
-          this.AddZ3Option("NL_ARITH=false");
+          this.AddZ3Option("smt.arith.nl=false");
           return true;
 
         case "autoReqPrint":
-- 
cgit v1.2.3


From bea62cec16ae455c2644a82d6425749f2eac0184 Mon Sep 17 00:00:00 2001
From: Michael Lowell Roberts <mirobert@microsoft.com>
Date: Wed, 23 Sep 2015 11:51:26 -0700
Subject: fixed bugs related to identifying newtypes as types of integers and
 reals.

---
 Source/Dafny/DafnyAst.cs | 21 ++++++++++++-----
 Source/Dafny/Resolver.cs | 60 +++++++++++++++++++++++++-----------------------
 2 files changed, 46 insertions(+), 35 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 600f7473..116b9004 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -5223,7 +5223,9 @@ namespace Microsoft.Dafny {
     public static Expression CreateAdd(Expression e0, Expression e1) {
       Contract.Requires(e0 != null);
       Contract.Requires(e1 != null);
-      Contract.Requires((e0.Type.IsIntegerType && e1.Type.IsIntegerType) || (e0.Type.IsRealType && e1.Type.IsRealType));
+      Contract.Requires(
+        (e0.Type.IsNumericBased(Type.NumericPersuation.Int) && e1.Type.IsNumericBased(Type.NumericPersuation.Int)) ||
+        (e0.Type.IsNumericBased(Type.NumericPersuation.Real) && e1.Type.IsNumericBased(Type.NumericPersuation.Real)));
       Contract.Ensures(Contract.Result<Expression>() != null);
       var s = new BinaryExpr(e0.tok, BinaryExpr.Opcode.Add, e0, e1);
       s.ResolvedOp = BinaryExpr.ResolvedOpcode.Add;  // resolve here
@@ -5265,8 +5267,12 @@ namespace Microsoft.Dafny {
     /// </summary>
     public static Expression CreateSubtract(Expression e0, Expression e1) {
       Contract.Requires(e0 != null);
+      Contract.Requires(e0.Type != null);
       Contract.Requires(e1 != null);
-      Contract.Requires((e0.Type.IsIntegerType && e1.Type.IsIntegerType) || (e0.Type.IsRealType && e1.Type.IsRealType));
+      Contract.Requires(e1.Type != null);
+      Contract.Requires(
+        (e0.Type.IsNumericBased(Type.NumericPersuation.Int) && e1.Type.IsNumericBased(Type.NumericPersuation.Int)) ||
+        (e0.Type.IsNumericBased(Type.NumericPersuation.Real) && e1.Type.IsNumericBased(Type.NumericPersuation.Real)));
       Contract.Ensures(Contract.Result<Expression>() != null);
       var s = new BinaryExpr(e0.tok, BinaryExpr.Opcode.Sub, e0, e1);
       s.ResolvedOp = BinaryExpr.ResolvedOpcode.Sub;  // resolve here
@@ -5279,7 +5285,8 @@ namespace Microsoft.Dafny {
     /// </summary>
     public static Expression CreateIncrement(Expression e, int n) {
       Contract.Requires(e != null);
-      Contract.Requires(e.Type.IsIntegerType);
+      Contract.Requires(e.Type != null);
+      Contract.Requires(e.Type.IsNumericBased(Type.NumericPersuation.Int));
       Contract.Requires(0 <= n);
       Contract.Ensures(Contract.Result<Expression>() != null);
       if (n == 0) {
@@ -5294,7 +5301,7 @@ namespace Microsoft.Dafny {
     /// </summary>
     public static Expression CreateDecrement(Expression e, int n) {
       Contract.Requires(e != null);
-      Contract.Requires(e.Type.IsIntegerType);
+      Contract.Requires(e.Type.IsNumericBased(Type.NumericPersuation.Int));
       Contract.Requires(0 <= n);
       Contract.Ensures(Contract.Result<Expression>() != null);
       if (n == 0) {
@@ -5353,7 +5360,7 @@ namespace Microsoft.Dafny {
     public static Expression CreateLess(Expression e0, Expression e1) {
       Contract.Requires(e0 != null);
       Contract.Requires(e1 != null);
-      Contract.Requires(e0.Type.IsIntegerType && e1.Type.IsIntegerType);
+      Contract.Requires(e0.Type.IsNumericBased(Type.NumericPersuation.Int) && e1.Type.IsNumericBased(Type.NumericPersuation.Int));
       Contract.Ensures(Contract.Result<Expression>() != null);
       var s = new BinaryExpr(e0.tok, BinaryExpr.Opcode.Lt, e0, e1);
       s.ResolvedOp = BinaryExpr.ResolvedOpcode.Lt;  // resolve here
@@ -5367,7 +5374,9 @@ namespace Microsoft.Dafny {
     public static Expression CreateAtMost(Expression e0, Expression e1) {
       Contract.Requires(e0 != null);
       Contract.Requires(e1 != null);
-      Contract.Requires((e0.Type.IsIntegerType && e1.Type.IsIntegerType) || (e0.Type.IsRealType && e1.Type.IsRealType));
+      Contract.Requires(
+        (e0.Type.IsNumericBased(Type.NumericPersuation.Int) && e1.Type.IsNumericBased(Type.NumericPersuation.Int)) ||
+        (e0.Type.IsNumericBased(Type.NumericPersuation.Real) && e1.Type.IsNumericBased(Type.NumericPersuation.Real)));
       Contract.Ensures(Contract.Result<Expression>() != null);
       var s = new BinaryExpr(e0.tok, BinaryExpr.Opcode.Le, e0, e1);
       s.ResolvedOp = BinaryExpr.ResolvedOpcode.Le;  // resolve here
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index a2ae401a..210cd4ac 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -7305,41 +7305,43 @@ namespace Microsoft.Dafny
             }
             eIter = ei.Seq;
           }
-          var e0 = eIter;
-
-          // Rewrite an update of the form "dt[dtor := E]" to be "let d' := dt in dtCtr(E, d'.dtor2, d'.dtor3,...)"
-          // Wrapping it in a let expr avoids exponential growth in the size of the expression
-          // More generally, rewrite "E0[dtor1 := E1][dtor2 := E2]...[dtorn := En]" to
-          //   "let d' := E0 in dtCtr(...mixtures of Ek and d'.dtorj...)"
-
-          // Create a unique name for d', the variable we introduce in the let expression
-          string tmpName = FreshTempVarName("dt_update_tmp#", opts.codeContext);
-          IdentifierExpr tmpVarIdExpr = new IdentifierExpr(e0.tok, tmpName);
-          BoundVar tmpVarBv = new BoundVar(e0.tok, tmpName, e0.Type);
-
-          // Build the arguments to the datatype constructor, using the updated value in the appropriate slot
-          List<Expression> ctor_args = new List<Expression>();
-          foreach (Formal d in ctor.Formals) {
-            Expression v = null;
-            foreach (var dvPair in IndexToValue.Values) {
-              var destructor = dvPair.Item1;
-              if (d == destructor.CorrespondingFormal) {
-                Contract.Assert(v == null);
-                v = dvPair.Item2;
+          if (ctor != null) {
+            var e0 = eIter;
+
+            // Rewrite an update of the form "dt[dtor := E]" to be "let d' := dt in dtCtr(E, d'.dtor2, d'.dtor3,...)"
+            // Wrapping it in a let expr avoids exponential growth in the size of the expression
+            // More generally, rewrite "E0[dtor1 := E1][dtor2 := E2]...[dtorn := En]" to
+            //   "let d' := E0 in dtCtr(...mixtures of Ek and d'.dtorj...)"
+
+            // Create a unique name for d', the variable we introduce in the let expression
+            string tmpName = FreshTempVarName("dt_update_tmp#", opts.codeContext);
+            IdentifierExpr tmpVarIdExpr = new IdentifierExpr(e0.tok, tmpName);
+            BoundVar tmpVarBv = new BoundVar(e0.tok, tmpName, e0.Type);
+
+            // Build the arguments to the datatype constructor, using the updated value in the appropriate slot
+            List<Expression> ctor_args = new List<Expression>();
+            foreach (Formal d in ctor.Formals) {
+              Expression v = null;
+              foreach (var dvPair in IndexToValue.Values) {
+                var destructor = dvPair.Item1;
+                if (d == destructor.CorrespondingFormal) {
+                  Contract.Assert(v == null);
+                  v = dvPair.Item2;
+                }
               }
+              ctor_args.Add(v ?? new ExprDotName(expr.tok, tmpVarIdExpr, d.Name, null));
             }
-            ctor_args.Add(v ?? new ExprDotName(expr.tok, tmpVarIdExpr, d.Name, null));
-          }
 
-          DatatypeValue ctor_call = new DatatypeValue(expr.tok, ctor.EnclosingDatatype.Name, ctor.Name, ctor_args);
+            DatatypeValue ctor_call = new DatatypeValue(expr.tok, ctor.EnclosingDatatype.Name, ctor.Name, ctor_args);
 
-          CasePattern tmpVarPat = new CasePattern(e0.tok, tmpVarBv);
-          LetExpr let = new LetExpr(e0.tok, new List<CasePattern>() { tmpVarPat }, new List<Expression>() { e0 }, ctor_call, true);
+            CasePattern tmpVarPat = new CasePattern(e0.tok, tmpVarBv);
+            LetExpr let = new LetExpr(e0.tok, new List<CasePattern>() { tmpVarPat }, new List<Expression>() { e0 }, ctor_call, true);
 
-          ResolveExpression(let, opts);
-          e.ResolvedUpdateExpr = let;
+            ResolveExpression(let, opts);
+            e.ResolvedUpdateExpr = let;
 
-          expr.Type = e0.Type;
+            expr.Type = e0.Type;
+          }
         } else {
           reporter.Error(MessageSource.Resolver, expr, "update requires a sequence, map, or datatype (got {0})", e.Seq.Type);
         }
-- 
cgit v1.2.3


From 0c1ec594e68dab4fcd458a00f9f7a1ac6de2e218 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Mon, 28 Sep 2015 13:16:15 -0700
Subject: Changed computation of ghosts until pass 2 of resolution. Other
 clean-up in resolution passes, like: Include everything of type "char" into
 bounds that are discovered, and likewise for reference types. Allow more set
 comprehensions, determining if they are finite based on their argument type.
 Changed CalcExpr.SubExpressions to not include computed expressions.

---
 Binaries/DafnyRuntime.cs                     |  13 +
 Source/Dafny/Cloner.cs                       |  14 +-
 Source/Dafny/Compiler.cs                     |  11 +
 Source/Dafny/DafnyAst.cs                     | 172 +++++++-
 Source/Dafny/Resolver.cs                     | 562 ++++++++++++++++-----------
 Test/dafny0/AssumptionVariables0.dfy.expect  |   4 +-
 Test/dafny0/CallStmtTests.dfy                |  34 +-
 Test/dafny0/CallStmtTests.dfy.expect         |   4 +-
 Test/dafny0/DiscoverBounds.dfy.expect        |   6 +-
 Test/dafny0/NonGhostQuantifiers.dfy          |   7 +
 Test/dafny0/NonGhostQuantifiers.dfy.expect   |  22 +-
 Test/dafny0/ParallelResolveErrors.dfy        |  13 +-
 Test/dafny0/ParallelResolveErrors.dfy.expect |  36 +-
 Test/dafny0/ResolutionErrors.dfy             | 278 +++++++++++--
 Test/dafny0/ResolutionErrors.dfy.expect      |  87 +++--
 Test/dafny0/TypeTests.dfy                    |  50 +--
 Test/dafny0/TypeTests.dfy.expect             |  14 +-
 Test/dafny4/set-compr.dfy.expect             |   4 +-
 18 files changed, 925 insertions(+), 406 deletions(-)

(limited to 'Source')

diff --git a/Binaries/DafnyRuntime.cs b/Binaries/DafnyRuntime.cs
index d1a3c092..4dda19fe 100644
--- a/Binaries/DafnyRuntime.cs
+++ b/Binaries/DafnyRuntime.cs
@@ -1012,6 +1012,12 @@ namespace Dafny
         return pred(false) || pred(true);
       }
     }
+    public static bool QuantChar(bool frall, System.Predicate<char> pred) {
+      for (int i = 0; i < 0x10000; i++) {
+        if (pred((char)i) != frall) { return !frall; }
+      }
+      return frall;
+    }
     public static bool QuantInt(BigInteger lo, BigInteger hi, bool frall, System.Predicate<BigInteger> pred) {
       for (BigInteger i = lo; i < hi; i++) {
         if (pred(i) != frall) { return !frall; }
@@ -1051,6 +1057,13 @@ namespace Dafny
         yield return true;
       }
     }
+    public static IEnumerable<char> AllChars {
+      get {
+        for (int i = 0; i < 0x10000; i++) {
+          yield return (char)i;
+        }
+      }
+    }
     public static IEnumerable<BigInteger> AllIntegers {
       get {
         yield return new BigInteger(0);
diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index dd2eed69..032e30a0 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -550,13 +550,21 @@ namespace Microsoft.Dafny
         r = new ForallStmt(Tok(s.Tok), Tok(s.EndTok), s.BoundVars.ConvertAll(CloneBoundVar), null, CloneExpr(s.Range), s.Ens.ConvertAll(CloneMayBeFreeExpr), CloneStmt(s.Body));
 
       } else if (stmt is CalcStmt) {
-          var s = (CalcStmt)stmt;
-          r = new CalcStmt(Tok(s.Tok), Tok(s.EndTok), CloneCalcOp(s.Op), s.Lines.ConvertAll(CloneExpr), s.Hints.ConvertAll(CloneBlockStmt), s.StepOps.ConvertAll(CloneCalcOp), CloneCalcOp(s.ResultOp), CloneAttributes(s.Attributes));
+        var s = (CalcStmt)stmt;
+        // calc statements have the unusual property that the last line is duplicated.  If that is the case (which
+        // we expect it to be here), we share the clone of that line as well.
+        var lineCount = s.Lines.Count;
+        var lines = new List<Expression>(lineCount);
+        for (int i = 0; i < lineCount; i++) {
+          lines.Add(i == lineCount - 1 && 2 <= lineCount && s.Lines[i] == s.Lines[i - 1] ? lines[i - 1] : CloneExpr(s.Lines[i]));
+        }
+        Contract.Assert(lines.Count == lineCount);
+        r = new CalcStmt(Tok(s.Tok), Tok(s.EndTok), CloneCalcOp(s.Op), lines, s.Hints.ConvertAll(CloneBlockStmt), s.StepOps.ConvertAll(CloneCalcOp), CloneCalcOp(s.ResultOp), CloneAttributes(s.Attributes));
 
       } else if (stmt is MatchStmt) {
         var s = (MatchStmt)stmt;
         r = new MatchStmt(Tok(s.Tok), Tok(s.EndTok), CloneExpr(s.Source),
-          s.Cases.ConvertAll(CloneMatchCaseStmt), s.UsesOptionalBraces);
+        s.Cases.ConvertAll(CloneMatchCaseStmt), s.UsesOptionalBraces);
 
       } else if (stmt is AssignSuchThatStmt) {
         var s = (AssignSuchThatStmt)stmt;
diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 477acabf..cdd968cf 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -1566,6 +1566,9 @@ namespace Microsoft.Dafny {
           if (bound is ComprehensionExpr.BoolBoundedPool) {
             Indent(ind);
             wr.Write("foreach (var @{0} in Dafny.Helpers.AllBooleans) {{ ", bv.CompileName);
+          } else if (bound is ComprehensionExpr.CharBoundedPool) {
+            Indent(ind);
+            wr.Write("foreach (var @{0} in Dafny.Helpers.AllChars) {{ ", bv.CompileName);
           } else if (bound is ComprehensionExpr.IntBoundedPool) {
             var b = (ComprehensionExpr.IntBoundedPool)bound;
             Indent(ind);
@@ -1777,6 +1780,8 @@ namespace Microsoft.Dafny {
         Indent(ind);
         if (bound is ComprehensionExpr.BoolBoundedPool) {
           wr.WriteLine("foreach (var {0} in Dafny.Helpers.AllBooleans) {{ @{1} = {0};", tmpVar, bv.CompileName);
+        } else if (bound is ComprehensionExpr.CharBoundedPool) {
+          wr.WriteLine("foreach (var {0} in Dafny.Helpers.AllChars) {{ @{1} = {0};", tmpVar, bv.CompileName);
         } else if (bound is ComprehensionExpr.IntBoundedPool) {
           var b = (ComprehensionExpr.IntBoundedPool)bound;
           if (AsNativeType(bv.Type) != null) {
@@ -2831,6 +2836,8 @@ namespace Microsoft.Dafny {
           // emit:  Dafny.Helpers.QuantX(boundsInformation, isForall, bv => body)
           if (bound is ComprehensionExpr.BoolBoundedPool) {
             wr.Write("Dafny.Helpers.QuantBool(");
+          } else if (bound is ComprehensionExpr.CharBoundedPool) {
+            wr.Write("Dafny.Helpers.QuantChar(");
           } else if (bound is ComprehensionExpr.IntBoundedPool) {
             var b = (ComprehensionExpr.IntBoundedPool)bound;
             wr.Write("Dafny.Helpers.QuantInt(");
@@ -2898,6 +2905,8 @@ namespace Microsoft.Dafny {
           var bv = e.BoundVars[i];
           if (bound is ComprehensionExpr.BoolBoundedPool) {
             wr.Write("foreach (var @{0} in Dafny.Helpers.AllBooleans) {{ ", bv.CompileName);
+          } else if (bound is ComprehensionExpr.CharBoundedPool) {
+            wr.Write("foreach (var @{0} in Dafny.Helpers.AllChars) {{ ", bv.CompileName);
           } else if (bound is ComprehensionExpr.IntBoundedPool) {
             var b = (ComprehensionExpr.IntBoundedPool)bound;
             if (AsNativeType(bv.Type) != null) {
@@ -2971,6 +2980,8 @@ namespace Microsoft.Dafny {
         var bv = e.BoundVars[0];
         if (bound is ComprehensionExpr.BoolBoundedPool) {
           wr.Write("foreach (var @{0} in Dafny.Helpers.AllBooleans) {{ ", bv.CompileName);
+        } else if (bound is ComprehensionExpr.CharBoundedPool) {
+          wr.Write("foreach (var @{0} in Dafny.Helpers.AllChars) {{ ", bv.CompileName);
         } else if (bound is ComprehensionExpr.IntBoundedPool) {
           var b = (ComprehensionExpr.IntBoundedPool)bound;
           if (AsNativeType(bv.Type) != null) {
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 2a98d5c2..b460d9b4 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -509,6 +509,27 @@ namespace Microsoft.Dafny {
       }
     }
 
+    public bool HasFinitePossibleValues {
+      get {
+        if (IsBoolType || IsCharType || IsRefType) {
+          return true;
+        }
+        var st = AsSetType;
+        if (st != null && st.Arg.HasFinitePossibleValues) {
+          return true;
+        }
+        var mt = AsMapType;
+        if (mt != null && mt.Domain.HasFinitePossibleValues) {
+          return true;
+        }
+        var dt = AsDatatype;
+        if (dt != null && dt.HasFinitePossibleValues) {
+          return true;
+        }
+        return false;
+      }
+    }
+
     public CollectionType AsCollectionType { get { return NormalizeExpand() as CollectionType; } }
     public SetType AsSetType { get { return NormalizeExpand() as SetType; } }
     public MultiSetType AsMultiSetType { get { return NormalizeExpand() as MultiSetType; } }
@@ -2376,6 +2397,48 @@ namespace Microsoft.Dafny {
       YieldCountVariable.type = YieldCountVariable.OptionalType;  // resolve YieldCountVariable here
     }
 
+    /// <summary>
+    /// Returns the non-null expressions of this declaration proper (that is, do not include the expressions of substatements).
+    /// Does not include the generated class members.
+    /// </summary>
+    public virtual IEnumerable<Expression> SubExpressions {
+      get {
+        foreach (var e in Attributes.SubExpressions(Attributes)) {
+          yield return e;
+        }
+        foreach (var e in Attributes.SubExpressions(Reads.Attributes)) {
+          yield return e;
+        }
+        foreach (var e in Reads.Expressions) {
+          yield return e.E;
+        }
+        foreach (var e in Attributes.SubExpressions(Modifies.Attributes)) {
+          yield return e;
+        }
+        foreach (var e in Modifies.Expressions) {
+          yield return e.E;
+        }
+        foreach (var e in Attributes.SubExpressions(Decreases.Attributes)) {
+          yield return e;
+        }
+        foreach (var e in Decreases.Expressions) {
+          yield return e;
+        }
+        foreach (var e in Requires) {
+          yield return e.E;
+        }
+        foreach (var e in Ensures) {
+          yield return e.E;
+        }
+        foreach (var e in YieldRequires) {
+          yield return e.E;
+        }
+        foreach (var e in YieldEnsures) {
+          yield return e.E;
+        }
+      }
+    }
+
     /// <summary>
     /// This Dafny type exists only for the purpose of giving the yield-count variable a type, so
     /// that the type can be recognized during translation of Dafny into Boogie.  It represents
@@ -2475,6 +2538,11 @@ namespace Microsoft.Dafny {
         return EnclosingClass.FullCompileName + ".@" + CompileName;
       }
     }
+    public virtual IEnumerable<Expression> SubExpressions {
+      get {
+        yield break;
+      }
+    }
   }
 
   public class Field : MemberDecl {
@@ -2999,6 +3067,26 @@ namespace Microsoft.Dafny {
     public bool IsBuiltin;
     public Function OverriddenFunction;
 
+    public override IEnumerable<Expression> SubExpressions {
+      get {
+        foreach (var e in Req) {
+          yield return e;
+        }
+        foreach (var e in Reads) {
+          yield return e.E;
+        }
+        foreach (var e in Ens) {
+          yield return e;
+        }
+        foreach (var e in Decreases.Expressions) {
+          yield return e;
+        }
+        if (Body != null) {
+          yield return Body;
+        }
+      }
+    }
+
     public Type Type {
       get {
         // Note, the following returned type can contain type parameters from the function and its enclosing class
@@ -3213,6 +3301,24 @@ namespace Microsoft.Dafny {
     public readonly ISet<IVariable> AssignedAssumptionVariables = new HashSet<IVariable>();
     public Method OverriddenMethod;
 
+    public override IEnumerable<Expression> SubExpressions {
+      get {
+        foreach (var e in Req) {
+          yield return e.E;
+        }
+        foreach (var e in Mod.Expressions) {
+          yield return e.E;
+        }
+        foreach (var e in Ens) {
+          yield return e.E;
+        }
+        foreach (var e in Decreases.Expressions) {
+          yield return e;
+        }
+      }
+    }
+
+
     [ContractInvariantMethod]
     void ObjectInvariant() {
       Contract.Invariant(cce.NonNullElements(TypeArgs));
@@ -4821,18 +4927,32 @@ namespace Microsoft.Dafny {
     }
     public override IEnumerable<Expression> SubExpressions
     {
-      get { // FIXME: This can return duplicates; this could confuse BottomUpVisitors that modify the AST in place
+      get {
         foreach (var e in base.SubExpressions) { yield return e; }
         foreach (var e in Attributes.SubExpressions(Attributes)) { yield return e; }
-        
-        foreach (var l in Lines) {
-          yield return l;
+
+        for (int i = 0; i < Lines.Count - 1; i++) {  // note, we skip the duplicated line at the end
+          yield return Lines[i];
         }
-        foreach (var e in Steps) {
-          yield return e;
+        foreach (var calcop in AllCalcOps) {
+          var o3 = calcop as TernaryCalcOp;
+          if (o3 != null) {
+            yield return o3.Index;
+          }
+        }
+      }
+    }
+
+    IEnumerable<CalcOp> AllCalcOps {
+      get {
+        if (Op != null) {
+          yield return Op;
         }
-        if (Result != null) {
-          yield return Result;
+        foreach (var stepop in StepOps) {
+          yield return stepop;
+        }
+        if (ResultOp != null) {
+          yield return ResultOp;
         }
       }
     }
@@ -6637,7 +6757,7 @@ namespace Microsoft.Dafny {
     public readonly Expression Body;
     public readonly bool Exact;  // Exact==true means a regular let expression; Exact==false means an assign-such-that expression
     public readonly Attributes Attributes;
-    public List<ComprehensionExpr.BoundedPool> Constraint_Bounds;  // initialized and filled in by resolver; null for Exact=true and for a ghost statement
+    public List<ComprehensionExpr.BoundedPool> Constraint_Bounds;  // initialized and filled in by resolver; null for Exact=true and for when expression is in a ghost context
     // invariant Constraint_Bounds == null || Constraint_Bounds.Count == BoundVars.Count;
     public List<IVariable> Constraint_MissingBounds;  // filled in during resolution; remains "null" if Exact==true or if bounds can be found
     // invariant Constraint_Bounds == null || Constraint_MissingBounds == null;
@@ -6790,6 +6910,22 @@ namespace Microsoft.Dafny {
         return 5;
       }
     }
+    public class CharBoundedPool : BoundedPool
+    {
+      public override int Preference() {
+        return 4;
+      }
+    }
+    public class RefBoundedPool : BoundedPool
+    {
+      public Type Type;
+      public RefBoundedPool(Type t) {
+        Type = t;
+      }
+      public override int Preference() {
+        return 2;
+      }
+    }
     public class IntBoundedPool : BoundedPool
     {
       public readonly Expression LowerBound;
@@ -6864,6 +7000,24 @@ namespace Microsoft.Dafny {
     public List<BoundVar> MissingBounds;  // filled in during resolution; remains "null" if bounds can be found
     // invariant Bounds == null || MissingBounds == null;
 
+    public List<BoundVar> UncompilableBoundVars() {
+      var bvs = new List<BoundVar>();
+      if (MissingBounds != null) {
+        bvs.AddRange(MissingBounds);
+      }
+      if (Bounds != null) {
+        Contract.Assert(Bounds.Count == BoundVars.Count);
+        for (int i = 0; i < Bounds.Count; i++) {
+          var bound = Bounds[i];
+          if (bound is RefBoundedPool) {
+            // yes, this is in principle a bound, but it's not one we'd like to compile
+            bvs.Add(BoundVars[i]);
+          }
+        }
+      }
+      return bvs;
+    }
+
     public ComprehensionExpr(IToken tok, List<BoundVar> bvars, Expression range, Expression term, Attributes attrs)
       : base(tok) {
       Contract.Requires(tok != null);
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index d82d7d1f..ec3a69c9 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -1313,16 +1313,6 @@ namespace Microsoft.Dafny
       }
     }
 
-    private readonly List<SetComprehension> needFiniteBoundsChecks_SetComprehension = new List<SetComprehension>();
-    private readonly List<AssignSuchThatStmt> needBoundsDiscovery_AssignSuchThatStmt = new List<AssignSuchThatStmt>();
-    private readonly List<LetExpr> needFiniteBoundsChecks_LetSuchThatExpr = new List<LetExpr>();
-    public int NFBC_Count {
-      // provided just for the purpose of conveniently writing contracts for ResolveTopLevelDecl_Meat
-      get {
-        return needFiniteBoundsChecks_SetComprehension.Count + needFiniteBoundsChecks_LetSuchThatExpr.Count;
-      }
-    }
-
     static readonly List<NativeType> NativeTypes = new List<NativeType>() {
       new NativeType("byte", 0, 0x100, "", true),
       new NativeType("sbyte", -0x80, 0x80, "", true),
@@ -1338,13 +1328,23 @@ namespace Microsoft.Dafny
       Contract.Requires(declarations != null);
       Contract.Requires(cce.NonNullElements(datatypeDependencies));
       Contract.Requires(cce.NonNullElements(codatatypeDependencies));
-      Contract.Requires(NFBC_Count == 0);
       Contract.Requires(AllTypeConstraints.Count == 0);
-      Contract.Ensures(NFBC_Count == 0);
       Contract.Ensures(AllTypeConstraints.Count == 0);
 
       int prevErrorCount = reporter.Count(ErrorLevel.Error);
 
+      // ---------------------------------- Pass 0 ----------------------------------
+      // This pass resolves names, introduces (and may solve) type constraints, and
+      // builds the module's call graph.
+      // Some bounds are discovered during this pass [is this necessary? can they be
+      // moved to pass 1 like the other bounds discovery? --KRML], namely:
+      //   - forall statements
+      //   - quantifier expressions
+      //   - map comprehensions
+      // For 'newtype' declarations, it also checks that all types were fully
+      // determined.
+      // ----------------------------------------------------------------------------
+
       // Resolve the meat of classes and iterators, the definitions of type synonyms, and the type parameters of all top-level type declarations
       // First, resolve the newtype declarations and the constraint clauses, including filling in .ResolvedOp fields.  This is needed for the
       // resolution of the other declarations, because those other declarations may invoke DiscoverBounds, which looks at the .Constraint field
@@ -1403,172 +1403,80 @@ namespace Microsoft.Dafny
         allTypeParameters.PopMarker();
       }
 
+      // ---------------------------------- Pass 1 ----------------------------------
+      // This pass:
+      // * checks that type inference was able to determine all types
+      // * fills in the .ResolvedOp field of binary expressions
+      // * discovers bounds for:
+      //     - set comprehensions
+      //     - assign-such-that statements
+      //     - compilable let-such-that expressions
+      //     - newtype constraints
+      // For each statement body that it successfully typed, this pass also:
+      // * computes ghost interests
+      // * determines/checks tail-recursion.
+      // ----------------------------------------------------------------------------
+
       Dictionary<string, NativeType> nativeTypeMap = new Dictionary<string, NativeType>();
       foreach (var nativeType in NativeTypes) {
         nativeTypeMap.Add(nativeType.Name, nativeType);
       }
-
       if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
         // Check that type inference went well everywhere; this will also fill in the .ResolvedOp field in binary expressions
         foreach (TopLevelDecl d in declarations) {
           if (d is IteratorDecl) {
             var iter = (IteratorDecl)d;
+            var prevErrCnt = reporter.Count(ErrorLevel.Error);
             iter.Members.Iter(CheckTypeInference_Member);
+            if (prevErrCnt == reporter.Count(ErrorLevel.Error)) {
+              iter.SubExpressions.Iter(e => CheckExpression(e, this, iter));
+            }
             if (iter.Body != null) {
               CheckTypeInference(iter.Body);
+              if (prevErrCnt == reporter.Count(ErrorLevel.Error)) {
+                ComputeGhostInterest(iter.Body, false, iter);
+                CheckExpression(iter.Body, this, iter);
+              }
             }
           } else if (d is ClassDecl) {
             var cl = (ClassDecl)d;
-            cl.Members.Iter(CheckTypeInference_Member);
             foreach (var member in cl.Members) {
-              var m = member as Method;
-              if (m != null && m.Body != null) {
-                DetermineTailRecursion(m);
+              var prevErrCnt = reporter.Count(ErrorLevel.Error);
+              CheckTypeInference_Member(member);
+              if (prevErrCnt == reporter.Count(ErrorLevel.Error)) {
+                if (member is Method) {
+                  var m = (Method)member;
+                  if (m.Body != null) {
+                    ComputeGhostInterest(m.Body, m.IsGhost, m);
+                    CheckExpression(m.Body, this, m);
+                    DetermineTailRecursion(m);
+                  }
+                } else if (member is Function) {
+                  var f = (Function)member;
+                  if (!f.IsGhost && f.Body != null) {
+                    CheckIsNonGhost(f.Body);
+                  }
+                  DetermineTailRecursion(f);
+                }
+                if (prevErrCnt == reporter.Count(ErrorLevel.Error) && member is ICodeContext) {
+                  member.SubExpressions.Iter(e => CheckExpression(e, this, (ICodeContext)member));
+                }
               }
             }
           } else if (d is NewtypeDecl) {
             var dd = (NewtypeDecl)d;
-            bool? boolNativeType = null;
-            NativeType stringNativeType = null;
-            object nativeTypeAttr = true;
-            bool hasNativeTypeAttr = Attributes.ContainsMatchingValue(dd.Attributes, "nativeType", ref nativeTypeAttr,
-              new Attributes.MatchingValueOption[] {
-                Attributes.MatchingValueOption.Empty,
-                Attributes.MatchingValueOption.Bool,
-                Attributes.MatchingValueOption.String },
-              err => reporter.Error(MessageSource.Resolver, dd, err));
-            if (hasNativeTypeAttr) {
-              if (nativeTypeAttr is bool) {
-                boolNativeType = (bool)nativeTypeAttr;
-              } else {
-                string keyString = (string)nativeTypeAttr;
-                if (nativeTypeMap.ContainsKey(keyString)) {
-                  stringNativeType = nativeTypeMap[keyString];
-                } else {
-                  reporter.Error(MessageSource.Resolver, dd, "Unsupported nativeType {0}", keyString);
-                }
-              }
-            }
-            if (stringNativeType != null || boolNativeType == true) {
-              if (!dd.BaseType.IsNumericBased(Type.NumericPersuation.Int)) {
-                reporter.Error(MessageSource.Resolver, dd, "nativeType can only be used on integral types");
-              }
-              if (dd.Var == null) {
-                reporter.Error(MessageSource.Resolver, dd, "nativeType can only be used if newtype specifies a constraint");
-              }
-            }
             if (dd.Var != null) {
               Contract.Assert(dd.Constraint != null);
-              CheckTypeInference(dd.Constraint);
-
-              Func<Expression, BigInteger?> GetConst = null;
-              GetConst = (Expression e) => {
-                int m = 1;
-                BinaryExpr bin = e as BinaryExpr;
-                if (bin != null && bin.Op == BinaryExpr.Opcode.Sub && GetConst(bin.E0) == BigInteger.Zero) {
-                  m = -1;
-                  e = bin.E1;
-                }
-                LiteralExpr l = e as LiteralExpr;
-                if (l != null && l.Value is BigInteger) {
-                  return m * (BigInteger)l.Value;
-                }
-                return null;
-              };
-              var bounds = DiscoverAllBounds_SingleVar(dd.Var, dd.Constraint);
-              List<NativeType> potentialNativeTypes =
-                (stringNativeType != null) ? new List<NativeType> { stringNativeType } :
-                (boolNativeType == false) ? new List<NativeType>() :
-                NativeTypes;
-              foreach (var nt in potentialNativeTypes) {
-                bool lowerOk = false;
-                bool upperOk = false;
-                foreach (var bound in bounds) {
-                  if (bound is ComprehensionExpr.IntBoundedPool) {
-                    var bnd = (ComprehensionExpr.IntBoundedPool)bound;
-                    if (bnd.LowerBound != null) {
-                      BigInteger? lower = GetConst(bnd.LowerBound);
-                      if (lower != null && nt.LowerBound <= lower) {
-                        lowerOk = true;
-                      }
-                    }
-                    if (bnd.UpperBound != null) {
-                      BigInteger? upper = GetConst(bnd.UpperBound);
-                      if (upper != null && upper <= nt.UpperBound) {
-                        upperOk = true;
-                      }
-                    }
-                  }
-                }
-                if (lowerOk && upperOk) {
-                  dd.NativeType = nt;
-                  break;
-                }
-              }
-              if (dd.NativeType == null && (boolNativeType == true || stringNativeType != null)) {
-                reporter.Error(MessageSource.Resolver, dd, "Dafny's heuristics cannot find a compatible native type.  " +
-                  "Hint: try writing a newtype constraint of the form 'i:int | lowerBound <= i < upperBound && (...any additional constraints...)'");
-              }
-              if (dd.NativeType != null && stringNativeType == null) {
-                reporter.Info(MessageSource.Resolver, dd.tok, "{:nativeType \"" + dd.NativeType.Name + "\"}");
-              }
+              CheckExpression(dd.Constraint, this, dd);
             }
+            FigureOutNativeType(dd, nativeTypeMap);
           }
         }
       }
 
-      if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
-        // At this point, it is necessary to know for each statement and expression if it is ghost or not
-        foreach (var e in needFiniteBoundsChecks_SetComprehension) {
-          CheckTypeInference(e.Range);  // we need to resolve operators before the call to DiscoverBounds
-          List<BoundVar> missingBounds;
-          e.Bounds = DiscoverBestBounds_MultipleVars(e.BoundVars, e.Range, true, true, out missingBounds);
-          if (missingBounds.Count != 0) {
-            e.MissingBounds = missingBounds;
-            if (e.Finite) {
-              foreach (var bv in e.MissingBounds) {
-                reporter.Error(MessageSource.Resolver, e, "a set comprehension must produce a finite set, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
-              }
-            }
-          }
-        }
-        foreach (AssignSuchThatStmt s in needBoundsDiscovery_AssignSuchThatStmt) {
-          Contract.Assert(!s.IsGhost);
-          var varLhss = new List<IVariable>();
-          foreach (var lhs in s.Lhss) {
-            var ide = (IdentifierExpr)lhs.Resolved;  // successful resolution above implies all LHS's are IdentifierExpr's
-            varLhss.Add(ide.Var);
-          }
-
-          List<IVariable> missingBounds;
-          var bestBounds = DiscoverBestBounds_MultipleVars(varLhss, s.Expr, true, false, out missingBounds);
-          if (missingBounds.Count != 0) {
-            s.MissingBounds = missingBounds;  // so that an error message can be produced during compilation
-          } else {
-            Contract.Assert(bestBounds != null);
-            s.Bounds = bestBounds;
-          }
-        }
-        foreach (var e in needFiniteBoundsChecks_LetSuchThatExpr) {
-          Contract.Assert(!e.Exact);  // only let-such-that expressions are ever added to the list
-          Contract.Assert(e.RHSs.Count == 1);  // if we got this far, the resolver will have checked this condition successfully
-          var constraint = e.RHSs[0];
-          CheckTypeInference(constraint);  // we need to resolve operators before the call to DiscoverBounds
-          List<IVariable> missingBounds;
-          var vars = new List<IVariable>(e.BoundVars);
-          var bestBounds = DiscoverBestBounds_MultipleVars(vars, constraint, true, false, out missingBounds);
-          if (missingBounds.Count != 0) {
-            e.Constraint_MissingBounds = missingBounds;
-            foreach (var bv in e.Constraint_MissingBounds) {
-              reporter.Error(MessageSource.Resolver, e, "a non-ghost let-such-that constraint must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
-            }
-          } else {
-            e.Constraint_Bounds = bestBounds;
-          }
-        }
-      }
-      needFiniteBoundsChecks_SetComprehension.Clear();
-      needFiniteBoundsChecks_LetSuchThatExpr.Clear();
+      // ---------------------------------- Pass 2 ----------------------------------
+      // This pass fills in various additional information.
+      // ----------------------------------------------------------------------------
 
       if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
         // fill in the postconditions and bodies of prefix lemmas
@@ -1894,6 +1802,93 @@ namespace Microsoft.Dafny
       }
     }
 
+    private void FigureOutNativeType(NewtypeDecl dd, Dictionary<string, NativeType> nativeTypeMap) {
+      Contract.Requires(dd != null);
+      Contract.Requires(nativeTypeMap != null);
+      bool? boolNativeType = null;
+      NativeType stringNativeType = null;
+      object nativeTypeAttr = true;
+      bool hasNativeTypeAttr = Attributes.ContainsMatchingValue(dd.Attributes, "nativeType", ref nativeTypeAttr,
+        new Attributes.MatchingValueOption[] {
+                Attributes.MatchingValueOption.Empty,
+                Attributes.MatchingValueOption.Bool,
+                Attributes.MatchingValueOption.String },
+        err => reporter.Error(MessageSource.Resolver, dd, err));
+      if (hasNativeTypeAttr) {
+        if (nativeTypeAttr is bool) {
+          boolNativeType = (bool)nativeTypeAttr;
+        } else {
+          string keyString = (string)nativeTypeAttr;
+          if (nativeTypeMap.ContainsKey(keyString)) {
+            stringNativeType = nativeTypeMap[keyString];
+          } else {
+            reporter.Error(MessageSource.Resolver, dd, "Unsupported nativeType {0}", keyString);
+          }
+        }
+      }
+      if (stringNativeType != null || boolNativeType == true) {
+        if (!dd.BaseType.IsNumericBased(Type.NumericPersuation.Int)) {
+          reporter.Error(MessageSource.Resolver, dd, "nativeType can only be used on integral types");
+        }
+        if (dd.Var == null) {
+          reporter.Error(MessageSource.Resolver, dd, "nativeType can only be used if newtype specifies a constraint");
+        }
+      }
+      if (dd.Var != null) {
+        Func<Expression, BigInteger?> GetConst = null;
+        GetConst = (Expression e) => {
+          int m = 1;
+          BinaryExpr bin = e as BinaryExpr;
+          if (bin != null && bin.Op == BinaryExpr.Opcode.Sub && GetConst(bin.E0) == BigInteger.Zero) {
+            m = -1;
+            e = bin.E1;
+          }
+          LiteralExpr l = e as LiteralExpr;
+          if (l != null && l.Value is BigInteger) {
+            return m * (BigInteger)l.Value;
+          }
+          return null;
+        };
+        var bounds = DiscoverAllBounds_SingleVar(dd.Var, dd.Constraint);
+        List<NativeType> potentialNativeTypes =
+          (stringNativeType != null) ? new List<NativeType> { stringNativeType } :
+          (boolNativeType == false) ? new List<NativeType>() :
+          NativeTypes;
+        foreach (var nt in potentialNativeTypes) {
+          bool lowerOk = false;
+          bool upperOk = false;
+          foreach (var bound in bounds) {
+            if (bound is ComprehensionExpr.IntBoundedPool) {
+              var bnd = (ComprehensionExpr.IntBoundedPool)bound;
+              if (bnd.LowerBound != null) {
+                BigInteger? lower = GetConst(bnd.LowerBound);
+                if (lower != null && nt.LowerBound <= lower) {
+                  lowerOk = true;
+                }
+              }
+              if (bnd.UpperBound != null) {
+                BigInteger? upper = GetConst(bnd.UpperBound);
+                if (upper != null && upper <= nt.UpperBound) {
+                  upperOk = true;
+                }
+              }
+            }
+          }
+          if (lowerOk && upperOk) {
+            dd.NativeType = nt;
+            break;
+          }
+        }
+        if (dd.NativeType == null && (boolNativeType == true || stringNativeType != null)) {
+          reporter.Error(MessageSource.Resolver, dd, "Dafny's heuristics cannot find a compatible native type.  " +
+            "Hint: try writing a newtype constraint of the form 'i:int | lowerBound <= i < upperBound && (...any additional constraints...)'");
+        }
+        if (dd.NativeType != null && stringNativeType == null) {
+          reporter.Info(MessageSource.Resolver, dd.tok, "{:nativeType \"" + dd.NativeType.Name + "\"}");
+        }
+      }
+    }
+
     /// <summary>
     /// Adds the type constraint ty==expected, eventually printing the error message "msg" if this is found to be
     /// untenable.  If this is immediately known not to be untenable, false is returned.
@@ -2123,16 +2118,60 @@ namespace Microsoft.Dafny
         } else if (stmt is ForallStmt) {
           var s = (ForallStmt)stmt;
           s.BoundVars.Iter(bv => CheckTypeIsDetermined(bv.tok, bv.Type, "bound variable"));
+        } else if (stmt is AssignSuchThatStmt) {
+          var s = (AssignSuchThatStmt)stmt;
+          if (s.AssumeToken == null) {
+            var varLhss = new List<IVariable>();
+            foreach (var lhs in s.Lhss) {
+              var ide = (IdentifierExpr)lhs.Resolved;  // successful resolution implies all LHS's are IdentifierExpr's
+              varLhss.Add(ide.Var);
+            }
+            List<IVariable> missingBounds;
+            var bestBounds = DiscoverBestBounds_MultipleVars(varLhss, s.Expr, true, false, out missingBounds);
+            if (missingBounds.Count != 0) {
+              s.MissingBounds = missingBounds;  // so that an error message can be produced during compilation
+            } else {
+              Contract.Assert(bestBounds != null);
+              s.Bounds = bestBounds;
+            }
+          }
+        } else if (stmt is CalcStmt) {
+          var s = (CalcStmt)stmt;
+          // The resolution of the calc statement builds up .Steps and .Result, which are of the form E0 OP E1, where
+          // E0 and E1 are expressions from .Lines.  These additional expressions still need to have their .ResolvedOp
+          // fields filled in, so we visit them (but not their subexpressions) here.
+          foreach (var e in s.Steps) {
+            VisitOneExpr(e);
+          }
+          VisitOneExpr(s.Result);
         }
       }
       protected override void VisitOneExpr(Expression expr) {
         if (expr is ComprehensionExpr) {
           var e = (ComprehensionExpr)expr;
-          if (e != null) {
-            foreach (var bv in e.BoundVars) {
-              if (!IsDetermined(bv.Type.Normalize())) {
-                resolver.reporter.Error(MessageSource.Resolver, bv.tok, "type of bound variable '{0}' could not be determined; please specify the type explicitly",
-                  bv.Name);
+          foreach (var bv in e.BoundVars) {
+            if (!IsDetermined(bv.Type.Normalize())) {
+              resolver.reporter.Error(MessageSource.Resolver, bv.tok, "type of bound variable '{0}' could not be determined; please specify the type explicitly", bv.Name);
+            }
+          }
+          if (e is SetComprehension) {
+            var sc = (SetComprehension)e;
+            if (sc.Finite) {
+              // A set must be finite.  Discover bounds for the Range expression, but report an error only if the Term is not
+              // of a finite-individuals type.
+              List<BoundVar> missingBounds;
+              sc.Bounds = DiscoverBestBounds_MultipleVars(sc.BoundVars, sc.Range, true, true, out missingBounds);
+              if (missingBounds.Count != 0) {
+                sc.MissingBounds = missingBounds;
+                if (sc.Type.HasFinitePossibleValues) {
+                  // This means the set is finite, regardless of if the Range is bounded.  So, we don't give any error here.
+                  // However, if this expression is used in a non-ghost context (which is not yet known at this stage of
+                  // resolution), the resolver will generate an error about that later.
+                } else {
+                  foreach (var bv in sc.MissingBounds) {
+                    resolver.reporter.Error(MessageSource.Resolver, sc, "a set comprehension must produce a finite set, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
+                  }
+                }
               }
             }
           }
@@ -2172,6 +2211,7 @@ namespace Microsoft.Dafny
           var bin = expr as BinaryExpr;
           if (bin != null) {
             bin.ResolvedOp = ResolveOp(bin.Op, bin.E1.Type);
+          
           }
         }
       }
@@ -2249,6 +2289,58 @@ namespace Microsoft.Dafny
     }
     #endregion CheckTypeInference
 
+    // ------------------------------------------------------------------------------------------------------
+    // ----- CheckExpression --------------------------------------------------------------------------------
+    // ------------------------------------------------------------------------------------------------------
+    #region CheckExpression
+    /// <summary>
+    /// This method computes ghost interests in the statement portion of StmtExpr's and
+    /// checks for hint restrictions in any CalcStmt.
+    /// </summary>
+    void CheckExpression(Expression expr, Resolver resolver, ICodeContext codeContext) {
+      Contract.Requires(expr != null);
+      Contract.Requires(resolver != null);
+      Contract.Requires(codeContext != null);
+      var v = new CheckExpression_Visitor(resolver, codeContext);
+      v.Visit(expr);
+    }
+    /// <summary>
+    /// This method computes ghost interests in the statement portion of StmtExpr's and
+    /// checks for hint restrictions in any CalcStmt.
+    /// </summary>
+    void CheckExpression(Statement stmt, Resolver resolver, ICodeContext codeContext) {
+      Contract.Requires(stmt != null);
+      Contract.Requires(resolver != null);
+      Contract.Requires(codeContext != null);
+      var v = new CheckExpression_Visitor(resolver, codeContext);
+      v.Visit(stmt);
+    }
+    class CheckExpression_Visitor : ResolverBottomUpVisitor
+    {
+      readonly ICodeContext CodeContext;
+      public CheckExpression_Visitor(Resolver resolver, ICodeContext codeContext)
+        : base(resolver) {
+        Contract.Requires(resolver != null);
+        Contract.Requires(codeContext != null);
+        CodeContext = codeContext;
+      }
+      protected override void VisitOneExpr(Expression expr) {
+        if (expr is StmtExpr) {
+          var e = (StmtExpr)expr;
+          resolver.ComputeGhostInterest(e.S, true, CodeContext);
+        }
+      }
+      protected override void VisitOneStmt(Statement stmt) {
+        if (stmt is CalcStmt) {
+          var s = (CalcStmt)stmt;
+          foreach (var h in s.Hints) {
+            resolver.CheckHintRestrictions(h, new HashSet<LocalVariable>());
+          }
+        }
+      }
+    }
+    #endregion
+
     // ------------------------------------------------------------------------------------------------------
     // ----- CheckTailRecursive -----------------------------------------------------------------------------
     // ------------------------------------------------------------------------------------------------------
@@ -3009,11 +3101,11 @@ namespace Microsoft.Dafny
     // ----- ComputeGhostInterest ---------------------------------------------------------------------------
     // ------------------------------------------------------------------------------------------------------
     #region ComputeGhostInterest
-    public void ComputeGhostInterest(Statement stmt, ICodeContext codeContext) {
+    public void ComputeGhostInterest(Statement stmt, bool mustBeErasable, ICodeContext codeContext) {
       Contract.Requires(stmt != null);
       Contract.Requires(codeContext != null);
       var visitor = new GhostInterest_Visitor(codeContext, this);
-      visitor.Visit(stmt, codeContext.IsGhost);
+      visitor.Visit(stmt, mustBeErasable);
     }
     class GhostInterest_Visitor
     {
@@ -3037,12 +3129,6 @@ namespace Microsoft.Dafny
         Contract.Requires(msgArgs != null);
         resolver.reporter.Error(MessageSource.Resolver, expr, msg, msgArgs);
       }
-      protected void Error(IToken tok, string msg, params object[] msgArgs) {
-        Contract.Requires(tok != null);
-        Contract.Requires(msg != null);
-        Contract.Requires(msgArgs != null);
-        resolver.reporter.Error(MessageSource.Resolver, tok, msg, msgArgs);
-      }
       /// <summary>
       /// This method does three things:
       /// 0. Reports an error if "mustBeErasable" and the statement assigns to a non-ghost field
@@ -3057,6 +3143,7 @@ namespace Microsoft.Dafny
       /// because break statements look at the ghost status of its enclosing statements.
       /// </summary>
       public void Visit(Statement stmt, bool mustBeErasable) {
+        Contract.Requires(stmt != null);
         Contract.Assume(!codeContext.IsGhost || mustBeErasable);  // (this is really a precondition) codeContext.IsGhost ==> mustBeErasable
 
         if (stmt is PredicateStmt) {
@@ -3107,9 +3194,6 @@ namespace Microsoft.Dafny
               }
             }
           }
-          if (!s.IsGhost) {
-            resolver.needBoundsDiscovery_AssignSuchThatStmt.Add(s);
-          }
 
         } else if (stmt is UpdateStmt) {
           var s = (UpdateStmt)stmt;
@@ -3124,13 +3208,6 @@ namespace Microsoft.Dafny
               local.IsGhost = true;
             }
           }
-          foreach (var local in s.Locals) {
-            if (Attributes.Contains(local.Attributes, "assumption")) {
-              if (!local.IsGhost) {
-                Error(local.Tok, "assumption variable must be ghost");
-              }
-            }
-          }
           s.IsGhost = (s.Update == null || s.Update.IsGhost) && s.Locals.All(v => v.IsGhost);
           if (s.Update != null) {
             Visit(s.Update, mustBeErasable);
@@ -4040,14 +4117,10 @@ namespace Microsoft.Dafny
         var prevErrorCount = reporter.Count(ErrorLevel.Error);
         ResolveExpression(f.Body, new ResolveOpts(f, false));
         SolveAllTypeConstraints();
-        if (!f.IsGhost && prevErrorCount == reporter.Count(ErrorLevel.Error)) {
-          CheckIsNonGhost(f.Body);
-        }
         Contract.Assert(f.Body.Type != null);  // follows from postcondition of ResolveExpression
         ConstrainTypes(f.Body.Type, f.ResultType, f, "Function body type mismatch (expected {0}, got {1})", f.ResultType, f.Body.Type);
       }
       scope.PopMarker();
-      DetermineTailRecursion(f);
     }
 
     /// <summary>
@@ -4187,7 +4260,7 @@ namespace Microsoft.Dafny
           ResolveBlockStatement(m.Body, m.IsGhost, m);
           SolveAllTypeConstraints();
           if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
-            ComputeGhostInterest(m.Body, m);
+//KRML            ComputeGhostInterest(m.Body, m);
           }
         }
 
@@ -4308,7 +4381,7 @@ namespace Microsoft.Dafny
       if (iter.Body != null) {
         ResolveBlockStatement(iter.Body, false, iter);
         if (reporter.Count(ErrorLevel.Error) == postSpecErrorCount) {
-          ComputeGhostInterest(iter.Body, iter);
+          //KRML          ComputeGhostInterest(iter.Body, iter);
         }
       }
 
@@ -5290,7 +5363,10 @@ namespace Microsoft.Dafny
             }
             if (!(local.Type.IsBoolType))
             {
-              reporter.Error(MessageSource.Resolver, s, "assumption variable must be of type 'bool'");
+              reporter.Error(MessageSource.Resolver, local.Tok, "assumption variable must be of type 'bool'");
+            }
+            if (!local.IsGhost) {
+              reporter.Error(MessageSource.Resolver, local.Tok, "assumption variable must be ghost");
             }
           }
         }
@@ -5599,7 +5675,6 @@ namespace Microsoft.Dafny
           loopStack = new List<Statement>();
           foreach (var h in s.Hints) {
             ResolveStatement(h, true, codeContext);
-            CheckHintRestrictions(h);
           }
           labeledStatements = prevLblStmts;
           loopStack = prevLoopStack;
@@ -6347,9 +6422,6 @@ namespace Microsoft.Dafny
       if (!isInitCall && callee is Constructor) {
         reporter.Error(MessageSource.Resolver, s, "a constructor is allowed to be called only when an object is being allocated");
       }
-      if (specContextOnly && !callee.IsGhost) {
-        reporter.Error(MessageSource.Resolver, s, "only ghost methods can be called from this context");
-      }
 
       // resolve left-hand sides
       foreach (var lhs in s.Lhs) {
@@ -6633,8 +6705,9 @@ namespace Microsoft.Dafny
     /// Check that a statment is a valid hint for a calculation.
     /// ToDo: generalize the part for compound statements to take a delegate?
     /// </summary>
-    public void CheckHintRestrictions(Statement stmt) {
+    public void CheckHintRestrictions(Statement stmt, ISet<LocalVariable> localsAllowedInUpdates) {
       Contract.Requires(stmt != null);
+      Contract.Requires(localsAllowedInUpdates != null);
       if (stmt is PredicateStmt) {
         // cool
       } else if (stmt is PrintStmt) {
@@ -6648,11 +6721,11 @@ namespace Microsoft.Dafny
       } else if (stmt is AssignSuchThatStmt) {
         var s = (AssignSuchThatStmt)stmt;
         foreach (var lhs in s.Lhss) {
-          CheckHintLhs(s.Tok, lhs.Resolved);
+          CheckHintLhs(s.Tok, lhs.Resolved, localsAllowedInUpdates);
         }
       } else if (stmt is AssignStmt) {
         var s = (AssignStmt)stmt;
-        CheckHintLhs(s.Tok, s.Lhs.Resolved);
+        CheckHintLhs(s.Tok, s.Lhs.Resolved, localsAllowedInUpdates);
       } else if (stmt is CallStmt) {
         var s = (CallStmt)stmt;
         if (s.Method.Mod.Expressions.Count != 0) {
@@ -6661,33 +6734,33 @@ namespace Microsoft.Dafny
       } else if (stmt is UpdateStmt) {
         var s = (UpdateStmt)stmt;
         foreach (var ss in s.ResolvedStatements) {
-          CheckHintRestrictions(ss);
+          CheckHintRestrictions(ss, localsAllowedInUpdates);
         }
       } else if (stmt is VarDeclStmt) {
         var s = (VarDeclStmt)stmt;
+        s.Locals.Iter(local => localsAllowedInUpdates.Add(local));
         if (s.Update != null) {
-          CheckHintRestrictions(s.Update);
+          CheckHintRestrictions(s.Update, localsAllowedInUpdates);
         }
       } else if (stmt is BlockStmt) {
         var s = (BlockStmt)stmt;
-        scope.PushMarker();
+        var newScopeForLocals = new HashSet<LocalVariable>(localsAllowedInUpdates);
         foreach (var ss in s.Body) {
-          CheckHintRestrictions(ss);
+          CheckHintRestrictions(ss, newScopeForLocals);
         }
-        scope.PopMarker();
 
       } else if (stmt is IfStmt) {
         var s = (IfStmt)stmt;
-        CheckHintRestrictions(s.Thn);
+        CheckHintRestrictions(s.Thn, localsAllowedInUpdates);
         if (s.Els != null) {
-          CheckHintRestrictions(s.Els);
+          CheckHintRestrictions(s.Els, localsAllowedInUpdates);
         }
 
       } else if (stmt is AlternativeStmt) {
         var s = (AlternativeStmt)stmt;
         foreach (var alt in s.Alternatives) {
           foreach (var ss in alt.Body) {
-            CheckHintRestrictions(ss);
+            CheckHintRestrictions(ss, localsAllowedInUpdates);
           }
         }
 
@@ -6697,14 +6770,14 @@ namespace Microsoft.Dafny
           reporter.Error(MessageSource.Resolver, s.Mod.Expressions[0].tok, "a while statement used inside a hint is not allowed to have a modifies clause");
         }
         if (s.Body != null) {
-          CheckHintRestrictions(s.Body);
+          CheckHintRestrictions(s.Body, localsAllowedInUpdates);
         }
 
       } else if (stmt is AlternativeLoopStmt) {
         var s = (AlternativeLoopStmt)stmt;
         foreach (var alt in s.Alternatives) {
           foreach (var ss in alt.Body) {
-            CheckHintRestrictions(ss);
+            CheckHintRestrictions(ss, localsAllowedInUpdates);
           }
         }
 
@@ -6726,14 +6799,14 @@ namespace Microsoft.Dafny
       } else if (stmt is CalcStmt) {
         var s = (CalcStmt)stmt;
         foreach (var h in s.Hints) {
-          CheckHintRestrictions(h);
+          CheckHintRestrictions(h, new HashSet<LocalVariable>());
         }
 
       } else if (stmt is MatchStmt) {
         var s = (MatchStmt)stmt;
         foreach (var kase in s.Cases) {
           foreach (var ss in kase.Body) {
-            CheckHintRestrictions(ss);
+            CheckHintRestrictions(ss, localsAllowedInUpdates);
           }
         }
 
@@ -6742,11 +6815,14 @@ namespace Microsoft.Dafny
       }
     }
 
-    void CheckHintLhs(IToken tok, Expression lhs) {
+    void CheckHintLhs(IToken tok, Expression lhs, ISet<LocalVariable> localsAllowedInUpdates) {
+      Contract.Requires(tok != null);
+      Contract.Requires(lhs != null);
+      Contract.Requires(localsAllowedInUpdates != null);
       var idExpr = lhs as IdentifierExpr;
       if (idExpr == null) {
         reporter.Error(MessageSource.Resolver, tok, "a hint is not allowed to update heap locations");
-      } else if (scope.ContainsDecl(idExpr.Var)) {
+      } else if (!localsAllowedInUpdates.Contains(idExpr.Var)) {
         reporter.Error(MessageSource.Resolver, tok, "a hint is not allowed to update a variable declared outside the hint");
       }
     }
@@ -7768,9 +7844,6 @@ namespace Microsoft.Dafny
             ResolveExpression(rhs, opts);
             ConstrainTypes(rhs.Type, Type.Bool, rhs.tok, "type of RHS of let-such-that expression must be boolean (got {0})", rhs.Type);
           }
-          if (!opts.DontCareAboutCompilation && !e.BoundVars.All(bv => bv.IsGhost)) {
-            needFiniteBoundsChecks_LetSuchThatExpr.Add(e);
-          }
         }
         ResolveExpression(e.Body, opts);
         ResolveAttributes(e.Attributes, new ResolveOpts(opts, true));
@@ -7819,21 +7892,17 @@ namespace Microsoft.Dafny
           List<BoundVar> missingBounds;
           e.Bounds = DiscoverBestBounds_MultipleVars(e.BoundVars, e.LogicalBody(), e is ExistsExpr, true, out missingBounds);
           if (missingBounds.Count != 0) {
-            // Report errors here about quantifications that depend on the allocation state.
-            var mb = missingBounds;
-            if (opts.codeContext is Function) {
-              mb = new List<BoundVar>();  // (who cares if we allocate another array; this happens only in the case of a resolution error anyhow)
-              foreach (var bv in missingBounds) {
-                if (bv.Type.IsRefType) {
-                  reporter.Error(MessageSource.Resolver, expr, "a quantifier involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of '{0}'", bv.Name);
-                } else {
-                  mb.Add(bv);
-                }
+            e.MissingBounds = missingBounds;
+          }
+          if (opts.codeContext is Function && e.Bounds != null) {
+            Contract.Assert(e.Bounds.Count == e.BoundVars.Count);
+            for (int i = 0; i < e.Bounds.Count; i++) {
+              var bound = e.Bounds[i] as ComprehensionExpr.RefBoundedPool;
+              if (bound != null) {
+                var bv = e.BoundVars[i];
+                reporter.Error(MessageSource.Resolver, expr, "a quantifier involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of '{0}'", bv.Name);
               }
             }
-            if (mb.Count != 0) {
-              e.MissingBounds = mb;
-            }
           }
         }
 
@@ -7855,12 +7924,6 @@ namespace Microsoft.Dafny
         scope.PopMarker();
         expr.Type = new SetType(e.Finite, e.Term.Type);
 
-        if (opts.DontCareAboutCompilation && (e.Term.Type.IsRefType || e.Term.Type.IsBoolType) || e.Term.Type.IsCharType) {
-          // ok, term type is finite and we're in a ghost context
-        } else {
-          needFiniteBoundsChecks_SetComprehension.Add(e);
-        }
-
       } else if (expr is MapComprehension) {
         var e = (MapComprehension)expr;
         int prevErrorCount = reporter.Count(ErrorLevel.Error);
@@ -9329,17 +9392,47 @@ namespace Microsoft.Dafny
             CheckIsNonGhost(e.RHSs[0]);
           }
           CheckIsNonGhost(e.Body);
+
+          // fill in bounds for this to-be-compiled let-such-that expression
+          Contract.Assert(e.RHSs.Count == 1);  // if we got this far, the resolver will have checked this condition successfully
+          var constraint = e.RHSs[0];
+          List<IVariable> missingBounds;
+          var vars = new List<IVariable>(e.BoundVars);
+          var bestBounds = DiscoverBestBounds_MultipleVars(vars, constraint, true, false, out missingBounds);
+          if (missingBounds.Count != 0) {
+            e.Constraint_MissingBounds = missingBounds;
+            foreach (var bv in e.Constraint_MissingBounds) {
+              reporter.Error(MessageSource.Resolver, e, "a non-ghost let-such-that constraint must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
+            }
+          } else {
+            e.Constraint_Bounds = bestBounds;
+          }
         }
         return;
-      } else if (expr is QuantifierExpr) {
-        var e = (QuantifierExpr)expr;
-        Contract.Assert(e.SplitQuantifier == null); // No split quantifiers during resolution
-        if (e.MissingBounds != null) {
-          foreach (var bv in e.MissingBounds) {
-            reporter.Error(MessageSource.Resolver, expr, "quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
+      } else if (expr is LambdaExpr) {
+        var e = expr as LambdaExpr;
+        CheckIsNonGhost(e.Body);
+        return;
+      } else if (expr is ComprehensionExpr) {
+        var e = (ComprehensionExpr)expr;
+        var uncompilableBoundVars = e.UncompilableBoundVars();
+        if (uncompilableBoundVars.Count != 0) {
+          string what;
+          if (e is SetComprehension) {
+            what = "set comprehensions";
+          } else if (e is MapComprehension) {
+            what = "map comprehensions";
+          } else {
+            Contract.Assume(e is QuantifierExpr);  // otherwise, unexpected ComprehensionExpr (since LambdaExpr is handled separately above)
+            Contract.Assert(((QuantifierExpr)e).SplitQuantifier == null); // No split quantifiers during resolution
+            what = "quantifiers";
+          }
+          foreach (var bv in uncompilableBoundVars) {
+            reporter.Error(MessageSource.Resolver, expr, "{0} in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for '{1}'", what, bv.Name);
           }
           return;
         }
+
       } else if (expr is MapComprehension) {
         var e = (MapComprehension)expr;
         if (e.MissingBounds != null && !e.Finite) {
@@ -9358,10 +9451,6 @@ namespace Microsoft.Dafny
         var e = (ChainingExpression)expr;
         e.Operands.ForEach(CheckIsNonGhost);
         return;
-      } else if (expr is LambdaExpr) {
-        var e = expr as LambdaExpr;
-        CheckIsNonGhost(e.Body);
-        return;
       }
 
       foreach (var ee in expr.SubExpressions) {
@@ -9520,8 +9609,11 @@ namespace Microsoft.Dafny
 
       // Maybe the type itself gives a bound
       if (bv.Type.IsBoolType) {
-        // easy
         bounds.Add(new ComprehensionExpr.BoolBoundedPool());
+      } else if (bv.Type.IsCharType) {
+        bounds.Add(new ComprehensionExpr.CharBoundedPool());
+      } else if (bv.Type.IsRefType) {
+        bounds.Add(new ComprehensionExpr.RefBoundedPool(bv.Type));
       } else if (bv.Type.IsIndDatatype && bv.Type.AsIndDatatype.HasFinitePossibleValues) {
         bounds.Add(new ComprehensionExpr.DatatypeBoundedPool(bv.Type.AsIndDatatype));
       } else if (bv.Type.IsNumericBased(Type.NumericPersuation.Int)) {
diff --git a/Test/dafny0/AssumptionVariables0.dfy.expect b/Test/dafny0/AssumptionVariables0.dfy.expect
index 16572961..83eb8a73 100644
--- a/Test/dafny0/AssumptionVariables0.dfy.expect
+++ b/Test/dafny0/AssumptionVariables0.dfy.expect
@@ -1,13 +1,13 @@
 AssumptionVariables0.dfy(6,29): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a0 && <boolean expression>"
 AssumptionVariables0.dfy(7,33): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a2 && <boolean expression>"
-AssumptionVariables0.dfy(9,2): Error: assumption variable must be of type 'bool'
+AssumptionVariables0.dfy(9,26): Error: assumption variable must be of type 'bool'
 AssumptionVariables0.dfy(15,5): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a3 && <boolean expression>"
 AssumptionVariables0.dfy(17,5): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a3 && <boolean expression>"
 AssumptionVariables0.dfy(27,5): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a0 && <boolean expression>"
 AssumptionVariables0.dfy(31,5): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a0 && <boolean expression>"
 AssumptionVariables0.dfy(53,9): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a0 && <boolean expression>"
 AssumptionVariables0.dfy(61,37): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a0 && <boolean expression>"
-AssumptionVariables0.dfy(61,10): Error: assumption variable must be of type 'bool'
+AssumptionVariables0.dfy(61,34): Error: assumption variable must be of type 'bool'
 AssumptionVariables0.dfy(69,15): Error: there may be at most one assignment to an assumption variable, the RHS of which must match the expression "a0 && <boolean expression>"
 AssumptionVariables0.dfy(78,20): Error: assumption variable must be ghost
 12 resolution/type errors detected in AssumptionVariables0.dfy
diff --git a/Test/dafny0/CallStmtTests.dfy b/Test/dafny0/CallStmtTests.dfy
index 67e66b34..46c466ff 100644
--- a/Test/dafny0/CallStmtTests.dfy
+++ b/Test/dafny0/CallStmtTests.dfy
@@ -1,23 +1,27 @@
 // RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
-method testing1(t: int)
-{
-   t := m(); // error: should be checked at the Dafny level, not fall to Boogie.
-}
+module M0 {
+  method testing1(t: int)
+ {
+    t := m(); // error: should be checked at the Dafny level, not fall to Boogie.
+  }
 
-method m() returns (r: int)
-{
-   return 3;
+  method m() returns (r: int)
+  {
+    return 3;
+  }
 }
 
-method testing2()
-{
-   var v;
-   v := m2(); // error: v needs to be ghost because r is.
-}
+module M1 {
+  method testing2()
+  {
+    var v;
+    v := m2(); // error: v needs to be ghost because r is.
+  }
 
-method m2() returns (ghost r: int)
-{
-   r := 23;
+  method m2() returns (ghost r: int)
+  {
+    r := 23;
+  }
 }
diff --git a/Test/dafny0/CallStmtTests.dfy.expect b/Test/dafny0/CallStmtTests.dfy.expect
index 8a334754..246b89f8 100644
--- a/Test/dafny0/CallStmtTests.dfy.expect
+++ b/Test/dafny0/CallStmtTests.dfy.expect
@@ -1,3 +1,3 @@
-CallStmtTests.dfy(6,3): Error: LHS of assignment must denote a mutable variable
-CallStmtTests.dfy(17,10): Error: actual out-parameter 0 is required to be a ghost variable
+CallStmtTests.dfy(7,4): Error: LHS of assignment must denote a mutable variable
+CallStmtTests.dfy(20,11): Error: actual out-parameter 0 is required to be a ghost variable
 2 resolution/type errors detected in CallStmtTests.dfy
diff --git a/Test/dafny0/DiscoverBounds.dfy.expect b/Test/dafny0/DiscoverBounds.dfy.expect
index ee816683..34003053 100644
--- a/Test/dafny0/DiscoverBounds.dfy.expect
+++ b/Test/dafny0/DiscoverBounds.dfy.expect
@@ -1,4 +1,4 @@
-DiscoverBounds.dfy(36,7): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'o''
-DiscoverBounds.dfy(39,7): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'r'
-DiscoverBounds.dfy(40,7): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'r''
+DiscoverBounds.dfy(36,7): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'o''
+DiscoverBounds.dfy(39,7): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'r'
+DiscoverBounds.dfy(40,7): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'r''
 3 resolution/type errors detected in DiscoverBounds.dfy
diff --git a/Test/dafny0/NonGhostQuantifiers.dfy b/Test/dafny0/NonGhostQuantifiers.dfy
index bff1d65b..e522d0fc 100644
--- a/Test/dafny0/NonGhostQuantifiers.dfy
+++ b/Test/dafny0/NonGhostQuantifiers.dfy
@@ -181,6 +181,12 @@ module DependencyOnAllAllocatedObjects {
     forall c: SomeClass :: true  // error: not allowed to dependend on which objects are allocated
   }
 
+  class SomeClass {
+    var f: int;
+  }
+}
+
+module DependencyOnAllAllocatedObjects_More {
   method M()
   {
     var b := forall c: SomeClass :: c != null ==> c.f == 0;  // error: non-ghost code requires bounds
@@ -192,3 +198,4 @@ module DependencyOnAllAllocatedObjects {
     var f: int;
   }
 }
+
diff --git a/Test/dafny0/NonGhostQuantifiers.dfy.expect b/Test/dafny0/NonGhostQuantifiers.dfy.expect
index 1e2fce17..6b737add 100644
--- a/Test/dafny0/NonGhostQuantifiers.dfy.expect
+++ b/Test/dafny0/NonGhostQuantifiers.dfy.expect
@@ -6,16 +6,16 @@ NonGhostQuantifiers.dfy(167,4): Error: a quantifier involved in a function defin
 NonGhostQuantifiers.dfy(171,4): Error: a quantifier involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of 'c'
 NonGhostQuantifiers.dfy(176,4): Error: a quantifier involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of 'c'
 NonGhostQuantifiers.dfy(181,4): Error: a quantifier involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of 'c'
-NonGhostQuantifiers.dfy(186,13): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'c'
-NonGhostQuantifiers.dfy(16,5): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'n'
-NonGhostQuantifiers.dfy(45,4): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'n'
-NonGhostQuantifiers.dfy(49,4): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'd'
-NonGhostQuantifiers.dfy(53,4): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'n'
-NonGhostQuantifiers.dfy(77,5): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'i'
-NonGhostQuantifiers.dfy(81,5): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'j'
-NonGhostQuantifiers.dfy(91,5): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'j'
-NonGhostQuantifiers.dfy(106,5): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'j'
-NonGhostQuantifiers.dfy(114,10): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'y'
-NonGhostQuantifiers.dfy(123,8): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'x'
+NonGhostQuantifiers.dfy(192,13): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'c'
+NonGhostQuantifiers.dfy(16,5): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'n'
+NonGhostQuantifiers.dfy(45,4): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'n'
+NonGhostQuantifiers.dfy(49,4): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'd'
+NonGhostQuantifiers.dfy(53,4): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'n'
+NonGhostQuantifiers.dfy(77,5): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'i'
+NonGhostQuantifiers.dfy(81,5): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'j'
+NonGhostQuantifiers.dfy(91,5): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'j'
+NonGhostQuantifiers.dfy(106,5): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'j'
+NonGhostQuantifiers.dfy(114,10): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'y'
+NonGhostQuantifiers.dfy(123,8): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'x'
 NonGhostQuantifiers.dfy(140,8): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
 20 resolution/type errors detected in NonGhostQuantifiers.dfy
diff --git a/Test/dafny0/ParallelResolveErrors.dfy b/Test/dafny0/ParallelResolveErrors.dfy
index 61956651..8c48487d 100644
--- a/Test/dafny0/ParallelResolveErrors.dfy
+++ b/Test/dafny0/ParallelResolveErrors.dfy
@@ -7,7 +7,6 @@ class C {
   ghost method Init_ModifyNothing() { }
   ghost method Init_ModifyThis() modifies this;
   {
-    data := 6;  // error: assignment to a non-ghost field
     gdata := 7;
   }
   ghost method Init_ModifyStuff(c: C) modifies this, c; { }
@@ -120,3 +119,15 @@ method M3(c: C)
     c.GhostMethodWithModifies(x);  // error: not allowed to call method with nonempty modifies clause
   }
 }
+
+module AnotherModule {
+  class C {
+    var data: int;
+    ghost var gdata: int;
+    ghost method Init_ModifyThis() modifies this;
+    {
+      data := 6;  // error: assignment to a non-ghost field
+      gdata := 7;
+    }
+  }
+}
diff --git a/Test/dafny0/ParallelResolveErrors.dfy.expect b/Test/dafny0/ParallelResolveErrors.dfy.expect
index 00030994..4d25ba11 100644
--- a/Test/dafny0/ParallelResolveErrors.dfy.expect
+++ b/Test/dafny0/ParallelResolveErrors.dfy.expect
@@ -1,23 +1,23 @@
-ParallelResolveErrors.dfy(10,9): Error: Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
-ParallelResolveErrors.dfy(21,4): Error: LHS of assignment must denote a mutable variable
-ParallelResolveErrors.dfy(26,6): Error: body of forall statement is attempting to update a variable declared outside the forall statement
+ParallelResolveErrors.dfy(129,11): Error: Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ParallelResolveErrors.dfy(20,4): Error: LHS of assignment must denote a mutable variable
+ParallelResolveErrors.dfy(25,6): Error: body of forall statement is attempting to update a variable declared outside the forall statement
+ParallelResolveErrors.dfy(42,6): Error: body of forall statement is attempting to update a variable declared outside the forall statement
 ParallelResolveErrors.dfy(43,6): Error: body of forall statement is attempting to update a variable declared outside the forall statement
-ParallelResolveErrors.dfy(44,6): Error: body of forall statement is attempting to update a variable declared outside the forall statement
-ParallelResolveErrors.dfy(56,13): Error: new allocation not supported in forall statements
+ParallelResolveErrors.dfy(55,13): Error: new allocation not supported in forall statements
+ParallelResolveErrors.dfy(60,13): Error: new allocation not allowed in ghost context
 ParallelResolveErrors.dfy(61,13): Error: new allocation not allowed in ghost context
 ParallelResolveErrors.dfy(62,13): Error: new allocation not allowed in ghost context
 ParallelResolveErrors.dfy(63,13): Error: new allocation not allowed in ghost context
-ParallelResolveErrors.dfy(64,13): Error: new allocation not allowed in ghost context
-ParallelResolveErrors.dfy(65,22): Error: the body of the enclosing forall statement is not allowed to update heap locations, so any call must be to a method with an empty modifies clause
-ParallelResolveErrors.dfy(66,20): Error: the body of the enclosing forall statement is not allowed to call non-ghost methods
-ParallelResolveErrors.dfy(73,19): Error: trying to break out of more loop levels than there are enclosing loops
-ParallelResolveErrors.dfy(77,18): Error: return statement is not allowed inside a forall statement
-ParallelResolveErrors.dfy(84,21): Error: trying to break out of more loop levels than there are enclosing loops
-ParallelResolveErrors.dfy(85,20): Error: trying to break out of more loop levels than there are enclosing loops
-ParallelResolveErrors.dfy(86,20): Error: break label is undefined or not in scope: OutsideLoop
-ParallelResolveErrors.dfy(95,24): Error: trying to break out of more loop levels than there are enclosing loops
-ParallelResolveErrors.dfy(96,24): Error: break label is undefined or not in scope: OutsideLoop
-ParallelResolveErrors.dfy(107,9): Error: the body of the enclosing forall statement is not allowed to update heap locations
-ParallelResolveErrors.dfy(115,29): Error: the body of the enclosing forall statement is not allowed to update heap locations, so any call must be to a method with an empty modifies clause
-ParallelResolveErrors.dfy(120,29): Error: the body of the enclosing forall statement is not allowed to update heap locations, so any call must be to a method with an empty modifies clause
+ParallelResolveErrors.dfy(64,22): Error: the body of the enclosing forall statement is not allowed to update heap locations, so any call must be to a method with an empty modifies clause
+ParallelResolveErrors.dfy(65,20): Error: the body of the enclosing forall statement is not allowed to call non-ghost methods
+ParallelResolveErrors.dfy(72,19): Error: trying to break out of more loop levels than there are enclosing loops
+ParallelResolveErrors.dfy(76,18): Error: return statement is not allowed inside a forall statement
+ParallelResolveErrors.dfy(83,21): Error: trying to break out of more loop levels than there are enclosing loops
+ParallelResolveErrors.dfy(84,20): Error: trying to break out of more loop levels than there are enclosing loops
+ParallelResolveErrors.dfy(85,20): Error: break label is undefined or not in scope: OutsideLoop
+ParallelResolveErrors.dfy(94,24): Error: trying to break out of more loop levels than there are enclosing loops
+ParallelResolveErrors.dfy(95,24): Error: break label is undefined or not in scope: OutsideLoop
+ParallelResolveErrors.dfy(106,9): Error: the body of the enclosing forall statement is not allowed to update heap locations
+ParallelResolveErrors.dfy(114,29): Error: the body of the enclosing forall statement is not allowed to update heap locations, so any call must be to a method with an empty modifies clause
+ParallelResolveErrors.dfy(119,29): Error: the body of the enclosing forall statement is not allowed to update heap locations, so any call must be to a method with an empty modifies clause
 22 resolution/type errors detected in ParallelResolveErrors.dfy
diff --git a/Test/dafny0/ResolutionErrors.dfy b/Test/dafny0/ResolutionErrors.dfy
index 2fab6bf3..d3514b2b 100644
--- a/Test/dafny0/ResolutionErrors.dfy
+++ b/Test/dafny0/ResolutionErrors.dfy
@@ -102,7 +102,7 @@ class EE {
 }
 
 // --------------- ghost tests -------------------------------------
-
+module HereAreMoreGhostTests {
 datatype GhostDt =
   Nil(ghost extraInfo: int) |
   Cons(data: int, tail: GhostDt, ghost moreInfo: int)
@@ -154,7 +154,7 @@ class GhostTests {
     ensures false;
   {
     while (true)
-      decreases *;  // error:  not allowed in ghost context
+//KRML-confirmed      decreases *;  // error:  not allowed in ghost context
     {
     }
   }
@@ -228,7 +228,7 @@ class GhostTests {
           if (p == 67) {
             break break;  // fine, since this is not a ghost context
           } else if (*) {
-            break break break;  // error: tries to break out of more loop levels than there are
+//KRML-confirmed            break break break;  // error: tries to break out of more loop levels than there are
           }
           q := q + 1;
         }
@@ -238,7 +238,7 @@ class GhostTests {
       p := p + 1;
     }
   }
-method BreakMayNotBeFineHere_Ghost(ghost t: int)
+  method BreakMayNotBeFineHere_Ghost(ghost t: int)
   {
     var n := 0;
     ghost var k := 0;
@@ -297,7 +297,7 @@ method BreakMayNotBeFineHere_Ghost(ghost t: int)
     }
   }
 }
-
+} //HereAreMoreGhostTests
 method DuplicateLabels(n: int) {
   var x;
   if (n < 7) {
@@ -364,17 +364,17 @@ method DatatypeDestructors(d: DTD_List) {
   }
 }
 method DatatypeDestructors_Ghost(d: DTD_List) {
-  var g1 := d.g;  // error: cannot use ghost member in non-ghost code
+  var g1 := d.g;  // error: cannot use ghost member in non-ghost code//KRML-confirmed
 }
 
 // ------------------- print statements ---------------------------------------
-
+module GhostPrintAttempts {
 method PrintOnlyNonGhosts(a: int, ghost b: int)
 {
   print "a: ", a, "\n";
   print "b: ", b, "\n";  // error: print statement cannot take ghosts
 }
-
+}
 // ------------------- auto-added type arguments ------------------------------
 
 class GenericClass<T> { var data: T; }
@@ -439,11 +439,11 @@ method TestCalc_Ghost(m: int, n: int, a: bool, b: bool)
 {
   calc {
     n + m;
-    { print n + m; } // error: non-ghost statements are not allowed in hints
+    { print n + m; } // error: non-ghost statements are not allowed in hints//KRML-confirmed
     m + n;
   }
 }
-
+module MyOwnModule {
 class SideEffectChecks {
   ghost var ycalc: int;
 
@@ -461,11 +461,11 @@ class SideEffectChecks {
     var x: int;
     calc {
       0;
-      { Mod(0); }     // methods with side-effects are not allowed
+      { Mod(0); }     // error: methods with side-effects are not allowed
       ycalc;
-      { ycalc := 1; } // heap updates are not allowed
+      { ycalc := 1; } // error: heap updates are not allowed
       1;
-      { x := 1; }     // updates to locals defined outside of the hint are not allowed
+      { x := 1; }     // error: updates to locals defined outside of the hint are not allowed
       x;
       {
         var x: int;
@@ -475,7 +475,7 @@ class SideEffectChecks {
     }
   }
 }
-
+}
 // ------------------- nameless constructors ------------------------------
 
 class YHWH {
@@ -523,13 +523,13 @@ method AssignSuchThatFromGhost()
   var x: int;
   ghost var g: int;
 
-  x := g;  // error: ghost cannot flow into non-ghost
+  x := g;  // error: ghost cannot flow into non-ghost//KRML-confirmed
 
   x := *;
   assume x == g;  // this mix of ghosts and non-ghosts is cool (but, of course,
                   // the compiler will complain)
 
-  x :| x == g;  // error: left-side has non-ghost, so RHS must be non-ghost as well
+  x :| x == g;  // error: left-side has non-ghost, so RHS must be non-ghost as well//KRML-confirmed
 
   x :| assume x == g;  // this is cool, since it's an assume (but, of course, the
                        // compiler will complain)
@@ -605,7 +605,7 @@ method LetSuchThat(ghost z: int, n: nat)
 }
 method LetSuchThat_Ghost(ghost z: int, n: nat)
 {
-  var x := var y :| y < z; y;  // error: contraint depend on ghost (z)
+  var x := var y :| y < z; y;  // error: contraint depend on ghost (z)//KRML-confirmed
 }
 
 // ------------ quantified variables whose types are not inferred ----------
@@ -677,9 +677,9 @@ module GhostAllocationTests {
       5;
       { var y := new G; }  // error: 'new' not allowed in ghost contexts
       2 + 3;
-      { if n != 0 { GhostNew4(n-1); } }  // error: cannot call non-ghost method in a ghost context
+      { if n != 0 { GhostNew4(n-1); } }  // error: cannot call non-ghost method in a ghost context//KRML-confirmed
       1 + 4;
-      { GhostNew5(g); }  // error: cannot call method with nonempty modifies
+      { GhostNew5(g); }  // error: cannot call method with nonempty modifies//KRML-confirmed
       -5 + 10;
     }
   }
@@ -735,7 +735,7 @@ module StatementsInExpressions {
     {
       calc {
         5;
-        { SideEffect(); }  // error: cannot call method with side effects
+        { SideEffect(); }  // error: cannot call method with side effects//KRML
         5;
       }
     }
@@ -745,7 +745,7 @@ module StatementsInExpressions {
       calc {
         6;
         { assert 6 < 8; }
-        { NonGhostMethod(); }  // error: cannot call non-ghost method
+        { NonGhostMethod(); }  // error: cannot call non-ghost method//KRML-confirmed
         { var x := 8;
           while x != 0
             decreases *;  // error: cannot use 'decreases *' in a ghost context
@@ -759,12 +759,12 @@ module StatementsInExpressions {
             x := x - 1;
           }
         }
-        { MyField := 12; }  // error: cannot assign to a field
-        { MyGhostField := 12; }  // error: cannot assign to any field
-        { SideEffect(); }  // error: cannot call (ghost) method with a modifies clause
+        { MyField := 12; }  // error: cannot assign to a field//KRML-confirmed
+        { MyGhostField := 12; }  // error: cannot assign to any field//KRML-confirmed
+        { SideEffect(); }  // error: cannot call (ghost) method with a modifies clause//KRML-confirmed
         { var x := 8;
           while x != 0
-            modifies this;  // error: cannot use a modifies clause on a loop
+            modifies this;  // error: cannot use a modifies clause on a loop//KRML-confirmed
           {
             x := x - 1;
           }
@@ -783,7 +783,7 @@ module StatementsInExpressions {
       calc {
         6;
         { assert 6 < 8; }
-        { NonGhostMethod(); }  // error: cannot call non-ghost method
+        { NonGhostMethod(); }  // error: cannot call non-ghost method//KRML-confirmed
         { var x := 8;
           while x != 0
             decreases *;  // error: cannot use 'decreases *' in a ghost context
@@ -791,12 +791,12 @@ module StatementsInExpressions {
             x := x - 1;
           }
         }
-        { MyField := 12; }  // error: cannot assign to a field
-        { MyGhostField := 12; }  // error: cannot assign to any field
-        { M(); }  // error: cannot call (ghost) method with a modifies clause
+        { MyField := 12; }  // error: cannot assign to a field//KRML-confirmed
+        { MyGhostField := 12; }  // error: cannot assign to any field//KRML-confirmed
+        { M(); }  // error: cannot call (ghost) method with a modifies clause//KRML-confirmed
         { var x := 8;
           while x != 0
-            modifies this;  // error: cannot use a modifies clause on a loop
+            modifies this;  // error: cannot use a modifies clause on a loop//KRML-confirmed
           {
             x := x - 1;
           }
@@ -822,7 +822,7 @@ module StatementsInExpressions {
     {
       MyLemma();
       MyGhostMethod();   // error: modifi2es state
-      OrdinaryMethod();  // error: not a ghost
+      OrdinaryMethod();  // error: not a ghost//KRML-confirmed
       OutParamMethod();  // error: has out-parameters
       10
     }
@@ -1446,3 +1446,219 @@ module SuchThat {
     w
   }
 }
+
+// ---------------------- NEW STUFF ----------------------------------------
+
+module GhostTests {
+  class G { }
+  
+  method GhostNew4(n: nat)
+  {
+    var g := new G;
+    calc {
+      5;
+      2 + 3;
+      { if n != 0 { GhostNew4(n-1); } }  // error: cannot call non-ghost method in a ghost context//ADD:680
+      1 + 4;
+      { GhostNew5(g); }  // error: cannot call method with nonempty modifies//ADD:682
+      -5 + 10;
+    }
+  }
+
+  ghost method GhostNew5(g: G)
+    modifies g;
+  {
+  }
+  
+  class MyClass {
+    ghost method SideEffect()
+      modifies this;
+    {
+    }
+
+    method NonGhostMethod()
+    {
+    }
+
+    ghost method M()
+      modifies this;
+    {
+      calc {
+        5;
+        { SideEffect(); }  // error: cannot call method with side effects//ADD:738
+        5;
+      }
+    }
+    function F(): int
+    {
+      calc {
+        6;
+        { assert 6 < 8; }
+        { NonGhostMethod(); }  // error: cannot call non-ghost method//ADD:748
+        { var x := 8;
+          while x != 0
+          {
+            x := x - 1;
+          }
+        }
+        { var x := 8;
+          while x != 0
+          {
+            x := x - 1;
+          }
+        }
+        { MyField := 12; }  // error: cannot assign to a field, and especially not a non-ghost field//ADD:762
+        { MyGhostField := 12; }  // error: cannot assign to any field//ADD:763
+        { SideEffect(); }  // error: cannot call (ghost) method with a modifies clause//ADD:764
+        { var x := 8;
+          while x != 0
+            modifies this;  // error: cannot use a modifies clause on a loop//ADD:767
+          {
+            x := x - 1;
+          }
+        }
+        6;
+      }
+      5
+    }
+    var MyField: int;
+    ghost var MyGhostField: int;
+    method N()
+    {
+      var y :=
+      calc {
+        6;
+        { assert 6 < 8; }
+        { NonGhostMethod(); }  // error: cannot call non-ghost method//ADD:786
+        { var x := 8;
+          while x != 0
+          {
+            x := x - 1;
+          }
+        }
+        { MyField := 12; }  // error: cannot assign to a field, and especially not a non-ghost field//ADD:794
+        { MyGhostField := 12; }  // error: cannot assign to any field//ADD:795
+        { M(); }  // error: cannot call (ghost) method with a modifies clause//ADD:796
+        { var x := 8;
+          while x != 0
+            modifies this;  // error: cannot use a modifies clause on a loop//ADD:799
+          {
+            x := x - 1;
+          }
+        }
+        { var x := 8;
+          while x != 0
+          {
+            x := x - 1;
+          }
+        }
+        6;
+      }
+      5;
+    }
+    ghost method MyLemma()
+    ghost method MyGhostMethod()
+      modifies this;
+    method OrdinaryMethod()
+    ghost method OutParamMethod() returns (y: int)
+
+    function UseLemma(): int
+    {
+      MyLemma();
+      OrdinaryMethod();  // error: not a ghost//ADD:825
+      10
+    }
+  }
+}
+
+module EvenMoreGhostTests {
+  ghost method NiceTry()
+    ensures false;
+  {
+    while (true)
+      decreases *;  // error:  not allowed in ghost context//ADD:157
+    {
+    }
+  }
+  method BreakMayNotBeFineHere()
+  {
+    var n := 0;
+    var p := 0;
+    while (true)
+    {
+      var dontKnow;
+      if (n == 112) {
+      } else if (dontKnow == 708) {
+        while * {
+          label IfNest:
+          if (p == 67) {
+            break break;  // fine, since this is not a ghost context
+          } else if (*) {
+            break break break;  // error: tries to break out of more loop levels than there are//ADD:231
+          }
+        }
+      }
+    }
+  }
+  ghost method Bad()
+  {
+    var x: int;
+    calc {
+      1;
+//******      { x := 1; }     // error: updates to locals defined outside of the hint are not allowed
+      x;
+      {
+        var x: int;
+        x := 1;       // this is OK
+      }
+      1;
+    }
+  }
+}
+
+module BadGhostTransfer {
+  datatype DTD_List = DTD_Nil | DTD_Cons(Car: int, Cdr: DTD_List, ghost g: int)
+
+  method DatatypeDestructors_Ghost(d: DTD_List) {
+    var g1 := d.g;  // error: cannot use ghost member in non-ghost code//ADD:367
+  }
+  method AssignSuchThatFromGhost()
+  {
+    var x: int;
+    ghost var g: int;
+
+    x := g;  // error: ghost cannot flow into non-ghost//ADD:526
+
+    x := *;
+    assume x == g;  // this mix of ghosts and non-ghosts is cool (but, of course,
+                    // the compiler will complain)
+
+    x :| x == g;  // error: left-side has non-ghost, so RHS must be non-ghost as well//ADD:532
+
+    x :| assume x == g;  // this is cool, since it's an assume (but, of course, the
+                         // compiler will complain)
+
+    x :| x == 5;
+    g :| g <= g;
+    g :| assume g < g;  // the compiler will complain here, despite the LHS being
+                        // ghost -- and rightly so, since an assume is used
+  }
+}
+
+module MoreGhostPrintAttempts {
+  method TestCalc_Ghost(m: int, n: int, a: bool, b: bool)
+  {
+    calc {
+      n + m;
+      { print n + m; } // error: non-ghost statements are not allowed in hints//ADD:442
+      m + n;
+    }
+  }
+}
+
+module MoreLetSuchThatExpr {
+  method LetSuchThat_Ghost(ghost z: int, n: nat)
+  {
+    var x := var y :| y < z; y;  // error: contraint depend on ghost (z)//ADD:608
+  }
+}
diff --git a/Test/dafny0/ResolutionErrors.dfy.expect b/Test/dafny0/ResolutionErrors.dfy.expect
index 0286778b..ee2dd5f7 100644
--- a/Test/dafny0/ResolutionErrors.dfy.expect
+++ b/Test/dafny0/ResolutionErrors.dfy.expect
@@ -1,3 +1,21 @@
+ResolutionErrors.dfy(113,9): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(114,9): Error: function calls are allowed only in specification contexts (consider declaring the function a 'function method')
+ResolutionErrors.dfy(118,11): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(119,10): Error: actual out-parameter 0 is required to be a ghost variable
+ResolutionErrors.dfy(126,15): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(130,23): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(137,4): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(141,21): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(142,35): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(151,10): Error: only ghost methods can be called from this context
+ResolutionErrors.dfy(251,27): Error: ghost-context break statement is not allowed to break out of non-ghost structure
+ResolutionErrors.dfy(274,12): Error: ghost-context break statement is not allowed to break out of non-ghost loop
+ResolutionErrors.dfy(288,12): Error: ghost-context break statement is not allowed to break out of non-ghost loop
+ResolutionErrors.dfy(293,8): Error: return statement is not allowed in this context (because it is guarded by a specification-only expression)
+ResolutionErrors.dfy(375,15): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(464,11): Error: calls to methods with side-effects are not allowed inside a hint
+ResolutionErrors.dfy(466,14): Error: a hint is not allowed to update heap locations
+ResolutionErrors.dfy(468,10): Error: a hint is not allowed to update a variable declared outside the hint
 ResolutionErrors.dfy(558,7): Error: RHS (of type List<A>) not assignable to LHS (of type List<B>)
 ResolutionErrors.dfy(563,7): Error: RHS (of type List<A>) not assignable to LHS (of type List<B>)
 ResolutionErrors.dfy(577,23): Error: type of case bodies do not agree (found Tree<_T1,_T0>, previous types Tree<_T0,_T1>)
@@ -13,26 +31,11 @@ ResolutionErrors.dfy(652,11): Error: the body of the enclosing forall statement
 ResolutionErrors.dfy(652,14): Error: new allocation not allowed in ghost context
 ResolutionErrors.dfy(662,23): Error: 'new' is not allowed in ghost contexts
 ResolutionErrors.dfy(669,15): Error: 'new' is not allowed in ghost contexts
-ResolutionErrors.dfy(669,15): Error: only ghost methods can be called from this context
 ResolutionErrors.dfy(678,17): Error: 'new' is not allowed in ghost contexts
-ResolutionErrors.dfy(680,29): Error: only ghost methods can be called from this context
-ResolutionErrors.dfy(682,17): Error: calls to methods with side-effects are not allowed inside a hint
 ResolutionErrors.dfy(700,21): Error: the type of this variable is underspecified
-ResolutionErrors.dfy(738,20): Error: calls to methods with side-effects are not allowed inside a hint
-ResolutionErrors.dfy(748,24): Error: only ghost methods can be called from this context
 ResolutionErrors.dfy(751,22): Error: 'decreases *' is not allowed on ghost loops
-ResolutionErrors.dfy(762,18): Error: a hint is not allowed to update heap locations
-ResolutionErrors.dfy(763,23): Error: a hint is not allowed to update heap locations
-ResolutionErrors.dfy(764,20): Error: calls to methods with side-effects are not allowed inside a hint
-ResolutionErrors.dfy(767,21): Error: a while statement used inside a hint is not allowed to have a modifies clause
-ResolutionErrors.dfy(786,24): Error: only ghost methods can be called from this context
 ResolutionErrors.dfy(789,22): Error: 'decreases *' is not allowed on ghost loops
-ResolutionErrors.dfy(794,18): Error: a hint is not allowed to update heap locations
-ResolutionErrors.dfy(795,23): Error: a hint is not allowed to update heap locations
-ResolutionErrors.dfy(796,11): Error: calls to methods with side-effects are not allowed inside a hint
-ResolutionErrors.dfy(799,21): Error: a while statement used inside a hint is not allowed to have a modifies clause
 ResolutionErrors.dfy(824,19): Error: calls to methods with side-effects are not allowed inside a statement expression
-ResolutionErrors.dfy(825,20): Error: only ghost methods can be called from this context
 ResolutionErrors.dfy(826,20): Error: wrong number of method result arguments (got 0, expected 1)
 ResolutionErrors.dfy(838,23): Error: function calls are allowed only in specification contexts (consider declaring the function a 'function method')
 ResolutionErrors.dfy(848,4): Error: ghost variables are allowed only in specification contexts
@@ -74,8 +77,8 @@ ResolutionErrors.dfy(1146,6): Error: RHS (of type P<int>) not assignable to LHS
 ResolutionErrors.dfy(1151,13): Error: arguments must have the same type (got P<int> and P<X>)
 ResolutionErrors.dfy(1152,13): Error: arguments must have the same type (got P<bool> and P<X>)
 ResolutionErrors.dfy(1153,13): Error: arguments must have the same type (got P<int> and P<bool>)
-ResolutionErrors.dfy(1176,38): Error: a set comprehension must produce a finite set, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'o'
-ResolutionErrors.dfy(1178,24): Error: a set comprehension must produce a finite set, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'o'
+ResolutionErrors.dfy(1176,38): Error: set comprehensions in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'o'
+ResolutionErrors.dfy(1178,24): Error: set comprehensions in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'o'
 ResolutionErrors.dfy(1283,26): Error: the type of this variable is underspecified
 ResolutionErrors.dfy(1284,31): Error: the type of this variable is underspecified
 ResolutionErrors.dfy(1285,29): Error: the type of this variable is underspecified
@@ -106,6 +109,29 @@ ResolutionErrors.dfy(1440,11): Error: type of RHS of assign-such-that statement
 ResolutionErrors.dfy(1441,9): Error: type of RHS of assign-such-that statement must be boolean (got int)
 ResolutionErrors.dfy(1442,13): Error: type of RHS of assign-such-that statement must be boolean (got int)
 ResolutionErrors.dfy(1445,15): Error: type of RHS of let-such-that expression must be boolean (got int)
+ResolutionErrors.dfy(1488,20): Error: calls to methods with side-effects are not allowed inside a hint
+ResolutionErrors.dfy(1510,18): Error: a hint is not allowed to update heap locations
+ResolutionErrors.dfy(1511,23): Error: a hint is not allowed to update heap locations
+ResolutionErrors.dfy(1512,20): Error: calls to methods with side-effects are not allowed inside a hint
+ResolutionErrors.dfy(1515,21): Error: a while statement used inside a hint is not allowed to have a modifies clause
+ResolutionErrors.dfy(1497,24): Error: only ghost methods can be called from this context
+ResolutionErrors.dfy(1510,18): Error: Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ResolutionErrors.dfy(1539,18): Error: a hint is not allowed to update heap locations
+ResolutionErrors.dfy(1540,23): Error: a hint is not allowed to update heap locations
+ResolutionErrors.dfy(1541,11): Error: calls to methods with side-effects are not allowed inside a hint
+ResolutionErrors.dfy(1544,21): Error: a while statement used inside a hint is not allowed to have a modifies clause
+ResolutionErrors.dfy(1532,24): Error: only ghost methods can be called from this context
+ResolutionErrors.dfy(1539,18): Error: Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ResolutionErrors.dfy(1568,20): Error: only ghost methods can be called from this context
+ResolutionErrors.dfy(1461,29): Error: only ghost methods can be called from this context
+ResolutionErrors.dfy(1463,17): Error: calls to methods with side-effects are not allowed inside a hint
+ResolutionErrors.dfy(1579,16): Error: 'decreases *' is not allowed on ghost loops
+ResolutionErrors.dfy(1597,12): Error: trying to break out of more loop levels than there are enclosing loops
+ResolutionErrors.dfy(1623,16): Error: ghost fields are allowed only in specification contexts
+ResolutionErrors.dfy(1630,9): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(1636,4): Error: non-ghost variable cannot be assigned a value that depends on a ghost
+ResolutionErrors.dfy(1653,8): Error: print statement is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ResolutionErrors.dfy(1662,26): Error: ghost variables are allowed only in specification contexts
 ResolutionErrors.dfy(488,2): Error: More than one anonymous constructor
 ResolutionErrors.dfy(50,13): Error: 'this' is not allowed in a 'static' context
 ResolutionErrors.dfy(87,14): Error: the name 'Benny' denotes a datatype constructor, but does not do so uniquely; add an explicit qualification (for example, 'Abc.Benny')
@@ -113,25 +139,6 @@ ResolutionErrors.dfy(92,14): Error: the name 'David' denotes a datatype construc
 ResolutionErrors.dfy(93,14): Error: the name 'David' denotes a datatype constructor, but does not do so uniquely; add an explicit qualification (for example, 'Abc.David')
 ResolutionErrors.dfy(95,14): Error: the name 'David' denotes a datatype constructor, but does not do so uniquely; add an explicit qualification (for example, 'Abc.David')
 ResolutionErrors.dfy(97,18): Error: wrong number of arguments to datatype constructor David (found 2, expected 1)
-ResolutionErrors.dfy(113,9): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(114,9): Error: function calls are allowed only in specification contexts (consider declaring the function a 'function method')
-ResolutionErrors.dfy(118,11): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(119,10): Error: actual out-parameter 0 is required to be a ghost variable
-ResolutionErrors.dfy(126,15): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(130,23): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(137,4): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(141,21): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(142,35): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(151,10): Error: only ghost methods can be called from this context
-ResolutionErrors.dfy(157,16): Error: 'decreases *' is not allowed on ghost loops
-ResolutionErrors.dfy(231,12): Error: trying to break out of more loop levels than there are enclosing loops
-ResolutionErrors.dfy(251,27): Error: ghost-context break statement is not allowed to break out of non-ghost structure
-ResolutionErrors.dfy(274,12): Error: ghost-context break statement is not allowed to break out of non-ghost loop
-ResolutionErrors.dfy(288,12): Error: ghost-context break statement is not allowed to break out of non-ghost loop
-ResolutionErrors.dfy(293,8): Error: return statement is not allowed in this context (because it is guarded by a specification-only expression)
-ResolutionErrors.dfy(464,11): Error: calls to methods with side-effects are not allowed inside a hint
-ResolutionErrors.dfy(466,14): Error: a hint is not allowed to update heap locations
-ResolutionErrors.dfy(468,10): Error: a hint is not allowed to update a variable declared outside the hint
 ResolutionErrors.dfy(494,14): Error: when allocating an object of type 'YHWH', one of its constructor methods must be called
 ResolutionErrors.dfy(499,6): Error: when allocating an object of type 'Lucifer', one of its constructor methods must be called
 ResolutionErrors.dfy(500,6): Error: when allocating an object of type 'Lucifer', one of its constructor methods must be called
@@ -168,8 +175,6 @@ ResolutionErrors.dfy(345,9): Error: a constructor is allowed to be called only w
 ResolutionErrors.dfy(359,16): Error: arguments must have the same type (got int and DTD_List)
 ResolutionErrors.dfy(360,16): Error: arguments must have the same type (got DTD_List and int)
 ResolutionErrors.dfy(361,25): Error: arguments must have the same type (got bool and int)
-ResolutionErrors.dfy(367,14): Error: ghost fields are allowed only in specification contexts
-ResolutionErrors.dfy(375,15): Error: ghost variables are allowed only in specification contexts
 ResolutionErrors.dfy(400,5): Error: incorrect type of method in-parameter 1 (expected GenericClass<int>, got GenericClass<bool>)
 ResolutionErrors.dfy(412,18): Error: incorrect type of datatype constructor argument (found GList<_T0>, expected GList<int>)
 ResolutionErrors.dfy(420,6): Error: arguments to + must be of a numeric type or a collection type (instead got bool)
@@ -180,11 +185,7 @@ ResolutionErrors.dfy(429,10): Error: first argument to ==> must be of type bool
 ResolutionErrors.dfy(429,10): Error: second argument to ==> must be of type bool (instead got int)
 ResolutionErrors.dfy(434,10): Error: first argument to ==> must be of type bool (instead got int)
 ResolutionErrors.dfy(434,10): Error: second argument to ==> must be of type bool (instead got int)
-ResolutionErrors.dfy(442,6): Error: print statement is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
-ResolutionErrors.dfy(526,7): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(532,2): Error: non-ghost variable cannot be assigned a value that depends on a ghost
 ResolutionErrors.dfy(603,18): Error: unresolved identifier: w
-ResolutionErrors.dfy(608,24): Error: ghost variables are allowed only in specification contexts
 ResolutionErrors.dfy(714,11): Error: lemmas are not allowed to have modifies clauses
 ResolutionErrors.dfy(976,9): Error: unresolved identifier: s
 ResolutionErrors.dfy(987,32): Error: RHS (of type (int,int,real)) not assignable to LHS (of type (int,real,int))
@@ -198,4 +199,4 @@ ResolutionErrors.dfy(1164,8): Error: new cannot be applied to a trait
 ResolutionErrors.dfy(1185,13): Error: first argument to / must be of numeric type (instead got set<bool>)
 ResolutionErrors.dfy(1192,18): Error: a call to a possibly non-terminating method is allowed only if the calling method is also declared (with 'decreases *') to be possibly non-terminating
 ResolutionErrors.dfy(1207,14): Error: a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating
-200 resolution/type errors detected in ResolutionErrors.dfy
+201 resolution/type errors detected in ResolutionErrors.dfy
diff --git a/Test/dafny0/TypeTests.dfy b/Test/dafny0/TypeTests.dfy
index b44f4d68..a9d473f6 100644
--- a/Test/dafny0/TypeTests.dfy
+++ b/Test/dafny0/TypeTests.dfy
@@ -39,7 +39,7 @@ datatype ReverseOrder_TheCounterpart<T> =
 
 // ---------------------
 
-class ArrayTests {
+module ArrayTests {
   ghost method G(a: array<int>)
     requires a != null && 10 <= a.Length;
     modifies a;
@@ -167,31 +167,33 @@ module Expl_Module {
 
 // --------------------- more ghost tests, for assign-such-that statements
 
-method M()
-{
-  ghost var b: bool;
-  ghost var k: int, l: int;
-  var m: int;
-
-  k :| k < 10;
-  k, m :| 0 <= k < m;  // error: LHS has non-ghost and RHS has ghost
-  m :| m < 10;
-
-  // Because of the ghost guard, these 'if' statements are ghost contexts, so only
-  // assignments to ghosts are allowed.
-  if (b) {
-    k :| k < 10;  // should be allowed
-    k, l :| 0 <= k < l;  // ditto
-  }
-  if (b) {
-    m :| m < 10;  // error: not allowed in ghost context
-    k, m :| 0 <= k < m;  // error: not allowed in ghost context
+module MoreGhostTests {
+  method M()
+  {
+    ghost var b: bool;
+    ghost var k: int, l: int;
+    var m: int;
+
+    k :| k < 10;
+    k, m :| 0 <= k < m;  // error: LHS has non-ghost and RHS has ghost
+    m :| m < 10;
+
+    // Because of the ghost guard, these 'if' statements are ghost contexts, so only
+    // assignments to ghosts are allowed.
+    if (b) {
+      k :| k < 10;  // should be allowed
+      k, l :| 0 <= k < l;  // ditto
+    }
+    if (b) {
+      m :| m < 10;  // error: not allowed in ghost context
+      k, m :| 0 <= k < m;  // error: not allowed in ghost context
+    }
   }
-}
 
-ghost method GhostM() returns (x: int)
-{
-  x :| true;  // no problem (but there once was a problem with this case, where an error was generated for no reason)
+  ghost method GhostM() returns (x: int)
+  {
+    x :| true;  // no problem (but there once was a problem with this case, where an error was generated for no reason)
+  }
 }
 
 // ------------------ cycles that could arise from proxy assignments ---------
diff --git a/Test/dafny0/TypeTests.dfy.expect b/Test/dafny0/TypeTests.dfy.expect
index 8206fd43..de0bfbed 100644
--- a/Test/dafny0/TypeTests.dfy.expect
+++ b/Test/dafny0/TypeTests.dfy.expect
@@ -1,6 +1,10 @@
-TypeTests.dfy(205,15): Error: incorrect type of datatype constructor argument (found ? -> ?, expected ? -> Dt<?>)
-TypeTests.dfy(211,15): Error: incorrect type of datatype constructor argument (found ? -> ?, expected ? -> Dt<?>)
-TypeTests.dfy(218,6): Error: RHS (of type set<?>) not assignable to LHS (of type ?)
+TypeTests.dfy(47,9): Error: Assignment to array element is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+TypeTests.dfy(178,7): Error: non-ghost variable cannot be assigned a value that depends on a ghost
+TypeTests.dfy(188,6): Error: cannot assign to non-ghost variable in a ghost context
+TypeTests.dfy(189,9): Error: cannot assign to non-ghost variable in a ghost context
+TypeTests.dfy(207,15): Error: incorrect type of datatype constructor argument (found ? -> ?, expected ? -> Dt<?>)
+TypeTests.dfy(213,15): Error: incorrect type of datatype constructor argument (found ? -> ?, expected ? -> Dt<?>)
+TypeTests.dfy(220,6): Error: RHS (of type set<?>) not assignable to LHS (of type ?)
 TypeTests.dfy(7,17): Error: type mismatch for argument 0 (function expects C, got D)
 TypeTests.dfy(7,20): Error: type mismatch for argument 1 (function expects D, got C)
 TypeTests.dfy(8,15): Error: type mismatch for argument 0 (function expects C, got int)
@@ -8,7 +12,6 @@ TypeTests.dfy(8,18): Error: type mismatch for argument 1 (function expects D, go
 TypeTests.dfy(14,16): Error: incorrect type of method in-parameter 0 (expected int, got bool)
 TypeTests.dfy(15,12): Error: incorrect type of method out-parameter 0 (expected int, got C)
 TypeTests.dfy(15,12): Error: incorrect type of method out-parameter 1 (expected C, got int)
-TypeTests.dfy(47,9): Error: Assignment to array element is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
 TypeTests.dfy(56,6): Error: Duplicate local-variable name: z
 TypeTests.dfy(58,6): Error: Duplicate local-variable name: x
 TypeTests.dfy(61,8): Error: Duplicate local-variable name: x
@@ -56,8 +59,5 @@ TypeTests.dfy(151,13): Error: sorry, cannot instantiate type parameter with a su
 TypeTests.dfy(152,2): Error: sorry, cannot instantiate type parameter with a subrange type
 TypeTests.dfy(153,16): Error: sorry, cannot instantiate type parameter with a subrange type
 TypeTests.dfy(154,14): Error: sorry, cannot instantiate type parameter with a subrange type
-TypeTests.dfy(177,5): Error: non-ghost variable cannot be assigned a value that depends on a ghost
-TypeTests.dfy(187,4): Error: cannot assign to non-ghost variable in a ghost context
-TypeTests.dfy(188,7): Error: cannot assign to non-ghost variable in a ghost context
 TypeTests.dfy(21,9): Error: because of cyclic dependencies among constructor argument types, no instances of datatype 'NeverendingList' can be constructed
 62 resolution/type errors detected in TypeTests.dfy
diff --git a/Test/dafny4/set-compr.dfy.expect b/Test/dafny4/set-compr.dfy.expect
index b31c6ac0..615ee2bc 100644
--- a/Test/dafny4/set-compr.dfy.expect
+++ b/Test/dafny4/set-compr.dfy.expect
@@ -1,3 +1,3 @@
-set-compr.dfy(25,7): Error: a set comprehension must produce a finite set, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'o'
-set-compr.dfy(51,13): Error: a set comprehension must produce a finite set, but Dafny's heuristics can't figure out how to produce a bounded set of values for 'o'
+set-compr.dfy(25,7): Error: set comprehensions in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'o'
+set-compr.dfy(51,13): Error: set comprehensions in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'o'
 2 resolution/type errors detected in set-compr.dfy
-- 
cgit v1.2.3


From 49706a5d1599f9167cb627a305d4abb32cc71edb Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Mon, 28 Sep 2015 15:36:45 -0700
Subject: Removed more traces of the previous resolution checks that happened
 during pass 0. Fixed resolution of specification components of alternative
 loops.

---
 Source/Dafny/Resolver.cs                | 294 ++++++++++++++++----------------
 Test/dafny0/ResolutionErrors.dfy        | 215 +++++++++++++++--------
 Test/dafny0/ResolutionErrors.dfy.expect | 275 ++++++++++++++---------------
 3 files changed, 430 insertions(+), 354 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index ec3a69c9..f4fac31b 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -1368,7 +1368,7 @@ namespace Microsoft.Dafny
             var added = scope.Push(dd.Var.Name, dd.Var);
             Contract.Assert(added == Scope<IVariable>.PushResult.Success);
             ResolveType(dd.Var.tok, dd.Var.Type, dd, ResolveTypeOptionEnum.DontInfer, null);
-            ResolveExpression(dd.Constraint, new ResolveOpts(dd, false, true));
+            ResolveExpression(dd.Constraint, new ResolveOpts(dd, false));
             Contract.Assert(dd.Constraint.Type != null);  // follows from postcondition of ResolveExpression
             ConstrainTypes(dd.Constraint.Type, Type.Bool, dd.Constraint, "newtype constraint must be of type bool (instead got {0})", dd.Constraint.Type);
             SolveAllTypeConstraints();
@@ -3129,6 +3129,12 @@ namespace Microsoft.Dafny
         Contract.Requires(msgArgs != null);
         resolver.reporter.Error(MessageSource.Resolver, expr, msg, msgArgs);
       }
+      protected void Error(IToken tok, string msg, params object[] msgArgs) {
+        Contract.Requires(tok != null);
+        Contract.Requires(msg != null);
+        Contract.Requires(msgArgs != null);
+        resolver.reporter.Error(MessageSource.Resolver, tok, msg, msgArgs);
+      }
       /// <summary>
       /// This method does three things:
       /// 0. Reports an error if "mustBeErasable" and the statement assigns to a non-ghost field
@@ -3219,6 +3225,9 @@ namespace Microsoft.Dafny
           var gk = AssignStmt.LhsIsToGhost_Which(lhs);
           if (gk == AssignStmt.NonGhostKind.IsGhost) {
             s.IsGhost = true;
+            if (s.Rhs is TypeRhs) {
+              Error(s.Rhs.Tok, "'new' is not allowed in ghost contexts");
+            }
           } else if (gk == AssignStmt.NonGhostKind.Variable && codeContext.IsGhost) {
             // cool
           } else if (mustBeErasable) {
@@ -3322,6 +3331,9 @@ namespace Microsoft.Dafny
           if (s.IsGhost && s.Decreases.Expressions.Exists(e => e is WildcardExpr)) {
             Error(s, "'decreases *' is not allowed on ghost loops");
           }
+          if (s.IsGhost && s.Mod.Expressions != null) {
+            s.Mod.Expressions.Iter(resolver.DisallowNonGhostFieldSpecifiers);
+          }
           if (s.Body != null) {
             Visit(s.Body, s.IsGhost);
           }
@@ -3330,6 +3342,12 @@ namespace Microsoft.Dafny
         } else if (stmt is AlternativeLoopStmt) {
           var s = (AlternativeLoopStmt)stmt;
           s.IsGhost = mustBeErasable || s.Alternatives.Exists(alt => resolver.UsesSpecFeatures(alt.Guard));
+          if (s.IsGhost && s.Decreases.Expressions.Exists(e => e is WildcardExpr)) {
+            Error(s, "'decreases *' is not allowed on ghost loops");
+          }
+          if (s.IsGhost && s.Mod.Expressions != null) {
+            s.Mod.Expressions.Iter(resolver.DisallowNonGhostFieldSpecifiers);
+          }
           s.Alternatives.Iter(alt => alt.Body.Iter(ss => Visit(ss, s.IsGhost)));
           s.IsGhost = s.IsGhost || (!s.Decreases.Expressions.Exists(e => e is WildcardExpr) && s.Alternatives.All(alt => alt.Body.All(ss => ss.IsGhost)));
 
@@ -3343,10 +3361,13 @@ namespace Microsoft.Dafny
 
         } else if (stmt is ModifyStmt) {
           var s = (ModifyStmt)stmt;
+          s.IsGhost = mustBeErasable;
+          if (s.IsGhost) {
+            s.Mod.Expressions.Iter(resolver.DisallowNonGhostFieldSpecifiers);
+          }
           if (s.Body != null) {
             Visit(s.Body, mustBeErasable);
           }
-          s.IsGhost = mustBeErasable;
 
         } else if (stmt is CalcStmt) {
           var s = (CalcStmt)stmt;
@@ -3999,7 +4020,6 @@ namespace Microsoft.Dafny
 
     void ResolveAttributes(Attributes attrs, ResolveOpts opts) {
       Contract.Requires(opts != null);
-      Contract.Requires(opts.DontCareAboutCompilation);  // attributes are never compiled
       // order does not matter much for resolution, so resolve them in reverse order
       foreach (var attr in attrs.AsEnumerable()) {
         if (attr.Args != null) {
@@ -4093,23 +4113,23 @@ namespace Microsoft.Dafny
       foreach (Formal p in f.Formals) {
         scope.Push(p.Name, p);
       }
-      ResolveAttributes(f.Attributes, new ResolveOpts(f, false, true));
+      ResolveAttributes(f.Attributes, new ResolveOpts(f, false));
       foreach (Expression r in f.Req) {
-        ResolveExpression(r, new ResolveOpts(f, false, true));
+        ResolveExpression(r, new ResolveOpts(f, false));
         Contract.Assert(r.Type != null);  // follows from postcondition of ResolveExpression
         ConstrainTypes(r.Type, Type.Bool, r, "Precondition must be a boolean (got {0})", r.Type);
       }
       foreach (FrameExpression fr in f.Reads) {
-        ResolveFrameExpression(fr, true, f.IsGhost, f);
+        ResolveFrameExpression(fr, true, f);
       }
       foreach (Expression r in f.Ens) {
-        ResolveExpression(r, new ResolveOpts(f, false, true));  // since this is a function, the postcondition is still a one-state predicate
+        ResolveExpression(r, new ResolveOpts(f, false));  // since this is a function, the postcondition is still a one-state predicate
         Contract.Assert(r.Type != null);  // follows from postcondition of ResolveExpression
         ConstrainTypes(r.Type, Type.Bool, r, "Postcondition must be a boolean (got {0})", r.Type);
       }
-      ResolveAttributes(f.Decreases.Attributes, new ResolveOpts(f, false, true));
+      ResolveAttributes(f.Decreases.Attributes, new ResolveOpts(f, false));
       foreach (Expression r in f.Decreases.Expressions) {
-        ResolveExpression(r, new ResolveOpts(f, false, true));
+        ResolveExpression(r, new ResolveOpts(f, false));
         // any type is fine
       }
       SolveAllTypeConstraints();
@@ -4126,14 +4146,11 @@ namespace Microsoft.Dafny
     /// <summary>
     /// 
     /// </summary>
-    /// <param name="fe"></param>
     /// <param name="readsFrame">True indicates "reads", false indicates "modifies".</param>
-    /// <param name="isGhostContext"></param>
-    /// <param name="codeContext"></param>
-    void ResolveFrameExpression(FrameExpression fe, bool readsFrame, bool isGhostContext, ICodeContext codeContext) {
+    void ResolveFrameExpression(FrameExpression fe, bool readsFrame, ICodeContext codeContext) {
       Contract.Requires(fe != null);
       Contract.Requires(codeContext != null);
-      ResolveExpression(fe.E, new ResolveOpts(codeContext, false, true /* yes, this is ghost */));
+      ResolveExpression(fe.E, new ResolveOpts(codeContext, false));
       Type t = fe.E.Type;
       Contract.Assert(t != null);  // follows from postcondition of ResolveExpression
       var arrTy = t.AsArrowType;
@@ -4153,8 +4170,6 @@ namespace Microsoft.Dafny
           // error has already been reported by ResolveMember
         } else if (!(member is Field)) {
           reporter.Error(MessageSource.Resolver, fe.E, "member {0} in type {1} does not refer to a field", fe.FieldName, ctype.Name);
-        } else if (!readsFrame && isGhostContext && !member.IsGhost) {
-          reporter.Error(MessageSource.Resolver, fe.E, "in a ghost context, only ghost fields can be mentioned as modifies frame targets ({0})", fe.FieldName);
         } else {
           Contract.Assert(ctype != null && ctype.ResolvedClass != null);  // follows from postcondition of ResolveMember
           fe.Field = (Field)member;
@@ -4162,6 +4177,17 @@ namespace Microsoft.Dafny
       }
     }
 
+    /// <summary>
+    /// This method can be called even if the resolution of "fe" failed; in that case, this method will
+    /// not issue any error message.
+    /// </summary>
+    void DisallowNonGhostFieldSpecifiers(FrameExpression fe) {
+      Contract.Requires(fe != null);
+      if (fe.Field != null && !fe.Field.IsGhost) {
+        reporter.Error(MessageSource.Resolver, fe.E, "in a ghost context, only ghost fields can be mentioned as modifies frame targets ({0})", fe.FieldName);
+      }
+    }
+
     /// <summary>
     /// Assumes type parameters have already been pushed
     /// </summary>
@@ -4206,25 +4232,24 @@ namespace Microsoft.Dafny
 
         // Start resolving specification...
         foreach (MaybeFreeExpression e in m.Req) {
-          ResolveAttributes(e.Attributes, new ResolveOpts(m, false, true));
-          ResolveExpression(e.E, new ResolveOpts(m, false, true));
+          ResolveAttributes(e.Attributes, new ResolveOpts(m, false));
+          ResolveExpression(e.E, new ResolveOpts(m, false));
           Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
           ConstrainTypes(e.E.Type, Type.Bool, e.E, "Precondition must be a boolean (got {0})", e.E.Type);
         }
-        ResolveAttributes(m.Mod.Attributes, new ResolveOpts(m, false, true));
+        ResolveAttributes(m.Mod.Attributes, new ResolveOpts(m, false));
         foreach (FrameExpression fe in m.Mod.Expressions) {
-          ResolveFrameExpression(fe, false, m.IsGhost, m);
+          ResolveFrameExpression(fe, false, m);
           if (m is Lemma || m is FixpointLemma) {
             reporter.Error(MessageSource.Resolver, fe.tok, "{0}s are not allowed to have modifies clauses", m.WhatKind);
+          } else if (m.IsGhost) {
+            DisallowNonGhostFieldSpecifiers(fe);
           }
         }
-        ResolveAttributes(m.Decreases.Attributes, new ResolveOpts(m, false, true));
+        ResolveAttributes(m.Decreases.Attributes, new ResolveOpts(m, false));
         foreach (Expression e in m.Decreases.Expressions) {
-          ResolveExpression(e, new ResolveOpts(m, false, true));
+          ResolveExpression(e, new ResolveOpts(m, false));
           // any type is fine
-          if (m.IsGhost && e is WildcardExpr) {
-            reporter.Error(MessageSource.Resolver, e, "'decreases *' is not allowed on ghost methods");
-          }
         }
 
         // Add out-parameters to a new scope that will also include the outermost-level locals of the body
@@ -4240,8 +4265,8 @@ namespace Microsoft.Dafny
 
         // ... continue resolving specification
         foreach (MaybeFreeExpression e in m.Ens) {
-          ResolveAttributes(e.Attributes, new ResolveOpts(m, true, true));
-          ResolveExpression(e.E, new ResolveOpts(m, true, true));
+          ResolveAttributes(e.Attributes, new ResolveOpts(m, true));
+          ResolveExpression(e.E, new ResolveOpts(m, true));
           Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
           ConstrainTypes(e.E.Type, Type.Bool, e.E, "Postcondition must be a boolean (got {0})", e.E.Type);
         }
@@ -4265,7 +4290,7 @@ namespace Microsoft.Dafny
         }
 
         // attributes are allowed to mention both in- and out-parameters (including the implicit _k, for colemmas)
-        ResolveAttributes(m.Attributes, new ResolveOpts(m, false, true));
+        ResolveAttributes(m.Attributes, new ResolveOpts(m, false));
 
         scope.PopMarker();  // for the out-parameters and outermost-level locals
         scope.PopMarker();  // for the in-parameters
@@ -4331,20 +4356,20 @@ namespace Microsoft.Dafny
       Contract.Assert(iter.Decreases.Expressions.Count == iter.DecreasesFields.Count);
       for (int i = 0; i < iter.Decreases.Expressions.Count; i++) {
         var e = iter.Decreases.Expressions[i];
-        ResolveExpression(e, new ResolveOpts(iter, false, true));
+        ResolveExpression(e, new ResolveOpts(iter, false));
         // any type is fine, but associate this type with the corresponding _decreases<n> field
         var d = iter.DecreasesFields[i];
         // If the following type constraint does not hold, then: Bummer, there was a use--and a bad use--of the field before, so this won't be the best of error messages
         ConstrainTypes(d.Type, e.Type, e, "type of field {0} is {1}, but has been constrained elsewhere to be of type {2}", d.Name, e.Type, d.Type);
       }
       foreach (FrameExpression fe in iter.Reads.Expressions) {
-        ResolveFrameExpression(fe, true, false, iter);
+        ResolveFrameExpression(fe, true, iter);
       }
       foreach (FrameExpression fe in iter.Modifies.Expressions) {
-        ResolveFrameExpression(fe, false, false, iter);
+        ResolveFrameExpression(fe, false, iter);
       }
       foreach (MaybeFreeExpression e in iter.Requires) {
-        ResolveExpression(e.E, new ResolveOpts(iter, false, true));
+        ResolveExpression(e.E, new ResolveOpts(iter, false));
         Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
         ConstrainTypes(e.E.Type, Type.Bool, e.E, "Precondition must be a boolean (got {0})", e.E.Type);
       }
@@ -4358,22 +4383,22 @@ namespace Microsoft.Dafny
       Contract.Assert(scope.AllowInstance);
 
       foreach (MaybeFreeExpression e in iter.YieldRequires) {
-        ResolveExpression(e.E, new ResolveOpts(iter, false, true));
+        ResolveExpression(e.E, new ResolveOpts(iter, false));
         Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
         ConstrainTypes(e.E.Type, Type.Bool, e.E, "Yield precondition must be a boolean (got {0})", e.E.Type);
       }
       foreach (MaybeFreeExpression e in iter.YieldEnsures) {
-        ResolveExpression(e.E, new ResolveOpts(iter, true, true));
+        ResolveExpression(e.E, new ResolveOpts(iter, true));
         Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
         ConstrainTypes(e.E.Type, Type.Bool, e.E, "Yield postcondition must be a boolean (got {0})", e.E.Type);
       }
       foreach (MaybeFreeExpression e in iter.Ensures) {
-        ResolveExpression(e.E, new ResolveOpts(iter, true, true));
+        ResolveExpression(e.E, new ResolveOpts(iter, true));
         Contract.Assert(e.E.Type != null);  // follows from postcondition of ResolveExpression
         ConstrainTypes(e.E.Type, Type.Bool, e.E, "Postcondition must be a boolean (got {0})", e.E.Type);
       }
 
-      ResolveAttributes(iter.Attributes, new ResolveOpts(iter, false, true));
+      ResolveAttributes(iter.Attributes, new ResolveOpts(iter, false));
 
       var postSpecErrorCount = reporter.Count(ErrorLevel.Error);
 
@@ -4687,13 +4712,13 @@ namespace Microsoft.Dafny
         }
         var prevErrorCount = reporter.Count(ErrorLevel.Error);
         if (t.NamePath is ExprDotName) {
-          var ret = ResolveDotSuffix_Type((ExprDotName)t.NamePath, new ResolveOpts(context, true, true), allowDanglingDotName, option, defaultTypeArguments);
+          var ret = ResolveDotSuffix_Type((ExprDotName)t.NamePath, new ResolveOpts(context, true), allowDanglingDotName, option, defaultTypeArguments);
           if (ret != null) {
             return ret;
           }
         } else {
           var s = (NameSegment)t.NamePath;
-          ResolveNameSegment_Type(s, new ResolveOpts(context, true, true), option, defaultTypeArguments);
+          ResolveNameSegment_Type(s, new ResolveOpts(context, true), option, defaultTypeArguments);
         }
         if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
           var r = t.NamePath.Resolved as Resolver_IdentifierExpr;
@@ -5225,17 +5250,17 @@ namespace Microsoft.Dafny
       Contract.Requires(stmt != null);
       Contract.Requires(codeContext != null);
       if (!(stmt is ForallStmt)) {  // forall statements do their own attribute resolution below
-        ResolveAttributes(stmt.Attributes, new ResolveOpts(codeContext, true, true));
+        ResolveAttributes(stmt.Attributes, new ResolveOpts(codeContext, true));
       }
       if (stmt is PredicateStmt) {
         PredicateStmt s = (PredicateStmt)stmt;
-        ResolveExpression(s.Expr, new ResolveOpts(codeContext, true, true));
+        ResolveExpression(s.Expr, new ResolveOpts(codeContext, true));
         Contract.Assert(s.Expr.Type != null);  // follows from postcondition of ResolveExpression
         ConstrainTypes(s.Expr.Type, Type.Bool, s.Expr, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Expr.Type);
 
       } else if (stmt is PrintStmt) {
         var s = (PrintStmt)stmt;
-        var opts = new ResolveOpts(codeContext, false, specContextOnly);
+        var opts = new ResolveOpts(codeContext, false);
         s.Args.Iter(e => ResolveExpression(e, opts));
 
       } else if (stmt is BreakStmt) {
@@ -5346,7 +5371,7 @@ namespace Microsoft.Dafny
         }
         // With the new locals in scope, it's now time to resolve the attributes on all the locals
         foreach (var local in s.Locals) {
-          ResolveAttributes(local.Attributes, new ResolveOpts(codeContext, true, true));
+          ResolveAttributes(local.Attributes, new ResolveOpts(codeContext, true));
         }
         // Resolve the AssignSuchThatStmt, if any
         if (s.Update is AssignSuchThatStmt) {
@@ -5374,18 +5399,16 @@ namespace Microsoft.Dafny
       } else if (stmt is AssignStmt) {
         AssignStmt s = (AssignStmt)stmt;
         int prevErrorCount = reporter.Count(ErrorLevel.Error);
-        ResolveExpression(s.Lhs, new ResolveOpts(codeContext, true, specContextOnly));  // allow ghosts for now, tighted up below
+        ResolveExpression(s.Lhs, new ResolveOpts(codeContext, true));  // allow ghosts for now, tighted up below
         bool lhsResolvedSuccessfully = reporter.Count(ErrorLevel.Error) == prevErrorCount;
         Contract.Assert(s.Lhs.Type != null);  // follows from postcondition of ResolveExpression
         // check that LHS denotes a mutable variable or a field
-        bool lvalueIsGhost = false;
         var lhs = s.Lhs.Resolved;
         if (lhs is IdentifierExpr) {
           IVariable var = ((IdentifierExpr)lhs).Var;
           if (var == null) {
             // the LHS didn't resolve correctly; some error would already have been reported
           } else {
-            lvalueIsGhost = var.IsGhost || codeContext.IsGhost;
             CheckIsLvalue(lhs, codeContext);
 
             var localVar = var as LocalVariable;
@@ -5411,7 +5434,6 @@ namespace Microsoft.Dafny
         } else if (lhs is MemberSelectExpr) {
           var fse = (MemberSelectExpr)lhs;
           if (fse.Member != null) {  // otherwise, an error was reported above
-            lvalueIsGhost = fse.Member.IsGhost;
             CheckIsLvalue(fse, codeContext);
           }
         } else if (lhs is SeqSelectExpr) {
@@ -5432,12 +5454,12 @@ namespace Microsoft.Dafny
         Type lhsType = s.Lhs.Type;
         if (s.Rhs is ExprRhs) {
           ExprRhs rr = (ExprRhs)s.Rhs;
-          ResolveExpression(rr.Expr, new ResolveOpts(codeContext, true, specContextOnly));
+          ResolveExpression(rr.Expr, new ResolveOpts(codeContext, true));
           Contract.Assert(rr.Expr.Type != null);  // follows from postcondition of ResolveExpression
           ConstrainTypes(lhsType, rr.Expr.Type, stmt, "RHS (of type {0}) not assignable to LHS (of type {1})", rr.Expr.Type, lhsType);
         } else if (s.Rhs is TypeRhs) {
           TypeRhs rr = (TypeRhs)s.Rhs;
-          Type t = ResolveTypeRhs(rr, stmt, lvalueIsGhost, codeContext);
+          Type t = ResolveTypeRhs(rr, stmt, codeContext);
           ConstrainTypes(lhsType, t, stmt, "type {0} is not assignable to LHS (of type {1})", t, lhsType);
         } else if (s.Rhs is HavocRhs) {
           // nothing else to do
@@ -5447,7 +5469,7 @@ namespace Microsoft.Dafny
 
       } else if (stmt is CallStmt) {
         CallStmt s = (CallStmt)stmt;
-        ResolveCallStmt(s, specContextOnly, codeContext, null);
+        ResolveCallStmt(s, codeContext, null);
 
       } else if (stmt is BlockStmt) {
         var s = (BlockStmt)stmt;
@@ -5460,7 +5482,7 @@ namespace Microsoft.Dafny
         bool branchesAreSpecOnly = specContextOnly;
         if (s.Guard != null) {
           int prevErrorCount = reporter.Count(ErrorLevel.Error);
-          ResolveExpression(s.Guard, new ResolveOpts(codeContext, true, specContextOnly));
+          ResolveExpression(s.Guard, new ResolveOpts(codeContext, true));
           Contract.Assert(s.Guard.Type != null);  // follows from postcondition of ResolveExpression
           bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
           ConstrainTypes(s.Guard.Type, Type.Bool, s.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Guard.Type);
@@ -5483,7 +5505,7 @@ namespace Microsoft.Dafny
         var fvs = new HashSet<IVariable>();
         if (s.Guard != null) {
           int prevErrorCount = reporter.Count(ErrorLevel.Error);
-          ResolveExpression(s.Guard, new ResolveOpts(codeContext, true, specContextOnly));
+          ResolveExpression(s.Guard, new ResolveOpts(codeContext, true));
           Contract.Assert(s.Guard.Type != null);  // follows from postcondition of ResolveExpression
           bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
           Translator.ComputeFreeVariables(s.Guard, fvs);
@@ -5493,34 +5515,8 @@ namespace Microsoft.Dafny
           }
         }
 
-        foreach (MaybeFreeExpression inv in s.Invariants) {
-          ResolveAttributes(inv.Attributes, new ResolveOpts(codeContext, true, true));
-          ResolveExpression(inv.E, new ResolveOpts(codeContext, true, true));
-          Contract.Assert(inv.E.Type != null);  // follows from postcondition of ResolveExpression
-          Translator.ComputeFreeVariables(inv.E, fvs);
-          ConstrainTypes(inv.E.Type, Type.Bool, inv.E, "invariant is expected to be of type {0}, but is {1}", Type.Bool, inv.E.Type);
-        }
+        ResolveLoopSpecificationComponents(s.Invariants, s.Decreases, s.Mod, codeContext, fvs);
 
-        ResolveAttributes(s.Decreases.Attributes, new ResolveOpts(codeContext, true, true));
-        foreach (Expression e in s.Decreases.Expressions) {
-          ResolveExpression(e, new ResolveOpts(codeContext, true, true));
-          if (e is WildcardExpr) {
-            if (bodyMustBeSpecOnly) {
-              reporter.Error(MessageSource.Resolver, e, "'decreases *' is not allowed on ghost loops");
-            } else if (!codeContext.AllowsNontermination && !DafnyOptions.O.Dafnycc) {
-              reporter.Error(MessageSource.Resolver, e, "a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating");
-            }
-          }
-          // any type is fine
-        }
-
-        if (s.Mod.Expressions != null) {
-          ResolveAttributes(s.Mod.Attributes, new ResolveOpts(codeContext, true, true));
-          foreach (FrameExpression fe in s.Mod.Expressions) {
-            ResolveFrameExpression(fe, false, bodyMustBeSpecOnly, codeContext);
-            Translator.ComputeFreeVariables(fe.E, fvs);
-          }
-        }
         if (s.Body != null) {
           loopStack.Add(s);  // push
           if (s.Labels == null) {  // otherwise, "s" is already in "inSpecOnlyContext" map
@@ -5537,21 +5533,7 @@ namespace Microsoft.Dafny
       } else if (stmt is AlternativeLoopStmt) {
         var s = (AlternativeLoopStmt)stmt;
         ResolveAlternatives(s.Alternatives, specContextOnly, s, codeContext);
-        foreach (MaybeFreeExpression inv in s.Invariants) {
-          ResolveExpression(inv.E, new ResolveOpts(codeContext, true, true));
-          Contract.Assert(inv.E.Type != null);  // follows from postcondition of ResolveExpression
-          ConstrainTypes(inv.E.Type, Type.Bool, inv.E, "invariant is expected to be of type {0}, but is {1}", Type.Bool, inv.E.Type);
-        }
-
-        foreach (Expression e in s.Decreases.Expressions) {
-          ResolveExpression(e, new ResolveOpts(codeContext, true, true));
-          if (e is WildcardExpr) {
-            if (!codeContext.AllowsNontermination && !DafnyOptions.O.Dafnycc) {
-              reporter.Error(MessageSource.Resolver, e, "a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating");
-            }
-          }
-          // any type is fine
-        }
+        ResolveLoopSpecificationComponents(s.Invariants, s.Decreases, s.Mod, codeContext, null);
 
       } else if (stmt is ForallStmt) {
         var s = (ForallStmt)stmt;
@@ -5562,17 +5544,17 @@ namespace Microsoft.Dafny
           ScopePushAndReport(scope, v, "local-variable");
           ResolveType(v.tok, v.Type, codeContext, ResolveTypeOptionEnum.InferTypeProxies, null);
         }
-        ResolveExpression(s.Range, new ResolveOpts(codeContext, true, specContextOnly));
+        ResolveExpression(s.Range, new ResolveOpts(codeContext, true));
         Contract.Assert(s.Range.Type != null);  // follows from postcondition of ResolveExpression
         ConstrainTypes(s.Range.Type, Type.Bool, stmt, "range restriction in forall statement must be of type bool (instead got {0})", s.Range.Type);
         foreach (var ens in s.Ens) {
-          ResolveExpression(ens.E, new ResolveOpts(codeContext, true, true));
+          ResolveExpression(ens.E, new ResolveOpts(codeContext, true));
           Contract.Assert(ens.E.Type != null);  // follows from postcondition of ResolveExpression
           ConstrainTypes(ens.E.Type, Type.Bool, ens.E, "ensures condition is expected to be of type {0}, but is {1}", Type.Bool, ens.E.Type);
         }
         // Since the range and postconditions are more likely to infer the types of the bound variables, resolve them
         // first (above) and only then resolve the attributes (below).
-        ResolveAttributes(s.Attributes, new ResolveOpts(codeContext, true, true));
+        ResolveAttributes(s.Attributes, new ResolveOpts(codeContext, true));
 
         bool bodyMustBeSpecOnly = specContextOnly || (prevErrorCount == reporter.Count(ErrorLevel.Error) && UsesSpecFeatures(s.Range));
         if (!bodyMustBeSpecOnly && prevErrorCount == reporter.Count(ErrorLevel.Error)) {
@@ -5637,10 +5619,9 @@ namespace Microsoft.Dafny
 
       } else if (stmt is ModifyStmt) {
         var s = (ModifyStmt)stmt;
-        ResolveAttributes(s.Mod.Attributes, new ResolveOpts(codeContext, true, true));
+        ResolveAttributes(s.Mod.Attributes, new ResolveOpts(codeContext, true));
         foreach (FrameExpression fe in s.Mod.Expressions) {
-          // (yes, say "modifies", not "modify", in the next line -- it seems to give a more readable error message
-          ResolveFrameExpression(fe, false, specContextOnly, codeContext);
+          ResolveFrameExpression(fe, false, codeContext);
         }
         if (s.Body != null) {
           ResolveBlockStatement(s.Body, specContextOnly, codeContext);
@@ -5651,17 +5632,17 @@ namespace Microsoft.Dafny
         CalcStmt s = (CalcStmt)stmt;
         if (s.Lines.Count > 0) {
           var e0 = s.Lines.First();
-          ResolveExpression(e0, new ResolveOpts(codeContext, true, true));
+          ResolveExpression(e0, new ResolveOpts(codeContext, true));
           Contract.Assert(e0.Type != null);  // follows from postcondition of ResolveExpression
           for (int i = 1; i < s.Lines.Count; i++) {
             if (i < s.Lines.Count - 1 || prevErrorCount == reporter.Count(ErrorLevel.Error)) { // do not resolve the dummy step if there were errors, it might generate more errors
               var e1 = s.Lines[i];
-              ResolveExpression(e1, new ResolveOpts(codeContext, true, true));
+              ResolveExpression(e1, new ResolveOpts(codeContext, true));
               Contract.Assert(e1.Type != null);  // follows from postcondition of ResolveExpression
               if (!ConstrainTypes(e0.Type, e1.Type, e1, "all lines in a calculation must have the same type (got {0} after {1})", e1.Type, e0.Type)) {
               } else {
                 var step = s.StepOps[i - 1].StepExpr(e0, e1); // Use custom line operator
-                ResolveExpression(step, new ResolveOpts(codeContext, true, true));
+                ResolveExpression(step, new ResolveOpts(codeContext, true));
                 s.Steps.Add(step);
               }
               e0 = e1;
@@ -5686,7 +5667,7 @@ namespace Microsoft.Dafny
         } else {
           s.Result = CalcStmt.DefaultOp.StepExpr(Expression.CreateIntLiteral(s.Tok, 0), Expression.CreateIntLiteral(s.Tok, 0));
         }
-        ResolveExpression(s.Result, new ResolveOpts(codeContext, true, true));
+        ResolveExpression(s.Result, new ResolveOpts(codeContext, true));
         Contract.Assert(s.Result != null);
         Contract.Assert(prevErrorCount != reporter.Count(ErrorLevel.Error) || s.Steps.Count == s.Hints.Count);
 
@@ -5704,13 +5685,51 @@ namespace Microsoft.Dafny
       }
     }
 
+    private void ResolveLoopSpecificationComponents(List<MaybeFreeExpression> invariants, Specification<Expression> decreases, Specification<FrameExpression> modifies, ICodeContext codeContext, HashSet<IVariable> fvs) {
+      Contract.Requires(invariants != null);
+      Contract.Requires(decreases != null);
+      Contract.Requires(modifies != null);
+      Contract.Requires(codeContext != null);
+
+      foreach (MaybeFreeExpression inv in invariants) {
+        ResolveAttributes(inv.Attributes, new ResolveOpts(codeContext, true));
+        ResolveExpression(inv.E, new ResolveOpts(codeContext, true));
+        Contract.Assert(inv.E.Type != null);  // follows from postcondition of ResolveExpression
+        if (fvs != null) {
+          Translator.ComputeFreeVariables(inv.E, fvs);
+        }
+        ConstrainTypes(inv.E.Type, Type.Bool, inv.E, "invariant is expected to be of type {0}, but is {1}", Type.Bool, inv.E.Type);
+      }
+
+      ResolveAttributes(decreases.Attributes, new ResolveOpts(codeContext, true));
+      foreach (Expression e in decreases.Expressions) {
+        ResolveExpression(e, new ResolveOpts(codeContext, true));
+        if (e is WildcardExpr) {
+          if (!codeContext.AllowsNontermination && !DafnyOptions.O.Dafnycc) {
+            reporter.Error(MessageSource.Resolver, e, "a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating");
+          }
+        }
+        // any type is fine
+      }
+
+      ResolveAttributes(modifies.Attributes, new ResolveOpts(codeContext, true));
+      if (modifies.Expressions != null) {
+        foreach (FrameExpression fe in modifies.Expressions) {
+          ResolveFrameExpression(fe, false, codeContext);
+          if (fvs != null) {
+            Translator.ComputeFreeVariables(fe.E, fvs);
+          }
+        }
+      }
+    }
+
     void ResolveMatchStmt(Statement stmt, bool specContextOnly, ICodeContext codeContext) {
       MatchStmt s = (MatchStmt)stmt;
       DesugarMatchStmtWithTupleExpression(s);
 
       bool bodyIsSpecOnly = specContextOnly;
       int prevErrorCount = reporter.Count(ErrorLevel.Error);
-      ResolveExpression(s.Source, new ResolveOpts(codeContext, true, specContextOnly));
+      ResolveExpression(s.Source, new ResolveOpts(codeContext, true));
       Contract.Assert(s.Source.Type != null);  // follows from postcondition of ResolveExpression
       bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
       if (!specContextOnly && successfullyResolved) {
@@ -6230,7 +6249,7 @@ namespace Microsoft.Dafny
       var lhsNameSet = new HashSet<string>();  // used to check for duplicate identifiers on the left (full duplication checking for references and the like is done during verification)
       foreach (var lhs in s.Lhss) {
         var ec = reporter.Count(ErrorLevel.Error);
-        ResolveExpression(lhs, new ResolveOpts(codeContext, true, specContextOnly));
+        ResolveExpression(lhs, new ResolveOpts(codeContext, true));
         if (ec == reporter.Count(ErrorLevel.Error)) {
           if (lhs is SeqSelectExpr && !((SeqSelectExpr)lhs).SelectOne) {
             reporter.Error(MessageSource.Resolver, lhs, "cannot assign to a range of array elements (try the 'forall' statement)");
@@ -6241,11 +6260,11 @@ namespace Microsoft.Dafny
       // Resolve RHSs
       if (update == null) {
         var suchThat = (AssignSuchThatStmt)s;  // this is the other possible subclass
-        ResolveAssignSuchThatStmt(suchThat, specContextOnly, codeContext);
+        ResolveAssignSuchThatStmt(suchThat, codeContext);
       } else {
         ResolveUpdateStmt(update, specContextOnly, codeContext, errorCountBeforeCheckingLhs);
       }
-      ResolveAttributes(s.Attributes, new ResolveOpts(codeContext, true, true));
+      ResolveAttributes(s.Attributes, new ResolveOpts(codeContext, true));
     }
     /// <summary>
     /// Resolve the RHSs and entire UpdateStmt (LHSs should already have been checked by the caller).
@@ -6262,7 +6281,7 @@ namespace Microsoft.Dafny
         bool isEffectful;
         if (rhs is TypeRhs) {
           var tr = (TypeRhs)rhs;
-          ResolveTypeRhs(tr, update, specContextOnly, codeContext);
+          ResolveTypeRhs(tr, update, codeContext);
           isEffectful = tr.InitCall != null;
         } else if (rhs is HavocRhs) {
           isEffectful = false;
@@ -6270,17 +6289,11 @@ namespace Microsoft.Dafny
           var er = (ExprRhs)rhs;
           if (er.Expr is ApplySuffix) {
             var a = (ApplySuffix)er.Expr;
-            // Note, in the following line, the dontCareAboutCompilation could be more precise. It could be computed as in the else
-            // branch if the ApplySuffix is really just the RHS of an assignment. However, if "update" is really a call statement,
-            // then we should not let the LHS influence  the call to ResolveApplySuffix. Unfortunately, we don't know which case
-            // we're in until ResolveApplySuffix has returned (where a non-null cRhs indicates that "update" is a call statement).
-            // So, we'll be conservative and will simply pass in specContextOnly here.
-            var cRhs = ResolveApplySuffix(a, new ResolveOpts(codeContext, true, specContextOnly/*see note on previous line*/), true);
+            var cRhs = ResolveApplySuffix(a, new ResolveOpts(codeContext, true), true);
             isEffectful = cRhs != null;
             methodCallInfo = methodCallInfo ?? cRhs;
           } else {
-            var dontCareAboutCompilation = specContextOnly || (j < update.Lhss.Count && AssignStmt.LhsIsToGhost(update.Lhss[j]));
-            ResolveExpression(er.Expr, new ResolveOpts(codeContext, true, dontCareAboutCompilation));
+            ResolveExpression(er.Expr, new ResolveOpts(codeContext, true));
             isEffectful = false;
           }
         }
@@ -6355,7 +6368,7 @@ namespace Microsoft.Dafny
       }
     }
 
-    private void ResolveAssignSuchThatStmt(AssignSuchThatStmt s, bool specContextOnly, ICodeContext codeContext) {
+    private void ResolveAssignSuchThatStmt(AssignSuchThatStmt s, ICodeContext codeContext) {
       Contract.Requires(s != null);
       Contract.Requires(codeContext != null);
 
@@ -6373,7 +6386,7 @@ namespace Microsoft.Dafny
       }
 
       var ec = reporter.Count(ErrorLevel.Error);
-      ResolveExpression(s.Expr, new ResolveOpts(codeContext, true, specContextOnly));
+      ResolveExpression(s.Expr, new ResolveOpts(codeContext, true));
       ConstrainTypes(s.Expr.Type, Type.Bool, s.Expr, "type of RHS of assign-such-that statement must be boolean (got {0})", s.Expr.Type);
     }
 
@@ -6384,7 +6397,7 @@ namespace Microsoft.Dafny
       // first, resolve the guards, which tells us whether or not the entire statement is a ghost statement
       foreach (var alternative in alternatives) {
         int prevErrorCount = reporter.Count(ErrorLevel.Error);
-        ResolveExpression(alternative.Guard, new ResolveOpts(codeContext, true, specContextOnly));
+        ResolveExpression(alternative.Guard, new ResolveOpts(codeContext, true));
         Contract.Assert(alternative.Guard.Type != null);  // follows from postcondition of ResolveExpression
         bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
         ConstrainTypes(alternative.Guard.Type, Type.Bool, alternative.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, alternative.Guard.Type);
@@ -6412,7 +6425,7 @@ namespace Microsoft.Dafny
     /// Resolves the given call statement.
     /// Assumes all LHSs have already been resolved (and checked for mutability).
     /// </summary>
-    void ResolveCallStmt(CallStmt s, bool specContextOnly, ICodeContext codeContext, Type receiverType) {
+    void ResolveCallStmt(CallStmt s, ICodeContext codeContext, Type receiverType) {
       Contract.Requires(s != null);
       Contract.Requires(codeContext != null);
       bool isInitCall = receiverType != null;
@@ -6430,8 +6443,7 @@ namespace Microsoft.Dafny
       // resolve arguments
       int j = 0;
       foreach (Expression e in s.Args) {
-        bool allowGhost = callee.Ins.Count <= j || callee.Ins[j].IsGhost;
-        ResolveExpression(e, new ResolveOpts(codeContext, true, allowGhost));
+        ResolveExpression(e, new ResolveOpts(codeContext, true));
         j++;
       }
 
@@ -6827,16 +6839,12 @@ namespace Microsoft.Dafny
       }
     }
 
-    Type ResolveTypeRhs(TypeRhs rr, Statement stmt, bool specContextOnly, ICodeContext codeContext) {
+    Type ResolveTypeRhs(TypeRhs rr, Statement stmt, ICodeContext codeContext) {
       Contract.Requires(rr != null);
       Contract.Requires(stmt != null);
       Contract.Requires(codeContext != null);
       Contract.Ensures(Contract.Result<Type>() != null);
 
-      // "new" is not allowed in ghost contexts
-      if (specContextOnly) {
-        reporter.Error(MessageSource.Resolver, rr.Tok, "'new' is not allowed in ghost contexts");
-      }
       if (rr.Type == null) {
         if (rr.ArrayDimensions != null) {
           // ---------- new T[EE]
@@ -6888,13 +6896,13 @@ namespace Microsoft.Dafny
               // type, create an dot-suffix expression around this receiver, and then resolve it in the usual way for dot-suffix expressions.
               var lhs = new ImplicitThisExpr(initCallTok) { Type = rr.EType };
               var callLhs = new ExprDotName(initCallTok, lhs, initCallName, ret == null ? null : ret.LastComponent.OptTypeArguments);
-              ResolveDotSuffix(callLhs, true, rr.Arguments, new ResolveOpts(codeContext, true, specContextOnly), true);
+              ResolveDotSuffix(callLhs, true, rr.Arguments, new ResolveOpts(codeContext, true), true);
               if (prevErrorCount == reporter.Count(ErrorLevel.Error)) {
                 Contract.Assert(callLhs.ResolvedExpression is MemberSelectExpr);  // since ResolveApplySuffix succeeded and call.Lhs denotes an expression (not a module or a type)
                 var methodSel = (MemberSelectExpr)callLhs.ResolvedExpression;
                 if (methodSel.Member is Method) {
                   rr.InitCall = new CallStmt(initCallTok, stmt.EndTok, new List<Expression>(), methodSel, rr.Arguments);
-                  ResolveCallStmt(rr.InitCall, specContextOnly, codeContext, rr.EType);
+                  ResolveCallStmt(rr.InitCall, codeContext, rr.EType);
                   if (rr.InitCall.Method is Constructor) {
                     callsConstructor = true;
                   }
@@ -7170,24 +7178,10 @@ namespace Microsoft.Dafny
     {
       public readonly ICodeContext codeContext;
       public readonly bool twoState;
-      public readonly bool DontCareAboutCompilation;
       public ResolveOpts(ICodeContext codeContext, bool twoState) {
         Contract.Requires(codeContext != null);
         this.codeContext = codeContext;
         this.twoState = twoState;
-        DontCareAboutCompilation = codeContext.IsGhost;
-      }
-      public ResolveOpts(ICodeContext codeContext, bool twoState, bool dontCareAboutCompilation) {
-        Contract.Requires(codeContext != null);
-        this.codeContext = codeContext;
-        this.twoState = twoState;
-        this.DontCareAboutCompilation = dontCareAboutCompilation;
-      }
-      public ResolveOpts(ResolveOpts r, bool dontCareAboutCompilation) {
-        Contract.Requires(r != null);
-        this.codeContext = r.codeContext;
-        this.twoState = r.twoState;
-        this.DontCareAboutCompilation = dontCareAboutCompilation;
       }
     }
 
@@ -7846,7 +7840,7 @@ namespace Microsoft.Dafny
           }
         }
         ResolveExpression(e.Body, opts);
-        ResolveAttributes(e.Attributes, new ResolveOpts(opts, true));
+        ResolveAttributes(e.Attributes, opts);
         scope.PopMarker();
         expr.Type = e.Body.Type;
 
@@ -7873,16 +7867,16 @@ namespace Microsoft.Dafny
           reporter.Error(MessageSource.Resolver, expr, "a quantifier cannot quantify over types. Possible fix: use the experimental attribute :typeQuantifier");
         }
         if (e.Range != null) {
-          ResolveExpression(e.Range, new ResolveOpts(opts, true));
+          ResolveExpression(e.Range, opts);
           Contract.Assert(e.Range.Type != null);  // follows from postcondition of ResolveExpression
           ConstrainTypes(e.Range.Type, Type.Bool, expr, "range of quantifier must be of type bool (instead got {0})", e.Range.Type);
         }
-        ResolveExpression(e.Term, new ResolveOpts(opts, true));
+        ResolveExpression(e.Term, opts);
         Contract.Assert(e.Term.Type != null);  // follows from postcondition of ResolveExpression
         ConstrainTypes(e.Term.Type, Type.Bool, expr, "body of quantifier must be of type bool (instead got {0})", e.Term.Type);
         // Since the body is more likely to infer the types of the bound variables, resolve it
         // first (above) and only then resolve the attributes (below).
-        ResolveAttributes(e.Attributes, new ResolveOpts(opts, true));
+        ResolveAttributes(e.Attributes, opts);
         scope.PopMarker();
         allTypeParameters.PopMarker();
         expr.Type = Type.Bool;
@@ -7920,7 +7914,7 @@ namespace Microsoft.Dafny
         ResolveExpression(e.Term, opts);
         Contract.Assert(e.Term.Type != null);  // follows from postcondition of ResolveExpression
 
-        ResolveAttributes(e.Attributes, new ResolveOpts(opts, true));
+        ResolveAttributes(e.Attributes, opts);
         scope.PopMarker();
         expr.Type = new SetType(e.Finite, e.Term.Type);
 
@@ -7941,7 +7935,7 @@ namespace Microsoft.Dafny
         ResolveExpression(e.Term, opts);
         Contract.Assert(e.Term.Type != null);  // follows from postcondition of ResolveExpression
 
-        ResolveAttributes(e.Attributes, new ResolveOpts(opts, true));
+        ResolveAttributes(e.Attributes, opts);
         scope.PopMarker();
         expr.Type = new MapType(e.Finite, e.BoundVars[0].Type, e.Term.Type);
 
@@ -7974,7 +7968,7 @@ namespace Microsoft.Dafny
         }
 
         foreach (var read in e.Reads) {
-          ResolveFrameExpression(read, true, false, opts.codeContext);
+          ResolveFrameExpression(read, true, opts.codeContext);
         }
 
         ResolveExpression(e.Term, opts);
diff --git a/Test/dafny0/ResolutionErrors.dfy b/Test/dafny0/ResolutionErrors.dfy
index 9d4d67f1..49e6efa0 100644
--- a/Test/dafny0/ResolutionErrors.dfy
+++ b/Test/dafny0/ResolutionErrors.dfy
@@ -9,9 +9,9 @@ method GhostDivergentLoop()
    a[1] := -1;
    ghost var i := 0;
    while (i < 2)
-      decreases *; // error: not allowed on a ghost loop
-      invariant i <= 2;
-      invariant (forall j :: 0 <= j && j < i ==> a[j] > 0);
+      decreases * // error: not allowed on a ghost loop
+      invariant i <= 2
+      invariant (forall j :: 0 <= j && j < i ==> a[j] > 0)
    {
      i := 0;
    }
@@ -613,20 +613,7 @@ module GhostAllocationTests {
     p := new G;  // error: ditto
   }
 
-  method GhostNew1(n: nat)
-  {
-    var a := new G[n];
-    forall i | 0 <= i < n {
-      a[i] := new G;  // error: 'new' is currently not supported in forall statements
-    }
-    forall i | 0 <= i < n
-      ensures true;  // this makes the whole 'forall' statement into a ghost statement
-    {
-      a[i] := new G;  // error: 'new' not allowed in ghost contexts, and proof-forall cannot update state
-    }
-  }
-
-  method GhostNew2(n: nat, ghost g: int) returns (t: G, z: int)
+  method GhostNew1(n: nat, ghost g: int) returns (t: G, z: int)
   {
     if n < 0 {
       z, t := 5, new G;  // fine
@@ -636,14 +623,14 @@ module GhostAllocationTests {
     }
   }
 
-  method GhostNew3(ghost b: bool)
+  method GhostNew2(ghost b: bool)
   {
     if (b) {
       var y := new GIter();  // error: 'new' not allowed in ghost contexts (and a non-ghost method is not allowed to be called here either)
     }
   }
 
-  method GhostNew4(n: nat)
+  method GhostNew3(n: nat)
   {
     var g := new G;
     calc {
@@ -653,12 +640,28 @@ module GhostAllocationTests {
     }
   }
 
-  ghost method GhostNew5(g: G)
+  ghost method GhostNew4(g: G)
     modifies g;
   {
   }
 }
 
+module NewForall {
+  class G { }
+  method NewForallTest(n: nat)
+  {
+    var a := new G[n];
+    forall i | 0 <= i < n {
+      a[i] := new G;  // error: 'new' is currently not supported in forall statements
+    }
+    forall i | 0 <= i < n
+      ensures true;  // this makes the whole 'forall' statement into a ghost statement
+    {
+      a[i] := new G;  // error: 'new' not allowed in ghost contexts, and proof-forall cannot update state
+    }
+  }
+}
+
 // ------------------------- underspecified types ------------------------------
 
 module UnderspecifiedTypes {
@@ -706,7 +709,7 @@ module StatementsInExpressions {
         { assert 6 < 8; }
         { var x := 8;
           while x != 0
-            decreases *;  // error: cannot use 'decreases *' in a ghost context
+            decreases *  // error: cannot use 'decreases *' here
           {
             x := x - 1;
           }
@@ -739,7 +742,7 @@ module StatementsInExpressions {
         { assert 6 < 8; }
         { var x := 8;
           while x != 0
-            decreases *;  // error: cannot use 'decreases *' in a ghost context
+            decreases *  // error: cannot use 'decreases *' here
           {
             x := x - 1;
           }
@@ -852,40 +855,48 @@ class ModifyStatementClass {
   ghost method G0()
     modifies `g;
     modifies `x;  // error: non-ghost field mentioned in ghost context
-  {
-    modify `g;
-    modify `x;  // error: non-ghost field mentioned in ghost context
-  }
-  method G1()
-    modifies this;
-  {
-    modify `x;
-    if g < 100 {
-      // we are now in a ghost context
+}
+module ModifyStatementClass_More {
+  class C {
+    var x: int;
+    ghost var g: int;
+    ghost method G0()
+      modifies `g;
+    {
+      modify `g;
       modify `x;  // error: non-ghost field mentioned in ghost context
     }
-  }
-  method G2(y: nat)
-    modifies this;
-  {
-    if g < 100 {
-      // we're now in a ghost context
-      var n := 0;
-      while n < y
-        modifies `x;  // error: non-ghost field mentioned in ghost context
-      {
-        if * {
-          g := g + 1;  // if we got as far as verification, this would be flagged as an error too
-        }
-        n := n + 1;
+    method G1()
+      modifies this;
+    {
+      modify `x;
+      if g < 100 {
+        // we are now in a ghost context
+        modify `x;  // error: non-ghost field mentioned in ghost context
       }
     }
-    modify `x;  // fine
-    ghost var i := 0;
-    while i < y
-      modifies `x;  // error: non-ghost field mentioned in ghost context
+    method G2(y: nat)
+      modifies this;
     {
-      i := i + 1;
+      if g < 100 {
+        // we're now in a ghost context
+        var n := 0;
+        while n < y
+          modifies `x;  // error: non-ghost field mentioned in ghost context
+        {
+          if * {
+            g := g + 1;  // if we got as far as verification, this would be flagged as an error too
+          }
+          n := n + 1;
+        }
+      }
+      modify `x;  // fine
+      ghost var i := 0;
+      while i < y
+        modifies `x;  // error: non-ghost field mentioned in ghost context
+      {
+        i := i + 1;
+      }
     }
   }
 }
@@ -1298,7 +1309,7 @@ module FrameTargetFields {
       modifies `z  // cool
     {
     }
-
+} } module FrameTargetFields_More {  class C {    var x: int    var y: int    ghost var z: int
     method P()
       modifies this
     {
@@ -1400,20 +1411,20 @@ module SuchThat {
 module GhostTests {
   class G { }
   
-  method GhostNew4(n: nat)
+  method GhostNew3(n: nat)
   {
     var g := new G;
     calc {
       5;
       2 + 3;
-      { if n != 0 { GhostNew4(n-1); } }  // error: cannot call non-ghost method in a ghost context
+      { if n != 0 { GhostNew3(n-1); } }  // error: cannot call non-ghost method in a ghost context
       1 + 4;
-      { GhostNew5(g); }  // error: cannot call method with nonempty modifies
+      { GhostNew4(g); }  // error: cannot call method with nonempty modifies
       -5 + 10;
     }
   }
 
-  ghost method GhostNew5(g: G)
+  ghost method GhostNew4(g: G)
     modifies g;
   {
   }
@@ -1524,7 +1535,7 @@ module EvenMoreGhostTests {
     ensures false;
   {
     while (true)
-      decreases *;  // error:  not allowed in ghost context
+      decreases *  // error:  not allowed here
     {
     }
   }
@@ -1548,20 +1559,6 @@ module EvenMoreGhostTests {
       }
     }
   }
-  ghost method Bad()
-  {
-    var x: int;
-    calc {
-      1;
-//******      { x := 1; }     // error: updates to locals defined outside of the hint are not allowed
-      x;
-      {
-        var x: int;
-        x := 1;       // this is OK
-      }
-      1;
-    }
-  }
 }
 
 module BadGhostTransfer {
@@ -1619,3 +1616,79 @@ module UnderspecifiedTypedShouldBeResolvedOnlyOnce {
     }
   }
 }
+
+module LoopResolutionTests {
+  class C {
+    var x: int
+    ghost var y: int
+  }
+
+  ghost method M(c: C)
+    requires c != null
+    modifies c
+  {
+    var n := 0;
+    while n < 100
+      modifies c`y
+      modifies c`x  // error: not allowed to mention non-ghost field in modifies clause of ghost loops
+    {
+      c.x := c.x + 1;  // error: assignment to non-ghost field not allowed here
+    }
+  }
+
+  method MM(c: C)
+    requires c != null
+    modifies c
+  {
+    var n := 0;
+    while
+      invariant n <= 100
+      modifies c  // regression test
+    {
+      case n < 100 =>  n := n + 1;
+    }
+  }
+
+  method MMX(c: C, ghost g: int)
+    requires c != null
+    modifies c
+  {
+    var n := 0;
+    while
+      invariant n <= 100
+      modifies c`y
+      modifies c`x  // error: not allowed to mention non-ghost field in modifies clause of ghost loops
+    {
+      case n < 100 =>  n := n + 1;  // error: cannot assign to non-ghost in a ghost loop
+      case g < 56 && n != 100 => n := n + 1;  // error: cannot assign to non-ghost in a ghost loop
+    }
+  }
+
+  method MD0(c: C, ghost g: nat)
+    requires c != null
+    modifies c
+    decreases *
+  {
+    var n := 0;
+    while n + g < 100
+      invariant n <= 100
+      decreases *  // error: disallowed on ghost loops
+    {
+      n := n + 1;  // error: cannot assign to non-ghost in a ghost loop
+    }
+  }
+
+  method MD1(c: C, ghost g: nat)
+    requires c != null
+    modifies c
+    decreases *
+  {
+    var n := 0;
+    while
+      invariant n <= 100
+      decreases *  // error: disallowed on ghost loops
+    {
+      case n + g < 100 =>  n := n + 1;  // error: cannot assign to non-ghost in a ghost loop
+    }
+  }
+}
diff --git a/Test/dafny0/ResolutionErrors.dfy.expect b/Test/dafny0/ResolutionErrors.dfy.expect
index 6f4b3519..edf61b33 100644
--- a/Test/dafny0/ResolutionErrors.dfy.expect
+++ b/Test/dafny0/ResolutionErrors.dfy.expect
@@ -26,113 +26,126 @@ ResolutionErrors.dfy(599,25): Error: the type of this variable is underspecified
 ResolutionErrors.dfy(599,23): Error: type variable 'T' in the function call to 'P' could not be determined
 ResolutionErrors.dfy(612,13): Error: 'new' is not allowed in ghost contexts
 ResolutionErrors.dfy(613,9): Error: 'new' is not allowed in ghost contexts
-ResolutionErrors.dfy(620,14): Error: new allocation not supported in forall statements
-ResolutionErrors.dfy(625,11): Error: the body of the enclosing forall statement is not allowed to update heap locations
-ResolutionErrors.dfy(625,14): Error: new allocation not allowed in ghost context
-ResolutionErrors.dfy(635,23): Error: 'new' is not allowed in ghost contexts
-ResolutionErrors.dfy(642,15): Error: 'new' is not allowed in ghost contexts
-ResolutionErrors.dfy(651,17): Error: 'new' is not allowed in ghost contexts
-ResolutionErrors.dfy(669,21): Error: the type of this variable is underspecified
-ResolutionErrors.dfy(709,22): Error: 'decreases *' is not allowed on ghost loops
-ResolutionErrors.dfy(742,22): Error: 'decreases *' is not allowed on ghost loops
-ResolutionErrors.dfy(773,19): Error: calls to methods with side-effects are not allowed inside a statement expression
-ResolutionErrors.dfy(774,20): Error: wrong number of method result arguments (got 0, expected 1)
-ResolutionErrors.dfy(786,23): Error: function calls are allowed only in specification contexts (consider declaring the function a 'function method')
-ResolutionErrors.dfy(796,4): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(807,36): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(816,17): Error: function calls are allowed only in specification contexts (consider declaring the function a 'function method')
-ResolutionErrors.dfy(830,6): Error: RHS (of type B) not assignable to LHS (of type object)
-ResolutionErrors.dfy(831,6): Error: RHS (of type int) not assignable to LHS (of type object)
-ResolutionErrors.dfy(832,6): Error: RHS (of type B) not assignable to LHS (of type object)
-ResolutionErrors.dfy(837,6): Error: RHS (of type G) not assignable to LHS (of type object)
-ResolutionErrors.dfy(838,6): Error: RHS (of type Dt) not assignable to LHS (of type object)
-ResolutionErrors.dfy(839,6): Error: RHS (of type CoDt) not assignable to LHS (of type object)
-ResolutionErrors.dfy(901,4): Error: LHS of array assignment must denote an array element (found seq<int>)
-ResolutionErrors.dfy(902,4): Error: LHS of array assignment must denote an array element (found seq<int>)
-ResolutionErrors.dfy(907,10): Error: LHS of assignment must denote a mutable field
-ResolutionErrors.dfy(908,10): Error: LHS of assignment must denote a mutable field
-ResolutionErrors.dfy(909,9): Error: cannot assign to a range of array elements (try the 'forall' statement)
-ResolutionErrors.dfy(910,9): Error: cannot assign to a range of array elements (try the 'forall' statement)
-ResolutionErrors.dfy(911,5): Error: cannot assign to a range of array elements (try the 'forall' statement)
-ResolutionErrors.dfy(912,5): Error: cannot assign to a range of array elements (try the 'forall' statement)
-ResolutionErrors.dfy(993,11): Error: Wrong number of type arguments (2 instead of 1) passed to array type: array3
-ResolutionErrors.dfy(994,11): Error: Wrong number of type arguments (2 instead of 1) passed to class: C
-ResolutionErrors.dfy(1005,7): Error: Duplicate name of top-level declaration: BadSyn2
-ResolutionErrors.dfy(1002,17): Error: Wrong number of type arguments (0 instead of 1) passed to datatype: List
-ResolutionErrors.dfy(1003,17): Error: Undeclared top-level type or type parameter: badName (did you forget to qualify a name or declare a module import 'opened?')
-ResolutionErrors.dfy(1004,22): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name or declare a module import 'opened?')
-ResolutionErrors.dfy(1011,7): Error: Cycle among redirecting types (newtypes, type synonyms): A -> A
-ResolutionErrors.dfy(1014,7): Error: Cycle among redirecting types (newtypes, type synonyms): A -> B -> A
-ResolutionErrors.dfy(1018,7): Error: Cycle among redirecting types (newtypes, type synonyms): A -> B -> A
-ResolutionErrors.dfy(1027,11): Error: because of cyclic dependencies among constructor argument types, no instances of datatype 'D' can be constructed
-ResolutionErrors.dfy(1030,7): Error: Cycle among redirecting types (newtypes, type synonyms): A -> B -> A
-ResolutionErrors.dfy(1035,7): Error: Cycle among redirecting types (newtypes, type synonyms): A -> B -> A
-ResolutionErrors.dfy(1054,21): Error: unresolved identifier: x
-ResolutionErrors.dfy(1061,35): Error: Wrong number of type arguments (2 instead of 1) passed to opaque type: P
-ResolutionErrors.dfy(1073,13): Error: Undeclared top-level type or type parameter: BX (did you forget to qualify a name or declare a module import 'opened?')
-ResolutionErrors.dfy(1083,6): Error: RHS (of type P<int>) not assignable to LHS (of type P<bool>)
-ResolutionErrors.dfy(1088,6): Error: RHS (of type P<A>) not assignable to LHS (of type P<B>)
-ResolutionErrors.dfy(1093,6): Error: RHS (of type P<A>) not assignable to LHS (of type P<int>)
-ResolutionErrors.dfy(1094,6): Error: RHS (of type P<int>) not assignable to LHS (of type P<A>)
-ResolutionErrors.dfy(1099,13): Error: arguments must have the same type (got P<int> and P<X>)
-ResolutionErrors.dfy(1100,13): Error: arguments must have the same type (got P<bool> and P<X>)
-ResolutionErrors.dfy(1101,13): Error: arguments must have the same type (got P<int> and P<bool>)
-ResolutionErrors.dfy(1124,38): Error: set comprehensions in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'o'
-ResolutionErrors.dfy(1126,24): Error: set comprehensions in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'o'
-ResolutionErrors.dfy(1231,26): Error: the type of this variable is underspecified
-ResolutionErrors.dfy(1232,31): Error: the type of this variable is underspecified
-ResolutionErrors.dfy(1233,29): Error: the type of this variable is underspecified
-ResolutionErrors.dfy(1243,34): Error: the type of this variable is underspecified
-ResolutionErrors.dfy(1259,21): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name or declare a module import 'opened?')
-ResolutionErrors.dfy(1260,24): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name or declare a module import 'opened?')
-ResolutionErrors.dfy(1297,16): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (y)
-ResolutionErrors.dfy(1307,18): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (x)
-ResolutionErrors.dfy(1335,15): Error: The name Inner ambiguously refers to a type in one of the modules A, B (try qualifying the type name with the module name)
-ResolutionErrors.dfy(1345,29): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(1347,49): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(1347,54): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(1368,11): Error: name of type (X) is used as a variable
-ResolutionErrors.dfy(1368,16): Error: name of type (X) is used as a variable
-ResolutionErrors.dfy(1369,11): Error: name of module (Y) is used as a variable
-ResolutionErrors.dfy(1369,16): Error: name of module (Y) is used as a variable
-ResolutionErrors.dfy(1370,11): Error: name of type (X) is used as a variable
-ResolutionErrors.dfy(1370,13): Error: second argument to "in" must be a set, multiset, or sequence with elements of type #type, or a map with domain #type (instead got map<real, string>)
-ResolutionErrors.dfy(1371,11): Error: name of module (Y) is used as a variable
-ResolutionErrors.dfy(1371,13): Error: second argument to "in" must be a set, multiset, or sequence with elements of type #module, or a map with domain #module (instead got map<real, string>)
-ResolutionErrors.dfy(1376,16): Error: name of type (X) is used as a variable
-ResolutionErrors.dfy(1376,13): Error: arguments must have the same type (got int and #type)
-ResolutionErrors.dfy(1377,16): Error: name of module (Y) is used as a variable
-ResolutionErrors.dfy(1377,13): Error: arguments must have the same type (got int and #module)
-ResolutionErrors.dfy(1378,4): Error: name of type (X) is used as a variable
-ResolutionErrors.dfy(1379,4): Error: name of module (Y) is used as a variable
-ResolutionErrors.dfy(1388,11): Error: type of RHS of assign-such-that statement must be boolean (got int)
-ResolutionErrors.dfy(1389,9): Error: type of RHS of assign-such-that statement must be boolean (got int)
-ResolutionErrors.dfy(1390,13): Error: type of RHS of assign-such-that statement must be boolean (got int)
-ResolutionErrors.dfy(1393,15): Error: type of RHS of let-such-that expression must be boolean (got int)
-ResolutionErrors.dfy(1436,20): Error: calls to methods with side-effects are not allowed inside a hint
-ResolutionErrors.dfy(1458,18): Error: a hint is not allowed to update heap locations
-ResolutionErrors.dfy(1459,23): Error: a hint is not allowed to update heap locations
-ResolutionErrors.dfy(1460,20): Error: calls to methods with side-effects are not allowed inside a hint
-ResolutionErrors.dfy(1463,21): Error: a while statement used inside a hint is not allowed to have a modifies clause
-ResolutionErrors.dfy(1445,24): Error: only ghost methods can be called from this context
-ResolutionErrors.dfy(1458,18): Error: Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
-ResolutionErrors.dfy(1487,18): Error: a hint is not allowed to update heap locations
-ResolutionErrors.dfy(1488,23): Error: a hint is not allowed to update heap locations
-ResolutionErrors.dfy(1489,11): Error: calls to methods with side-effects are not allowed inside a hint
-ResolutionErrors.dfy(1492,21): Error: a while statement used inside a hint is not allowed to have a modifies clause
-ResolutionErrors.dfy(1480,24): Error: only ghost methods can be called from this context
-ResolutionErrors.dfy(1487,18): Error: Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
-ResolutionErrors.dfy(1516,20): Error: only ghost methods can be called from this context
-ResolutionErrors.dfy(1409,29): Error: only ghost methods can be called from this context
-ResolutionErrors.dfy(1411,17): Error: calls to methods with side-effects are not allowed inside a hint
-ResolutionErrors.dfy(1527,16): Error: 'decreases *' is not allowed on ghost loops
-ResolutionErrors.dfy(1545,12): Error: trying to break out of more loop levels than there are enclosing loops
-ResolutionErrors.dfy(1571,16): Error: ghost fields are allowed only in specification contexts
-ResolutionErrors.dfy(1578,9): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(1584,4): Error: non-ghost variable cannot be assigned a value that depends on a ghost
-ResolutionErrors.dfy(1601,8): Error: print statement is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
-ResolutionErrors.dfy(1610,26): Error: ghost variables are allowed only in specification contexts
-ResolutionErrors.dfy(1618,6): Error: the type of the bound variable 't' could not be determined
+ResolutionErrors.dfy(622,23): Error: 'new' is not allowed in ghost contexts
+ResolutionErrors.dfy(629,15): Error: 'new' is not allowed in ghost contexts
+ResolutionErrors.dfy(638,17): Error: 'new' is not allowed in ghost contexts
+ResolutionErrors.dfy(655,14): Error: new allocation not supported in forall statements
+ResolutionErrors.dfy(660,11): Error: the body of the enclosing forall statement is not allowed to update heap locations
+ResolutionErrors.dfy(660,14): Error: new allocation not allowed in ghost context
+ResolutionErrors.dfy(672,21): Error: the type of this variable is underspecified
+ResolutionErrors.dfy(712,22): Error: a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating
+ResolutionErrors.dfy(745,22): Error: a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating
+ResolutionErrors.dfy(776,19): Error: calls to methods with side-effects are not allowed inside a statement expression
+ResolutionErrors.dfy(777,20): Error: wrong number of method result arguments (got 0, expected 1)
+ResolutionErrors.dfy(789,23): Error: function calls are allowed only in specification contexts (consider declaring the function a 'function method')
+ResolutionErrors.dfy(799,4): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(810,36): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(819,17): Error: function calls are allowed only in specification contexts (consider declaring the function a 'function method')
+ResolutionErrors.dfy(833,6): Error: RHS (of type B) not assignable to LHS (of type object)
+ResolutionErrors.dfy(834,6): Error: RHS (of type int) not assignable to LHS (of type object)
+ResolutionErrors.dfy(835,6): Error: RHS (of type B) not assignable to LHS (of type object)
+ResolutionErrors.dfy(840,6): Error: RHS (of type G) not assignable to LHS (of type object)
+ResolutionErrors.dfy(841,6): Error: RHS (of type Dt) not assignable to LHS (of type object)
+ResolutionErrors.dfy(842,6): Error: RHS (of type CoDt) not assignable to LHS (of type object)
+ResolutionErrors.dfy(867,14): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (x)
+ResolutionErrors.dfy(875,16): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (x)
+ResolutionErrors.dfy(885,20): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (x)
+ResolutionErrors.dfy(896,18): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (x)
+ResolutionErrors.dfy(912,4): Error: LHS of array assignment must denote an array element (found seq<int>)
+ResolutionErrors.dfy(913,4): Error: LHS of array assignment must denote an array element (found seq<int>)
+ResolutionErrors.dfy(918,10): Error: LHS of assignment must denote a mutable field
+ResolutionErrors.dfy(919,10): Error: LHS of assignment must denote a mutable field
+ResolutionErrors.dfy(920,9): Error: cannot assign to a range of array elements (try the 'forall' statement)
+ResolutionErrors.dfy(921,9): Error: cannot assign to a range of array elements (try the 'forall' statement)
+ResolutionErrors.dfy(922,5): Error: cannot assign to a range of array elements (try the 'forall' statement)
+ResolutionErrors.dfy(923,5): Error: cannot assign to a range of array elements (try the 'forall' statement)
+ResolutionErrors.dfy(1004,11): Error: Wrong number of type arguments (2 instead of 1) passed to array type: array3
+ResolutionErrors.dfy(1005,11): Error: Wrong number of type arguments (2 instead of 1) passed to class: C
+ResolutionErrors.dfy(1016,7): Error: Duplicate name of top-level declaration: BadSyn2
+ResolutionErrors.dfy(1013,17): Error: Wrong number of type arguments (0 instead of 1) passed to datatype: List
+ResolutionErrors.dfy(1014,17): Error: Undeclared top-level type or type parameter: badName (did you forget to qualify a name or declare a module import 'opened?')
+ResolutionErrors.dfy(1015,22): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name or declare a module import 'opened?')
+ResolutionErrors.dfy(1022,7): Error: Cycle among redirecting types (newtypes, type synonyms): A -> A
+ResolutionErrors.dfy(1025,7): Error: Cycle among redirecting types (newtypes, type synonyms): A -> B -> A
+ResolutionErrors.dfy(1029,7): Error: Cycle among redirecting types (newtypes, type synonyms): A -> B -> A
+ResolutionErrors.dfy(1038,11): Error: because of cyclic dependencies among constructor argument types, no instances of datatype 'D' can be constructed
+ResolutionErrors.dfy(1041,7): Error: Cycle among redirecting types (newtypes, type synonyms): A -> B -> A
+ResolutionErrors.dfy(1046,7): Error: Cycle among redirecting types (newtypes, type synonyms): A -> B -> A
+ResolutionErrors.dfy(1065,21): Error: unresolved identifier: x
+ResolutionErrors.dfy(1072,35): Error: Wrong number of type arguments (2 instead of 1) passed to opaque type: P
+ResolutionErrors.dfy(1084,13): Error: Undeclared top-level type or type parameter: BX (did you forget to qualify a name or declare a module import 'opened?')
+ResolutionErrors.dfy(1094,6): Error: RHS (of type P<int>) not assignable to LHS (of type P<bool>)
+ResolutionErrors.dfy(1099,6): Error: RHS (of type P<A>) not assignable to LHS (of type P<B>)
+ResolutionErrors.dfy(1104,6): Error: RHS (of type P<A>) not assignable to LHS (of type P<int>)
+ResolutionErrors.dfy(1105,6): Error: RHS (of type P<int>) not assignable to LHS (of type P<A>)
+ResolutionErrors.dfy(1110,13): Error: arguments must have the same type (got P<int> and P<X>)
+ResolutionErrors.dfy(1111,13): Error: arguments must have the same type (got P<bool> and P<X>)
+ResolutionErrors.dfy(1112,13): Error: arguments must have the same type (got P<int> and P<bool>)
+ResolutionErrors.dfy(1135,38): Error: set comprehensions in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'o'
+ResolutionErrors.dfy(1137,24): Error: set comprehensions in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'o'
+ResolutionErrors.dfy(1242,26): Error: the type of this variable is underspecified
+ResolutionErrors.dfy(1243,31): Error: the type of this variable is underspecified
+ResolutionErrors.dfy(1244,29): Error: the type of this variable is underspecified
+ResolutionErrors.dfy(1254,34): Error: the type of this variable is underspecified
+ResolutionErrors.dfy(1270,21): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name or declare a module import 'opened?')
+ResolutionErrors.dfy(1271,24): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name or declare a module import 'opened?')
+ResolutionErrors.dfy(1308,16): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (y)
+ResolutionErrors.dfy(1318,18): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (x)
+ResolutionErrors.dfy(1346,15): Error: The name Inner ambiguously refers to a type in one of the modules A, B (try qualifying the type name with the module name)
+ResolutionErrors.dfy(1356,29): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(1358,49): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(1358,54): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(1379,11): Error: name of type (X) is used as a variable
+ResolutionErrors.dfy(1379,16): Error: name of type (X) is used as a variable
+ResolutionErrors.dfy(1380,11): Error: name of module (Y) is used as a variable
+ResolutionErrors.dfy(1380,16): Error: name of module (Y) is used as a variable
+ResolutionErrors.dfy(1381,11): Error: name of type (X) is used as a variable
+ResolutionErrors.dfy(1381,13): Error: second argument to "in" must be a set, multiset, or sequence with elements of type #type, or a map with domain #type (instead got map<real, string>)
+ResolutionErrors.dfy(1382,11): Error: name of module (Y) is used as a variable
+ResolutionErrors.dfy(1382,13): Error: second argument to "in" must be a set, multiset, or sequence with elements of type #module, or a map with domain #module (instead got map<real, string>)
+ResolutionErrors.dfy(1387,16): Error: name of type (X) is used as a variable
+ResolutionErrors.dfy(1387,13): Error: arguments must have the same type (got int and #type)
+ResolutionErrors.dfy(1388,16): Error: name of module (Y) is used as a variable
+ResolutionErrors.dfy(1388,13): Error: arguments must have the same type (got int and #module)
+ResolutionErrors.dfy(1389,4): Error: name of type (X) is used as a variable
+ResolutionErrors.dfy(1390,4): Error: name of module (Y) is used as a variable
+ResolutionErrors.dfy(1399,11): Error: type of RHS of assign-such-that statement must be boolean (got int)
+ResolutionErrors.dfy(1400,9): Error: type of RHS of assign-such-that statement must be boolean (got int)
+ResolutionErrors.dfy(1401,13): Error: type of RHS of assign-such-that statement must be boolean (got int)
+ResolutionErrors.dfy(1404,15): Error: type of RHS of let-such-that expression must be boolean (got int)
+ResolutionErrors.dfy(1447,20): Error: calls to methods with side-effects are not allowed inside a hint
+ResolutionErrors.dfy(1469,18): Error: a hint is not allowed to update heap locations
+ResolutionErrors.dfy(1470,23): Error: a hint is not allowed to update heap locations
+ResolutionErrors.dfy(1471,20): Error: calls to methods with side-effects are not allowed inside a hint
+ResolutionErrors.dfy(1474,21): Error: a while statement used inside a hint is not allowed to have a modifies clause
+ResolutionErrors.dfy(1456,24): Error: only ghost methods can be called from this context
+ResolutionErrors.dfy(1469,18): Error: Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ResolutionErrors.dfy(1498,18): Error: a hint is not allowed to update heap locations
+ResolutionErrors.dfy(1499,23): Error: a hint is not allowed to update heap locations
+ResolutionErrors.dfy(1500,11): Error: calls to methods with side-effects are not allowed inside a hint
+ResolutionErrors.dfy(1503,21): Error: a while statement used inside a hint is not allowed to have a modifies clause
+ResolutionErrors.dfy(1491,24): Error: only ghost methods can be called from this context
+ResolutionErrors.dfy(1498,18): Error: Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ResolutionErrors.dfy(1527,20): Error: only ghost methods can be called from this context
+ResolutionErrors.dfy(1420,29): Error: only ghost methods can be called from this context
+ResolutionErrors.dfy(1422,17): Error: calls to methods with side-effects are not allowed inside a hint
+ResolutionErrors.dfy(1538,16): Error: a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating
+ResolutionErrors.dfy(1556,12): Error: trying to break out of more loop levels than there are enclosing loops
+ResolutionErrors.dfy(1568,16): Error: ghost fields are allowed only in specification contexts
+ResolutionErrors.dfy(1575,9): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(1581,4): Error: non-ghost variable cannot be assigned a value that depends on a ghost
+ResolutionErrors.dfy(1598,8): Error: print statement is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ResolutionErrors.dfy(1607,26): Error: ghost variables are allowed only in specification contexts
+ResolutionErrors.dfy(1615,6): Error: the type of the bound variable 't' could not be determined
+ResolutionErrors.dfy(1633,15): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (x)
+ResolutionErrors.dfy(1635,10): Error: Assignment to non-ghost field is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ResolutionErrors.dfy(1660,15): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (x)
+ResolutionErrors.dfy(1662,25): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ResolutionErrors.dfy(1663,35): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ResolutionErrors.dfy(1673,4): Error: 'decreases *' is not allowed on ghost loops
+ResolutionErrors.dfy(1677,8): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ResolutionErrors.dfy(1687,4): Error: 'decreases *' is not allowed on ghost loops
+ResolutionErrors.dfy(1691,29): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
 ResolutionErrors.dfy(469,2): Error: More than one anonymous constructor
 ResolutionErrors.dfy(50,13): Error: 'this' is not allowed in a 'static' context
 ResolutionErrors.dfy(87,14): Error: the name 'Benny' denotes a datatype constructor, but does not do so uniquely; add an explicit qualification (for example, 'Abc.Benny')
@@ -144,18 +157,14 @@ ResolutionErrors.dfy(475,14): Error: when allocating an object of type 'YHWH', o
 ResolutionErrors.dfy(480,6): Error: when allocating an object of type 'Lucifer', one of its constructor methods must be called
 ResolutionErrors.dfy(481,6): Error: when allocating an object of type 'Lucifer', one of its constructor methods must be called
 ResolutionErrors.dfy(483,9): Error: class Lamb does not have an anonymous constructor
-ResolutionErrors.dfy(850,11): Error: a modifies-clause expression must denote an object or a collection of objects (instead got int)
-ResolutionErrors.dfy(854,14): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (x)
-ResolutionErrors.dfy(857,12): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (x)
-ResolutionErrors.dfy(865,14): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (x)
-ResolutionErrors.dfy(875,18): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (x)
-ResolutionErrors.dfy(886,16): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (x)
-ResolutionErrors.dfy(1042,23): Error: unresolved identifier: x
-ResolutionErrors.dfy(1045,20): Error: unresolved identifier: x
-ResolutionErrors.dfy(1048,23): Error: unresolved identifier: x
-ResolutionErrors.dfy(1050,19): Error: unresolved identifier: x
-ResolutionErrors.dfy(1052,19): Error: unresolved identifier: x
-ResolutionErrors.dfy(12,16): Error: 'decreases *' is not allowed on ghost loops
+ResolutionErrors.dfy(853,11): Error: a modifies-clause expression must denote an object or a collection of objects (instead got int)
+ResolutionErrors.dfy(857,14): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (x)
+ResolutionErrors.dfy(1053,23): Error: unresolved identifier: x
+ResolutionErrors.dfy(1056,20): Error: unresolved identifier: x
+ResolutionErrors.dfy(1059,23): Error: unresolved identifier: x
+ResolutionErrors.dfy(1061,19): Error: unresolved identifier: x
+ResolutionErrors.dfy(1063,19): Error: unresolved identifier: x
+ResolutionErrors.dfy(12,16): Error: a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating
 ResolutionErrors.dfy(24,11): Error: array selection requires an array2 (got array3<T>)
 ResolutionErrors.dfy(25,12): Error: sequence/array/multiset/map selection requires a sequence, array, multiset, or map (got array3<T>)
 ResolutionErrors.dfy(26,11): Error: array selection requires an array4 (got array<T>)
@@ -187,17 +196,17 @@ ResolutionErrors.dfy(416,10): Error: second argument to ==> must be of type bool
 ResolutionErrors.dfy(421,10): Error: first argument to ==> must be of type bool (instead got int)
 ResolutionErrors.dfy(421,10): Error: second argument to ==> must be of type bool (instead got int)
 ResolutionErrors.dfy(580,18): Error: unresolved identifier: w
-ResolutionErrors.dfy(683,11): Error: lemmas are not allowed to have modifies clauses
-ResolutionErrors.dfy(924,9): Error: unresolved identifier: s
-ResolutionErrors.dfy(935,32): Error: RHS (of type (int,int,real)) not assignable to LHS (of type (int,real,int))
-ResolutionErrors.dfy(936,37): Error: RHS (of type (int,real,int)) not assignable to LHS (of type (int,real,int,real))
-ResolutionErrors.dfy(942,16): Error: condition is expected to be of type bool, but is int
-ResolutionErrors.dfy(943,16): Error: member 3 does not exist in datatype _tuple#3
-ResolutionErrors.dfy(943,26): Error: member x does not exist in datatype _tuple#2
-ResolutionErrors.dfy(966,15): Error: arguments to / must have the same type (got real and int)
-ResolutionErrors.dfy(967,10): Error: second argument to % must be of type int (instead got real)
-ResolutionErrors.dfy(1112,8): Error: new cannot be applied to a trait
-ResolutionErrors.dfy(1133,13): Error: first argument to / must be of numeric type (instead got set<bool>)
-ResolutionErrors.dfy(1140,18): Error: a call to a possibly non-terminating method is allowed only if the calling method is also declared (with 'decreases *') to be possibly non-terminating
-ResolutionErrors.dfy(1155,14): Error: a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating
-202 resolution/type errors detected in ResolutionErrors.dfy
+ResolutionErrors.dfy(686,11): Error: lemmas are not allowed to have modifies clauses
+ResolutionErrors.dfy(935,9): Error: unresolved identifier: s
+ResolutionErrors.dfy(946,32): Error: RHS (of type (int,int,real)) not assignable to LHS (of type (int,real,int))
+ResolutionErrors.dfy(947,37): Error: RHS (of type (int,real,int)) not assignable to LHS (of type (int,real,int,real))
+ResolutionErrors.dfy(953,16): Error: condition is expected to be of type bool, but is int
+ResolutionErrors.dfy(954,16): Error: member 3 does not exist in datatype _tuple#3
+ResolutionErrors.dfy(954,26): Error: member x does not exist in datatype _tuple#2
+ResolutionErrors.dfy(977,15): Error: arguments to / must have the same type (got real and int)
+ResolutionErrors.dfy(978,10): Error: second argument to % must be of type int (instead got real)
+ResolutionErrors.dfy(1123,8): Error: new cannot be applied to a trait
+ResolutionErrors.dfy(1144,13): Error: first argument to / must be of numeric type (instead got set<bool>)
+ResolutionErrors.dfy(1151,18): Error: a call to a possibly non-terminating method is allowed only if the calling method is also declared (with 'decreases *') to be possibly non-terminating
+ResolutionErrors.dfy(1166,14): Error: a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating
+211 resolution/type errors detected in ResolutionErrors.dfy
-- 
cgit v1.2.3


From fc76e0501cb3f1f7e9254b970315d4c63254a2d5 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Mon, 28 Sep 2015 15:38:41 -0700
Subject: Renamed CheckIsNonGhost to CheckIsCompilable.

---
 Source/Dafny/Resolver.cs | 40 ++++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 20 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index f4fac31b..a50d1a7d 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -1454,7 +1454,7 @@ namespace Microsoft.Dafny
                 } else if (member is Function) {
                   var f = (Function)member;
                   if (!f.IsGhost && f.Body != null) {
-                    CheckIsNonGhost(f.Body);
+                    CheckIsCompilable(f.Body);
                   }
                   DetermineTailRecursion(f);
                 }
@@ -3160,7 +3160,7 @@ namespace Microsoft.Dafny
           if (mustBeErasable) {
             Error(stmt, "print statement is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)");
           } else {
-            s.Args.Iter(resolver.CheckIsNonGhost);
+            s.Args.Iter(resolver.CheckIsCompilable);
           }
 
         } else if (stmt is BreakStmt) {
@@ -3235,19 +3235,19 @@ namespace Microsoft.Dafny
               AssignStmt.NonGhostKind_To_String(gk));
           } else if (s.Rhs is ExprRhs) {
             var rhs = (ExprRhs)s.Rhs;
-            resolver.CheckIsNonGhost(rhs.Expr);
+            resolver.CheckIsCompilable(rhs.Expr);
           } else if (s.Rhs is HavocRhs) {
             // cool
           } else {
             var rhs = (TypeRhs)s.Rhs;
             if (rhs.ArrayDimensions != null) {
               foreach (var dim in rhs.ArrayDimensions) {
-                resolver.CheckIsNonGhost(dim);
+                resolver.CheckIsCompilable(dim);
               }
             }
             if (rhs.InitCall != null) {
               foreach (var arg in rhs.InitCall.Args) {
-                resolver.CheckIsNonGhost(arg);
+                resolver.CheckIsCompilable(arg);
               }
             }
           }
@@ -3263,14 +3263,14 @@ namespace Microsoft.Dafny
               Error(s, "only ghost methods can be called from this context");
             }
           } else {
-            resolver.CheckIsNonGhost(s.Receiver);
+            resolver.CheckIsCompilable(s.Receiver);
             int j;
             if (!callee.IsGhost) {
               j = 0;
               foreach (var e in s.Args) {
                 Contract.Assume(j < callee.Ins.Count);  // this should have already been checked by the resolver
                 if (!callee.Ins[j].IsGhost) {
-                  resolver.CheckIsNonGhost(e);
+                  resolver.CheckIsCompilable(e);
                 }
                 j++;
               }
@@ -9283,7 +9283,7 @@ namespace Microsoft.Dafny
     /// Generate an error for every non-ghost feature used in "expr".
     /// Requires "expr" to have been successfully resolved.
     /// </summary>
-    void CheckIsNonGhost(Expression expr) {
+    void CheckIsCompilable(Expression expr) {
       Contract.Requires(expr != null);
       Contract.Requires(expr.WasResolved());  // this check approximates the requirement that "expr" be resolved
 
@@ -9309,10 +9309,10 @@ namespace Microsoft.Dafny
             return;
           }
           // function is okay, so check all NON-ghost arguments
-          CheckIsNonGhost(e.Receiver);
+          CheckIsCompilable(e.Receiver);
           for (int i = 0; i < e.Function.Formals.Count; i++) {
             if (!e.Function.Formals[i].IsGhost) {
-              CheckIsNonGhost(e.Args[i]);
+              CheckIsCompilable(e.Args[i]);
             }
           }
         }
@@ -9324,7 +9324,7 @@ namespace Microsoft.Dafny
         // note that if resolution is successful, then |e.Arguments| == |e.Ctor.Formals|
         for (int i = 0; i < e.Arguments.Count; i++) {
           if (!e.Ctor.Formals[i].IsGhost) {
-            CheckIsNonGhost(e.Arguments[i]);
+            CheckIsCompilable(e.Arguments[i]);
           }
         }
         return;
@@ -9343,7 +9343,7 @@ namespace Microsoft.Dafny
       } else if (expr is StmtExpr) {
         var e = (StmtExpr)expr;
         // ignore the statement
-        CheckIsNonGhost(e.E);
+        CheckIsCompilable(e.E);
         return;
 
       } else if (expr is BinaryExpr) {
@@ -9374,18 +9374,18 @@ namespace Microsoft.Dafny
           var i = 0;
           foreach (var ee in e.RHSs) {
             if (!e.LHSs[i].Vars.All(bv => bv.IsGhost)) {
-              CheckIsNonGhost(ee);
+              CheckIsCompilable(ee);
             }
             i++;
           }
-          CheckIsNonGhost(e.Body);
+          CheckIsCompilable(e.Body);
         } else {
           Contract.Assert(e.RHSs.Count == 1);
           var lhsVarsAreAllGhost = e.BoundVars.All(bv => bv.IsGhost);
           if (!lhsVarsAreAllGhost) {
-            CheckIsNonGhost(e.RHSs[0]);
+            CheckIsCompilable(e.RHSs[0]);
           }
-          CheckIsNonGhost(e.Body);
+          CheckIsCompilable(e.Body);
 
           // fill in bounds for this to-be-compiled let-such-that expression
           Contract.Assert(e.RHSs.Count == 1);  // if we got this far, the resolver will have checked this condition successfully
@@ -9405,7 +9405,7 @@ namespace Microsoft.Dafny
         return;
       } else if (expr is LambdaExpr) {
         var e = expr as LambdaExpr;
-        CheckIsNonGhost(e.Body);
+        CheckIsCompilable(e.Body);
         return;
       } else if (expr is ComprehensionExpr) {
         var e = (ComprehensionExpr)expr;
@@ -9437,18 +9437,18 @@ namespace Microsoft.Dafny
         }
       } else if (expr is NamedExpr) {
         if (!moduleInfo.IsAbstract)
-          CheckIsNonGhost(((NamedExpr)expr).Body);
+          CheckIsCompilable(((NamedExpr)expr).Body);
         return;
       } else if (expr is ChainingExpression) {
         // We don't care about the different operators; we only want the operands, so let's get them directly from
         // the chaining expression
         var e = (ChainingExpression)expr;
-        e.Operands.ForEach(CheckIsNonGhost);
+        e.Operands.ForEach(CheckIsCompilable);
         return;
       }
 
       foreach (var ee in expr.SubExpressions) {
-        CheckIsNonGhost(ee);
+        CheckIsCompilable(ee);
       }
     }
 
-- 
cgit v1.2.3


From 9dd401ba24bf795c73a8d66c0890c760de6c8ad5 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Mon, 28 Sep 2015 16:18:01 -0700
Subject: Removed the 'inSpecOnlyContext' map that had been part of the
 resolution of 'break' statements out of ghost structures.  This is now done
 in pass 2 by looking at the .IsGhost field of the target statement.

---
 Source/Dafny/Resolver.cs | 59 +++++++++++++++++++++++-------------------------
 1 file changed, 28 insertions(+), 31 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index a50d1a7d..9f2feb14 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -3136,17 +3136,23 @@ namespace Microsoft.Dafny
         resolver.reporter.Error(MessageSource.Resolver, tok, msg, msgArgs);
       }
       /// <summary>
-      /// This method does three things:
-      /// 0. Reports an error if "mustBeErasable" and the statement assigns to a non-ghost field
-      /// 1. Reports an error if the statement assigns to a non-ghost field and the right-hand side
-      ///    depends on a ghost.
-      /// 2. Sets to "true" the .IsGhost field of the statement if it should be erased during compilation.
-      ///    In that case, substatements should be visited with "mustBeErasable".
-      /// Note that the method called by a StmtExpr must be ghost; however, this is checked elsewhere.  For
-      /// this reason, it is not necessary to visit all subexpressions, unless the subexpression
-      /// matter for the ghost checking/recording of "stmt".
-      /// Note, it is important to set the statement's ghost status before descending into its sub-statements,
-      /// because break statements look at the ghost status of its enclosing statements.
+      /// This method does three things, in order:
+      /// 0. Sets .IsGhost to "true" if the statement is ghost.  This often depends on some guard of the statement
+      ///    (like the guard of an "if" statement) or the LHS of the statement (if it is an assignment).
+      ///    Note, if "mustBeErasable", then the statement is already in a ghost context.
+      ///    statement itself is ghost) or and the statement assigns to a non-ghost field
+      /// 1. Determines if the statement and all its subparts are legal under its computed .IsGhost setting.
+      /// 2. ``Upgrades'' .IsGhost to "true" if, after investigation of the substatements of the statement, it
+      ///    turns out that the statement can be erased during compilation.
+      /// Notes:
+      /// * Both step (0) and step (2) sets the .IsGhost field.  What step (0) does affects only the
+      ///   rules of resolution, whereas step (2) makes a note for the later compilation phase.
+      /// * It is important to do step (0) before step (1)--that is, it is important to set the statement's ghost
+      ///   status before descending into its sub-statements--because break statements look at the ghost status of
+      ///   its enclosing statements.
+      /// * The method called by a StmtExpr must be ghost; however, this is checked elsewhere.  For
+      ///   this reason, it is not necessary to visit all subexpressions, unless the subexpression
+      ///   matter for the ghost checking/recording of "stmt".
       /// </summary>
       public void Visit(Statement stmt, bool mustBeErasable) {
         Contract.Requires(stmt != null);
@@ -3165,11 +3171,10 @@ namespace Microsoft.Dafny
 
         } else if (stmt is BreakStmt) {
           var s = (BreakStmt)stmt;
-          if (mustBeErasable) {
-            if (!s.TargetStmt.IsGhost && !resolver.inSpecOnlyContext[s.TargetStmt]) {  // TODO: inSpecOnlyContext should probably move from Resolver to GhostInterest_Visitor
-              var targetIsLoop = s.TargetStmt is WhileStmt || s.TargetStmt is AlternativeLoopStmt;
-              Error(stmt, "ghost-context break statement is not allowed to break out of non-ghost " + (targetIsLoop ? "loop" : "structure"));
-            }
+          s.IsGhost = mustBeErasable;
+          if (s.IsGhost && !s.TargetStmt.IsGhost) {
+            var targetIsLoop = s.TargetStmt is WhileStmt || s.TargetStmt is AlternativeLoopStmt;
+            Error(stmt, "ghost-context break statement is not allowed to break out of non-ghost " + (targetIsLoop ? "loop" : "structure"));
           }
 
         } else if (stmt is ProduceStmt) {
@@ -3306,8 +3311,9 @@ namespace Microsoft.Dafny
 
         } else if (stmt is BlockStmt) {
           var s = (BlockStmt)stmt;
+          s.IsGhost = mustBeErasable;  // set .IsGhost before descending into substatements (since substatements may do a 'break' out of this block)
           s.Body.Iter(ss => Visit(ss, mustBeErasable));
-          s.IsGhost = s.Body.All(ss => ss.IsGhost);  // mark the block statement as ghost if all its substatements are ghost
+          s.IsGhost = s.IsGhost || s.Body.All(ss => ss.IsGhost);  // mark the block statement as ghost if all its substatements are ghost
 
         } else if (stmt is IfStmt) {
           var s = (IfStmt)stmt;
@@ -3378,14 +3384,16 @@ namespace Microsoft.Dafny
 
         } else if (stmt is MatchStmt) {
           var s = (MatchStmt)stmt;
-          var mbe = mustBeErasable || resolver.UsesSpecFeatures(s.Source);
-          s.Cases.Iter(kase => kase.Body.Iter(ss => Visit(ss, mbe)));
-          s.IsGhost = mbe || s.Cases.All(kase => kase.Body.All(ss => ss.IsGhost));
+          s.IsGhost = mustBeErasable || resolver.UsesSpecFeatures(s.Source);
+          s.Cases.Iter(kase => kase.Body.Iter(ss => Visit(ss, s.IsGhost)));
+          s.IsGhost = s.IsGhost || s.Cases.All(kase => kase.Body.All(ss => ss.IsGhost));
 
         } else if (stmt is SkeletonStatement) {
           var s = (SkeletonStatement)stmt;
+          s.IsGhost = mustBeErasable;
           if (s.S != null) {
             Visit(s.S, mustBeErasable);
+            s.IsGhost = s.IsGhost || s.S.IsGhost;
           }
 
         } else {
@@ -3509,7 +3517,6 @@ namespace Microsoft.Dafny
     readonly Scope<IVariable>/*!*/ scope = new Scope<IVariable>();
     Scope<Statement>/*!*/ labeledStatements = new Scope<Statement>();
     List<Statement> loopStack = new List<Statement>();  // the enclosing loops (from which it is possible to break out)
-    readonly Dictionary<Statement, bool> inSpecOnlyContext = new Dictionary<Statement, bool>();  // invariant: domain contain union of the domains of "labeledStatements" and "loopStack"
 
     /// <summary>
     /// This method resolves the types that have been given after the 'extends' keyword.  Then, it populates
@@ -5519,10 +5526,6 @@ namespace Microsoft.Dafny
 
         if (s.Body != null) {
           loopStack.Add(s);  // push
-          if (s.Labels == null) {  // otherwise, "s" is already in "inSpecOnlyContext" map
-            inSpecOnlyContext.Add(s, specContextOnly);
-          }
-
           ResolveStatement(s.Body, bodyMustBeSpecOnly, codeContext);
           loopStack.RemoveAt(loopStack.Count - 1);  // pop
         } else {
@@ -6405,9 +6408,6 @@ namespace Microsoft.Dafny
 
       if (loopToCatchBreaks != null) {
         loopStack.Add(loopToCatchBreaks);  // push
-        if (loopToCatchBreaks.Labels == null) {  // otherwise, "loopToCatchBreak" is already in "inSpecOnlyContext" map
-          inSpecOnlyContext.Add(loopToCatchBreaks, specContextOnly);
-        }
       }
       foreach (var alternative in alternatives) {
         scope.PushMarker();
@@ -6559,9 +6559,6 @@ namespace Microsoft.Dafny
           } else {
             var r = labeledStatements.Push(lnode.Name, ss);
             Contract.Assert(r == Scope<Statement>.PushResult.Success);  // since we just checked for duplicates, we expect the Push to succeed
-            if (l == ss.Labels) {  // add it only once
-              inSpecOnlyContext.Add(ss, specContextOnly);
-            }
           }
         }
         ResolveStatement(ss, specContextOnly, codeContext);
-- 
cgit v1.2.3


From 8a869bcfaeceb6b5a1d01e9b1c0c08b7000a094e Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Mon, 28 Sep 2015 22:47:35 -0700
Subject: Removed specContextOnly parameter from ResolveStatement. Moved all
 bounds discovery to resolution pass 1.

---
 Source/Dafny/Resolver.cs                | 277 ++++++++++++++------------------
 Test/dafny0/ResolutionErrors.dfy        |  26 +--
 Test/dafny0/ResolutionErrors.dfy.expect |  27 +++-
 Test/dafny4/Regression0.dfy             |   6 +-
 Test/dafny4/Regression0.dfy.expect      |   3 +-
 Test/dafny4/set-compr.dfy               |  54 +++++--
 Test/dafny4/set-compr.dfy.expect        |  15 +-
 Test/hofs/ReadsReads.dfy                |   4 +-
 8 files changed, 218 insertions(+), 194 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 9f2feb14..1c376c49 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -1336,11 +1336,6 @@ namespace Microsoft.Dafny
       // ---------------------------------- Pass 0 ----------------------------------
       // This pass resolves names, introduces (and may solve) type constraints, and
       // builds the module's call graph.
-      // Some bounds are discovered during this pass [is this necessary? can they be
-      // moved to pass 1 like the other bounds discovery? --KRML], namely:
-      //   - forall statements
-      //   - quantifier expressions
-      //   - map comprehensions
       // For 'newtype' declarations, it also checks that all types were fully
       // determined.
       // ----------------------------------------------------------------------------
@@ -1375,7 +1370,7 @@ namespace Microsoft.Dafny
             if (!CheckTypeInference_Visitor.IsDetermined(dd.BaseType.NormalizeExpand())) {
               reporter.Error(MessageSource.Resolver, dd.tok, "newtype's base type is not fully determined; add an explicit type for '{0}'", dd.Var.Name);
             }
-            CheckTypeInference(dd.Constraint);
+            CheckTypeInference(dd.Constraint, dd);
             scope.PopMarker();
           }
         }
@@ -1408,7 +1403,10 @@ namespace Microsoft.Dafny
       // * checks that type inference was able to determine all types
       // * fills in the .ResolvedOp field of binary expressions
       // * discovers bounds for:
+      //     - forall statements
       //     - set comprehensions
+      //     - map comprehensions
+      //     - quantifier expressions
       //     - assign-such-that statements
       //     - compilable let-such-that expressions
       //     - newtype constraints
@@ -1432,7 +1430,7 @@ namespace Microsoft.Dafny
               iter.SubExpressions.Iter(e => CheckExpression(e, this, iter));
             }
             if (iter.Body != null) {
-              CheckTypeInference(iter.Body);
+              CheckTypeInference(iter.Body, iter);
               if (prevErrCnt == reporter.Count(ErrorLevel.Error)) {
                 ComputeGhostInterest(iter.Body, false, iter);
                 CheckExpression(iter.Body, this, iter);
@@ -2047,22 +2045,22 @@ namespace Microsoft.Dafny
     private void CheckTypeInference_Member(MemberDecl member) {
       if (member is Method) {
         var m = (Method)member;
-        m.Req.Iter(CheckTypeInference_MaybeFreeExpression);
-        m.Ens.Iter(CheckTypeInference_MaybeFreeExpression);
-        CheckTypeInference_Specification_FrameExpr(m.Mod);
-        CheckTypeInference_Specification_Expr(m.Decreases);
+        m.Req.Iter(mfe => CheckTypeInference_MaybeFreeExpression(mfe, m));
+        m.Ens.Iter(mfe => CheckTypeInference_MaybeFreeExpression(mfe, m));
+        CheckTypeInference_Specification_FrameExpr(m.Mod, m);
+        CheckTypeInference_Specification_Expr(m.Decreases, m);
         if (m.Body != null) {
-          CheckTypeInference(m.Body);
+          CheckTypeInference(m.Body, m);
         }
       } else if (member is Function) {
         var f = (Function)member;
         var errorCount = reporter.Count(ErrorLevel.Error);
-        f.Req.Iter(CheckTypeInference);
-        f.Ens.Iter(CheckTypeInference);
-        f.Reads.Iter(fe => CheckTypeInference(fe.E));
-        CheckTypeInference_Specification_Expr(f.Decreases);
+        f.Req.Iter(e => CheckTypeInference(e, f));
+        f.Ens.Iter(e => CheckTypeInference(e, f));
+        f.Reads.Iter(fe => CheckTypeInference(fe.E, f));
+        CheckTypeInference_Specification_Expr(f.Decreases, f);
         if (f.Body != null) {
-          CheckTypeInference(f.Body);
+          CheckTypeInference(f.Body, f);
         }
         if (errorCount == reporter.Count(ErrorLevel.Error) && f is FixpointPredicate) {
           var cop = (FixpointPredicate)f;
@@ -2071,43 +2069,51 @@ namespace Microsoft.Dafny
       }
     }
 
-    private void CheckTypeInference_MaybeFreeExpression(MaybeFreeExpression mfe) {
+    private void CheckTypeInference_MaybeFreeExpression(MaybeFreeExpression mfe, ICodeContext codeContext) {
       Contract.Requires(mfe != null);
+      Contract.Requires(codeContext != null);
       foreach (var e in Attributes.SubExpressions(mfe.Attributes)) {
-        CheckTypeInference(e);
+        CheckTypeInference(e, codeContext);
       }
-      CheckTypeInference(mfe.E);
+      CheckTypeInference(mfe.E, codeContext);
     }
-    private void CheckTypeInference_Specification_Expr(Specification<Expression> spec) {
+    private void CheckTypeInference_Specification_Expr(Specification<Expression> spec, ICodeContext codeContext) {
       Contract.Requires(spec != null);
+      Contract.Requires(codeContext != null);
       foreach (var e in Attributes.SubExpressions(spec.Attributes)) {
-        CheckTypeInference(e);
+        CheckTypeInference(e, codeContext);
       }
-      spec.Expressions.Iter(CheckTypeInference);
+      spec.Expressions.Iter(e => CheckTypeInference(e, codeContext));
     }
-    private void CheckTypeInference_Specification_FrameExpr(Specification<FrameExpression> spec) {
+    private void CheckTypeInference_Specification_FrameExpr(Specification<FrameExpression> spec, ICodeContext codeContext) {
       Contract.Requires(spec != null);
+      Contract.Requires(codeContext != null);
       foreach (var e in Attributes.SubExpressions(spec.Attributes)) {
-        CheckTypeInference(e);
+        CheckTypeInference(e, codeContext);
       }
-      spec.Expressions.Iter(fe => CheckTypeInference(fe.E));
+      spec.Expressions.Iter(fe => CheckTypeInference(fe.E, codeContext));
     }
-    void CheckTypeInference(Expression expr) {
+    void CheckTypeInference(Expression expr, ICodeContext codeContext) {
       Contract.Requires(expr != null);
+      Contract.Requires(codeContext != null);
       PartiallySolveTypeConstraints();
-      var c = new CheckTypeInference_Visitor(this);
+      var c = new CheckTypeInference_Visitor(this, codeContext);
       c.Visit(expr);
     }
-    void CheckTypeInference(Statement stmt) {
+    void CheckTypeInference(Statement stmt, ICodeContext codeContext) {
       Contract.Requires(stmt != null);
-      var c = new CheckTypeInference_Visitor(this);
+      Contract.Requires(codeContext != null);
+      var c = new CheckTypeInference_Visitor(this, codeContext);
       c.Visit(stmt);
     }
     class CheckTypeInference_Visitor : ResolverBottomUpVisitor
     {
-      public CheckTypeInference_Visitor(Resolver resolver)
+      readonly ICodeContext codeContext;
+      public CheckTypeInference_Visitor(Resolver resolver, ICodeContext codeContext)
         : base(resolver) {
         Contract.Requires(resolver != null);
+        Contract.Requires(codeContext != null);
+        this.codeContext = codeContext;
       }
       protected override void VisitOneStmt(Statement stmt) {
         if (stmt is VarDeclStmt) {
@@ -2118,6 +2124,9 @@ namespace Microsoft.Dafny
         } else if (stmt is ForallStmt) {
           var s = (ForallStmt)stmt;
           s.BoundVars.Iter(bv => CheckTypeIsDetermined(bv.tok, bv.Type, "bound variable"));
+          List<BoundVar> missingBounds;
+          s.Bounds = DiscoverBestBounds_MultipleVars(s.BoundVars, s.Range, true, true, out missingBounds);
+
         } else if (stmt is AssignSuchThatStmt) {
           var s = (AssignSuchThatStmt)stmt;
           if (s.AssumeToken == null) {
@@ -2154,27 +2163,55 @@ namespace Microsoft.Dafny
               resolver.reporter.Error(MessageSource.Resolver, bv.tok, "type of bound variable '{0}' could not be determined; please specify the type explicitly", bv.Name);
             }
           }
-          if (e is SetComprehension) {
-            var sc = (SetComprehension)e;
-            if (sc.Finite) {
-              // A set must be finite.  Discover bounds for the Range expression, but report an error only if the Term is not
-              // of a finite-individuals type.
-              List<BoundVar> missingBounds;
-              sc.Bounds = DiscoverBestBounds_MultipleVars(sc.BoundVars, sc.Range, true, true, out missingBounds);
-              if (missingBounds.Count != 0) {
-                sc.MissingBounds = missingBounds;
-                if (sc.Type.HasFinitePossibleValues) {
-                  // This means the set is finite, regardless of if the Range is bounded.  So, we don't give any error here.
-                  // However, if this expression is used in a non-ghost context (which is not yet known at this stage of
-                  // resolution), the resolver will generate an error about that later.
-                } else {
-                  foreach (var bv in sc.MissingBounds) {
-                    resolver.reporter.Error(MessageSource.Resolver, sc, "a set comprehension must produce a finite set, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
-                  }
+          // apply bounds discovery to quantifiers, finite sets, and finite maps
+          string what = null;
+          Expression whereToLookForBounds = null;
+          bool polarity = true;
+          if (e is QuantifierExpr) {
+            what = "quantifier";
+            whereToLookForBounds = ((QuantifierExpr)e).LogicalBody();
+            polarity = e is ExistsExpr;
+          } else if (e is SetComprehension && ((SetComprehension)e).Finite) {
+            what = "set comprehension";
+            whereToLookForBounds = e.Range;
+          } else if (e is MapComprehension && ((MapComprehension)e).Finite) {
+            what = "map comprehension";
+            whereToLookForBounds = e.Range;
+          }
+          if (whereToLookForBounds != null) {
+            List<BoundVar> missingBounds;
+            e.Bounds = DiscoverBestBounds_MultipleVars(e.BoundVars, whereToLookForBounds, polarity, true, out missingBounds);
+            if (missingBounds.Count != 0) {
+              e.MissingBounds = missingBounds;
+
+              if ((e is SetComprehension && !((SetComprehension)e).Finite) || (e is MapComprehension && !((MapComprehension)e).Finite)) {
+                // a possibly infinite set/map has no restrictions on its range
+              } else if (e is QuantifierExpr) {
+                // don't report any errors at this time (instead, wait to see if the quantifier is used in a non-ghost context)
+              } else if (e is SetComprehension && e.Type.HasFinitePossibleValues) {
+                // This means the set is finite, regardless of if the Range is bounded.  So, we don't give any error here.
+                // However, if this expression is used in a non-ghost context (which is not yet known at this stage of
+                // resolution), the resolver will generate an error about that later.
+              } else {
+                // we cannot be sure that the set/map really is finite
+                foreach (var bv in missingBounds) {
+                  resolver.reporter.Error(MessageSource.Resolver, e, "a {0} must produce a finite set, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{1}'", what, bv.Name);
+                }
+              }
+            }
+            if (codeContext is Function && e.Bounds != null) {
+              // functions are not allowed to depend on the set of allocated objects
+              Contract.Assert(e.Bounds.Count == e.BoundVars.Count);
+              for (int i = 0; i < e.Bounds.Count; i++) {
+                var bound = e.Bounds[i] as ComprehensionExpr.RefBoundedPool;
+                if (bound != null) {
+                  var bv = e.BoundVars[i];
+                  resolver.reporter.Error(MessageSource.Resolver, expr, "a {0} involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of '{1}'", what, bv.Name);
                 }
               }
             }
           }
+
         } else if (expr is MemberSelectExpr) {
           var e = (MemberSelectExpr)expr;
           if (e.Member is Function || e.Member is Method) {
@@ -4035,7 +4072,7 @@ namespace Microsoft.Dafny
             int prevErrors = reporter.Count(ErrorLevel.Error);
             ResolveExpression(arg, opts);
             if (prevErrors == reporter.Count(ErrorLevel.Error)) {
-              CheckTypeInference(arg);
+              CheckTypeInference(arg, opts.codeContext);
             }
           }
         }
@@ -4289,7 +4326,7 @@ namespace Microsoft.Dafny
             scope.Push(k.Name, k);  // we expect no name conflict for _k
           }
           var prevErrorCount = reporter.Count(ErrorLevel.Error);
-          ResolveBlockStatement(m.Body, m.IsGhost, m);
+          ResolveBlockStatement(m.Body, m);
           SolveAllTypeConstraints();
           if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
 //KRML            ComputeGhostInterest(m.Body, m);
@@ -4411,7 +4448,7 @@ namespace Microsoft.Dafny
 
       // Resolve body
       if (iter.Body != null) {
-        ResolveBlockStatement(iter.Body, false, iter);
+        ResolveBlockStatement(iter.Body, iter);
         if (reporter.Count(ErrorLevel.Error) == postSpecErrorCount) {
           //KRML          ComputeGhostInterest(iter.Body, iter);
         }
@@ -5249,11 +5286,7 @@ namespace Microsoft.Dafny
       return at;
     }
 
-    /// <summary>
-    /// "specContextOnly" means that the statement must be erasable, that is, it should be okay to omit it
-    /// at run time.  That means it must not have any side effects on non-ghost variables, for example.
-    /// </summary>
-    public void ResolveStatement(Statement stmt, bool specContextOnly, ICodeContext codeContext) {
+    public void ResolveStatement(Statement stmt, ICodeContext codeContext) {
       Contract.Requires(stmt != null);
       Contract.Requires(codeContext != null);
       if (!(stmt is ForallStmt)) {  // forall statements do their own attribute resolution below
@@ -5328,13 +5361,13 @@ namespace Microsoft.Dafny
             }
             s.hiddenUpdate = new UpdateStmt(s.Tok, s.EndTok, formals, s.rhss, true);
             // resolving the update statement will check for return/yield statement specifics.
-            ResolveStatement(s.hiddenUpdate, specContextOnly, codeContext);
+            ResolveStatement(s.hiddenUpdate, codeContext);
           }
         } else {// this is a regular return/yield statement.
           s.hiddenUpdate = null;
         }
       } else if (stmt is ConcreteUpdateStatement) {
-        ResolveConcreteUpdateStmt((ConcreteUpdateStatement)stmt, specContextOnly, codeContext);
+        ResolveConcreteUpdateStmt((ConcreteUpdateStatement)stmt, codeContext);
       } else if (stmt is VarDeclStmt) {
         var s = (VarDeclStmt)stmt;
         // We have three cases.
@@ -5370,7 +5403,7 @@ namespace Microsoft.Dafny
             lhs.Type = local.Type;
           }
           // resolve the whole thing
-          ResolveConcreteUpdateStmt(s.Update, specContextOnly, codeContext);
+          ResolveConcreteUpdateStmt(s.Update, codeContext);
         }
         // Add the locals to the scope
         foreach (var local in s.Locals) {
@@ -5382,7 +5415,7 @@ namespace Microsoft.Dafny
         }
         // Resolve the AssignSuchThatStmt, if any
         if (s.Update is AssignSuchThatStmt) {
-          ResolveConcreteUpdateStmt(s.Update, specContextOnly, codeContext);
+          ResolveConcreteUpdateStmt(s.Update, codeContext);
         }
         // Update the VarDeclStmt's ghost status according to its components
         foreach (var local in s.Locals)
@@ -5481,52 +5514,40 @@ namespace Microsoft.Dafny
       } else if (stmt is BlockStmt) {
         var s = (BlockStmt)stmt;
         scope.PushMarker();
-        ResolveBlockStatement(s, specContextOnly, codeContext);
+        ResolveBlockStatement(s, codeContext);
         scope.PopMarker();
 
       } else if (stmt is IfStmt) {
         IfStmt s = (IfStmt)stmt;
-        bool branchesAreSpecOnly = specContextOnly;
         if (s.Guard != null) {
-          int prevErrorCount = reporter.Count(ErrorLevel.Error);
           ResolveExpression(s.Guard, new ResolveOpts(codeContext, true));
           Contract.Assert(s.Guard.Type != null);  // follows from postcondition of ResolveExpression
-          bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
           ConstrainTypes(s.Guard.Type, Type.Bool, s.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Guard.Type);
-          if (!specContextOnly && successfullyResolved) {
-            branchesAreSpecOnly = UsesSpecFeatures(s.Guard);
-          }
         }
-        ResolveStatement(s.Thn, branchesAreSpecOnly, codeContext);
+        ResolveStatement(s.Thn, codeContext);
         if (s.Els != null) {
-          ResolveStatement(s.Els, branchesAreSpecOnly, codeContext);
+          ResolveStatement(s.Els, codeContext);
         }
 
       } else if (stmt is AlternativeStmt) {
         var s = (AlternativeStmt)stmt;
-        ResolveAlternatives(s.Alternatives, specContextOnly, null, codeContext);
+        ResolveAlternatives(s.Alternatives, null, codeContext);
 
       } else if (stmt is WhileStmt) {
         WhileStmt s = (WhileStmt)stmt;
-        bool bodyMustBeSpecOnly = specContextOnly;
         var fvs = new HashSet<IVariable>();
         if (s.Guard != null) {
-          int prevErrorCount = reporter.Count(ErrorLevel.Error);
           ResolveExpression(s.Guard, new ResolveOpts(codeContext, true));
           Contract.Assert(s.Guard.Type != null);  // follows from postcondition of ResolveExpression
-          bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
           Translator.ComputeFreeVariables(s.Guard, fvs);
           ConstrainTypes(s.Guard.Type, Type.Bool, s.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Guard.Type);
-          if (!specContextOnly && successfullyResolved) {
-            bodyMustBeSpecOnly = UsesSpecFeatures(s.Guard);
-          }
         }
 
         ResolveLoopSpecificationComponents(s.Invariants, s.Decreases, s.Mod, codeContext, fvs);
 
         if (s.Body != null) {
           loopStack.Add(s);  // push
-          ResolveStatement(s.Body, bodyMustBeSpecOnly, codeContext);
+          ResolveStatement(s.Body, codeContext);
           loopStack.RemoveAt(loopStack.Count - 1);  // pop
         } else {
           string text = "havoc {" + Util.Comma(", ", fvs, fv => fv.Name) + "};";  // always terminate with a semi-colon
@@ -5535,7 +5556,7 @@ namespace Microsoft.Dafny
 
       } else if (stmt is AlternativeLoopStmt) {
         var s = (AlternativeLoopStmt)stmt;
-        ResolveAlternatives(s.Alternatives, specContextOnly, s, codeContext);
+        ResolveAlternatives(s.Alternatives, s, codeContext);
         ResolveLoopSpecificationComponents(s.Invariants, s.Decreases, s.Mod, codeContext, null);
 
       } else if (stmt is ForallStmt) {
@@ -5559,23 +5580,13 @@ namespace Microsoft.Dafny
         // first (above) and only then resolve the attributes (below).
         ResolveAttributes(s.Attributes, new ResolveOpts(codeContext, true));
 
-        bool bodyMustBeSpecOnly = specContextOnly || (prevErrorCount == reporter.Count(ErrorLevel.Error) && UsesSpecFeatures(s.Range));
-        if (!bodyMustBeSpecOnly && prevErrorCount == reporter.Count(ErrorLevel.Error)) {
-          CheckTypeInference(s.Range);  // we need to resolve operators before the call to DiscoverBounds
-          List<BoundVar> missingBounds;
-          s.Bounds = DiscoverBestBounds_MultipleVars(s.BoundVars, s.Range, true, true, out missingBounds);
-          if (missingBounds.Count != 0) {
-            bodyMustBeSpecOnly = true;
-          }
-        }
-
         if (s.Body != null) {
           // clear the labels for the duration of checking the body, because break statements are not allowed to leave a forall statement
           var prevLblStmts = labeledStatements;
           var prevLoopStack = loopStack;
           labeledStatements = new Scope<Statement>();
           loopStack = new List<Statement>();
-          ResolveStatement(s.Body, bodyMustBeSpecOnly, codeContext);
+          ResolveStatement(s.Body, codeContext);
           labeledStatements = prevLblStmts;
           loopStack = prevLoopStack;
         }
@@ -5627,7 +5638,7 @@ namespace Microsoft.Dafny
           ResolveFrameExpression(fe, false, codeContext);
         }
         if (s.Body != null) {
-          ResolveBlockStatement(s.Body, specContextOnly, codeContext);
+          ResolveBlockStatement(s.Body, codeContext);
         }
 
       } else if (stmt is CalcStmt) {
@@ -5658,7 +5669,7 @@ namespace Microsoft.Dafny
           labeledStatements = new Scope<Statement>();
           loopStack = new List<Statement>();
           foreach (var h in s.Hints) {
-            ResolveStatement(h, true, codeContext);
+            ResolveStatement(h, codeContext);
           }
           labeledStatements = prevLblStmts;
           loopStack = prevLoopStack;
@@ -5675,13 +5686,13 @@ namespace Microsoft.Dafny
         Contract.Assert(prevErrorCount != reporter.Count(ErrorLevel.Error) || s.Steps.Count == s.Hints.Count);
 
       } else if (stmt is MatchStmt) {
-        ResolveMatchStmt(stmt, specContextOnly, codeContext);
+        ResolveMatchStmt(stmt, codeContext);
       } else if (stmt is SkeletonStatement) {
         var s = (SkeletonStatement)stmt;
         reporter.Error(MessageSource.Resolver, s.Tok, "skeleton statements are allowed only in refining methods");
         // nevertheless, resolve the underlying statement; hey, why not
         if (s.S != null) {
-          ResolveStatement(s.S, specContextOnly, codeContext);
+          ResolveStatement(s.S, codeContext);
         }
       } else {
         Contract.Assert(false); throw new cce.UnreachableException();
@@ -5726,18 +5737,12 @@ namespace Microsoft.Dafny
       }
     }
 
-    void ResolveMatchStmt(Statement stmt, bool specContextOnly, ICodeContext codeContext) {
+    void ResolveMatchStmt(Statement stmt, ICodeContext codeContext) {
       MatchStmt s = (MatchStmt)stmt;
       DesugarMatchStmtWithTupleExpression(s);
 
-      bool bodyIsSpecOnly = specContextOnly;
-      int prevErrorCount = reporter.Count(ErrorLevel.Error);
       ResolveExpression(s.Source, new ResolveOpts(codeContext, true));
       Contract.Assert(s.Source.Type != null);  // follows from postcondition of ResolveExpression
-      bool successfullyResolved = reporter.Count(ErrorLevel.Error) == prevErrorCount;
-      if (!specContextOnly && successfullyResolved) {
-        bodyIsSpecOnly = UsesSpecFeatures(s.Source);
-      }
       UserDefinedType sourceType = null;
       DatatypeDecl dtd = null;
       if (s.Source.Type.IsDatatype) {
@@ -5814,7 +5819,7 @@ namespace Microsoft.Dafny
           }
         }
         foreach (Statement ss in mc.Body) {
-          ResolveStatement(ss, bodyIsSpecOnly, codeContext);
+          ResolveStatement(ss, codeContext);
         }
         // substitute body to replace the case pat with v. This needs to happen
         // after the body is resolved so we can scope the bv correctly.
@@ -5824,7 +5829,7 @@ namespace Microsoft.Dafny
           foreach (Statement ss in mc.Body) {
             Statement clone = cloner.CloneStmt(ss);
             // resolve it again since we just cloned it.
-            ResolveStatement(clone, bodyIsSpecOnly, codeContext);
+            ResolveStatement(clone, codeContext);
             list.Add(clone);
           }
           mc.UpdateBody(list);
@@ -6242,7 +6247,7 @@ namespace Microsoft.Dafny
         reporter.Info(MessageSource.Resolver, loopStmt.Tok, s);
       }
     }
-    private void ResolveConcreteUpdateStmt(ConcreteUpdateStatement s, bool specContextOnly, ICodeContext codeContext) {
+    private void ResolveConcreteUpdateStmt(ConcreteUpdateStatement s, ICodeContext codeContext) {
       Contract.Requires(codeContext != null);
 
       // First, resolve all LHS's and expression-looking RHS's.
@@ -6265,7 +6270,7 @@ namespace Microsoft.Dafny
         var suchThat = (AssignSuchThatStmt)s;  // this is the other possible subclass
         ResolveAssignSuchThatStmt(suchThat, codeContext);
       } else {
-        ResolveUpdateStmt(update, specContextOnly, codeContext, errorCountBeforeCheckingLhs);
+        ResolveUpdateStmt(update, codeContext, errorCountBeforeCheckingLhs);
       }
       ResolveAttributes(s.Attributes, new ResolveOpts(codeContext, true));
     }
@@ -6274,7 +6279,7 @@ namespace Microsoft.Dafny
     /// errorCountBeforeCheckingLhs is passed in so that this method can determined if any resolution errors were found during
     /// LHS or RHS checking, because only if no errors were found is update.ResolvedStmt changed.
     /// </summary>
-    private void ResolveUpdateStmt(UpdateStmt update, bool specContextOnly, ICodeContext codeContext, int errorCountBeforeCheckingLhs) {
+    private void ResolveUpdateStmt(UpdateStmt update, ICodeContext codeContext, int errorCountBeforeCheckingLhs) {
       Contract.Requires(update != null);
       Contract.Requires(codeContext != null);
       IToken firstEffectfulRhs = null;
@@ -6367,7 +6372,7 @@ namespace Microsoft.Dafny
       }
 
       foreach (var a in update.ResolvedStatements) {
-        ResolveStatement(a, specContextOnly, codeContext);
+        ResolveStatement(a, codeContext);
       }
     }
 
@@ -6393,7 +6398,7 @@ namespace Microsoft.Dafny
       ConstrainTypes(s.Expr.Type, Type.Bool, s.Expr, "type of RHS of assign-such-that statement must be boolean (got {0})", s.Expr.Type);
     }
 
-    void ResolveAlternatives(List<GuardedAlternative> alternatives, bool specContextOnly, AlternativeLoopStmt loopToCatchBreaks, ICodeContext codeContext) {
+    void ResolveAlternatives(List<GuardedAlternative> alternatives, AlternativeLoopStmt loopToCatchBreaks, ICodeContext codeContext) {
       Contract.Requires(alternatives != null);
       Contract.Requires(codeContext != null);
 
@@ -6412,7 +6417,7 @@ namespace Microsoft.Dafny
       foreach (var alternative in alternatives) {
         scope.PushMarker();
         foreach (Statement ss in alternative.Body) {
-          ResolveStatement(ss, specContextOnly, codeContext);
+          ResolveStatement(ss, codeContext);
         }
         scope.PopMarker();
       }
@@ -6541,7 +6546,7 @@ namespace Microsoft.Dafny
       }
     }
 
-    void ResolveBlockStatement(BlockStmt blockStmt, bool specContextOnly, ICodeContext codeContext) {
+    void ResolveBlockStatement(BlockStmt blockStmt, ICodeContext codeContext) {
       Contract.Requires(blockStmt != null);
       Contract.Requires(codeContext != null);
 
@@ -6561,7 +6566,7 @@ namespace Microsoft.Dafny
             Contract.Assert(r == Scope<Statement>.PushResult.Success);  // since we just checked for duplicates, we expect the Push to succeed
           }
         }
-        ResolveStatement(ss, specContextOnly, codeContext);
+        ResolveStatement(ss, codeContext);
         labeledStatements.PopMarker();
       }
     }
@@ -7878,25 +7883,6 @@ namespace Microsoft.Dafny
         allTypeParameters.PopMarker();
         expr.Type = Type.Bool;
 
-        if (prevErrorCount == reporter.Count(ErrorLevel.Error)) {
-          CheckTypeInference(e.LogicalBody());  // we need to resolve operators before the call to DiscoverBounds
-          List<BoundVar> missingBounds;
-          e.Bounds = DiscoverBestBounds_MultipleVars(e.BoundVars, e.LogicalBody(), e is ExistsExpr, true, out missingBounds);
-          if (missingBounds.Count != 0) {
-            e.MissingBounds = missingBounds;
-          }
-          if (opts.codeContext is Function && e.Bounds != null) {
-            Contract.Assert(e.Bounds.Count == e.BoundVars.Count);
-            for (int i = 0; i < e.Bounds.Count; i++) {
-              var bound = e.Bounds[i] as ComprehensionExpr.RefBoundedPool;
-              if (bound != null) {
-                var bv = e.BoundVars[i];
-                reporter.Error(MessageSource.Resolver, expr, "a quantifier involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of '{0}'", bv.Name);
-              }
-            }
-          }
-        }
-
       } else if (expr is SetComprehension) {
         var e = (SetComprehension)expr;
         int prevErrorCount = reporter.Count(ErrorLevel.Error);
@@ -7936,19 +7922,6 @@ namespace Microsoft.Dafny
         scope.PopMarker();
         expr.Type = new MapType(e.Finite, e.BoundVars[0].Type, e.Term.Type);
 
-        if (prevErrorCount == reporter.Count(ErrorLevel.Error)) {
-          CheckTypeInference(e.Range);  // we need to resolve operators before the call to DiscoverBounds
-          List<BoundVar> missingBounds;
-          e.Bounds = DiscoverBestBounds_MultipleVars(e.BoundVars, e.Range, true, true, out missingBounds);
-          if (missingBounds.Count != 0) {
-            e.MissingBounds = missingBounds;
-            if (e.Finite) {
-              foreach (var bv in e.MissingBounds) {
-                reporter.Error(MessageSource.Resolver, expr, "a map comprehension must produce a finite domain, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
-              }
-            }
-          }
-        }
       } else if (expr is LambdaExpr) {
         var e = (LambdaExpr)expr;
         int prevErrorCount = reporter.Count(ErrorLevel.Error);
@@ -7977,7 +7950,7 @@ namespace Microsoft.Dafny
       } else if (expr is StmtExpr) {
         var e = (StmtExpr)expr;
         int prevErrorCount = reporter.Count(ErrorLevel.Error);
-        ResolveStatement(e.S, true, opts.codeContext);
+        ResolveStatement(e.S, opts.codeContext);
         if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
           var r = e.S as UpdateStmt;
           if (r != null && r.ResolvedStatements.Count == 1) {
@@ -10335,21 +10308,19 @@ namespace Microsoft.Dafny
         }
       } else if (expr is NamedExpr) {
         return moduleInfo.IsAbstract ? false : UsesSpecFeatures(((NamedExpr)expr).Body);
-      } else if (expr is ComprehensionExpr) {
-        var q = expr as QuantifierExpr;
-        Contract.Assert(q == null || q.SplitQuantifier == null); // No split quantifiers during resolution
-        if (q != null && q.Bounds.Contains(null)) {
-          return true;  // the quantifier cannot be compiled if the resolver found no bounds
-        }
-        return Contract.Exists(expr.SubExpressions, se => UsesSpecFeatures(se));
+      } else if (expr is QuantifierExpr) {
+        var e = (QuantifierExpr)expr;
+        Contract.Assert(e.SplitQuantifier == null); // No split quantifiers during resolution
+        return e.UncompilableBoundVars().Count != 0;
       } else if (expr is SetComprehension) {
         var e = (SetComprehension)expr;
-        return (e.Range != null && UsesSpecFeatures(e.Range)) || (e.Term != null && UsesSpecFeatures(e.Term));
+        return !e.Finite || e.UncompilableBoundVars().Count != 0 || (e.Range != null && UsesSpecFeatures(e.Range)) || (e.Term != null && UsesSpecFeatures(e.Term));
       } else if (expr is MapComprehension) {
         var e = (MapComprehension)expr;
-        return (UsesSpecFeatures(e.Range)) || (UsesSpecFeatures(e.Term));
+        return !e.Finite || e.UncompilableBoundVars().Count != 0 || UsesSpecFeatures(e.Range) || UsesSpecFeatures(e.Term);
       } else if (expr is LambdaExpr) {
-        return Contract.Exists(expr.SubExpressions, UsesSpecFeatures);
+        var e = (LambdaExpr)expr;
+        return UsesSpecFeatures(e.Term);
       } else if (expr is WildcardExpr) {
         return false;
       } else if (expr is StmtExpr) {
diff --git a/Test/dafny0/ResolutionErrors.dfy b/Test/dafny0/ResolutionErrors.dfy
index 49e6efa0..e935c83d 100644
--- a/Test/dafny0/ResolutionErrors.dfy
+++ b/Test/dafny0/ResolutionErrors.dfy
@@ -586,16 +586,16 @@ method LetSuchThat(ghost z: int, n: nat)
 module NonInferredType {
   predicate P<T>(x: T)
 
-  method NonInferredType0(x: int)
+  method InferredType(x: int)
   {
     var t;
-    assume forall z :: P(z) && z == t;  // It would be nice to allow the following example, but the implementation calls DiscoverBounds before CheckInference for quantifiers.
+    assume forall z :: P(z) && z == t;
     assume t == x;  // this statement determines the type of t and z
   }
 
-  method NonInferredType1(x: int)
+  method NonInferredType(x: int)
   {
-    var t;
+    var t;  // error: the type of t is not determined
     assume forall z :: P(z) && z == t;  // error: the type of z is not determined
   }
 }
@@ -1126,15 +1126,15 @@ method TraitSynonym()
 // ----- set comprehensions where the term type is finite -----
 
 module ObjectSetComprehensions {
-  // allowed in non-ghost context:
-  function A() : set<object> { set o : object | true :: o }
+  // the following set comprehensions are known to be finite
+  function A() : set<object> { set o : object | true :: o }  // error: a function is not allowed to depend on the allocated state
 
-  lemma B() { var x := set o : object | true :: o; }
+  function method B() : set<object> { set o : object | true :: o }  // error: a function is not allowed to depend on the allocated state
 
-  // not allowed in non-ghost context:
-  function method C() : set<object> { set o : object | true :: o }
+  // outside functions, the comprehension is permitted, but it cannot be compiled
+  lemma C() { var x := set o : object | true :: o; }
 
-  method D() { var x := set o : object | true :: o; }
+  method D() { var x := set o : object | true :: o; }  // error: not (easily) compilable
 }
 
 // ------ regression test for type checking of integer division -----
@@ -1228,9 +1228,9 @@ module NonInferredTypeVariables {
   method BadClient(n: nat)
   {
     var p := P(n);  // error: cannot infer the type argument for P
-    ghost var q := Q(n);  // error: cannot infer the type argument for Q
+    ghost var q := Q(n);  // error: cannot infer the type argument for Q (and thus q's type cannot be determined either)
     M(n);  // error: cannot infer the type argument for M
-    var x := N(n);  // error: cannot infer the type argument for N
+    var x := N(n);  // error: cannot infer the type argument for N (and thus x's type cannot be determined either)
     var a := new array;  // error: cannot infer the type argument for 'array'
     var c := new C;  // error: cannot infer the type argument for 'C'
     var s: set;  // type argument for 'set' 
@@ -1248,7 +1248,7 @@ module NonInferredTypeVariables {
     ghost var d0 := forall s :: s == {7} ==> s != {};
     var d1 := forall s: set :: s in S ==> s == {};
     var ggcc0: C;
-    var ggcc1: C;
+    var ggcc1: C;  // error: full type cannot be determined
     ghost var d2 := forall c: C :: c != null ==> c.f == 10;
     ghost var d2' := forall c :: c == ggcc0 && c != null ==> c.f == 10;
     ghost var d2'' := forall c :: c == ggcc1 && c != null ==> c.f == c.f; // error: here, type of c is not determined
diff --git a/Test/dafny0/ResolutionErrors.dfy.expect b/Test/dafny0/ResolutionErrors.dfy.expect
index edf61b33..be19eeac 100644
--- a/Test/dafny0/ResolutionErrors.dfy.expect
+++ b/Test/dafny0/ResolutionErrors.dfy.expect
@@ -20,10 +20,9 @@ ResolutionErrors.dfy(535,7): Error: RHS (of type List<A>) not assignable to LHS
 ResolutionErrors.dfy(540,7): Error: RHS (of type List<A>) not assignable to LHS (of type List<B>)
 ResolutionErrors.dfy(554,23): Error: type of case bodies do not agree (found Tree<_T1,_T0>, previous types Tree<_T0,_T1>)
 ResolutionErrors.dfy(566,24): Error: Wrong number of type arguments (0 instead of 2) passed to datatype: Tree
-ResolutionErrors.dfy(592,25): Error: the type of this variable is underspecified
-ResolutionErrors.dfy(592,23): Error: type variable 'T' in the function call to 'P' could not be determined
-ResolutionErrors.dfy(599,25): Error: the type of this variable is underspecified
+ResolutionErrors.dfy(598,8): Error: the type of this local variable is underspecified
 ResolutionErrors.dfy(599,23): Error: type variable 'T' in the function call to 'P' could not be determined
+ResolutionErrors.dfy(599,18): Error: type of bound variable 'z' could not be determined; please specify the type explicitly
 ResolutionErrors.dfy(612,13): Error: 'new' is not allowed in ghost contexts
 ResolutionErrors.dfy(613,9): Error: 'new' is not allowed in ghost contexts
 ResolutionErrors.dfy(622,23): Error: 'new' is not allowed in ghost contexts
@@ -81,12 +80,28 @@ ResolutionErrors.dfy(1105,6): Error: RHS (of type P<int>) not assignable to LHS
 ResolutionErrors.dfy(1110,13): Error: arguments must have the same type (got P<int> and P<X>)
 ResolutionErrors.dfy(1111,13): Error: arguments must have the same type (got P<bool> and P<X>)
 ResolutionErrors.dfy(1112,13): Error: arguments must have the same type (got P<int> and P<bool>)
-ResolutionErrors.dfy(1135,38): Error: set comprehensions in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'o'
+ResolutionErrors.dfy(1130,31): Error: a set comprehension involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of 'o'
+ResolutionErrors.dfy(1132,38): Error: a set comprehension involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of 'o'
 ResolutionErrors.dfy(1137,24): Error: set comprehensions in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'o'
+ResolutionErrors.dfy(1230,13): Error: type variable 'PT' in the function call to 'P' could not be determined
+ResolutionErrors.dfy(1231,14): Error: the type of this variable is underspecified
+ResolutionErrors.dfy(1231,19): Error: type variable 'QT' in the function call to 'Q' could not be determined
+ResolutionErrors.dfy(1232,4): Error: type '?' to the method 'M' is not determined
+ResolutionErrors.dfy(1233,8): Error: the type of this variable is underspecified
+ResolutionErrors.dfy(1233,13): Error: type '?' to the method 'N' is not determined
+ResolutionErrors.dfy(1234,8): Error: the type of this variable is underspecified
+ResolutionErrors.dfy(1235,8): Error: the type of this variable is underspecified
+ResolutionErrors.dfy(1236,8): Error: the type of this local variable is underspecified
+ResolutionErrors.dfy(1237,8): Error: the type of this variable is underspecified
+ResolutionErrors.dfy(1238,8): Error: the type of this local variable is underspecified
 ResolutionErrors.dfy(1242,26): Error: the type of this variable is underspecified
+ResolutionErrors.dfy(1242,21): Error: type of bound variable 's' could not be determined; please specify the type explicitly
 ResolutionErrors.dfy(1243,31): Error: the type of this variable is underspecified
+ResolutionErrors.dfy(1243,21): Error: type of bound variable 's' could not be determined; please specify the type explicitly
 ResolutionErrors.dfy(1244,29): Error: the type of this variable is underspecified
-ResolutionErrors.dfy(1254,34): Error: the type of this variable is underspecified
+ResolutionErrors.dfy(1244,21): Error: type of bound variable 'c' could not be determined; please specify the type explicitly
+ResolutionErrors.dfy(1251,8): Error: the type of this local variable is underspecified
+ResolutionErrors.dfy(1254,29): Error: type of bound variable 'c' could not be determined; please specify the type explicitly
 ResolutionErrors.dfy(1270,21): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name or declare a module import 'opened?')
 ResolutionErrors.dfy(1271,24): Error: Undeclared top-level type or type parameter: X (did you forget to qualify a name or declare a module import 'opened?')
 ResolutionErrors.dfy(1308,16): Error: in a ghost context, only ghost fields can be mentioned as modifies frame targets (y)
@@ -209,4 +224,4 @@ ResolutionErrors.dfy(1123,8): Error: new cannot be applied to a trait
 ResolutionErrors.dfy(1144,13): Error: first argument to / must be of numeric type (instead got set<bool>)
 ResolutionErrors.dfy(1151,18): Error: a call to a possibly non-terminating method is allowed only if the calling method is also declared (with 'decreases *') to be possibly non-terminating
 ResolutionErrors.dfy(1166,14): Error: a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating
-211 resolution/type errors detected in ResolutionErrors.dfy
+226 resolution/type errors detected in ResolutionErrors.dfy
diff --git a/Test/dafny4/Regression0.dfy b/Test/dafny4/Regression0.dfy
index be092261..666d9575 100644
--- a/Test/dafny4/Regression0.dfy
+++ b/Test/dafny4/Regression0.dfy
@@ -4,10 +4,10 @@
 // This once crashed Dafny
 
 method M() {
-  var s := [1, "2"];
+  var s := [1, "2"];  // error: all elements must have the same type
   if * {
-    assert exists n :: n in s && n != 1;
+    assert exists n :: n in s && n != 1;  // the type of n is inferred to be int
   } else {
-    assert "2" in s;
+    assert "2" in s;  // error: since the type of s wasn't determined
   }
 }
diff --git a/Test/dafny4/Regression0.dfy.expect b/Test/dafny4/Regression0.dfy.expect
index 9d1e3019..566b3e3f 100644
--- a/Test/dafny4/Regression0.dfy.expect
+++ b/Test/dafny4/Regression0.dfy.expect
@@ -1,4 +1,3 @@
 Regression0.dfy(7,15): Error: All elements of display must be of the same type (got string, but type of previous elements is int)
-Regression0.dfy(9,28): Error: the type of this variable is underspecified
 Regression0.dfy(11,15): Error: second argument to "in" must be a set, multiset, or sequence with elements of type string, or a map with domain string (instead got ?)
-3 resolution/type errors detected in Regression0.dfy
+2 resolution/type errors detected in Regression0.dfy
diff --git a/Test/dafny4/set-compr.dfy b/Test/dafny4/set-compr.dfy
index 71a07f3d..d093a924 100644
--- a/Test/dafny4/set-compr.dfy
+++ b/Test/dafny4/set-compr.dfy
@@ -22,7 +22,7 @@ method O() returns (ghost p: set<object>)
 
 method P() returns (p: set<object>)
 {
-  p := set o: object | true;  // not allowed -- not in a ghost context
+  p := set o: object | true;  // error: not (easily) compilable
 }
 
 ghost method Q() returns (p: set<object>)
@@ -30,26 +30,54 @@ ghost method Q() returns (p: set<object>)
   p := set o: object | true;  // allowed, since the whole method is ghost
 }
 
-function F(): int
+function F(p: object): int
+  requires p in set o: object | true  // error: function is not allowed to depend on allocation state
+  ensures p in set o: object | true  // error: ditto (although one could argue that this would be okay)
+  reads set o: object | true  // error: same as for 'requires'
+  decreases set o: object | true  // error: same as for 'ensures'
+{
+  if p in set o: object | true then  // error: function is not allowed to depend on allocation state
+    F(p)
+  else
+    0
+}
+
+function method G(p: object): int
+  requires p in set o: object | true  // error (see F)
+  ensures p in set o: object | true  // error (see F)
+  reads set o: object | true  // error (see F)
+  decreases set o: object | true  // error (see F)
+{
+  if p in set o: object | true then  // error (see F)
+    G(p)
+  else
+    0
+}
+
+method M0() returns (ghost r: int, s: int)
   requires null in set o: object | true  // allowed
   ensures null in set o: object | true  // allowed
-  reads set o: object | true  // allowed
+  modifies set o: object | true  // allowed
   decreases set o: object | true  // allowed
 {
-  if null in set o: object | true then  // allowed -- in a ghost context
-    F()
-  else
-    0
+  if null in set o: object | true {  // this makes the "if" a ghost
+    r := G(null);
+    s := G(null);  // error: assignment of non-ghost not allowed inside ghost "if"
+  } else {
+    r := 0;
+  }
 }
 
-function method G(): int
+method M1() returns (ghost r: int, s: int)
   requires null in set o: object | true  // (X) allowed
   ensures null in set o: object | true  // (X) allowed
-  reads set o: object | true  // allowed
+  modifies set o: object | true  // allowed
   decreases set o: object | true  // (X) allowed
 {
-  if null in set o: object | true then  // not allowed, since this is not a ghost context
-    G()
-  else
-    0
+  if null in set o: object | true {  // this makes the "if" a ghost
+    r := G(null);
+    s := G(null);  // error: assignment of non-ghost not allowed inside ghost "if"
+  } else {
+    r := 0;
+  }
 }
diff --git a/Test/dafny4/set-compr.dfy.expect b/Test/dafny4/set-compr.dfy.expect
index 615ee2bc..b0490a11 100644
--- a/Test/dafny4/set-compr.dfy.expect
+++ b/Test/dafny4/set-compr.dfy.expect
@@ -1,3 +1,14 @@
 set-compr.dfy(25,7): Error: set comprehensions in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'o'
-set-compr.dfy(51,13): Error: set comprehensions in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'o'
-2 resolution/type errors detected in set-compr.dfy
+set-compr.dfy(34,16): Error: a set comprehension involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of 'o'
+set-compr.dfy(35,15): Error: a set comprehension involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of 'o'
+set-compr.dfy(36,8): Error: a set comprehension involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of 'o'
+set-compr.dfy(37,12): Error: a set comprehension involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of 'o'
+set-compr.dfy(39,10): Error: a set comprehension involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of 'o'
+set-compr.dfy(46,16): Error: a set comprehension involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of 'o'
+set-compr.dfy(47,15): Error: a set comprehension involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of 'o'
+set-compr.dfy(48,8): Error: a set comprehension involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of 'o'
+set-compr.dfy(49,12): Error: a set comprehension involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of 'o'
+set-compr.dfy(51,10): Error: a set comprehension involved in a function definition is not allowed to depend on the set of allocated references; Dafny's heuristics can't figure out a bound for the values of 'o'
+set-compr.dfy(65,6): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+set-compr.dfy(79,6): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+13 resolution/type errors detected in set-compr.dfy
diff --git a/Test/hofs/ReadsReads.dfy b/Test/hofs/ReadsReads.dfy
index a6f8d922..60ac35f5 100644
--- a/Test/hofs/ReadsReads.dfy
+++ b/Test/hofs/ReadsReads.dfy
@@ -105,14 +105,14 @@ module WhatWeKnowAboutReads {
 
 module ReadsAll {
   function A(f: int -> int) : int
-    reads set o,x | o in f.reads(x) :: o
+    reads set x,o | o in f.reads(x) :: o  // note, with "set o,x ..." instead, Dafny complains (this is perhaps less than ideal)
     requires forall x :: f.requires(x)
   {
     f(0) + f(1) + f(2)
   }
 
   function method B(f: int -> int) : int
-    reads set o,x | o in f.reads(x) :: o
+    reads set x,o | o in f.reads(x) :: o  // note, with "set o,x ..." instead, Dafny complains (this is perhaps less than ideal)
     requires forall x :: f.requires(x)
   {
     f(0) + f(1) + f(2)
-- 
cgit v1.2.3


From 69ed5bac5efbc0ac64f26b6dadf81bcfec9a0b5b Mon Sep 17 00:00:00 2001
From: wuestholz <unknown>
Date: Tue, 29 Sep 2015 17:45:10 +0200
Subject: Fix the build.

---
 Source/DafnyDriver/DafnyDriver.cs     |  6 +++---
 Source/DafnyServer/DafnyServer.csproj | 13 ++++++++-----
 2 files changed, 11 insertions(+), 8 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyDriver/DafnyDriver.cs b/Source/DafnyDriver/DafnyDriver.cs
index c45d66fc..8282edc7 100644
--- a/Source/DafnyDriver/DafnyDriver.cs
+++ b/Source/DafnyDriver/DafnyDriver.cs
@@ -226,8 +226,8 @@ namespace Microsoft.Dafny
 
       stats = new PipelineStatistics();
       LinearTypeChecker ltc;
-      MoverTypeChecker mtc;
-      PipelineOutcome oc = ExecutionEngine.ResolveAndTypecheck(program, bplFileName, out ltc, out mtc);
+      CivlTypeChecker ctc;
+      PipelineOutcome oc = ExecutionEngine.ResolveAndTypecheck(program, bplFileName, out ltc, out ctc);
       switch (oc) {
         case PipelineOutcome.Done:
           return oc;
@@ -244,7 +244,7 @@ namespace Microsoft.Dafny
             fileNames.Add(bplFileName);
             Bpl.Program reparsedProgram = ExecutionEngine.ParseBoogieProgram(fileNames, true);
             if (reparsedProgram != null) {
-              ExecutionEngine.ResolveAndTypecheck(reparsedProgram, bplFileName, out ltc, out mtc);
+              ExecutionEngine.ResolveAndTypecheck(reparsedProgram, bplFileName, out ltc, out ctc);
             }
           }
           return oc;
diff --git a/Source/DafnyServer/DafnyServer.csproj b/Source/DafnyServer/DafnyServer.csproj
index 1a256f5f..af262fc3 100644
--- a/Source/DafnyServer/DafnyServer.csproj
+++ b/Source/DafnyServer/DafnyServer.csproj
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
   <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
   <PropertyGroup>
@@ -84,9 +84,6 @@
     <Reference Include="System.Runtime.Serialization" />
     <Reference Include="System.Xml.Linq" />
     <Reference Include="Microsoft.CSharp" />
-    <Reference Include="DafnyPipeline">
-      <HintPath>..\..\Binaries\DafnyPipeline.dll</HintPath>
-    </Reference>
     <Reference Include="System.Xml" />
   </ItemGroup>
   <ItemGroup>
@@ -99,6 +96,12 @@
   <ItemGroup>
     <None Include="App.config" />
   </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\Dafny\DafnyPipeline.csproj">
+      <Project>{fe44674a-1633-4917-99f4-57635e6fa740}</Project>
+      <Name>DafnyPipeline</Name>
+    </ProjectReference>
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
   <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
        Other similar extension points exist, see Microsoft.Common.targets.
@@ -107,4 +110,4 @@
   <Target Name="AfterBuild">
   </Target>
   -->
-</Project>
+</Project>
\ No newline at end of file
-- 
cgit v1.2.3


From d6d0062d4fd25d733d97e02ea65d9653f7d77175 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Wed, 30 Sep 2015 13:30:43 -0700
Subject: Removed some unused code.

---
 Source/Dafny/Resolver.cs | 7 -------
 1 file changed, 7 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 0b0bbf26..36464925 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -4406,12 +4406,8 @@ namespace Microsoft.Dafny
             var k = com.PrefixLemma.Ins[0];
             scope.Push(k.Name, k);  // we expect no name conflict for _k
           }
-          var prevErrorCount = reporter.Count(ErrorLevel.Error);
           ResolveBlockStatement(m.Body, m);
           SolveAllTypeConstraints();
-          if (reporter.Count(ErrorLevel.Error) == prevErrorCount) {
-//KRML            ComputeGhostInterest(m.Body, m);
-          }
         }
 
         // attributes are allowed to mention both in- and out-parameters (including the implicit _k, for colemmas)
@@ -4530,9 +4526,6 @@ namespace Microsoft.Dafny
       // Resolve body
       if (iter.Body != null) {
         ResolveBlockStatement(iter.Body, iter);
-        if (reporter.Count(ErrorLevel.Error) == postSpecErrorCount) {
-          //KRML          ComputeGhostInterest(iter.Body, iter);
-        }
       }
 
       currentClass = null;
-- 
cgit v1.2.3


From c5a1c58d3c89c55c31331cb419cd3c06e276b5dd Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Fri, 2 Oct 2015 14:46:50 -0700
Subject: Fixed latent crash of hovertext/outlining with include. (This also
 undoes two previous attempted fixes, which had accidentally disabled some
 outlining and hovertexts.)

---
 Source/DafnyExtension/IdentifierTagger.cs | 146 +++++++++++++++++-------------
 Source/DafnyExtension/OutliningTagger.cs  |  30 +++---
 2 files changed, 103 insertions(+), 73 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyExtension/IdentifierTagger.cs b/Source/DafnyExtension/IdentifierTagger.cs
index d638cb6c..51f837f7 100644
--- a/Source/DafnyExtension/IdentifierTagger.cs
+++ b/Source/DafnyExtension/IdentifierTagger.cs
@@ -77,7 +77,7 @@ namespace DafnyLanguage
       int start = entire.Start;
       int end = entire.End;
       foreach (var r in _regions) {
-        if (0 <= r.Length && r.Start >= start && r.Start + r.Length <= end) {
+        if (0 <= r.Length && r.Start <= end && start <= r.Start + r.Length) {
           DafnyTokenKind kind;
           switch (r.Kind) {
             case IdRegion.OccurrenceKind.Use:
@@ -136,7 +136,7 @@ namespace DafnyLanguage
       List<IdRegion> newRegions = new List<IdRegion>();
 
       foreach (var info in program.reporter.AllMessages[ErrorLevel.Info]) {
-        IdRegion.Add(newRegions, info.token, info.message, info.token.val.Length);
+        IdRegion.Add(newRegions, program, info.token, info.message, info.token.val.Length);
       }
 
       foreach (var module in program.Modules) {
@@ -149,29 +149,29 @@ namespace DafnyLanguage
             foreach (var ctor in dt.Ctors) {
               foreach (var dtor in ctor.Destructors) {
                 if (dtor.CorrespondingFormal.HasName) {
-                  IdRegion.Add(newRegions, dtor.tok, dtor, null, "destructor", true, module);
+                  IdRegion.Add(newRegions, program, dtor.tok, dtor, null, "destructor", true, module);
                 }
               }
             }
           } else if (d is IteratorDecl) {
             var iter = (IteratorDecl)d;
             foreach (var p in iter.Ins) {
-              IdRegion.Add(newRegions, p.tok, p, true, module);
+              IdRegion.Add(newRegions, program, p.tok, p, true, module);
             }
             foreach (var p in iter.Outs) {
-              IdRegion.Add(newRegions, p.tok, p, true, "yield-parameter", module);
+              IdRegion.Add(newRegions, program, p.tok, p, true, "yield-parameter", module);
             }
-            iter.Reads.Expressions.ForEach(fe => FrameExprRegions(fe, newRegions, true, module));
-            iter.Modifies.Expressions.ForEach(fe => FrameExprRegions(fe, newRegions, true, module));
-            iter.Requires.ForEach(e => ExprRegions(e.E, newRegions, module));
-            iter.YieldRequires.ForEach(e => ExprRegions(e.E, newRegions, module));
-            iter.YieldEnsures.ForEach(e => ExprRegions(e.E, newRegions, module));
-            iter.Ensures.ForEach(e => ExprRegions(e.E, newRegions, module));
+            iter.Reads.Expressions.ForEach(fe => FrameExprRegions(fe, newRegions, true, program, module));
+            iter.Modifies.Expressions.ForEach(fe => FrameExprRegions(fe, newRegions, true, program, module));
+            iter.Requires.ForEach(e => ExprRegions(e.E, newRegions, program, module));
+            iter.YieldRequires.ForEach(e => ExprRegions(e.E, newRegions, program, module));
+            iter.YieldEnsures.ForEach(e => ExprRegions(e.E, newRegions, program, module));
+            iter.Ensures.ForEach(e => ExprRegions(e.E, newRegions, program, module));
             if (!((ICallable)iter).InferredDecreases) {
-              iter.Decreases.Expressions.ForEach(e => ExprRegions(e, newRegions, module));
+              iter.Decreases.Expressions.ForEach(e => ExprRegions(e, newRegions, program, module));
             }
             if (iter.Body != null) {
-              StatementRegions(iter.Body, newRegions, module);
+              StatementRegions(iter.Body, newRegions, program, module);
             }
 
           } else if (d is ClassDecl) {
@@ -182,42 +182,42 @@ namespace DafnyLanguage
               } else  if (member is Function) {
                 var f = (Function)member;
                 foreach (var p in f.Formals) {
-                  IdRegion.Add(newRegions, p.tok, p, true, module);
+                  IdRegion.Add(newRegions, program, p.tok, p, true, module);
                 }
-                f.Req.ForEach(e => ExprRegions(e, newRegions, module));
-                f.Reads.ForEach(fe => FrameExprRegions(fe, newRegions, true, module));
-                f.Ens.ForEach(e => ExprRegions(e, newRegions, module));
-                f.Decreases.Expressions.ForEach(e => ExprRegions(e, newRegions, module));
+                f.Req.ForEach(e => ExprRegions(e, newRegions, program, module));
+                f.Reads.ForEach(fe => FrameExprRegions(fe, newRegions, true, program, module));
+                f.Ens.ForEach(e => ExprRegions(e, newRegions, program, module));
+                f.Decreases.Expressions.ForEach(e => ExprRegions(e, newRegions, program, module));
                 if (f.Body != null) {
-                  ExprRegions(f.Body, newRegions, module);
+                  ExprRegions(f.Body, newRegions, program, module);
                 }
               } else if (member is Method) {
                 var m = (Method)member;
                 foreach (var p in m.Ins) {
-                  IdRegion.Add(newRegions, p.tok, p, true, module);
+                  IdRegion.Add(newRegions, program, p.tok, p, true, module);
                 }
                 foreach (var p in m.Outs) {
-                  IdRegion.Add(newRegions, p.tok, p, true, module);
+                  IdRegion.Add(newRegions, program, p.tok, p, true, module);
                 }
-                m.Req.ForEach(e => ExprRegions(e.E, newRegions, module));
-                m.Mod.Expressions.ForEach(fe => FrameExprRegions(fe, newRegions, true, module));
-                m.Ens.ForEach(e => ExprRegions(e.E, newRegions, module));
-                m.Decreases.Expressions.ForEach(e => ExprRegions(e, newRegions, module));
+                m.Req.ForEach(e => ExprRegions(e.E, newRegions, program, module));
+                m.Mod.Expressions.ForEach(fe => FrameExprRegions(fe, newRegions, true, program, module));
+                m.Ens.ForEach(e => ExprRegions(e.E, newRegions, program, module));
+                m.Decreases.Expressions.ForEach(e => ExprRegions(e, newRegions, program, module));
                 if (m.Body != null) {
-                  StatementRegions(m.Body, newRegions, module);
+                  StatementRegions(m.Body, newRegions, program, module);
                 }
               } else if (member is SpecialField) {
                 // do nothing
               } else if (member is Field) {
                 var fld = (Field)member;
-                IdRegion.Add(newRegions, fld.tok, fld, null, "field", true, module);
+                IdRegion.Add(newRegions, program, fld.tok, fld, null, "field", true, module);
               }
             }
           } else if (d is NewtypeDecl) {
             var dd = (NewtypeDecl)d;
             if (dd.Var != null) {
-              IdRegion.Add(newRegions, dd.Var.tok, dd.Var, true, module);
-              ExprRegions(dd.Constraint, newRegions, module);
+              IdRegion.Add(newRegions, program, dd.Var.tok, dd.Var, true, module);
+              ExprRegions(dd.Constraint, newRegions, program, module);
             }
           }
         }
@@ -228,54 +228,56 @@ namespace DafnyLanguage
       return true;
     }
 
-    static void FrameExprRegions(FrameExpression fe, List<IdRegion> regions, bool descendIntoExpressions, ModuleDefinition module) {
+    static void FrameExprRegions(FrameExpression fe, List<IdRegion> regions, bool descendIntoExpressions, Microsoft.Dafny.Program prog, ModuleDefinition module) {
       Contract.Requires(fe != null);
       Contract.Requires(regions != null);
+      Contract.Requires(prog != null);
       if (descendIntoExpressions) {
-        ExprRegions(fe.E, regions, module);
+        ExprRegions(fe.E, regions, prog, module);
       }
       if (fe.Field != null) {
         Microsoft.Dafny.Type showType = null;  // TODO: if we had the instantiated type of this field, that would have been nice to use here (but the Resolver currently does not compute or store the instantiated type for a FrameExpression)
-        IdRegion.Add(regions, fe.tok, fe.Field, showType, "field", false, module);
+        IdRegion.Add(regions, prog, fe.tok, fe.Field, showType, "field", false, module);
       }
     }
 
-    static void ExprRegions(Microsoft.Dafny.Expression expr, List<IdRegion> regions, ModuleDefinition module) {
+    static void ExprRegions(Microsoft.Dafny.Expression expr, List<IdRegion> regions, Microsoft.Dafny.Program prog, ModuleDefinition module) {
       Contract.Requires(expr != null);
       Contract.Requires(regions != null);
+      Contract.Requires(prog != null);
       if (expr is AutoGeneratedExpression) {
         // do nothing
         return;
       } else if (expr is IdentifierExpr) {
         var e = (IdentifierExpr)expr;
-        IdRegion.Add(regions, e.tok, e.Var, false, module);
+        IdRegion.Add(regions, prog, e.tok, e.Var, false, module);
       } else if (expr is MemberSelectExpr) {
         var e = (MemberSelectExpr)expr;
         var field = e.Member as Field;
         if (field != null) {
-          IdRegion.Add(regions, e.tok, field, e.Type, "field", false, module);
+          IdRegion.Add(regions, prog, e.tok, field, e.Type, "field", false, module);
         }
       } else if (expr is LetExpr) {
         var e = (LetExpr)expr;
         foreach (var bv in e.BoundVars) {
-          IdRegion.Add(regions, bv.tok, bv, true, module);
+          IdRegion.Add(regions, prog, bv.tok, bv, true, module);
         }
       } else if (expr is ComprehensionExpr) {
         var e = (ComprehensionExpr)expr;
         foreach (var bv in e.BoundVars) {
-          IdRegion.Add(regions, bv.tok, bv, true, module);
+          IdRegion.Add(regions, prog, bv.tok, bv, true, module);
         }
       } else if (expr is MatchExpr) {
         var e = (MatchExpr)expr;
         foreach (var kase in e.Cases) {
           kase.Arguments.ForEach(bv => {
-            IdRegion.Add(regions, bv.tok, bv, true, module);
+            IdRegion.Add(regions, prog, bv.tok, bv, true, module);
             // if the arguments is an encapsulation of different boundvars from nested match cases,
             // add the boundvars so that they can show up in the IDE correctly
             if (bv.tok is MatchCaseToken) {
               MatchCaseToken mt = (MatchCaseToken)bv.tok;
               foreach(Tuple<Bpl.IToken, BoundVar, bool> entry in mt.varList) {
-                IdRegion.Add(regions, entry.Item1, entry.Item2, entry.Item3, module);
+                IdRegion.Add(regions, prog, entry.Item1, entry.Item2, entry.Item3, module);
               }
             }
           });
@@ -283,22 +285,23 @@ namespace DafnyLanguage
       } else if (expr is ChainingExpression) {
         var e = (ChainingExpression)expr;
         // Do the subexpressions only once (that is, avoid the duplication that occurs in the desugared form of the ChainingExpression)
-        e.Operands.ForEach(ee => ExprRegions(ee, regions, module));
+        e.Operands.ForEach(ee => ExprRegions(ee, regions, prog, module));
         return;  // return here, so as to avoid doing the subexpressions below
       }
       foreach (var ee in expr.SubExpressions) {
-        ExprRegions(ee, regions, module);
+        ExprRegions(ee, regions, prog, module);
       }
     }
 
-    static void StatementRegions(Statement stmt, List<IdRegion> regions, ModuleDefinition module) {
+    static void StatementRegions(Statement stmt, List<IdRegion> regions, Microsoft.Dafny.Program prog, ModuleDefinition module) {
       Contract.Requires(stmt != null);
       Contract.Requires(regions != null);
+      Contract.Requires(prog != null);
       if (stmt is VarDeclStmt) {
         var s = (VarDeclStmt)stmt;
         // Add the variables here, once, and then go directly to the RHS's (without letting the sub-statements re-do the LHS's)
         foreach (var local in s.Locals) {
-          IdRegion.Add(regions, local.Tok, local, true, module);
+          IdRegion.Add(regions, prog, local.Tok, local, true, module);
         }
         if (s.Update == null) {
           // the VarDeclStmt has no associated assignment
@@ -306,29 +309,29 @@ namespace DafnyLanguage
           var upd = (UpdateStmt)s.Update;
           foreach (var rhs in upd.Rhss) {
             foreach (var ee in rhs.SubExpressions) {
-              ExprRegions(ee, regions, module);
+              ExprRegions(ee, regions, prog, module);
             }
           }
         } else {
           var upd = (AssignSuchThatStmt)s.Update;
-          ExprRegions(upd.Expr, regions, module);
+          ExprRegions(upd.Expr, regions, prog, module);
         }
         // we're done, so don't do the sub-statements/expressions again
         return;
       } else if (stmt is ForallStmt) {
         var s = (ForallStmt)stmt;
-        s.BoundVars.ForEach(bv => IdRegion.Add(regions, bv.tok, bv, true, module));
+        s.BoundVars.ForEach(bv => IdRegion.Add(regions, prog, bv.tok, bv, true, module));
       } else if (stmt is MatchStmt) {
         var s = (MatchStmt)stmt;
         foreach (var kase in s.Cases) {
           kase.Arguments.ForEach(bv => {
-            IdRegion.Add(regions, bv.tok, bv, true, module);
+            IdRegion.Add(regions, prog, bv.tok, bv, true, module);
             // if the arguments is an encapsulation of different boundvars from nested match cases,
             // add the boundvars so that they can show up in the IDE correctly
             if (bv.tok is MatchCaseToken) {
               MatchCaseToken mt = (MatchCaseToken)bv.tok;
               foreach (Tuple<Bpl.IToken, BoundVar, bool> entry in mt.varList) {
-                IdRegion.Add(regions, entry.Item1, entry.Item2, entry.Item3, module);
+                IdRegion.Add(regions, prog, entry.Item1, entry.Item2, entry.Item3, module);
               }
             }              
           });
@@ -336,28 +339,28 @@ namespace DafnyLanguage
       } else if (stmt is LoopStmt) {
         var s = (LoopStmt)stmt;
         if (s.Mod.Expressions != null) {
-          s.Mod.Expressions.ForEach(fe => FrameExprRegions(fe, regions, false, module));
+          s.Mod.Expressions.ForEach(fe => FrameExprRegions(fe, regions, false, prog, module));
         }
       } else if (stmt is CalcStmt) {
         var s = (CalcStmt)stmt;
         // skip the last line, which is just a duplicate anyway
         for (int i = 0; i < s.Lines.Count - 1; i++) {
-          ExprRegions(s.Lines[i], regions, module);
+          ExprRegions(s.Lines[i], regions, prog, module);
         }
         foreach (var ss in stmt.SubStatements) {
-          StatementRegions(ss, regions, module);
+          StatementRegions(ss, regions, prog, module);
         }
         return;
       }
       foreach (var ee in stmt.SubExpressions) {
-        ExprRegions(ee, regions, module);
+        ExprRegions(ee, regions, prog, module);
       }
       foreach (var ss in stmt.SubStatements) {
-        StatementRegions(ss, regions, module);
+        StatementRegions(ss, regions, prog, module);
       }
     }
 
-    class IdRegion
+    class IdRegion : DafnyRegion
     {
       public readonly int Start;
       public readonly int Length;
@@ -366,31 +369,41 @@ namespace DafnyLanguage
       public readonly OccurrenceKind Kind;
       public readonly IVariable Variable;
 
-      public static void Add(List<IdRegion> regions, Bpl.IToken tok, IVariable v, bool isDefinition, ModuleDefinition context) {
+      public static void Add(List<IdRegion> regions, Microsoft.Dafny.Program prog, Bpl.IToken tok, IVariable v, bool isDefinition, ModuleDefinition context) {
         Contract.Requires(regions != null);
+        Contract.Requires(prog != null);
         Contract.Requires(tok != null);
         Contract.Requires(v != null);
-        Add(regions, tok, v, isDefinition, null, context);
+        Add(regions, prog, tok, v, isDefinition, null, context);
       }
-      public static void Add(List<IdRegion> regions, Bpl.IToken tok, IVariable v, bool isDefinition, string kind, ModuleDefinition context) {
+      public static void Add(List<IdRegion> regions, Microsoft.Dafny.Program prog, Bpl.IToken tok, IVariable v, bool isDefinition, string kind, ModuleDefinition context) {
         Contract.Requires(regions != null);
+        Contract.Requires(prog != null);
         Contract.Requires(tok != null);
         Contract.Requires(v != null);
-        regions.Add(new IdRegion(tok, v, isDefinition, kind, context));
+        if (InMainFile(prog, tok)) {
+          regions.Add(new IdRegion(tok, v, isDefinition, kind, context));
+        }
       }
-      public static void Add(List<IdRegion> regions, Bpl.IToken tok, Field decl, Microsoft.Dafny.Type showType, string kind, bool isDefinition, ModuleDefinition context) {
+      public static void Add(List<IdRegion> regions, Microsoft.Dafny.Program prog, Bpl.IToken tok, Field decl, Microsoft.Dafny.Type showType, string kind, bool isDefinition, ModuleDefinition context) {
         Contract.Requires(regions != null);
+        Contract.Requires(prog != null);
         Contract.Requires(tok != null);
         Contract.Requires(decl != null);
         Contract.Requires(kind != null);
-        regions.Add(new IdRegion(tok, decl, showType, kind, isDefinition, context));
+        if (InMainFile(prog, tok)) {
+          regions.Add(new IdRegion(tok, decl, showType, kind, isDefinition, context));
+        }
       }
 
-      public static void Add(List<IdRegion> regions, Bpl.IToken tok, string text, int length) {
+      public static void Add(List<IdRegion> regions, Microsoft.Dafny.Program prog, Bpl.IToken tok, string text, int length) {
         Contract.Requires(regions != null);
+        Contract.Requires(prog != null);
         Contract.Requires(tok != null);
         Contract.Requires(text != null);
-        regions.Add(new IdRegion(tok, OccurrenceKind.AdditionalInformation, text, length));
+        if (InMainFile(prog, tok)) {
+          regions.Add(new IdRegion(tok, OccurrenceKind.AdditionalInformation, text, length));
+        }
       }
 
       private IdRegion(Bpl.IToken tok, IVariable v, bool isDefinition, string kind, ModuleDefinition context) {
@@ -442,6 +455,15 @@ namespace DafnyLanguage
     }
   }
 
+  public abstract class DafnyRegion
+  {
+    public static bool InMainFile(Microsoft.Dafny.Program prog, Bpl.IToken tok) {
+      Contract.Requires(prog != null);
+      Contract.Requires(tok != null);
+      return object.Equals(prog.FullName, tok.filename);
+    }
+  }
+
   #endregion
 
 }
diff --git a/Source/DafnyExtension/OutliningTagger.cs b/Source/DafnyExtension/OutliningTagger.cs
index 85771e94..ea611594 100644
--- a/Source/DafnyExtension/OutliningTagger.cs
+++ b/Source/DafnyExtension/OutliningTagger.cs
@@ -80,7 +80,7 @@ namespace DafnyLanguage
       if (start == end) yield break;
 
       foreach (var r in _regions) {
-        if (0 <= r.Length && r.Start >= start && r.Start + r.Length <= end) {
+        if (0 <= r.Length && r.Start <= end && start <= r.Start + r.Length) {
           yield return new TagSpan<OutliningRegionTag>(
             new SnapshotSpan(_snapshot, r.Start, r.Length),
             new OutliningRegionTag(false, false, "...", r.HoverText));
@@ -130,18 +130,18 @@ namespace DafnyLanguage
           if (module.IsAbstract) {
             nm = "abstract " + nm;
           }
-          newRegions.Add(new OutliningRegion(module, nm));
+          OutliningRegion.Add(newRegions, program, module, nm);
         }
         foreach (Dafny.TopLevelDecl d in module.TopLevelDecls) {
           if (!HasBodyTokens(d) && !(d is Dafny.ClassDecl)) {
             continue;
           }
           if (d is Dafny.OpaqueTypeDecl) {
-            newRegions.Add(new OutliningRegion(d, "type"));
+            OutliningRegion.Add(newRegions, program, d, "type");
           } else if (d is Dafny.CoDatatypeDecl) {
-            newRegions.Add(new OutliningRegion(d, "codatatype"));
+            OutliningRegion.Add(newRegions, program, d, "codatatype");
           } else if (d is Dafny.DatatypeDecl) {
-            newRegions.Add(new OutliningRegion(d, "datatype"));
+            OutliningRegion.Add(newRegions, program, d, "datatype");
           } else if (d is Dafny.ModuleDecl) {
             // do nothing here, since the outer loop handles modules
           } else {
@@ -149,9 +149,9 @@ namespace DafnyLanguage
             if (cl.IsDefaultClass) {
               // do nothing
             } else if (cl is Dafny.IteratorDecl) {
-              newRegions.Add(new OutliningRegion(cl, "iterator"));
+              OutliningRegion.Add(newRegions, program, cl, "iterator");
             } else {
-              newRegions.Add(new OutliningRegion(cl, "class"));
+              OutliningRegion.Add(newRegions, program, cl, "class");
             }
             // do the class members (in particular, functions and methods)
             foreach (Dafny.MemberDecl m in cl.Members) {
@@ -168,7 +168,7 @@ namespace DafnyLanguage
                 if (!m.IsGhost) {
                   nm += " method";
                 }
-                newRegions.Add(new OutliningRegion(m, nm));
+                OutliningRegion.Add(newRegions, program, m, nm);
               } else if (m is Dafny.Method && ((Dafny.Method)m).Body != null) {
                 var nm =
                   m is Dafny.Constructor ? "constructor" :
@@ -179,7 +179,7 @@ namespace DafnyLanguage
                 if (m.IsGhost && !(m is Dafny.CoLemma)) {
                   nm = "ghost " + nm;
                 }
-                newRegions.Add(new OutliningRegion(m, nm));
+                OutliningRegion.Add(newRegions, program, m, nm);
               }
             }
           }
@@ -196,12 +196,20 @@ namespace DafnyLanguage
       return decl.BodyStartTok != Bpl.Token.NoToken && decl.BodyEndTok != Bpl.Token.NoToken;
     }
 
-    class OutliningRegion
+    class OutliningRegion : DafnyRegion
     {
+      public static void Add(List<OutliningRegion> regions, Microsoft.Dafny.Program prog, Dafny.INamedRegion decl, string kind) {
+        Contract.Requires(regions != null);
+        Contract.Requires(prog != null);
+        if (InMainFile(prog, decl.BodyStartTok)) {
+          regions.Add(new OutliningRegion(decl, kind));
+        }
+      }
+
       public readonly int Start;
       public readonly int Length;
       public readonly string HoverText;
-      public OutliningRegion(Dafny.INamedRegion decl, string kind) {
+      private OutliningRegion(Dafny.INamedRegion decl, string kind) {
         int startPosition = decl.BodyStartTok.pos + 1;  // skip the open-curly brace itself
         int length = decl.BodyEndTok.pos - startPosition;
         Start = startPosition;
-- 
cgit v1.2.3


From 1885f7d7d1fb9bd6ceb8220450dbb5d890501337 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Fri, 2 Oct 2015 15:26:56 -0700
Subject: Hover text includes #[_k-1] suffix for terms rewritten in prefix
 predicates/lemmas (this fixes an item from the wishlist). Include in hover
 text the extreme predicates for which an extreme lemmas has been rewritten
 (but don't include ==# in this list--or should it perhaps be included?).
 Under a (temporary) switch /rewriteFocalPredicates, each use of a focal
 predicate P in a prefix lemma is rewritten into P#[_k-1].

---
 Source/Dafny/Cloner.cs                             | 91 ++++++++++++++++++----
 Source/Dafny/DafnyOptions.cs                       | 27 +++++--
 Source/Dafny/Resolver.cs                           | 16 +++-
 Test/dafny0/CoinductiveProofs.dfy                  | 61 ++++++++++++++-
 Test/dafny0/CoinductiveProofs.dfy.expect           | 65 +++++++++++-----
 Test/wishlist/tooltips-on-inductive-lemmas.dfy     | 12 ---
 .../tooltips-on-inductive-lemmas.dfy.expect        |  7 --
 7 files changed, 214 insertions(+), 65 deletions(-)
 delete mode 100644 Test/wishlist/tooltips-on-inductive-lemmas.dfy
 delete mode 100644 Test/wishlist/tooltips-on-inductive-lemmas.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index c94c697d..45d8a2c9 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -715,7 +715,7 @@ namespace Microsoft.Dafny
   {
     protected readonly Expression k;
     protected readonly ErrorReporter reporter;
-    readonly string suffix;
+    protected readonly string suffix;
     protected FixpointCloner(Expression k, ErrorReporter reporter)
     {
       Contract.Requires(k != null);
@@ -724,6 +724,18 @@ namespace Microsoft.Dafny
       this.reporter = reporter;
       this.suffix = string.Format("#[{0}]", Printer.ExprToString(k));
     }
+    protected Expression CloneCallAndAddK(FunctionCallExpr e) {
+      Contract.Requires(e != null);
+      var receiver = CloneExpr(e.Receiver);
+      var args = new List<Expression>();
+      args.Add(k);
+      foreach (var arg in e.Args) {
+        args.Add(CloneExpr(arg));
+      }
+      var fexp = new FunctionCallExpr(Tok(e.tok), e.Name + "#", receiver, e.OpenParen, args);
+      reporter.Info(MessageSource.Cloner, e.tok, e.Name + suffix);
+      return fexp;
+    }
   }
 
   /// <summary>
@@ -733,6 +745,7 @@ namespace Microsoft.Dafny
   /// precondition (resp. postcondition) of the inductive lemma's (resp. colemma's) corresponding prefix lemma.
   /// It is assumed that the source expression has been resolved.  Note, the "k" given to the constructor
   /// is not cloned with each use; it is simply used as is.
+  /// The resulting expression needs to be resolved by the caller.
   /// </summary>
   class FixpointLemmaSpecificationSubstituter : FixpointCloner
   {
@@ -756,15 +769,7 @@ namespace Microsoft.Dafny
       } else if (expr is FunctionCallExpr) {
         var e = (FunctionCallExpr)expr;
         if (friendlyCalls.Contains(e)) {
-          var receiver = CloneExpr(e.Receiver);
-          var args = new List<Expression>();
-          args.Add(k);
-          foreach (var arg in e.Args) {
-            args.Add(CloneExpr(arg));
-          }
-          var fexp = new FunctionCallExpr(Tok(e.tok), e.Name + "#", receiver, e.OpenParen, args);
-          reporter.Info(MessageSource.Cloner, e.tok, e.Name);
-          return fexp;
+          return CloneCallAndAddK(e);
         }
       } else if (expr is BinaryExpr && isCoContext) {
         var e = (BinaryExpr)expr;
@@ -774,7 +779,7 @@ namespace Microsoft.Dafny
           var B = CloneExpr(e.E1);
           var teq = new TernaryExpr(Tok(e.tok), op, k, A, B);
           var opString = op == TernaryExpr.Opcode.PrefixEqOp ? "==" : "!=";
-          reporter.Info(MessageSource.Cloner, e.tok, opString);
+          reporter.Info(MessageSource.Cloner, e.tok, opString + suffix);
           return teq;
         }
       }
@@ -803,19 +808,77 @@ namespace Microsoft.Dafny
   }
 
   /// <summary>
-  /// The task of the FixpointLemmaBodyCloner is to fill in the implicit _k-1 arguments in recursive inductive/co-lemma calls.
+  /// The task of the FixpointLemmaBodyCloner is to fill in the implicit _k-1 arguments in recursive inductive/co-lemma calls
+  /// and in calls to the focal predicates.
   /// The source statement and the given "k" are assumed to have been resolved.
   /// </summary>
   class FixpointLemmaBodyCloner : FixpointCloner
   {
     readonly FixpointLemma context;
-    public FixpointLemmaBodyCloner(FixpointLemma context, Expression k, ErrorReporter reporter)
+    readonly ISet<FixpointPredicate> focalPredicates;
+    public FixpointLemmaBodyCloner(FixpointLemma context, Expression k, ISet<FixpointPredicate> focalPredicates, ErrorReporter reporter)
       : base(k, reporter)
     {
       Contract.Requires(context != null);
       Contract.Requires(k != null);
       Contract.Requires(reporter != null);
       this.context = context;
+      this.focalPredicates = focalPredicates;
+    }
+    public override Expression CloneExpr(Expression expr) {
+      if (DafnyOptions.O.RewriteFocalPredicates) {
+        if (expr is FunctionCallExpr) {
+          var e = (FunctionCallExpr)expr;
+#if DEBUG_PRINT
+          if (e.Function.Name.EndsWith("#") && Contract.Exists(focalPredicates, p => e.Function.Name == p.Name + "#")) {
+            Console.WriteLine("{0}({1},{2}): DEBUG: Possible opportunity to rely on new rewrite: {3}", e.tok.filename, e.tok.line, e.tok.col, Printer.ExprToString(e));
+          }
+#endif
+          // Note, we don't actually ever get here, because all calls will have been parsed as ApplySuffix.
+          // However, if something changes in the future (for example, some rewrite that changing an ApplySuffix
+          // to its resolved FunctionCallExpr), then we do want this code, so with the hope of preventing
+          // some error in the future, this case is included.  (Of course, it is currently completely untested!)
+          var f = e.Function as FixpointPredicate;
+          if (f != null && focalPredicates.Contains(f)) {
+#if DEBUG_PRINT
+            var r = CloneCallAndAddK(e);
+            Console.WriteLine("{0}({1},{2}): DEBUG: Rewrote extreme predicate into prefix predicate: {3}", e.tok.filename, e.tok.line, e.tok.col, Printer.ExprToString(r));
+            return r;
+#else
+            return CloneCallAndAddK(e);
+#endif
+          }
+        } else if (expr is ApplySuffix) {
+          var apply = (ApplySuffix)expr;
+          if (!apply.WasResolved()) {
+            // Since we're assuming the enclosing statement to have been resolved, this ApplySuffix must
+            // be part of an ExprRhs that actually designates a method call.  Such an ApplySuffix does
+            // not get listed as being resolved, but its components (like its .Lhs) are resolved.
+            var mse = (MemberSelectExpr)apply.Lhs.Resolved;
+            Contract.Assume(mse.Member is Method);
+          } else {
+            var fce = apply.Resolved as FunctionCallExpr;
+            if (fce != null) {
+#if DEBUG_PRINT
+              if (fce.Function.Name.EndsWith("#") && Contract.Exists(focalPredicates, p => fce.Function.Name == p.Name + "#")) {
+                Console.WriteLine("{0}({1},{2}): DEBUG: Possible opportunity to rely on new rewrite: {3}", fce.tok.filename, fce.tok.line, fce.tok.col, Printer.ExprToString(fce));
+              }
+#endif
+              var f = fce.Function as FixpointPredicate;
+              if (f != null && focalPredicates.Contains(f)) {
+#if DEBUG_PRINT
+                var r = CloneCallAndAddK(fce);
+                Console.WriteLine("{0}({1},{2}): DEBUG: Rewrote extreme predicate into prefix predicate: {3}", fce.tok.filename, fce.tok.line, fce.tok.col, Printer.ExprToString(r));
+                return r;
+#else
+                return CloneCallAndAddK(fce);
+#endif
+              }
+            }
+          }
+        }
+      }
+      return base.CloneExpr(expr);
     }
     public override AssignmentRhs CloneRHS(AssignmentRhs rhs) {
       var r = rhs as ExprRhs;
@@ -839,7 +902,7 @@ namespace Microsoft.Dafny
           apply.Args.ForEach(arg => args.Add(CloneExpr(arg)));
           var applyClone = new ApplySuffix(Tok(apply.tok), lhsClone, args);
           var c = new ExprRhs(applyClone);
-          reporter.Info(MessageSource.Cloner, apply.Lhs.tok, mse.Member.Name);
+          reporter.Info(MessageSource.Cloner, apply.Lhs.tok, mse.Member.Name + suffix);
           return c;
         }
       }
diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index 59d0eb2c..2d8756d2 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -65,11 +65,12 @@ namespace Microsoft.Dafny
     public bool AllowGlobals = false;
     public bool CountVerificationErrors = true;
     public bool Optimize = false;
-    public bool AutoTriggers = false;
+    public bool AutoTriggers = false;
+    public bool RewriteFocalPredicates = false;
     public bool PrintTooltips = false;
     public bool PrintStats = false;
     public bool PrintFunctionCallGraph = false;
-    public bool WarnShadowing = false;
+    public bool WarnShadowing = false;
     public bool IronDafny = 
 #if ENABLE_IRONDAFNY 
       true
@@ -216,12 +217,20 @@ namespace Microsoft.Dafny
 
         case "printTooltips":
           PrintTooltips = true;
-          return true;
+          return true;
+
+        case "autoTriggers": {
+            int autoTriggers = 0;
+            if (ps.GetNumericArgument(ref autoTriggers, 2)) {
+              AutoTriggers = autoTriggers == 1;
+            }
+            return true;
+          }
 
-        case "autoTriggers": {
-            int autoTriggers = 0;
-            if (ps.GetNumericArgument(ref autoTriggers, 2)) {
-              AutoTriggers = autoTriggers == 1;
+        case "rewriteFocalPredicates": {
+            int rewriteFocalPredicates = 0;
+            if (ps.GetNumericArgument(ref rewriteFocalPredicates, 2)) {
+              RewriteFocalPredicates = rewriteFocalPredicates == 1;
             }
             return true;
           }
@@ -369,6 +378,10 @@ namespace Microsoft.Dafny
                 0 (default) - Do not generate {:trigger} annotations for user-level quantifiers.
                 1 - Add a {:trigger} to each user-level quantifier. Existing
                               annotations are preserved.
+  /rewriteFocalPredicates:<n>
+                0 (default) - Don't rewrite predicates in the body of prefix lemmas.
+                1 - In the body of prefix lemmas, rewrite any use of a focal predicate
+                    P to P#[_k-1].
   /optimize     Produce optimized C# code, meaning:
                   - selects optimized C# prelude by passing 
                     /define:DAFNY_USE_SYSTEM_COLLECTIONS_IMMUTABLE to csc.exe (requires 
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 36464925..7a540722 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -1565,6 +1565,7 @@ namespace Microsoft.Dafny
             continue;  // something went wrong during registration of the prefix lemma (probably a duplicated fixpoint-lemma name)
           }
           var k = prefixLemma.Ins[0];
+          var focalPredicates = new HashSet<FixpointPredicate>();
           if (com is CoLemma) {
             // compute the postconditions of the prefix lemma
             Contract.Assume(prefixLemma.Ens.Count == 0);  // these are not supposed to have been filled in before
@@ -1574,6 +1575,12 @@ namespace Microsoft.Dafny
               var subst = new FixpointLemmaSpecificationSubstituter(coConclusions, new IdentifierExpr(k.tok, k.Name), this.reporter, true);
               var post = subst.CloneExpr(p.E);
               prefixLemma.Ens.Add(new MaybeFreeExpression(post, p.IsFree));
+              foreach (var e in coConclusions) {
+                var fce = e as FunctionCallExpr;
+                if (fce != null) {  // the other possibility is that "e" is a BinaryExpr
+                  focalPredicates.Add((CoPredicate)fce.Function);
+                }
+              }
             }
           } else {
             // compute the preconditions of the prefix lemma
@@ -1584,13 +1591,18 @@ namespace Microsoft.Dafny
               var subst = new FixpointLemmaSpecificationSubstituter(antecedents, new IdentifierExpr(k.tok, k.Name), this.reporter, false);
               var pre = subst.CloneExpr(p.E);
               prefixLemma.Req.Add(new MaybeFreeExpression(pre, p.IsFree));
+              foreach (var e in antecedents) {
+                var fce = (FunctionCallExpr)e;  // we expect "antecedents" to contain only FunctionCallExpr's
+                focalPredicates.Add((InductivePredicate)fce.Function);
+              }
             }
           }
+          reporter.Info(MessageSource.Resolver, com.tok, string.Format("{0} specialized for {1}", com.PrefixLemma.Name, Util.Comma(focalPredicates, p => p.Name)));
           // Compute the statement body of the prefix lemma
           Contract.Assume(prefixLemma.Body == null);  // this is not supposed to have been filled in before
           if (com.Body != null) {
             var kMinusOne = new BinaryExpr(com.tok, BinaryExpr.Opcode.Sub, new IdentifierExpr(k.tok, k.Name), new LiteralExpr(com.tok, 1));
-            var subst = new FixpointLemmaBodyCloner(com, kMinusOne, this.reporter);
+            var subst = new FixpointLemmaBodyCloner(com, kMinusOne, focalPredicates, this.reporter);
             var mainBody = subst.CloneBlockStmt(com.Body);
             var kPositive = new BinaryExpr(com.tok, BinaryExpr.Opcode.Lt, new LiteralExpr(com.tok, 0), new IdentifierExpr(k.tok, k.Name));
             var condBody = new IfStmt(com.BodyStartTok, mainBody.EndTok, kPositive, mainBody, null);
@@ -3571,7 +3583,7 @@ namespace Microsoft.Dafny
             var substituter = new Translator.AlphaConverting_Substituter(cs.Receiver, argsSubstMap, new Dictionary<TypeParameter, Type>(), new Translator(resolver.reporter));
             foreach (var ens in cs.Method.Ens) {
               var p = substituter.Substitute(ens.E);  // substitute the call's actuals for the method's formals
-              resolver.reporter.Info(MessageSource.Resolver, s.Tok, "ensures " + Printer.ExprToString(p) + ";");
+              resolver.reporter.Info(MessageSource.Resolver, s.Tok, "ensures " + Printer.ExprToString(p));
             }
           }
         }
diff --git a/Test/dafny0/CoinductiveProofs.dfy b/Test/dafny0/CoinductiveProofs.dfy
index d990ae51..0dce8af9 100644
--- a/Test/dafny0/CoinductiveProofs.dfy
+++ b/Test/dafny0/CoinductiveProofs.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /rewriteFocalPredicates:1 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 codatatype Stream<T> = Cons(head: T, tail: Stream)
@@ -12,6 +12,7 @@ copredicate Pos(s: Stream<int>)
 {
   0 < s.head && Pos(s.tail)
 }
+predicate FullPos(s: Stream<int>) { Pos(s) }  // a way in the test file to sidestep focal-predicate rewrites
 
 colemma {:induction false} PosLemma0(n: int)
   requires 1 <= n;
@@ -26,7 +27,25 @@ colemma {:induction false} PosLemma1(n: int)
 {
   PosLemma1(n + 1);
   if (*) {
-    assert Pos(Upward(n + 1));  // error: cannot conclude this here, because we only have prefix predicates
+    assert FullPos(Upward(n + 1));  // error: cannot conclude this here, because we only have prefix predicates
+  }
+}
+
+colemma {:induction false} PosLemma2(n: int)
+  requires 1 <= n;
+  ensures Pos(Upward(n));
+{
+  PosLemma2(n + 1);
+  if (*) {
+    assert Pos(Upward(n + 1));  // Pos gets rewritten to Pos#[_k-1], which does hold
+  } else if (*) {
+    assert Pos#[_k-1](Upward(n + 1));  // explicitly saying Pos#[_k-1] also holds
+  } else if (*) {
+    assert Pos#[_k](Upward(n + 1));  // error: this is not known to hold for _k and n+1
+  } else if (*) {
+    assert Pos#[_k](Upward(n));  // but it does hold with Pos#[_k] and n (which is the postcondition of the prefix lemma)
+  } else if (*) {
+    assert Pos#[_k+1](Upward(n));  // error: this is too much to ask for
   }
 }
 
@@ -65,13 +84,29 @@ colemma {:induction false} AlwaysLemma_X1(s: Stream)
 {
   AlwaysLemma_X1(s);  // this is the right proof
 }
+predicate FullX(s: Stream) { X(s) }  // a way in the test file to sidestep focal-predicate rewrites
 
 colemma {:induction false} AlwaysLemma_X2(s: Stream)
   ensures X(s);
 {
   AlwaysLemma_X2(s);
   if (*) {
-    assert X(s);  // error: cannot conclude the full predicate here
+    assert FullX(s);  // error: cannot conclude the full predicate here
+  }
+}
+
+colemma {:induction false} AlwaysLemma_X3(s: Stream)
+  ensures X(s);
+{
+  AlwaysLemma_X3(s);
+  if (*) {
+    assert X(s);  // holds, because it gets rewritten to X#[_k-1]
+  } else if (*) {
+    assert X#[_k-1](s);  // explicitly saying X#[_k-1] also holds
+  } else if (*) {
+    assert X#[_k](s);  // in fact, X#[_k] holds, too (which is the postcondition of the prefix lemma)
+  } else if (*) {
+    assert X#[_k+1](s);  // as it turns out, this holds too, since the definition of X makes X#[_k+1] equal X#[_k]
   }
 }
 
@@ -79,6 +114,7 @@ copredicate Y(s: Stream)  // this is equivalent to always returning 'true'
 {
   Y(s.tail)
 }
+predicate FullY(s: Stream) { Y(s) }  // a way in the test file to sidestep focal-predicate rewrites
 
 colemma {:induction false} AlwaysLemma_Y0(s: Stream)
   ensures Y(s);  // prove that Y(s) really is always 'true'
@@ -97,7 +133,24 @@ colemma {:induction false} AlwaysLemma_Y2(s: Stream)
 {
   AlwaysLemma_Y2(s.tail);
   if (*) {
-    assert Y(s.tail);  // error: not provable here
+    assert FullY(s.tail);  // error: not provable here
+  }
+}
+
+colemma {:induction false} AlwaysLemma_Y3(s: Stream)
+  ensures Y(s);
+{
+  AlwaysLemma_Y3(s.tail);
+  if (*) {
+    assert Y(s.tail);  // this holds, because it's rewritten to Y#[_k-1]
+  } else if (*) {
+    assert Y#[_k-1](s.tail);
+  } else if (*) {
+    assert Y#[_k](s.tail);  // error: not known to hold for _k and s.tail
+  } else if (*) {
+    assert Y#[_k](s);  // this is also the postcondition of the prefix lemma
+  } else if (*) {
+    assert Y#[_k+1](s);  // error: this is too much to ask for
   }
 }
 
diff --git a/Test/dafny0/CoinductiveProofs.dfy.expect b/Test/dafny0/CoinductiveProofs.dfy.expect
index 2a5a2b0b..c4f4c405 100644
--- a/Test/dafny0/CoinductiveProofs.dfy.expect
+++ b/Test/dafny0/CoinductiveProofs.dfy.expect
@@ -1,50 +1,77 @@
-CoinductiveProofs.dfy(29,11): Error: assertion violation
+CoinductiveProofs.dfy(30,11): Error: assertion violation
+CoinductiveProofs.dfy(15,36): Related location
 CoinductiveProofs.dfy(13,16): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
     (0,0): anon6_Then
-CoinductiveProofs.dfy(59,0): Error BP5003: A postcondition might not hold on this return path.
-CoinductiveProofs.dfy(58,10): Related location: This is the postcondition that might not hold.
-CoinductiveProofs.dfy(54,2): Related location
+CoinductiveProofs.dfy(44,11): Error: assertion violation
+CoinductiveProofs.dfy(13,16): Related location
+Execution trace:
+    (0,0): anon0
+    (0,0): anon13_Then
+    (0,0): anon16_Then
+CoinductiveProofs.dfy(48,11): Error: assertion violation
+CoinductiveProofs.dfy(13,16): Related location
+Execution trace:
+    (0,0): anon0
+    (0,0): anon13_Then
+    (0,0): anon18_Then
+CoinductiveProofs.dfy(78,0): Error BP5003: A postcondition might not hold on this return path.
+CoinductiveProofs.dfy(77,10): Related location: This is the postcondition that might not hold.
+CoinductiveProofs.dfy(73,2): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-CoinductiveProofs.dfy(74,11): Error: assertion violation
-CoinductiveProofs.dfy(54,2): Related location
+CoinductiveProofs.dfy(94,11): Error: assertion violation
+CoinductiveProofs.dfy(87,29): Related location
+CoinductiveProofs.dfy(73,2): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
     (0,0): anon6_Then
-CoinductiveProofs.dfy(91,0): Error BP5003: A postcondition might not hold on this return path.
-CoinductiveProofs.dfy(90,10): Related location: This is the postcondition that might not hold.
-CoinductiveProofs.dfy(80,2): Related location
+CoinductiveProofs.dfy(127,0): Error BP5003: A postcondition might not hold on this return path.
+CoinductiveProofs.dfy(126,10): Related location: This is the postcondition that might not hold.
+CoinductiveProofs.dfy(115,2): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-CoinductiveProofs.dfy(100,11): Error: assertion violation
-CoinductiveProofs.dfy(80,2): Related location
+CoinductiveProofs.dfy(136,11): Error: assertion violation
+CoinductiveProofs.dfy(117,29): Related location
+CoinductiveProofs.dfy(115,2): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon5_Then
     (0,0): anon6_Then
-CoinductiveProofs.dfy(111,0): Error BP5003: A postcondition might not hold on this return path.
-CoinductiveProofs.dfy(110,10): Related location: This is the postcondition that might not hold.
-CoinductiveProofs.dfy(106,2): Related location
+CoinductiveProofs.dfy(149,11): Error: assertion violation
+CoinductiveProofs.dfy(115,2): Related location
+Execution trace:
+    (0,0): anon0
+    (0,0): anon13_Then
+    (0,0): anon16_Then
+CoinductiveProofs.dfy(153,11): Error: assertion violation
+CoinductiveProofs.dfy(115,2): Related location
+Execution trace:
+    (0,0): anon0
+    (0,0): anon13_Then
+    (0,0): anon18_Then
+CoinductiveProofs.dfy(164,0): Error BP5003: A postcondition might not hold on this return path.
+CoinductiveProofs.dfy(163,10): Related location: This is the postcondition that might not hold.
+CoinductiveProofs.dfy(159,2): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-CoinductiveProofs.dfy(150,0): Error BP5003: A postcondition might not hold on this return path.
-CoinductiveProofs.dfy(149,21): Related location: This is the postcondition that might not hold.
+CoinductiveProofs.dfy(203,0): Error BP5003: A postcondition might not hold on this return path.
+CoinductiveProofs.dfy(202,21): Related location: This is the postcondition that might not hold.
 CoinductiveProofs.dfy(4,23): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
-CoinductiveProofs.dfy(156,0): Error BP5003: A postcondition might not hold on this return path.
-CoinductiveProofs.dfy(155,21): Related location: This is the postcondition that might not hold.
+CoinductiveProofs.dfy(209,0): Error BP5003: A postcondition might not hold on this return path.
+CoinductiveProofs.dfy(208,21): Related location: This is the postcondition that might not hold.
 CoinductiveProofs.dfy(4,23): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
 
-Dafny program verifier finished with 35 verified, 8 errors
+Dafny program verifier finished with 42 verified, 12 errors
diff --git a/Test/wishlist/tooltips-on-inductive-lemmas.dfy b/Test/wishlist/tooltips-on-inductive-lemmas.dfy
deleted file mode 100644
index 1bd25437..00000000
--- a/Test/wishlist/tooltips-on-inductive-lemmas.dfy
+++ /dev/null
@@ -1,12 +0,0 @@
-// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:1 /printTooltips "%s" > "%t"
-// RUN: %diff "%s.expect" "%t"
-
-inductive lemma P()
-  requires Q() { // WISH the tooltip for this was broken at some point between
-                 // revisions 94ee216fe0cd (1179) and bd779dda3b3d (1785)
-  P();
-}
-
-inductive predicate Q() {
-  Q()
-}
diff --git a/Test/wishlist/tooltips-on-inductive-lemmas.dfy.expect b/Test/wishlist/tooltips-on-inductive-lemmas.dfy.expect
deleted file mode 100644
index 4d036eef..00000000
--- a/Test/wishlist/tooltips-on-inductive-lemmas.dfy.expect
+++ /dev/null
@@ -1,7 +0,0 @@
-tooltips-on-inductive-lemmas.dfy(5,11): Info: Q
-tooltips-on-inductive-lemmas.dfy(7,2): Info: P
-tooltips-on-inductive-lemmas.dfy(11,2): Info: Q#[_k - 1]
-tooltips-on-inductive-lemmas.dfy(4,16): Info: P# {:induction _k}
-tooltips-on-inductive-lemmas.dfy(4,16): Info: P# decreases _k
-
-Dafny program verifier finished with 3 verified, 0 errors
-- 
cgit v1.2.3


From cfe05df94a5ccb6025c94bd21b09bfc1240de756 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Fri, 2 Oct 2015 18:56:13 -0700
Subject: Made /rewriteFocalPredicates:1 the default

---
 Source/Dafny/DafnyOptions.cs         |  8 ++++----
 Test/dafny0/CoinductiveProofs.dfy    |  2 +-
 Test/dafny0/InductivePredicates.dfy  |  6 +++---
 Test/dafny3/Filter.dfy               |  6 +++---
 Test/dafny4/NipkowKlein-chapter7.dfy | 12 ++++++------
 5 files changed, 17 insertions(+), 17 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index 2d8756d2..b61ba555 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -66,7 +66,7 @@ namespace Microsoft.Dafny
     public bool CountVerificationErrors = true;
     public bool Optimize = false;
     public bool AutoTriggers = false;
-    public bool RewriteFocalPredicates = false;
+    public bool RewriteFocalPredicates = true;
     public bool PrintTooltips = false;
     public bool PrintStats = false;
     public bool PrintFunctionCallGraph = false;
@@ -379,9 +379,9 @@ namespace Microsoft.Dafny
                 1 - Add a {:trigger} to each user-level quantifier. Existing
                               annotations are preserved.
   /rewriteFocalPredicates:<n>
-                0 (default) - Don't rewrite predicates in the body of prefix lemmas.
-                1 - In the body of prefix lemmas, rewrite any use of a focal predicate
-                    P to P#[_k-1].
+                0 - Don't rewrite predicates in the body of prefix lemmas.
+                1 (default) - In the body of prefix lemmas, rewrite any use of a focal predicate
+                              P to P#[_k-1].
   /optimize     Produce optimized C# code, meaning:
                   - selects optimized C# prelude by passing 
                     /define:DAFNY_USE_SYSTEM_COLLECTIONS_IMMUTABLE to csc.exe (requires 
diff --git a/Test/dafny0/CoinductiveProofs.dfy b/Test/dafny0/CoinductiveProofs.dfy
index 0dce8af9..c8bb45c7 100644
--- a/Test/dafny0/CoinductiveProofs.dfy
+++ b/Test/dafny0/CoinductiveProofs.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /rewriteFocalPredicates:1 "%s" > "%t"
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 codatatype Stream<T> = Cons(head: T, tail: Stream)
diff --git a/Test/dafny0/InductivePredicates.dfy b/Test/dafny0/InductivePredicates.dfy
index 8d05af11..e9aa7604 100644
--- a/Test/dafny0/InductivePredicates.dfy
+++ b/Test/dafny0/InductivePredicates.dfy
@@ -58,7 +58,7 @@ inductive lemma {:induction false} IL_EvenBetter(x: natinf)
   if {
     case x.N? && x.n == 0 =>
       // trivial
-    case x.N? && 2 <= x.n && Even(N(x.n - 2)) =>
+    case x.N? && 2 <= x.n && Even(N(x.n - 2)) =>  // syntactic rewrite makes this like in IL
       IL_EvenBetter(N(x.n - 2));
   }
 }
@@ -142,7 +142,7 @@ module Alt {
     }
   }
 
-  inductive lemma {:induction false} MyLemma_NiceButNotFast(x: natinf)
+  inductive lemma {:induction false} MyLemma_Nicer(x: natinf)  // same as MyLemma_NotSoNice but relying on syntactic rewrites
     requires Even(x)
     ensures x.N? && x.n % 2 == 0
   {
@@ -151,7 +151,7 @@ module Alt {
         // trivial
       case exists y :: x == S(S(y)) && Even(y) =>
         var y :| x == S(S(y)) && Even(y);
-        MyLemma_NiceButNotFast(y);
+        MyLemma_Nicer(y);
         assert x.n == y.n + 2;
     }
   }
diff --git a/Test/dafny3/Filter.dfy b/Test/dafny3/Filter.dfy
index 6f541396..4f8b35ec 100644
--- a/Test/dafny3/Filter.dfy
+++ b/Test/dafny3/Filter.dfy
@@ -157,11 +157,11 @@ colemma Filter_IsSubStream(s: Stream, P: Predicate)
     calc {
       true;
     ==  { Filter_IsSubStream(s.tail, P); }  // induction hypothesis
-      IsSubStream#[_k-1](Filter(s.tail, P), s.tail);
+      IsSubStream(Filter(s.tail, P), s.tail);
     == // { assert Filter(s.tail, h) == Filter(s, h).tail; }
-      IsSubStream#[_k-1](Filter(s, P).tail, s.tail);
+      IsSubStream(Filter(s, P).tail, s.tail);
     ==> { Lemma_TailSubStreamK(Filter(s, P).tail, s, _k-1); }
-      IsSubStream#[_k-1](Filter(s, P).tail, s);
+      IsSubStream(Filter(s, P).tail, s);
     }
     calc {
       In(Filter(s, P).head, s);
diff --git a/Test/dafny4/NipkowKlein-chapter7.dfy b/Test/dafny4/NipkowKlein-chapter7.dfy
index aae94550..0c089895 100644
--- a/Test/dafny4/NipkowKlein-chapter7.dfy
+++ b/Test/dafny4/NipkowKlein-chapter7.dfy
@@ -162,8 +162,8 @@ inductive lemma SmallStep_is_deterministic(cs: (com, state), cs': (com, state),
   case Seq(c0, c1) =>
     if c0 == SKIP {
     } else {
-      var c0' :| cs'.0 == Seq(c0', c1) && small_step#[_k-1](c0, cs.1, c0', cs'.1);
-      var c0'' :| cs''.0 == Seq(c0'', c1) && small_step#[_k-1](c0, cs.1, c0'', cs''.1);
+      var c0' :| cs'.0 == Seq(c0', c1) && small_step(c0, cs.1, c0', cs'.1);
+      var c0'' :| cs''.0 == Seq(c0'', c1) && small_step(c0, cs.1, c0'', cs''.1);
       SmallStep_is_deterministic((c0, cs.1), (c0', cs'.1), (c0'', cs''.1));
     }
   case If(b, thn, els) =>
@@ -200,7 +200,7 @@ inductive lemma BigStep_implies_SmallStepStar(c: com, s: state, t: state)
   case Assign(x, a) =>
     assert small_step_star(SKIP, t, SKIP, t);
   case Seq(c0, c1) =>
-    var s' :| big_step#[_k-1](c0, s, s') && big_step#[_k-1](c1, s', t);
+    var s' :| big_step(c0, s, s') && big_step(c1, s', t);
     calc <== {
       small_step_star(c, s, SKIP, t);
       { star_transitive(Seq(c0, c1), s, Seq(SKIP, c1), s', SKIP, t); }
@@ -226,7 +226,7 @@ inductive lemma BigStep_implies_SmallStepStar(c: com, s: state, t: state)
         true;
       }
     } else {
-      var s' :| big_step#[_k-1](body, s, s') && big_step#[_k-1](While(b, body), s', t);
+      var s' :| big_step(body, s, s') && big_step(While(b, body), s', t);
       calc <== {
         small_step_star(c, s, SKIP, t);
         { assert small_step(c, s, If(b, Seq(body, While(b, body)), SKIP), s); }
@@ -253,7 +253,7 @@ inductive lemma lemma_7_13(c0: com, s0: state, c: com, t: state, c1: com)
 {
   if c0 == c && s0 == t {
   } else {
-    var c', s' :| small_step(c0, s0, c', s') && small_step_star#[_k-1](c', s', c, t);
+    var c', s' :| small_step(c0, s0, c', s') && small_step_star(c', s', c, t);
     lemma_7_13(c', s', c, t, c1);
   }
 }
@@ -264,7 +264,7 @@ inductive lemma SmallStepStar_implies_BigStep(c: com, s: state, t: state)
 {
   if c == SKIP && s == t {
   } else {
-    var c', s' :| small_step(c, s, c', s') && small_step_star#[_k-1](c', s', SKIP, t);
+    var c', s' :| small_step(c, s, c', s') && small_step_star(c', s', SKIP, t);
     SmallStep_plus_BigStep(c, s, c', s', t);
   }
 }
-- 
cgit v1.2.3


From e07d86d6cc4423703dbfb479f09b44c80f877ef9 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Sat, 3 Oct 2015 02:40:41 -0700
Subject: Parsing and pretty printing of the new "existential guards" of the
 two kinds of "if" statements.

---
 Source/Dafny/Cloner.cs                   |    4 +-
 Source/Dafny/Dafny.atg                   |   64 +-
 Source/Dafny/DafnyAst.cs                 |   12 +-
 Source/Dafny/Parser.cs                   | 1268 ++++++++++++++++--------------
 Source/Dafny/Printer.cs                  |   60 +-
 Source/Dafny/RefinementTransformer.cs    |    8 +-
 Source/Dafny/Resolver.cs                 |    2 +-
 Source/Dafny/Rewriter.cs                 |    2 +-
 Source/Dafny/Scanner.cs                  |  264 +++----
 Source/Dafny/Translator.cs               |    4 +-
 Test/dafny0/ExistentialGuards.dfy        |   89 +++
 Test/dafny0/ExistentialGuards.dfy.expect |   94 +++
 Test/dafny0/Simple.dfy                   |   27 +
 Test/dafny0/Simple.dfy.expect            |   29 +
 14 files changed, 1137 insertions(+), 790 deletions(-)
 create mode 100644 Test/dafny0/ExistentialGuards.dfy
 create mode 100644 Test/dafny0/ExistentialGuards.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index 45d8a2c9..9a93a340 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -531,7 +531,7 @@ namespace Microsoft.Dafny
 
       } else if (stmt is IfStmt) {
         var s = (IfStmt)stmt;
-        r = new IfStmt(Tok(s.Tok), Tok(s.EndTok), CloneExpr(s.Guard), CloneBlockStmt(s.Thn), CloneStmt(s.Els));
+        r = new IfStmt(Tok(s.Tok), Tok(s.EndTok), s.IsExistentialGuard, CloneExpr(s.Guard), CloneBlockStmt(s.Thn), CloneStmt(s.Els));
 
       } else if (stmt is AlternativeStmt) {
         var s = (AlternativeStmt)stmt;
@@ -631,7 +631,7 @@ namespace Microsoft.Dafny
     }
 
     public GuardedAlternative CloneGuardedAlternative(GuardedAlternative alt) {
-      return new GuardedAlternative(Tok(alt.Tok), CloneExpr(alt.Guard), alt.Body.ConvertAll(CloneStmt));
+      return new GuardedAlternative(Tok(alt.Tok), alt.IsExistentialGuard, CloneExpr(alt.Guard), alt.Body.ConvertAll(CloneStmt));
     }
 
     public Function CloneFunction(Function f, string newName = null) {
diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index 954448af..66dff8a2 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -104,6 +104,25 @@ bool IsAlternative() {
   return la.kind == _lbrace && x.kind == _case;
 }
 
+// an existential guard starts with an identifier and is then followed by
+// * a colon (if the first identifier is given an explicit type),
+// * a comma (if there's a list a bound variables and the first one is not given an explicit type),
+// * a start-attribute (if there's one bound variable and it is not given an explicit type and there are attributes), or
+// * a bored smiley (if there's one bound variable and it is not given an explicit type).
+bool IsExistentialGuard() {
+  scanner.ResetPeek();
+  if (la.kind == _ident) {
+    Token x = scanner.Peek();
+    if (x.kind == _colon || x.kind == _comma || x.kind == _boredSmiley) {
+      return true;
+    } else if (x.kind == _lbrace) {
+      x = scanner.Peek();
+      return x.kind == _colon;
+    }
+  }
+  return false;
+}
+
 bool IsLoopSpec() {
   return la.kind == _invariant | la.kind == _decreases | la.kind == _modifies;
 }
@@ -456,6 +475,7 @@ TOKENS
   comma = ','.
   verticalbar = '|'.
   doublecolon = "::".
+  boredSmiley = ":|".
   bullet = '\u2022'.
   dot = '.'.
   semi = ';'.
@@ -1651,7 +1671,7 @@ VarDeclStatement<.out Statement/*!*/ s.>
   .
 IfStmt<out Statement/*!*/ ifStmt>
 = (. Contract.Ensures(Contract.ValueAtReturn(out ifStmt) != null); IToken/*!*/ x;
-     Expression guard = null;  IToken guardEllipsis = null;
+     Expression guard = null;  IToken guardEllipsis = null;  bool isExistentialGuard = false;
      BlockStmt/*!*/ thn;
      BlockStmt/*!*/ bs;
      Statement/*!*/ s;
@@ -1663,11 +1683,13 @@ IfStmt<out Statement/*!*/ ifStmt>
   "if"                       (. x = t; .)
   (
     IF(IsAlternative())
-    AlternativeBlock<out alternatives, out endTok>
+    AlternativeBlock<true, out alternatives, out endTok>
     (. ifStmt = new AlternativeStmt(x, endTok, alternatives); .)
   |
-    ( Guard<out guard>
-    | "..."                  (. guardEllipsis = t; .)
+    ( IF(IsExistentialGuard())
+      ExistentialGuard<out guard, true>  (. isExistentialGuard = true; .)
+    | Guard<out guard>
+    | "..."                              (. guardEllipsis = t; .)
     )
     BlockStmt<out thn, out bodyStart, out bodyEnd>    (. endTok = thn.EndTok; .)
     [ "else"
@@ -1676,26 +1698,29 @@ IfStmt<out Statement/*!*/ ifStmt>
       )
     ]
     (. if (guardEllipsis != null) {
-         ifStmt = new SkeletonStatement(new IfStmt(x, endTok, guard, thn, els), guardEllipsis, null);
+         ifStmt = new SkeletonStatement(new IfStmt(x, endTok, isExistentialGuard, guard, thn, els), guardEllipsis, null);
        } else {
-         ifStmt = new IfStmt(x, endTok, guard, thn, els);
+         ifStmt = new IfStmt(x, endTok, isExistentialGuard, guard, thn, els);
        }
     .)
   )
   .
-AlternativeBlock<.out List<GuardedAlternative> alternatives, out IToken endTok.>
+AlternativeBlock<.bool allowExistentialGuards, out List<GuardedAlternative> alternatives, out IToken endTok.>
 = (. alternatives = new List<GuardedAlternative>();
      IToken x;
-     Expression e;
+     Expression e; bool isExistentialGuard;
      List<Statement> body;
   .)
   "{"
-  { "case"                      (. x = t; .)
-    Expression<out e, true, false> // NB: don't allow lambda here
+  { "case"                             (. x = t; isExistentialGuard = false; e = dummyExpr; .)
+    ( IF(allowExistentialGuards && IsExistentialGuard())
+      ExistentialGuard<out e, false >  (. isExistentialGuard = true; .)  // NB: don't allow lambda here
+    | Expression<out e, true, false> // NB: don't allow lambda here
+    )
     "=>"
     (. body = new List<Statement>(); .)
     { Stmt<body> }
-    (. alternatives.Add(new GuardedAlternative(x, e, body)); .)
+    (. alternatives.Add(new GuardedAlternative(x, isExistentialGuard, e, body)); .)
   }
   "}"                           (. endTok = t; .)
   .
@@ -1719,7 +1744,7 @@ WhileStmt<out Statement stmt>
   (
     IF(IsLoopSpec() || IsAlternative())
     { LoopSpec<invariants, decreases, ref mod, ref decAttrs, ref modAttrs> }
-    AlternativeBlock<out alternatives, out endTok>
+    AlternativeBlock<false, out alternatives, out endTok>
     (. stmt = new AlternativeLoopStmt(x, endTok, invariants, new Specification<Expression>(decreases, decAttrs), new Specification<FrameExpression>(mod, modAttrs), alternatives); .)
   |
     ( Guard<out guard>           (. Contract.Assume(guard == null || cce.Owner.None(guard)); .)
@@ -1799,6 +1824,21 @@ Guard<out Expression e>   /* null represents demonic-choice */
   | Expression<out ee, true, true>        (. e = ee; .)
   )
   .
+ExistentialGuard<out Expression e, bool allowLambda>
+= (. var bvars = new List<BoundVar>();
+     BoundVar bv;  IToken x;
+     Attributes attrs = null;
+     Expression body;
+  .)
+  IdentTypeOptional<out bv>                    (. bvars.Add(bv); x = bv.tok; .)
+  { ","
+    IdentTypeOptional<out bv>                  (. bvars.Add(bv); .)
+  }
+  { Attribute<ref attrs> }
+  ":|"
+  Expression<out body, true, allowLambda>
+  (. e = new ExistsExpr(x, bvars, null, body, attrs); .)
+  .
 MatchStmt<out Statement/*!*/ s>
 = (. Contract.Ensures(Contract.ValueAtReturn(out s) != null);
      Token x;  Expression/*!*/ e;  MatchCaseStmt/*!*/ c;
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 4fc48f2f..64af1425 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -4411,20 +4411,24 @@ namespace Microsoft.Dafny {
   }
 
   public class IfStmt : Statement {
+    public readonly bool IsExistentialGuard;
     public readonly Expression Guard;
     public readonly BlockStmt Thn;
     public readonly Statement Els;
     [ContractInvariantMethod]
     void ObjectInvariant() {
+      Contract.Invariant(!IsExistentialGuard || (Guard is ExistsExpr && ((ExistsExpr)Guard).Range == null));
       Contract.Invariant(Thn != null);
       Contract.Invariant(Els == null || Els is BlockStmt || Els is IfStmt || Els is SkeletonStatement);
     }
-    public IfStmt(IToken tok, IToken endTok, Expression guard, BlockStmt thn, Statement els)
+    public IfStmt(IToken tok, IToken endTok, bool isExistentialGuard, Expression guard, BlockStmt thn, Statement els)
       : base(tok, endTok) {
       Contract.Requires(tok != null);
       Contract.Requires(endTok != null);
+      Contract.Requires(!isExistentialGuard || (guard is ExistsExpr && ((ExistsExpr)guard).Range == null));
       Contract.Requires(thn != null);
       Contract.Requires(els == null || els is BlockStmt || els is IfStmt || els is SkeletonStatement);
+      this.IsExistentialGuard = isExistentialGuard;
       this.Guard = guard;
       this.Thn = thn;
       this.Els = els;
@@ -4450,20 +4454,24 @@ namespace Microsoft.Dafny {
   public class GuardedAlternative
   {
     public readonly IToken Tok;
+    public readonly bool IsExistentialGuard;
     public readonly Expression Guard;
     public readonly List<Statement> Body;
     [ContractInvariantMethod]
     void ObjectInvariant() {
       Contract.Invariant(Tok != null);
       Contract.Invariant(Guard != null);
+      Contract.Invariant(!IsExistentialGuard || (Guard is ExistsExpr && ((ExistsExpr)Guard).Range == null));
       Contract.Invariant(Body != null);
     }
-    public GuardedAlternative(IToken tok, Expression guard, List<Statement> body)
+    public GuardedAlternative(IToken tok, bool isExistentialGuard, Expression guard, List<Statement> body)
     {
       Contract.Requires(tok != null);
       Contract.Requires(guard != null);
+      Contract.Requires(!isExistentialGuard || (guard is ExistsExpr && ((ExistsExpr)guard).Range == null));
       Contract.Requires(body != null);
       this.Tok = tok;
+      this.IsExistentialGuard = isExistentialGuard;
       this.Guard = guard;
       this.Body = body;
     }
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index 7dafb572..c79c1051 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -38,40 +38,41 @@ public class Parser {
 	public const int _comma = 22;
 	public const int _verticalbar = 23;
 	public const int _doublecolon = 24;
-	public const int _bullet = 25;
-	public const int _dot = 26;
-	public const int _semi = 27;
-	public const int _darrow = 28;
-	public const int _arrow = 29;
-	public const int _assume = 30;
-	public const int _calc = 31;
-	public const int _case = 32;
-	public const int _then = 33;
-	public const int _else = 34;
-	public const int _decreases = 35;
-	public const int _invariant = 36;
-	public const int _function = 37;
-	public const int _predicate = 38;
-	public const int _inductive = 39;
-	public const int _lemma = 40;
-	public const int _copredicate = 41;
-	public const int _modifies = 42;
-	public const int _reads = 43;
-	public const int _requires = 44;
-	public const int _lbrace = 45;
-	public const int _rbrace = 46;
-	public const int _lbracket = 47;
-	public const int _rbracket = 48;
-	public const int _openparen = 49;
-	public const int _closeparen = 50;
-	public const int _openAngleBracket = 51;
-	public const int _closeAngleBracket = 52;
-	public const int _eq = 53;
-	public const int _neq = 54;
-	public const int _neqAlt = 55;
-	public const int _star = 56;
-	public const int _notIn = 57;
-	public const int _ellipsis = 58;
+	public const int _boredSmiley = 25;
+	public const int _bullet = 26;
+	public const int _dot = 27;
+	public const int _semi = 28;
+	public const int _darrow = 29;
+	public const int _arrow = 30;
+	public const int _assume = 31;
+	public const int _calc = 32;
+	public const int _case = 33;
+	public const int _then = 34;
+	public const int _else = 35;
+	public const int _decreases = 36;
+	public const int _invariant = 37;
+	public const int _function = 38;
+	public const int _predicate = 39;
+	public const int _inductive = 40;
+	public const int _lemma = 41;
+	public const int _copredicate = 42;
+	public const int _modifies = 43;
+	public const int _reads = 44;
+	public const int _requires = 45;
+	public const int _lbrace = 46;
+	public const int _rbrace = 47;
+	public const int _lbracket = 48;
+	public const int _rbracket = 49;
+	public const int _openparen = 50;
+	public const int _closeparen = 51;
+	public const int _openAngleBracket = 52;
+	public const int _closeAngleBracket = 53;
+	public const int _eq = 54;
+	public const int _neq = 55;
+	public const int _neqAlt = 56;
+	public const int _star = 57;
+	public const int _notIn = 58;
+	public const int _ellipsis = 59;
 	public const int maxT = 138;
 
 	const bool _T = true;
@@ -175,6 +176,25 @@ bool IsAlternative() {
   return la.kind == _lbrace && x.kind == _case;
 }
 
+// an existential guard starts with an identifier and is then followed by
+// * a colon (if the first identifier is given an explicit type),
+// * a comma (if there's a list a bound variables and the first one is not given an explicit type),
+// * a start-attribute (if there's one bound variable and it is not given an explicit type and there are attributes), or
+// * a bored smiley (if there's one bound variable and it is not given an explicit type).
+bool IsExistentialGuard() {
+  scanner.ResetPeek();
+  if (la.kind == _ident) {
+    Token x = scanner.Peek();
+    if (x.kind == _colon || x.kind == _comma || x.kind == _boredSmiley) {
+      return true;
+    } else if (x.kind == _lbrace) {
+      x = scanner.Peek();
+      return x.kind == _colon;
+    }
+  }
+  return false;
+}
+
 bool IsLoopSpec() {
   return la.kind == _invariant | la.kind == _decreases | la.kind == _modifies;
 }
@@ -532,7 +552,7 @@ bool IsType(ref IToken pt) {
 		TraitDecl/*!*/ trait;
 		Contract.Assert(defaultModule != null);
 		
-		while (la.kind == 59) {
+		while (la.kind == 60) {
 			Get();
 			Expect(20);
 			{
@@ -552,42 +572,42 @@ bool IsType(ref IToken pt) {
 		}
 		while (StartOf(1)) {
 			switch (la.kind) {
-			case 60: case 61: case 64: {
+			case 61: case 62: case 65: {
 				SubModuleDecl(defaultModule, out submodule);
 				defaultModule.TopLevelDecls.Add(submodule); 
 				break;
 			}
-			case 69: {
+			case 70: {
 				ClassDecl(defaultModule, out c);
 				defaultModule.TopLevelDecls.Add(c); 
 				break;
 			}
-			case 75: case 76: {
+			case 76: case 77: {
 				DatatypeDecl(defaultModule, out dt);
 				defaultModule.TopLevelDecls.Add(dt); 
 				break;
 			}
-			case 78: {
+			case 79: {
 				NewtypeDecl(defaultModule, out td);
 				defaultModule.TopLevelDecls.Add(td); 
 				break;
 			}
-			case 79: {
+			case 80: {
 				OtherTypeDecl(defaultModule, out td);
 				defaultModule.TopLevelDecls.Add(td); 
 				break;
 			}
-			case 80: {
+			case 81: {
 				IteratorDecl(defaultModule, out iter);
 				defaultModule.TopLevelDecls.Add(iter); 
 				break;
 			}
-			case 71: {
+			case 72: {
 				TraitDecl(defaultModule, out trait);
 				defaultModule.TopLevelDecls.Add(trait); 
 				break;
 			}
-			case 37: case 38: case 39: case 40: case 41: case 72: case 73: case 74: case 77: case 83: case 84: case 85: case 86: {
+			case 38: case 39: case 40: case 41: case 42: case 73: case 74: case 75: case 78: case 84: case 85: case 86: case 87: {
 				ClassMemberDecl(membersDefaultClass, false, !DafnyOptions.O.AllowGlobals, false);
 				break;
 			}
@@ -621,20 +641,20 @@ bool IsType(ref IToken pt) {
 		bool isExclusively = false;
 		bool opened = false;
 		
-		if (la.kind == 60 || la.kind == 61) {
-			if (la.kind == 60) {
+		if (la.kind == 61 || la.kind == 62) {
+			if (la.kind == 61) {
 				Get();
 				isAbstract = true; 
 			}
-			Expect(61);
-			while (la.kind == 45) {
+			Expect(62);
+			while (la.kind == 46) {
 				Attribute(ref attrs);
 			}
 			NoUSIdent(out id);
-			if (la.kind == 62 || la.kind == 63) {
-				if (la.kind == 62) {
+			if (la.kind == 63 || la.kind == 64) {
+				if (la.kind == 63) {
 					Get();
-					Expect(63);
+					Expect(64);
 					QualifiedModuleName(out idRefined);
 					isExclusively = true; 
 				} else {
@@ -644,79 +664,79 @@ bool IsType(ref IToken pt) {
 				}
 			}
 			module = new ModuleDefinition(id, id.val, isAbstract, false, isExclusively, idRefined == null ? null : idRefined, parent, attrs, false, this); 
-			Expect(45);
+			Expect(46);
 			module.BodyStartTok = t; 
 			while (StartOf(1)) {
 				switch (la.kind) {
-				case 60: case 61: case 64: {
+				case 61: case 62: case 65: {
 					SubModuleDecl(module, out sm);
 					module.TopLevelDecls.Add(sm); 
 					break;
 				}
-				case 69: {
+				case 70: {
 					ClassDecl(module, out c);
 					module.TopLevelDecls.Add(c); 
 					break;
 				}
-				case 71: {
+				case 72: {
 					TraitDecl(module, out trait);
 					module.TopLevelDecls.Add(trait); 
 					break;
 				}
-				case 75: case 76: {
+				case 76: case 77: {
 					DatatypeDecl(module, out dt);
 					module.TopLevelDecls.Add(dt); 
 					break;
 				}
-				case 78: {
+				case 79: {
 					NewtypeDecl(module, out td);
 					module.TopLevelDecls.Add(td); 
 					break;
 				}
-				case 79: {
+				case 80: {
 					OtherTypeDecl(module, out td);
 					module.TopLevelDecls.Add(td); 
 					break;
 				}
-				case 80: {
+				case 81: {
 					IteratorDecl(module, out iter);
 					module.TopLevelDecls.Add(iter); 
 					break;
 				}
-				case 37: case 38: case 39: case 40: case 41: case 72: case 73: case 74: case 77: case 83: case 84: case 85: case 86: {
+				case 38: case 39: case 40: case 41: case 42: case 73: case 74: case 75: case 78: case 84: case 85: case 86: case 87: {
 					ClassMemberDecl(namedModuleDefaultClassMembers, false, !DafnyOptions.O.AllowGlobals, DafnyOptions.O.IronDafny && isAbstract);
 					break;
 				}
 				}
 			}
-			Expect(46);
+			Expect(47);
 			module.BodyEndTok = t;
 			module.TopLevelDecls.Add(new DefaultClassDecl(module, namedModuleDefaultClassMembers));
 			submodule = new LiteralModuleDecl(module, parent); 
-		} else if (la.kind == 64) {
+		} else if (la.kind == 65) {
 			Get();
-			if (la.kind == 65) {
+			if (la.kind == 66) {
 				Get();
 				opened = true;
 			}
 			NoUSIdent(out id);
-			if (la.kind == 66 || la.kind == 67) {
-				if (la.kind == 66) {
+			if (la.kind == 67 || la.kind == 68) {
+				if (la.kind == 67) {
 					Get();
 					QualifiedModuleName(out idPath);
 					submodule = new AliasModuleDecl(idPath, id, parent, opened); 
 				} else {
 					Get();
 					QualifiedModuleName(out idPath);
-					if (la.kind == 68) {
+					if (la.kind == 69) {
 						Get();
 						QualifiedModuleName(out idAssignment);
 					}
 					submodule = new ModuleFacadeDecl(idPath, id, parent, idAssignment, opened); 
 				}
 			}
-			if (la.kind == 27) {
-				while (!(la.kind == 0 || la.kind == 27)) {SynErr(139); Get();}
+			if (la.kind == 28) {
+				while (!(la.kind == 0 || la.kind == 28)) {SynErr(139); Get();}
 				Get();
 				errors.Warning(t, "the semi-colon that used to terminate a sub-module declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 			}
@@ -740,16 +760,16 @@ bool IsType(ref IToken pt) {
 		List<MemberDecl/*!*/> members = new List<MemberDecl/*!*/>();
 		IToken bodyStart;
 		
-		while (!(la.kind == 0 || la.kind == 69)) {SynErr(141); Get();}
-		Expect(69);
-		while (la.kind == 45) {
+		while (!(la.kind == 0 || la.kind == 70)) {SynErr(141); Get();}
+		Expect(70);
+		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		if (la.kind == 51) {
+		if (la.kind == 52) {
 			GenericParameters(typeArgs);
 		}
-		if (la.kind == 70) {
+		if (la.kind == 71) {
 			Get();
 			Type(out trait);
 			traits.Add(trait); 
@@ -759,12 +779,12 @@ bool IsType(ref IToken pt) {
 				traits.Add(trait); 
 			}
 		}
-		Expect(45);
+		Expect(46);
 		bodyStart = t;  
 		while (StartOf(2)) {
 			ClassMemberDecl(members, true, false, false);
 		}
-		Expect(46);
+		Expect(47);
 		c = new ClassDecl(id, id.val, module, typeArgs, members, attrs, traits);
 		c.BodyStartTok = bodyStart;
 		c.BodyEndTok = t;
@@ -781,29 +801,29 @@ bool IsType(ref IToken pt) {
 		IToken bodyStart = Token.NoToken;  // dummy assignment
 		bool co = false;
 		
-		while (!(la.kind == 0 || la.kind == 75 || la.kind == 76)) {SynErr(142); Get();}
-		if (la.kind == 75) {
+		while (!(la.kind == 0 || la.kind == 76 || la.kind == 77)) {SynErr(142); Get();}
+		if (la.kind == 76) {
 			Get();
-		} else if (la.kind == 76) {
+		} else if (la.kind == 77) {
 			Get();
 			co = true; 
 		} else SynErr(143);
-		while (la.kind == 45) {
+		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		if (la.kind == 51) {
+		if (la.kind == 52) {
 			GenericParameters(typeArgs);
 		}
-		Expect(66);
+		Expect(67);
 		bodyStart = t; 
 		DatatypeMemberDecl(ctors);
 		while (la.kind == 23) {
 			Get();
 			DatatypeMemberDecl(ctors);
 		}
-		if (la.kind == 27) {
-			while (!(la.kind == 0 || la.kind == 27)) {SynErr(144); Get();}
+		if (la.kind == 28) {
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(144); Get();}
 			Get();
 			errors.Warning(t, "the semi-colon that used to terminate a (co)datatype declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 		}
@@ -824,12 +844,12 @@ bool IsType(ref IToken pt) {
 		Type baseType = null;
 		Expression wh;
 		
-		Expect(78);
-		while (la.kind == 45) {
+		Expect(79);
+		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		Expect(66);
+		Expect(67);
 		if (IsIdentColonOrBar()) {
 			NoUSIdent(out bvId);
 			if (la.kind == 21) {
@@ -854,24 +874,24 @@ bool IsType(ref IToken pt) {
 		td = null;
 		Type ty;
 		
-		Expect(79);
-		while (la.kind == 45) {
+		Expect(80);
+		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		if (la.kind == 49) {
+		if (la.kind == 50) {
 			Get();
-			Expect(53);
-			Expect(50);
+			Expect(54);
+			Expect(51);
 			eqSupport = TypeParameter.EqualitySupportValue.Required; 
-			if (la.kind == 51) {
+			if (la.kind == 52) {
 				GenericParameters(typeArgs);
 			}
 		} else if (StartOf(4)) {
-			if (la.kind == 51) {
+			if (la.kind == 52) {
 				GenericParameters(typeArgs);
 			}
-			if (la.kind == 66) {
+			if (la.kind == 67) {
 				Get();
 				Type(out ty);
 				td = new TypeSynonymDecl(id, id.val, typeArgs, module, ty, attrs); 
@@ -881,8 +901,8 @@ bool IsType(ref IToken pt) {
 		 td = new OpaqueTypeDecl(id, id.val, module, eqSupport, typeArgs, attrs);
 		}
 		
-		if (la.kind == 27) {
-			while (!(la.kind == 0 || la.kind == 27)) {SynErr(147); Get();}
+		if (la.kind == 28) {
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(147); Get();}
 			Get();
 			errors.Warning(t, "the semi-colon that used to terminate an opaque-type declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 		}
@@ -911,19 +931,19 @@ bool IsType(ref IToken pt) {
 		IToken bodyStart = Token.NoToken;
 		IToken bodyEnd = Token.NoToken;
 		
-		while (!(la.kind == 0 || la.kind == 80)) {SynErr(148); Get();}
-		Expect(80);
-		while (la.kind == 45) {
+		while (!(la.kind == 0 || la.kind == 81)) {SynErr(148); Get();}
+		Expect(81);
+		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		if (la.kind == 49 || la.kind == 51) {
-			if (la.kind == 51) {
+		if (la.kind == 50 || la.kind == 52) {
+			if (la.kind == 52) {
 				GenericParameters(typeArgs);
 			}
 			Formals(true, true, ins);
-			if (la.kind == 81 || la.kind == 82) {
-				if (la.kind == 81) {
+			if (la.kind == 82 || la.kind == 83) {
+				if (la.kind == 82) {
 					Get();
 				} else {
 					Get();
@@ -931,14 +951,14 @@ bool IsType(ref IToken pt) {
 				}
 				Formals(false, true, outs);
 			}
-		} else if (la.kind == 58) {
+		} else if (la.kind == 59) {
 			Get();
 			signatureEllipsis = t; 
 		} else SynErr(149);
 		while (StartOf(5)) {
 			IteratorSpec(reads, mod, decreases, req, ens, yieldReq, yieldEns, ref readsAttrs, ref modAttrs, ref decrAttrs);
 		}
-		if (la.kind == 45) {
+		if (la.kind == 46) {
 			BlockStmt(out body, out bodyStart, out bodyEnd);
 		}
 		iter = new IteratorDecl(id, id.val, module, typeArgs, ins, outs,
@@ -961,21 +981,21 @@ bool IsType(ref IToken pt) {
 		List<MemberDecl/*!*/> members = new List<MemberDecl/*!*/>();
 		IToken bodyStart;
 		
-		while (!(la.kind == 0 || la.kind == 71)) {SynErr(150); Get();}
-		Expect(71);
-		while (la.kind == 45) {
+		while (!(la.kind == 0 || la.kind == 72)) {SynErr(150); Get();}
+		Expect(72);
+		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		if (la.kind == 51) {
+		if (la.kind == 52) {
 			GenericParameters(typeArgs);
 		}
-		Expect(45);
+		Expect(46);
 		bodyStart = t; 
 		while (StartOf(2)) {
 			ClassMemberDecl(members, true, false, false);
 		}
-		Expect(46);
+		Expect(47);
 		trait = new TraitDecl(id, id.val, module, typeArgs, members, attrs);
 		trait.BodyStartTok = bodyStart;
 		trait.BodyEndTok = t;
@@ -989,11 +1009,11 @@ bool IsType(ref IToken pt) {
 		MemberModifiers mmod = new MemberModifiers();
 		IToken staticToken = null, protectedToken = null;
 		
-		while (la.kind == 72 || la.kind == 73 || la.kind == 74) {
-			if (la.kind == 72) {
+		while (la.kind == 73 || la.kind == 74 || la.kind == 75) {
+			if (la.kind == 73) {
 				Get();
 				mmod.IsGhost = true; 
-			} else if (la.kind == 73) {
+			} else if (la.kind == 74) {
 				Get();
 				mmod.IsStatic = true; staticToken = t; 
 			} else {
@@ -1001,7 +1021,7 @@ bool IsType(ref IToken pt) {
 				mmod.IsProtected = true; protectedToken = t; 
 			}
 		}
-		if (la.kind == 77) {
+		if (la.kind == 78) {
 			if (moduleLevelDecl) {
 			 SemErr(la, "fields are not allowed to be declared at the module level; instead, wrap the field in a 'class' declaration");
 			 mmod.IsStatic = false;
@@ -1036,14 +1056,14 @@ bool IsType(ref IToken pt) {
 		IToken x; string name;
 		var args = new List<Expression>();
 		
-		Expect(45);
+		Expect(46);
 		Expect(21);
 		NoUSIdent(out x);
 		name = x.val; 
 		if (StartOf(7)) {
 			Expressions(args);
 		}
-		Expect(46);
+		Expect(47);
 		attrs = new Attributes(name, args, attrs); 
 	}
 
@@ -1061,7 +1081,7 @@ bool IsType(ref IToken pt) {
 		IToken id; ids = new List<IToken>(); 
 		Ident(out id);
 		ids.Add(id); 
-		while (la.kind == 26) {
+		while (la.kind == 27) {
 			Get();
 			Ident(out id);
 			ids.Add(id); 
@@ -1079,13 +1099,13 @@ bool IsType(ref IToken pt) {
 		IToken/*!*/ id;
 		TypeParameter.EqualitySupportValue eqSupport;
 		
-		Expect(51);
+		Expect(52);
 		NoUSIdent(out id);
 		eqSupport = TypeParameter.EqualitySupportValue.Unspecified; 
-		if (la.kind == 49) {
+		if (la.kind == 50) {
 			Get();
-			Expect(53);
-			Expect(50);
+			Expect(54);
+			Expect(51);
 			eqSupport = TypeParameter.EqualitySupportValue.Required; 
 		}
 		typeArgs.Add(new TypeParameter(id, id.val, eqSupport)); 
@@ -1093,15 +1113,15 @@ bool IsType(ref IToken pt) {
 			Get();
 			NoUSIdent(out id);
 			eqSupport = TypeParameter.EqualitySupportValue.Unspecified; 
-			if (la.kind == 49) {
+			if (la.kind == 50) {
 				Get();
-				Expect(53);
-				Expect(50);
+				Expect(54);
+				Expect(51);
 				eqSupport = TypeParameter.EqualitySupportValue.Required; 
 			}
 			typeArgs.Add(new TypeParameter(id, id.val, eqSupport)); 
 		}
-		Expect(52);
+		Expect(53);
 	}
 
 	void Type(out Type ty) {
@@ -1114,11 +1134,11 @@ bool IsType(ref IToken pt) {
 		Attributes attrs = null;
 		IToken/*!*/ id;  Type/*!*/ ty;
 		
-		while (!(la.kind == 0 || la.kind == 77)) {SynErr(152); Get();}
-		Expect(77);
+		while (!(la.kind == 0 || la.kind == 78)) {SynErr(152); Get();}
+		Expect(78);
 		if (mmod.IsStatic) { SemErr(t, "fields cannot be declared 'static'"); }
 		
-		while (la.kind == 45) {
+		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		FIdentType(out id, out ty);
@@ -1150,48 +1170,48 @@ bool IsType(ref IToken pt) {
 		IToken signatureEllipsis = null;
 		bool missingOpenParen;
 		
-		if (la.kind == 37) {
+		if (la.kind == 38) {
 			Get();
-			if (la.kind == 83) {
+			if (la.kind == 84) {
 				Get();
 				isFunctionMethod = true; 
 			}
 			if (mmod.IsGhost) { SemErr(t, "functions cannot be declared 'ghost' (they are ghost by default)"); }
 			
-			while (la.kind == 45) {
+			while (la.kind == 46) {
 				Attribute(ref attrs);
 			}
 			NoUSIdent(out id);
-			if (la.kind == 49 || la.kind == 51) {
-				if (la.kind == 51) {
+			if (la.kind == 50 || la.kind == 52) {
+				if (la.kind == 52) {
 					GenericParameters(typeArgs);
 				}
 				Formals(true, isFunctionMethod, formals);
 				Expect(21);
 				Type(out returnType);
-			} else if (la.kind == 58) {
+			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
 			} else SynErr(153);
-		} else if (la.kind == 38) {
+		} else if (la.kind == 39) {
 			Get();
 			isPredicate = true; 
-			if (la.kind == 83) {
+			if (la.kind == 84) {
 				Get();
 				isFunctionMethod = true; 
 			}
 			if (mmod.IsGhost) { SemErr(t, "predicates cannot be declared 'ghost' (they are ghost by default)"); }
 			
-			while (la.kind == 45) {
+			while (la.kind == 46) {
 				Attribute(ref attrs);
 			}
 			NoUSIdent(out id);
 			if (StartOf(8)) {
-				if (la.kind == 51) {
+				if (la.kind == 52) {
 					GenericParameters(typeArgs);
 				}
 				missingOpenParen = true; 
-				if (la.kind == 49) {
+				if (la.kind == 50) {
 					Formals(true, isFunctionMethod, formals);
 					missingOpenParen = false; 
 				}
@@ -1200,22 +1220,22 @@ bool IsType(ref IToken pt) {
 					Get();
 					SemErr(t, "predicates do not have an explicitly declared return type; it is always bool"); 
 				}
-			} else if (la.kind == 58) {
+			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
 			} else SynErr(154);
-		} else if (la.kind == 39) {
+		} else if (la.kind == 40) {
 			Get();
-			Expect(38);
+			Expect(39);
 			isIndPredicate = true; 
 			if (mmod.IsGhost) { SemErr(t, "inductive predicates cannot be declared 'ghost' (they are ghost by default)"); }
 			
-			while (la.kind == 45) {
+			while (la.kind == 46) {
 				Attribute(ref attrs);
 			}
 			NoUSIdent(out id);
-			if (la.kind == 49 || la.kind == 51) {
-				if (la.kind == 51) {
+			if (la.kind == 50 || la.kind == 52) {
+				if (la.kind == 52) {
 					GenericParameters(typeArgs);
 				}
 				Formals(true, isFunctionMethod, formals);
@@ -1223,21 +1243,21 @@ bool IsType(ref IToken pt) {
 					Get();
 					SemErr(t, "inductive predicates do not have an explicitly declared return type; it is always bool"); 
 				}
-			} else if (la.kind == 58) {
+			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
 			} else SynErr(155);
-		} else if (la.kind == 41) {
+		} else if (la.kind == 42) {
 			Get();
 			isCoPredicate = true; 
 			if (mmod.IsGhost) { SemErr(t, "copredicates cannot be declared 'ghost' (they are ghost by default)"); }
 			
-			while (la.kind == 45) {
+			while (la.kind == 46) {
 				Attribute(ref attrs);
 			}
 			NoUSIdent(out id);
-			if (la.kind == 49 || la.kind == 51) {
-				if (la.kind == 51) {
+			if (la.kind == 50 || la.kind == 52) {
+				if (la.kind == 52) {
 					GenericParameters(typeArgs);
 				}
 				Formals(true, isFunctionMethod, formals);
@@ -1245,7 +1265,7 @@ bool IsType(ref IToken pt) {
 					Get();
 					SemErr(t, "copredicates do not have an explicitly declared return type; it is always bool"); 
 				}
-			} else if (la.kind == 58) {
+			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
 			} else SynErr(156);
@@ -1254,7 +1274,7 @@ bool IsType(ref IToken pt) {
 		while (StartOf(9)) {
 			FunctionSpec(reqs, reads, ens, decreases);
 		}
-		if (la.kind == 45) {
+		if (la.kind == 46) {
 			FunctionBody(out body, out bodyStart, out bodyEnd);
 		}
 		if (!isWithinAbstractModule && DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported")) {
@@ -1310,34 +1330,34 @@ bool IsType(ref IToken pt) {
 		
 		while (!(StartOf(10))) {SynErr(158); Get();}
 		switch (la.kind) {
-		case 83: {
+		case 84: {
 			Get();
 			break;
 		}
-		case 40: {
+		case 41: {
 			Get();
 			isLemma = true; 
 			break;
 		}
-		case 84: {
+		case 85: {
 			Get();
 			isCoLemma = true; 
 			break;
 		}
-		case 85: {
+		case 86: {
 			Get();
 			isCoLemma = true;
 			errors.Warning(t, "the 'comethod' keyword has been deprecated; it has been renamed to 'colemma'");
 			
 			break;
 		}
-		case 39: {
+		case 40: {
 			Get();
-			Expect(40);
+			Expect(41);
 			isIndLemma = true; 
 			break;
 		}
-		case 86: {
+		case 87: {
 			Get();
 			if (allowConstructor) {
 			 isConstructor = true;
@@ -1371,7 +1391,7 @@ bool IsType(ref IToken pt) {
 		 }
 		}
 		
-		while (la.kind == 45) {
+		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		if (la.kind == 1) {
@@ -1385,24 +1405,24 @@ bool IsType(ref IToken pt) {
 		 }
 		}
 		
-		if (la.kind == 49 || la.kind == 51) {
-			if (la.kind == 51) {
+		if (la.kind == 50 || la.kind == 52) {
+			if (la.kind == 52) {
 				GenericParameters(typeArgs);
 			}
 			Formals(true, !mmod.IsGhost, ins);
-			if (la.kind == 82) {
+			if (la.kind == 83) {
 				Get();
 				if (isConstructor) { SemErr(t, "constructors cannot have out-parameters"); } 
 				Formals(false, !mmod.IsGhost, outs);
 			}
-		} else if (la.kind == 58) {
+		} else if (la.kind == 59) {
 			Get();
 			signatureEllipsis = t; 
 		} else SynErr(160);
 		while (StartOf(11)) {
 			MethodSpec(req, mod, ens, dec, ref decAttrs, ref modAttrs);
 		}
-		if (la.kind == 45) {
+		if (la.kind == 46) {
 			BlockStmt(out body, out bodyStart, out bodyEnd);
 		}
 		if (!isWithinAbstractModule && DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported") && !Attributes.Contains(attrs, "decl") && theVerifyThisFile) {
@@ -1437,11 +1457,11 @@ bool IsType(ref IToken pt) {
 		IToken/*!*/ id;
 		List<Formal/*!*/> formals = new List<Formal/*!*/>();
 		
-		while (la.kind == 45) {
+		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		if (la.kind == 49) {
+		if (la.kind == 50) {
 			FormalsOptionalIds(formals);
 		}
 		ctors.Add(new DatatypeCtor(id, id.val, formals, attrs)); 
@@ -1449,7 +1469,7 @@ bool IsType(ref IToken pt) {
 
 	void FormalsOptionalIds(List<Formal/*!*/>/*!*/ formals) {
 		Contract.Requires(cce.NonNullElements(formals)); IToken/*!*/ id;  Type/*!*/ ty;  string/*!*/ name;  bool isGhost; 
-		Expect(49);
+		Expect(50);
 		if (StartOf(12)) {
 			TypeIdentOptional(out id, out name, out ty, out isGhost);
 			formals.Add(new Formal(id, name, ty, true, isGhost)); 
@@ -1459,7 +1479,7 @@ bool IsType(ref IToken pt) {
 				formals.Add(new Formal(id, name, ty, true, isGhost)); 
 			}
 		}
-		Expect(50);
+		Expect(51);
 	}
 
 	void FIdentType(out IToken/*!*/ id, out Type/*!*/ ty) {
@@ -1477,8 +1497,8 @@ bool IsType(ref IToken pt) {
 	}
 
 	void OldSemi() {
-		if (la.kind == 27) {
-			while (!(la.kind == 0 || la.kind == 27)) {SynErr(162); Get();}
+		if (la.kind == 28) {
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(162); Get();}
 			Get();
 		}
 	}
@@ -1487,7 +1507,7 @@ bool IsType(ref IToken pt) {
 		Expression e0; IToken endTok; 
 		EquivExpression(out e, allowSemi, allowLambda);
 		if (SemiFollowsCall(allowSemi, e)) {
-			Expect(27);
+			Expect(28);
 			endTok = t; 
 			Expression(out e0, allowSemi, allowLambda);
 			e = new StmtExpr(e.tok,
@@ -1501,7 +1521,7 @@ bool IsType(ref IToken pt) {
 		Contract.Ensures(Contract.ValueAtReturn(out id)!=null);
 		Contract.Ensures(Contract.ValueAtReturn(out ty)!=null);
 		isGhost = false; 
-		if (la.kind == 72) {
+		if (la.kind == 73) {
 			Get();
 			if (allowGhostKeyword) { isGhost = true; } else { SemErr(t, "formal cannot be declared 'ghost' in this context"); } 
 		}
@@ -1553,7 +1573,7 @@ bool IsType(ref IToken pt) {
 		Contract.Ensures(Contract.ValueAtReturn(out ty)!=null);
 		Contract.Ensures(Contract.ValueAtReturn(out identName)!=null);
 		string name = null; id = Token.NoToken; ty = new BoolType()/*dummy*/; isGhost = false; 
-		if (la.kind == 72) {
+		if (la.kind == 73) {
 			Get();
 			isGhost = true; 
 		}
@@ -1623,7 +1643,7 @@ bool IsType(ref IToken pt) {
 		case 13: {
 			Get();
 			tok = t;  gt = new List<Type>(); 
-			if (la.kind == 51) {
+			if (la.kind == 52) {
 				GenericInstantiation(gt);
 			}
 			if (gt.Count > 1) {
@@ -1636,7 +1656,7 @@ bool IsType(ref IToken pt) {
 		case 14: {
 			Get();
 			tok = t;  gt = new List<Type>(); 
-			if (la.kind == 51) {
+			if (la.kind == 52) {
 				GenericInstantiation(gt);
 			}
 			if (gt.Count > 1) {
@@ -1649,7 +1669,7 @@ bool IsType(ref IToken pt) {
 		case 15: {
 			Get();
 			tok = t;  gt = new List<Type>(); 
-			if (la.kind == 51) {
+			if (la.kind == 52) {
 				GenericInstantiation(gt);
 			}
 			if (gt.Count > 1) {
@@ -1662,7 +1682,7 @@ bool IsType(ref IToken pt) {
 		case 16: {
 			Get();
 			tok = t;  gt = new List<Type>(); 
-			if (la.kind == 51) {
+			if (la.kind == 52) {
 				GenericInstantiation(gt);
 			}
 			if (gt.Count > 1) {
@@ -1680,7 +1700,7 @@ bool IsType(ref IToken pt) {
 		case 17: {
 			Get();
 			tok = t;  gt = new List<Type>(); 
-			if (la.kind == 51) {
+			if (la.kind == 52) {
 				GenericInstantiation(gt);
 			}
 			if (gt.Count == 0) {
@@ -1697,7 +1717,7 @@ bool IsType(ref IToken pt) {
 		case 18: {
 			Get();
 			tok = t;  gt = new List<Type>(); 
-			if (la.kind == 51) {
+			if (la.kind == 52) {
 				GenericInstantiation(gt);
 			}
 			if (gt.Count == 0) {
@@ -1714,7 +1734,7 @@ bool IsType(ref IToken pt) {
 		case 5: {
 			Get();
 			tok = t;  gt = null; 
-			if (la.kind == 51) {
+			if (la.kind == 52) {
 				gt = new List<Type>(); 
 				GenericInstantiation(gt);
 			}
@@ -1723,7 +1743,7 @@ bool IsType(ref IToken pt) {
 			
 			break;
 		}
-		case 49: {
+		case 50: {
 			Get();
 			tok = t; tupleArgTypes = new List<Type>(); 
 			if (StartOf(3)) {
@@ -1735,7 +1755,7 @@ bool IsType(ref IToken pt) {
 					tupleArgTypes.Add(ty); 
 				}
 			}
-			Expect(50);
+			Expect(51);
 			if (tupleArgTypes.Count == 1) {
 			 // just return the type 'ty'
 			} else {
@@ -1750,11 +1770,11 @@ bool IsType(ref IToken pt) {
 			Expression e; tok = t; 
 			NameSegmentForTypeName(out e);
 			tok = t; 
-			while (la.kind == 26) {
+			while (la.kind == 27) {
 				Get();
 				Expect(1);
 				tok = t; List<Type> typeArgs = null; 
-				if (la.kind == 51) {
+				if (la.kind == 52) {
 					typeArgs = new List<Type>(); 
 					GenericInstantiation(typeArgs);
 				}
@@ -1765,7 +1785,7 @@ bool IsType(ref IToken pt) {
 		}
 		default: SynErr(164); break;
 		}
-		if (la.kind == 29) {
+		if (la.kind == 30) {
 			Type t2; 
 			Get();
 			tok = t; 
@@ -1783,8 +1803,8 @@ bool IsType(ref IToken pt) {
 
 	void Formals(bool incoming, bool allowGhostKeyword, List<Formal> formals) {
 		Contract.Requires(cce.NonNullElements(formals)); IToken id;  Type ty;  bool isGhost; 
-		Expect(49);
-		if (la.kind == 1 || la.kind == 72) {
+		Expect(50);
+		if (la.kind == 1 || la.kind == 73) {
 			GIdentType(allowGhostKeyword, out id, out ty, out isGhost);
 			formals.Add(new Formal(id, id.val, ty, incoming, isGhost)); 
 			while (la.kind == 22) {
@@ -1793,7 +1813,7 @@ bool IsType(ref IToken pt) {
 				formals.Add(new Formal(id, id.val, ty, incoming, isGhost)); 
 			}
 		}
-		Expect(50);
+		Expect(51);
 	}
 
 	void IteratorSpec(List<FrameExpression/*!*/>/*!*/ reads, List<FrameExpression/*!*/>/*!*/ mod, List<Expression/*!*/> decreases,
@@ -1803,7 +1823,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 		Expression/*!*/ e; FrameExpression/*!*/ fe; bool isFree = false; bool isYield = false; Attributes ensAttrs = null;
 		
 		while (!(StartOf(13))) {SynErr(165); Get();}
-		if (la.kind == 43) {
+		if (la.kind == 44) {
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref readsAttrs);
@@ -1816,7 +1836,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 				reads.Add(fe); 
 			}
 			OldSemi();
-		} else if (la.kind == 42) {
+		} else if (la.kind == 43) {
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref modAttrs);
@@ -1830,17 +1850,17 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 			}
 			OldSemi();
 		} else if (StartOf(14)) {
-			if (la.kind == 87) {
+			if (la.kind == 88) {
 				Get();
 				isFree = true;
 				errors.Warning(t, "the 'free' keyword is soon to be deprecated");
 				
 			}
-			if (la.kind == 89) {
+			if (la.kind == 90) {
 				Get();
 				isYield = true; 
 			}
-			if (la.kind == 44) {
+			if (la.kind == 45) {
 				Get();
 				Expression(out e, false, false);
 				OldSemi();
@@ -1850,7 +1870,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 				 req.Add(new MaybeFreeExpression(e, isFree));
 				}
 				
-			} else if (la.kind == 88) {
+			} else if (la.kind == 89) {
 				Get();
 				while (IsAttribute()) {
 					Attribute(ref ensAttrs);
@@ -1864,7 +1884,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 				}
 				
 			} else SynErr(166);
-		} else if (la.kind == 35) {
+		} else if (la.kind == 36) {
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref decrAttrs);
@@ -1878,12 +1898,12 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 		Contract.Ensures(Contract.ValueAtReturn(out block) != null);
 		List<Statement/*!*/> body = new List<Statement/*!*/>();
 		
-		Expect(45);
+		Expect(46);
 		bodyStart = t; 
 		while (StartOf(15)) {
 			Stmt(body);
 		}
-		Expect(46);
+		Expect(47);
 		bodyEnd = t;
 		block = new BlockStmt(bodyStart, bodyEnd, body); 
 	}
@@ -1894,7 +1914,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression/*!*/ e;  FrameExpression/*!*/ fe;  bool isFree = false; Attributes ensAttrs = null;
 		
 		while (!(StartOf(16))) {SynErr(168); Get();}
-		if (la.kind == 42) {
+		if (la.kind == 43) {
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref modAttrs);
@@ -1907,19 +1927,19 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				mod.Add(fe); 
 			}
 			OldSemi();
-		} else if (la.kind == 44 || la.kind == 87 || la.kind == 88) {
-			if (la.kind == 87) {
+		} else if (la.kind == 45 || la.kind == 88 || la.kind == 89) {
+			if (la.kind == 88) {
 				Get();
 				isFree = true;
 				errors.Warning(t, "the 'free' keyword is soon to be deprecated");
 				
 			}
-			if (la.kind == 44) {
+			if (la.kind == 45) {
 				Get();
 				Expression(out e, false, false);
 				OldSemi();
 				req.Add(new MaybeFreeExpression(e, isFree)); 
-			} else if (la.kind == 88) {
+			} else if (la.kind == 89) {
 				Get();
 				while (IsAttribute()) {
 					Attribute(ref ensAttrs);
@@ -1928,7 +1948,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				OldSemi();
 				ens.Add(new MaybeFreeExpression(e, isFree, ensAttrs)); 
 			} else SynErr(169);
-		} else if (la.kind == 35) {
+		} else if (la.kind == 36) {
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref decAttrs);
@@ -1948,13 +1968,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (StartOf(7)) {
 			Expression(out e, allowSemi, allowLambda);
 			feTok = e.tok; 
-			if (la.kind == 90) {
+			if (la.kind == 91) {
 				Get();
 				Ident(out id);
 				fieldName = id.val;  feTok = id; 
 			}
 			fe = new FrameExpression(feTok, e, fieldName); 
-		} else if (la.kind == 90) {
+		} else if (la.kind == 91) {
 			Get();
 			Ident(out id);
 			fieldName = id.val; 
@@ -1985,7 +2005,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void GenericInstantiation(List<Type/*!*/>/*!*/ gt) {
 		Contract.Requires(cce.NonNullElements(gt)); Type/*!*/ ty; 
-		Expect(51);
+		Expect(52);
 		Type(out ty);
 		gt.Add(ty); 
 		while (la.kind == 22) {
@@ -1993,7 +2013,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Type(out ty);
 			gt.Add(ty); 
 		}
-		Expect(52);
+		Expect(53);
 	}
 
 	void NameSegmentForTypeName(out Expression e) {
@@ -2001,7 +2021,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<Type> typeArgs = null;
 		
 		Ident(out id);
-		if (la.kind == 51) {
+		if (la.kind == 52) {
 			typeArgs = new List<Type>(); 
 			GenericInstantiation(typeArgs);
 		}
@@ -2015,12 +2035,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Requires(decreases == null || cce.NonNullElements(decreases));
 		Expression/*!*/ e;  FrameExpression/*!*/ fe; 
 		while (!(StartOf(17))) {SynErr(172); Get();}
-		if (la.kind == 44) {
+		if (la.kind == 45) {
 			Get();
 			Expression(out e, false, false);
 			OldSemi();
 			reqs.Add(e); 
-		} else if (la.kind == 43) {
+		} else if (la.kind == 44) {
 			Get();
 			PossiblyWildFrameExpression(out fe, false);
 			reads.Add(fe); 
@@ -2030,12 +2050,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				reads.Add(fe); 
 			}
 			OldSemi();
-		} else if (la.kind == 88) {
+		} else if (la.kind == 89) {
 			Get();
 			Expression(out e, false, false);
 			OldSemi();
 			ens.Add(e); 
-		} else if (la.kind == 35) {
+		} else if (la.kind == 36) {
 			Get();
 			if (decreases == null) {
 			 SemErr(t, "'decreases' clauses are meaningless for copredicates, so they are not allowed");
@@ -2049,16 +2069,16 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void FunctionBody(out Expression/*!*/ e, out IToken bodyStart, out IToken bodyEnd) {
 		Contract.Ensures(Contract.ValueAtReturn(out e) != null); e = dummyExpr; 
-		Expect(45);
+		Expect(46);
 		bodyStart = t; 
 		Expression(out e, true, true);
-		Expect(46);
+		Expect(47);
 		bodyEnd = t; 
 	}
 
 	void PossiblyWildFrameExpression(out FrameExpression fe, bool allowSemi) {
 		Contract.Ensures(Contract.ValueAtReturn(out fe) != null); fe = dummyFrameExpr; 
-		if (la.kind == 56) {
+		if (la.kind == 57) {
 			Get();
 			fe = new FrameExpression(t, new WildcardExpr(t), null); 
 		} else if (StartOf(18)) {
@@ -2069,7 +2089,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 	void PossiblyWildExpression(out Expression e, bool allowLambda) {
 		Contract.Ensures(Contract.ValueAtReturn(out e)!=null);
 		e = dummyExpr; 
-		if (la.kind == 56) {
+		if (la.kind == 57) {
 			Get();
 			e = new WildcardExpr(t); 
 		} else if (StartOf(7)) {
@@ -2093,7 +2113,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		
 		while (!(StartOf(19))) {SynErr(176); Get();}
 		switch (la.kind) {
-		case 45: {
+		case 46: {
 			BlockStmt(out bs, out bodyStart, out bodyEnd);
 			s = bs; 
 			break;
@@ -2102,7 +2122,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			AssertStmt(out s);
 			break;
 		}
-		case 30: {
+		case 31: {
 			AssumeStmt(out s);
 			break;
 		}
@@ -2110,11 +2130,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			PrintStmt(out s);
 			break;
 		}
-		case 1: case 2: case 3: case 4: case 8: case 10: case 19: case 20: case 23: case 49: case 131: case 132: case 133: case 134: case 135: case 136: {
+		case 1: case 2: case 3: case 4: case 8: case 10: case 19: case 20: case 23: case 50: case 131: case 132: case 133: case 134: case 135: case 136: {
 			UpdateStmt(out s);
 			break;
 		}
-		case 72: case 77: {
+		case 73: case 78: {
 			VarDeclStatement(out s);
 			break;
 		}
@@ -2134,7 +2154,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			ForallStmt(out s);
 			break;
 		}
-		case 31: {
+		case 32: {
 			CalcStmt(out s);
 			break;
 		}
@@ -2142,7 +2162,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			ModifyStmt(out s);
 			break;
 		}
-		case 91: {
+		case 92: {
 			Get();
 			x = t; 
 			NoUSIdent(out id);
@@ -2151,28 +2171,28 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			s.Labels = new LList<Label>(new Label(x, id.val), s.Labels); 
 			break;
 		}
-		case 92: {
+		case 93: {
 			Get();
 			x = t; breakCount = 1; label = null; 
 			if (la.kind == 1) {
 				NoUSIdent(out id);
 				label = id.val; 
-			} else if (la.kind == 27 || la.kind == 92) {
-				while (la.kind == 92) {
+			} else if (la.kind == 28 || la.kind == 93) {
+				while (la.kind == 93) {
 					Get();
 					breakCount++; 
 				}
 			} else SynErr(177);
-			while (!(la.kind == 0 || la.kind == 27)) {SynErr(178); Get();}
-			Expect(27);
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(178); Get();}
+			Expect(28);
 			s = label != null ? new BreakStmt(x, t, label) : new BreakStmt(x, t, breakCount); 
 			break;
 		}
-		case 89: case 95: {
+		case 90: case 96: {
 			ReturnStmt(out s);
 			break;
 		}
-		case 58: {
+		case 59: {
 			SkeletonStmt(out s);
 			break;
 		}
@@ -2192,11 +2212,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		}
 		if (StartOf(7)) {
 			Expression(out e, false, true);
-		} else if (la.kind == 58) {
+		} else if (la.kind == 59) {
 			Get();
 			dotdotdot = t; 
 		} else SynErr(180);
-		Expect(27);
+		Expect(28);
 		if (dotdotdot != null) {
 		 s = new SkeletonStatement(new AssertStmt(x, t, new LiteralExpr(x, true), attrs), dotdotdot, null);
 		} else {
@@ -2210,18 +2230,18 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression e = dummyExpr; Attributes attrs = null;
 		IToken dotdotdot = null;
 		
-		Expect(30);
+		Expect(31);
 		x = t; 
 		while (IsAttribute()) {
 			Attribute(ref attrs);
 		}
 		if (StartOf(7)) {
 			Expression(out e, false, true);
-		} else if (la.kind == 58) {
+		} else if (la.kind == 59) {
 			Get();
 			dotdotdot = t; 
 		} else SynErr(181);
-		Expect(27);
+		Expect(28);
 		if (dotdotdot != null) {
 		 s = new SkeletonStatement(new AssumeStmt(x, t, new LiteralExpr(x, true), attrs), dotdotdot, null);
 		} else {
@@ -2244,7 +2264,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Expression(out e, false, true);
 			args.Add(e); 
 		}
-		Expect(27);
+		Expect(28);
 		s = new PrintStmt(x, t, args); 
 	}
 
@@ -2259,20 +2279,20 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		
 		Lhs(out e);
 		x = e.tok; 
-		if (la.kind == 27 || la.kind == 45) {
-			while (la.kind == 45) {
+		if (la.kind == 28 || la.kind == 46) {
+			while (la.kind == 46) {
 				Attribute(ref attrs);
 			}
-			Expect(27);
+			Expect(28);
 			endTok = t; rhss.Add(new ExprRhs(e, attrs)); 
-		} else if (la.kind == 22 || la.kind == 94 || la.kind == 96) {
+		} else if (la.kind == 22 || la.kind == 25 || la.kind == 95) {
 			lhss.Add(e); 
 			while (la.kind == 22) {
 				Get();
 				Lhs(out e);
 				lhss.Add(e); 
 			}
-			if (la.kind == 94) {
+			if (la.kind == 95) {
 				Get();
 				x = t; 
 				Rhs(out r);
@@ -2282,16 +2302,16 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					Rhs(out r);
 					rhss.Add(r); 
 				}
-			} else if (la.kind == 96) {
+			} else if (la.kind == 25) {
 				Get();
 				x = t; 
 				if (la.kind == _assume) {
-					Expect(30);
+					Expect(31);
 					suchThatAssume = t; 
 				}
 				Expression(out suchThat, false, true);
 			} else SynErr(182);
-			Expect(27);
+			Expect(28);
 			endTok = t; 
 		} else if (la.kind == 21) {
 			Get();
@@ -2320,27 +2340,27 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Attributes attrs = null;
 		IToken endTok;
 		
-		if (la.kind == 72) {
+		if (la.kind == 73) {
 			Get();
 			isGhost = true;  x = t; 
 		}
-		Expect(77);
+		Expect(78);
 		if (!isGhost) { x = t; } 
-		while (la.kind == 45) {
+		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		LocalIdentTypeOptional(out d, isGhost);
 		lhss.Add(d); d.Attributes = attrs; attrs = null; 
 		while (la.kind == 22) {
 			Get();
-			while (la.kind == 45) {
+			while (la.kind == 46) {
 				Attribute(ref attrs);
 			}
 			LocalIdentTypeOptional(out d, isGhost);
 			lhss.Add(d); d.Attributes = attrs; attrs = null; 
 		}
-		if (la.kind == 45 || la.kind == 94 || la.kind == 96) {
-			if (la.kind == 94) {
+		if (la.kind == 25 || la.kind == 46 || la.kind == 95) {
+			if (la.kind == 95) {
 				Get();
 				assignTok = t; 
 				Rhs(out r);
@@ -2351,20 +2371,20 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					rhss.Add(r); 
 				}
 			} else {
-				while (la.kind == 45) {
+				while (la.kind == 46) {
 					Attribute(ref attrs);
 				}
-				Expect(96);
+				Expect(25);
 				assignTok = t; 
 				if (la.kind == _assume) {
-					Expect(30);
+					Expect(31);
 					suchThatAssume = t; 
 				}
 				Expression(out suchThat, false, true);
 			}
 		}
-		while (!(la.kind == 0 || la.kind == 27)) {SynErr(184); Get();}
-		Expect(27);
+		while (!(la.kind == 0 || la.kind == 28)) {SynErr(184); Get();}
+		Expect(28);
 		endTok = t; 
 		ConcreteUpdateStatement update;
 		if (suchThat != null) {
@@ -2388,7 +2408,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void IfStmt(out Statement/*!*/ ifStmt) {
 		Contract.Ensures(Contract.ValueAtReturn(out ifStmt) != null); IToken/*!*/ x;
-		Expression guard = null;  IToken guardEllipsis = null;
+		Expression guard = null;  IToken guardEllipsis = null;  bool isExistentialGuard = false;
 		BlockStmt/*!*/ thn;
 		BlockStmt/*!*/ bs;
 		Statement/*!*/ s;
@@ -2400,10 +2420,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expect(98);
 		x = t; 
 		if (IsAlternative()) {
-			AlternativeBlock(out alternatives, out endTok);
+			AlternativeBlock(true, out alternatives, out endTok);
 			ifStmt = new AlternativeStmt(x, endTok, alternatives); 
 		} else if (StartOf(20)) {
-			if (StartOf(21)) {
+			if (IsExistentialGuard()) {
+				ExistentialGuard(out guard, true);
+				isExistentialGuard = true; 
+			} else if (StartOf(21)) {
 				Guard(out guard);
 			} else {
 				Get();
@@ -2411,20 +2434,20 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			BlockStmt(out thn, out bodyStart, out bodyEnd);
 			endTok = thn.EndTok; 
-			if (la.kind == 34) {
+			if (la.kind == 35) {
 				Get();
 				if (la.kind == 98) {
 					IfStmt(out s);
 					els = s; endTok = s.EndTok; 
-				} else if (la.kind == 45) {
+				} else if (la.kind == 46) {
 					BlockStmt(out bs, out bodyStart, out bodyEnd);
 					els = bs; endTok = bs.EndTok; 
 				} else SynErr(185);
 			}
 			if (guardEllipsis != null) {
-			 ifStmt = new SkeletonStatement(new IfStmt(x, endTok, guard, thn, els), guardEllipsis, null);
+			 ifStmt = new SkeletonStatement(new IfStmt(x, endTok, isExistentialGuard, guard, thn, els), guardEllipsis, null);
 			} else {
-			 ifStmt = new IfStmt(x, endTok, guard, thn, els);
+			 ifStmt = new IfStmt(x, endTok, isExistentialGuard, guard, thn, els);
 			}
 			
 		} else SynErr(186);
@@ -2452,7 +2475,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (StartOf(22)) {
 				LoopSpec(invariants, decreases, ref mod, ref decAttrs, ref modAttrs);
 			}
-			AlternativeBlock(out alternatives, out endTok);
+			AlternativeBlock(false, out alternatives, out endTok);
 			stmt = new AlternativeLoopStmt(x, endTok, invariants, new Specification<Expression>(decreases, decAttrs), new Specification<FrameExpression>(mod, modAttrs), alternatives); 
 		} else if (StartOf(20)) {
 			if (StartOf(21)) {
@@ -2469,7 +2492,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				BlockStmt(out body, out bodyStart, out bodyEnd);
 				endTok = body.EndTok; isDirtyLoop = false; 
 			} else if (la.kind == _ellipsis) {
-				Expect(58);
+				Expect(59);
 				bodyEllipsis = t; endTok = t; isDirtyLoop = false; 
 			} else if (StartOf(23)) {
 			} else SynErr(187);
@@ -2503,13 +2526,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		x = t; 
 		Expression(out e, true, true);
 		if (la.kind == _lbrace) {
-			Expect(45);
+			Expect(46);
 			usesOptionalBrace = true; 
-			while (la.kind == 32) {
+			while (la.kind == 33) {
 				CaseStatement(out c);
 				cases.Add(c); 
 			}
-			Expect(46);
+			Expect(47);
 		} else if (StartOf(23)) {
 			while (la.kind == _case) {
 				CaseStatement(out c);
@@ -2542,11 +2565,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			
 		} else SynErr(190);
 		if (la.kind == _openparen) {
-			Expect(49);
+			Expect(50);
 			if (la.kind == 1) {
 				QuantifierDomain(out bvars, out attrs, out range);
 			}
-			Expect(50);
+			Expect(51);
 		} else if (StartOf(24)) {
 			if (la.kind == _ident) {
 				QuantifierDomain(out bvars, out attrs, out range);
@@ -2555,15 +2578,15 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (bvars == null) { bvars = new List<BoundVar>(); }
 		if (range == null) { range = new LiteralExpr(x, true); }
 		
-		while (la.kind == 87 || la.kind == 88) {
+		while (la.kind == 88 || la.kind == 89) {
 			isFree = false; 
-			if (la.kind == 87) {
+			if (la.kind == 88) {
 				Get();
 				isFree = true;
 				errors.Warning(t, "the 'free' keyword is soon to be deprecated");
 				
 			}
-			Expect(88);
+			Expect(89);
 			Expression(out e, false, true);
 			ens.Add(new MaybeFreeExpression(e, isFree)); 
 			OldSemi();
@@ -2597,7 +2620,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken opTok;
 		IToken danglingOperator = null;
 		
-		Expect(31);
+		Expect(32);
 		x = t; 
 		while (IsAttribute()) {
 			Attribute(ref attrs);
@@ -2611,11 +2634,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			resOp = calcOp;
 			
 		}
-		Expect(45);
+		Expect(46);
 		while (StartOf(7)) {
 			Expression(out e, false, true);
 			lines.Add(e); stepOp = calcOp; danglingOperator = null; 
-			Expect(27);
+			Expect(28);
 			if (StartOf(25)) {
 				CalcOp(out opTok, out op);
 				maybeOp = resOp.ResultOp(op);
@@ -2635,10 +2658,10 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			BlockStmt subBlock; Statement subCalc;
 			
 			while (la.kind == _lbrace || la.kind == _calc) {
-				if (la.kind == 45) {
+				if (la.kind == 46) {
 					BlockStmt(out subBlock, out t0, out t1);
 					hintEnd = subBlock.EndTok; subhints.Add(subBlock); 
-				} else if (la.kind == 31) {
+				} else if (la.kind == 32) {
 					CalcStmt(out subCalc);
 					hintEnd = subCalc.EndTok; subhints.Add(subCalc); 
 				} else SynErr(192);
@@ -2648,7 +2671,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			if (h.Body.Count != 0) { danglingOperator = null; }
 			
 		}
-		Expect(46);
+		Expect(47);
 		if (danglingOperator != null) {
 		 SemErr(danglingOperator, "a calculation cannot end with an operator");
 		}
@@ -2680,14 +2703,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				FrameExpression(out fe, false, true);
 				mod.Add(fe); 
 			}
-		} else if (la.kind == 58) {
+		} else if (la.kind == 59) {
 			Get();
 			ellipsisToken = t; 
 		} else SynErr(193);
-		if (la.kind == 45) {
+		if (la.kind == 46) {
 			BlockStmt(out body, out bodyStart, out endTok);
-		} else if (la.kind == 27) {
-			while (!(la.kind == 0 || la.kind == 27)) {SynErr(194); Get();}
+		} else if (la.kind == 28) {
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(194); Get();}
 			Get();
 			endTok = t; 
 		} else SynErr(195);
@@ -2704,10 +2727,10 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		AssignmentRhs r;
 		bool isYield = false;
 		
-		if (la.kind == 95) {
+		if (la.kind == 96) {
 			Get();
 			returnTok = t; 
-		} else if (la.kind == 89) {
+		} else if (la.kind == 90) {
 			Get();
 			returnTok = t; isYield = true; 
 		} else SynErr(196);
@@ -2720,7 +2743,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				rhss.Add(r); 
 			}
 		}
-		Expect(27);
+		Expect(28);
 		if (isYield) {
 		 s = new YieldStmt(returnTok, t, rhss);
 		} else {
@@ -2734,9 +2757,9 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<Expression> exprs = null;
 		IToken tok, dotdotdot, whereTok;
 		Expression e; 
-		Expect(58);
+		Expect(59);
 		dotdotdot = t; 
-		if (la.kind == 93) {
+		if (la.kind == 94) {
 			Get();
 			names = new List<IToken>(); exprs = new List<Expression>(); whereTok = t;
 			Ident(out tok);
@@ -2746,7 +2769,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Ident(out tok);
 				names.Add(tok); 
 			}
-			Expect(94);
+			Expect(95);
 			Expression(out e, false, true);
 			exprs.Add(e); 
 			while (la.kind == 22) {
@@ -2760,7 +2783,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			
 		}
-		Expect(27);
+		Expect(28);
 		s = new SkeletonStatement(dotdotdot, t, names, exprs); 
 	}
 
@@ -2777,12 +2800,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 			newToken = t; 
 			TypeAndToken(out x, out ty);
-			if (la.kind == 47 || la.kind == 49) {
-				if (la.kind == 47) {
+			if (la.kind == 48 || la.kind == 50) {
+				if (la.kind == 48) {
 					Get();
 					ee = new List<Expression>(); 
 					Expressions(ee);
-					Expect(48);
+					Expect(49);
 					var tmp = theBuiltIns.ArrayType(ee.Count, new IntType(), true);
 					
 				} else {
@@ -2791,7 +2814,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					if (StartOf(7)) {
 						Expressions(args);
 					}
-					Expect(50);
+					Expect(51);
 				}
 			}
 			if (ee != null) {
@@ -2802,14 +2825,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 r = new TypeRhs(newToken, ty);
 			}
 			
-		} else if (la.kind == 56) {
+		} else if (la.kind == 57) {
 			Get();
 			r = new HavocRhs(t); 
 		} else if (StartOf(7)) {
 			Expression(out e, false, true);
 			r = new ExprRhs(e); 
 		} else SynErr(197);
-		while (la.kind == 45) {
+		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		r.Attributes = attrs; 
@@ -2820,13 +2843,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		
 		if (la.kind == 1) {
 			NameSegment(out e);
-			while (la.kind == 26 || la.kind == 47 || la.kind == 49) {
+			while (la.kind == 27 || la.kind == 48 || la.kind == 50) {
 				Suffix(ref e);
 			}
 		} else if (StartOf(27)) {
 			ConstAtomExpression(out e, false, false);
 			Suffix(ref e);
-			while (la.kind == 26 || la.kind == 47 || la.kind == 49) {
+			while (la.kind == 27 || la.kind == 48 || la.kind == 50) {
 				Suffix(ref e);
 			}
 		} else SynErr(198);
@@ -2843,71 +2866,97 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		}
 	}
 
-	void AlternativeBlock(out List<GuardedAlternative> alternatives, out IToken endTok) {
+	void AlternativeBlock(bool allowExistentialGuards, out List<GuardedAlternative> alternatives, out IToken endTok) {
 		alternatives = new List<GuardedAlternative>();
 		IToken x;
-		Expression e;
+		Expression e; bool isExistentialGuard;
 		List<Statement> body;
 		
-		Expect(45);
-		while (la.kind == 32) {
-			Get();
-			x = t; 
-			Expression(out e, true, false);
-			Expect(28);
+		Expect(46);
+		while (la.kind == 33) {
+			Get();
+			x = t; isExistentialGuard = false; e = dummyExpr; 
+			if (allowExistentialGuards && IsExistentialGuard()) {
+				ExistentialGuard(out e, false );
+				isExistentialGuard = true; 
+			} else if (StartOf(7)) {
+				Expression(out e, true, false);
+			} else SynErr(199);
+			Expect(29);
 			body = new List<Statement>(); 
 			while (StartOf(15)) {
 				Stmt(body);
 			}
-			alternatives.Add(new GuardedAlternative(x, e, body)); 
+			alternatives.Add(new GuardedAlternative(x, isExistentialGuard, e, body)); 
 		}
-		Expect(46);
+		Expect(47);
 		endTok = t; 
 	}
 
+	void ExistentialGuard(out Expression e, bool allowLambda) {
+		var bvars = new List<BoundVar>();
+		BoundVar bv;  IToken x;
+		Attributes attrs = null;
+		Expression body;
+		
+		IdentTypeOptional(out bv);
+		bvars.Add(bv); x = bv.tok; 
+		while (la.kind == 22) {
+			Get();
+			IdentTypeOptional(out bv);
+			bvars.Add(bv); 
+		}
+		while (la.kind == 46) {
+			Attribute(ref attrs);
+		}
+		Expect(25);
+		Expression(out body, true, allowLambda);
+		e = new ExistsExpr(x, bvars, null, body, attrs); 
+	}
+
 	void Guard(out Expression e) {
 		Expression/*!*/ ee;  e = null; 
-		if (la.kind == 56) {
+		if (la.kind == 57) {
 			Get();
 			e = null; 
 		} else if (IsParenStar()) {
-			Expect(49);
-			Expect(56);
 			Expect(50);
+			Expect(57);
+			Expect(51);
 			e = null; 
 		} else if (StartOf(7)) {
 			Expression(out ee, true, true);
 			e = ee; 
-		} else SynErr(199);
+		} else SynErr(200);
 	}
 
 	void LoopSpec(List<MaybeFreeExpression> invariants, List<Expression> decreases, ref List<FrameExpression> mod, ref Attributes decAttrs, ref Attributes modAttrs) {
 		Expression e; FrameExpression fe;
 		bool isFree = false; Attributes attrs = null;
 		
-		if (la.kind == 36 || la.kind == 87) {
-			while (!(la.kind == 0 || la.kind == 36 || la.kind == 87)) {SynErr(200); Get();}
-			if (la.kind == 87) {
+		if (la.kind == 37 || la.kind == 88) {
+			while (!(la.kind == 0 || la.kind == 37 || la.kind == 88)) {SynErr(201); Get();}
+			if (la.kind == 88) {
 				Get();
 				isFree = true; errors.Warning(t, "the 'free' keyword is soon to be deprecated"); 
 			}
-			Expect(36);
+			Expect(37);
 			while (IsAttribute()) {
 				Attribute(ref attrs);
 			}
 			Expression(out e, false, true);
 			invariants.Add(new MaybeFreeExpression(e, isFree, attrs)); 
 			OldSemi();
-		} else if (la.kind == 35) {
-			while (!(la.kind == 0 || la.kind == 35)) {SynErr(201); Get();}
+		} else if (la.kind == 36) {
+			while (!(la.kind == 0 || la.kind == 36)) {SynErr(202); Get();}
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref decAttrs);
 			}
 			DecreasesList(decreases, true, true);
 			OldSemi();
-		} else if (la.kind == 42) {
-			while (!(la.kind == 0 || la.kind == 42)) {SynErr(202); Get();}
+		} else if (la.kind == 43) {
+			while (!(la.kind == 0 || la.kind == 43)) {SynErr(203); Get();}
 			Get();
 			mod = mod ?? new List<FrameExpression>(); 
 			while (IsAttribute()) {
@@ -2921,7 +2970,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				mod.Add(fe); 
 			}
 			OldSemi();
-		} else SynErr(203);
+		} else SynErr(204);
 	}
 
 	void CaseStatement(out MatchCaseStmt/*!*/ c) {
@@ -2932,12 +2981,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<Statement/*!*/> body = new List<Statement/*!*/>();
 		string/*!*/ name = "";
 		
-		Expect(32);
+		Expect(33);
 		x = t; 
 		if (la.kind == 1) {
 			Ident(out id);
 			name = id.val; 
-			if (la.kind == 49) {
+			if (la.kind == 50) {
 				Get();
 				CasePattern(out pat);
 				arguments.Add(pat); 
@@ -2946,9 +2995,9 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					CasePattern(out pat);
 					arguments.Add(pat); 
 				}
-				Expect(50);
+				Expect(51);
 			}
-		} else if (la.kind == 49) {
+		} else if (la.kind == 50) {
 			Get();
 			CasePattern(out pat);
 			arguments.Add(pat); 
@@ -2957,13 +3006,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				CasePattern(out pat);
 				arguments.Add(pat); 
 			}
-			Expect(50);
-		} else SynErr(204);
-		Expect(28);
-		while (!(StartOf(28))) {SynErr(205); Get();}
+			Expect(51);
+		} else SynErr(205);
+		Expect(29);
+		while (!(StartOf(28))) {SynErr(206); Get();}
 		while (IsNotEndOfCase()) {
 			Stmt(body);
-			while (!(StartOf(28))) {SynErr(206); Get();}
+			while (!(StartOf(28))) {SynErr(207); Get();}
 		}
 		c = new MatchCaseStmt(x, name, arguments, body); 
 	}
@@ -2975,9 +3024,9 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		
 		if (IsIdentParen()) {
 			Ident(out id);
-			Expect(49);
+			Expect(50);
 			arguments = new List<CasePattern>(); 
-			if (la.kind == 1 || la.kind == 49) {
+			if (la.kind == 1 || la.kind == 50) {
 				CasePattern(out pat);
 				arguments.Add(pat); 
 				while (la.kind == 22) {
@@ -2986,14 +3035,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					arguments.Add(pat); 
 				}
 			}
-			Expect(50);
+			Expect(51);
 			pat = new CasePattern(id, id.val, arguments); 
-		} else if (la.kind == 49) {
+		} else if (la.kind == 50) {
 			Get();
 			id = t;                                                           
 			arguments = new List<CasePattern>(); 
 			
-			if (la.kind == 1 || la.kind == 49) {
+			if (la.kind == 1 || la.kind == 50) {
 				CasePattern(out pat);
 				arguments.Add(pat); 
 				while (la.kind == 22) {
@@ -3002,7 +3051,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					arguments.Add(pat); 
 				}
 			}
-			Expect(50);
+			Expect(51);
 			theBuiltIns.TupleType(id, arguments.Count, true); // make sure the tuple type exists
 			string ctor = BuiltIns.TupleTypeCtorName;  //use the TupleTypeCtors
 			pat = new CasePattern(id, ctor, arguments); 
@@ -3011,7 +3060,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			IdentTypeOptional(out bv);
 			pat = new CasePattern(bv.tok, bv);
 			
-		} else SynErr(207);
+		} else SynErr(208);
 		if (pat == null) {
 		 pat = new CasePattern(t, "_ParseError", new List<CasePattern>());
 		}
@@ -3046,23 +3095,23 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		x = null;
 		
 		switch (la.kind) {
-		case 53: {
+		case 54: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Eq; 
 			if (la.kind == 106) {
 				Get();
-				Expect(47);
-				Expression(out k, true, true);
 				Expect(48);
+				Expression(out k, true, true);
+				Expect(49);
 			}
 			break;
 		}
-		case 51: {
+		case 52: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Lt; 
 			break;
 		}
-		case 52: {
+		case 53: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Gt; 
 			break;
@@ -3077,12 +3126,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  binOp = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		case 54: {
+		case 55: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Neq; 
 			break;
 		}
-		case 55: {
+		case 56: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Neq; 
 			break;
@@ -3112,7 +3161,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  binOp = BinaryExpr.Opcode.Exp; 
 			break;
 		}
-		default: SynErr(208); break;
+		default: SynErr(209); break;
 		}
 		if (k == null) {
 		 op = new Microsoft.Dafny.CalcStmt.BinaryCalcOp(binOp);
@@ -3127,7 +3176,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 112) {
 			Get();
-		} else SynErr(209);
+		} else SynErr(210);
 	}
 
 	void ImpliesOp() {
@@ -3135,7 +3184,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 114) {
 			Get();
-		} else SynErr(210);
+		} else SynErr(211);
 	}
 
 	void ExpliesOp() {
@@ -3143,7 +3192,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 116) {
 			Get();
-		} else SynErr(211);
+		} else SynErr(212);
 	}
 
 	void AndOp() {
@@ -3151,7 +3200,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 118) {
 			Get();
-		} else SynErr(212);
+		} else SynErr(213);
 	}
 
 	void OrOp() {
@@ -3159,7 +3208,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 120) {
 			Get();
-		} else SynErr(213);
+		} else SynErr(214);
 	}
 
 	void NegOp() {
@@ -3167,7 +3216,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 122) {
 			Get();
-		} else SynErr(214);
+		} else SynErr(215);
 	}
 
 	void Forall() {
@@ -3175,7 +3224,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 123) {
 			Get();
-		} else SynErr(215);
+		} else SynErr(216);
 	}
 
 	void Exists() {
@@ -3183,15 +3232,15 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 125) {
 			Get();
-		} else SynErr(216);
+		} else SynErr(217);
 	}
 
 	void QSep() {
 		if (la.kind == 24) {
 			Get();
-		} else if (la.kind == 25) {
+		} else if (la.kind == 26) {
 			Get();
-		} else SynErr(217);
+		} else SynErr(218);
 	}
 
 	void EquivExpression(out Expression e0, bool allowSemi, bool allowLambda) {
@@ -3225,7 +3274,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					LogicalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e0, e1); 
 				}
-			} else SynErr(218);
+			} else SynErr(219);
 		}
 	}
 
@@ -3255,7 +3304,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					RelationalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Or, e0, e1); 
 				}
-			} else SynErr(219);
+			} else SynErr(220);
 		}
 	}
 
@@ -3388,23 +3437,23 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		k = null;
 		
 		switch (la.kind) {
-		case 53: {
+		case 54: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Eq; 
 			if (la.kind == 106) {
 				Get();
-				Expect(47);
-				Expression(out k, true, true);
 				Expect(48);
+				Expression(out k, true, true);
+				Expect(49);
 			}
 			break;
 		}
-		case 51: {
+		case 52: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Lt; 
 			break;
 		}
-		case 52: {
+		case 53: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Gt; 
 			break;
@@ -3419,14 +3468,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  op = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		case 54: {
+		case 55: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Neq; 
 			if (la.kind == 106) {
 				Get();
-				Expect(47);
-				Expression(out k, true, true);
 				Expect(48);
+				Expression(out k, true, true);
+				Expect(49);
 			}
 			break;
 		}
@@ -3435,7 +3484,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  op = BinaryExpr.Opcode.In; 
 			break;
 		}
-		case 57: {
+		case 58: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.NotIn; 
 			break;
@@ -3458,7 +3507,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			
 			break;
 		}
-		case 55: {
+		case 56: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Neq; 
 			break;
@@ -3473,7 +3522,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  op = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		default: SynErr(220); break;
+		default: SynErr(221); break;
 		}
 	}
 
@@ -3495,7 +3544,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 128) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Sub; 
-		} else SynErr(221);
+		} else SynErr(222);
 	}
 
 	void UnaryExpression(out Expression e, bool allowSemi, bool allowLambda) {
@@ -3540,7 +3589,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (IsSuffix()) {
 				Suffix(ref e);
 			}
-		} else if (la.kind == 45 || la.kind == 47) {
+		} else if (la.kind == 46 || la.kind == 48) {
 			DisplayExpr(out e);
 			while (IsSuffix()) {
 				Suffix(ref e);
@@ -3555,12 +3604,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (IsSuffix()) {
 				Suffix(ref e);
 			}
-		} else SynErr(222);
+		} else SynErr(223);
 	}
 
 	void MulOp(out IToken x, out BinaryExpr.Opcode op) {
 		Contract.Ensures(Contract.ValueAtReturn(out x) != null); x = Token.NoToken;  op = BinaryExpr.Opcode.Add/*(dummy)*/; 
-		if (la.kind == 56) {
+		if (la.kind == 57) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Mul; 
 		} else if (la.kind == 129) {
@@ -3569,7 +3618,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 130) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Mod; 
-		} else SynErr(223);
+		} else SynErr(224);
 	}
 
 	void MapDisplayExpr(IToken/*!*/ mapToken, bool finite, out Expression e) {
@@ -3577,12 +3626,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<ExpressionPair/*!*/>/*!*/ elements= new List<ExpressionPair/*!*/>() ;
 		e = dummyExpr;
 		
-		Expect(47);
+		Expect(48);
 		if (StartOf(7)) {
 			MapLiteralExpressions(out elements);
 		}
 		e = new MapDisplayExpr(mapToken, finite, elements);
-		Expect(48);
+		Expect(49);
 	}
 
 	void Suffix(ref Expression e) {
@@ -3592,7 +3641,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<Expression> multipleLengths = null; bool takeRest = false; // takeRest is relevant only if multipleLengths is non-null
 		List<Expression> multipleIndices = null;
 		
-		if (la.kind == 26) {
+		if (la.kind == 27) {
 			DotSuffix(out id, out x);
 			if (x != null) {
 			 // process id as a Suffix in its own right
@@ -3607,13 +3656,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			} else if (la.kind == 106) {
 				HashCall(id, out openParen, out typeArgs, out args);
 			} else if (StartOf(30)) {
-			} else SynErr(224);
+			} else SynErr(225);
 			e = new ExprDotName(id, e, id.val, typeArgs);
 			if (openParen != null) {
 			 e = new ApplySuffix(openParen, e, args);
 			}
 			
-		} else if (la.kind == 47) {
+		} else if (la.kind == 48) {
 			Get();
 			x = t; 
 			if (StartOf(7)) {
@@ -3626,7 +3675,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 						Expression(out ee, true, true);
 						e1 = ee; 
 					}
-				} else if (la.kind == 94) {
+				} else if (la.kind == 95) {
 					Get();
 					Expression(out ee, true, true);
 					e1 = ee; 
@@ -3649,7 +3698,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 							takeRest = true; 
 						}
 					}
-				} else if (la.kind == 22 || la.kind == 48) {
+				} else if (la.kind == 22 || la.kind == 49) {
 					while (la.kind == 22) {
 						Get();
 						Expression(out ee, true, true);
@@ -3660,7 +3709,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 						multipleIndices.Add(ee);
 						
 					}
-				} else SynErr(225);
+				} else SynErr(226);
 			} else if (la.kind == 137) {
 				Get();
 				anyDots = true; 
@@ -3668,7 +3717,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					Expression(out ee, true, true);
 					e1 = ee; 
 				}
-			} else SynErr(226);
+			} else SynErr(227);
 			if (multipleIndices != null) {
 			 e = new MultiSelectExpr(x, e, multipleIndices);
 			 // make sure an array class with this dimensionality exists
@@ -3703,16 +3752,16 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 }
 			}
 			
-			Expect(48);
-		} else if (la.kind == 49) {
+			Expect(49);
+		} else if (la.kind == 50) {
 			Get();
 			IToken openParen = t; var args = new List<Expression>(); 
 			if (StartOf(7)) {
 				Expressions(args);
 			}
-			Expect(50);
+			Expect(51);
 			e = new ApplySuffix(openParen, e, args); 
-		} else SynErr(227);
+		} else SynErr(228);
 	}
 
 	void ISetDisplayExpr(IToken/*!*/ setToken, bool finite, out Expression e) {
@@ -3720,12 +3769,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<Expression> elements = new List<Expression/*!*/>();;
 		e = dummyExpr;
 		
-		Expect(45);
+		Expect(46);
 		if (StartOf(7)) {
 			Expressions(elements);
 		}
 		e = new SetDisplayExpr(setToken, finite, elements);
-		Expect(46);
+		Expect(47);
 	}
 
 	void LambdaExpression(out Expression e, bool allowSemi) {
@@ -3741,7 +3790,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (la.kind == 1) {
 			WildIdent(out id, true);
 			x = t; bvs.Add(new BoundVar(id, id.val, new InferredTypeProxy())); 
-		} else if (la.kind == 49) {
+		} else if (la.kind == 50) {
 			Get();
 			x = t; 
 			if (la.kind == 1) {
@@ -3753,10 +3802,10 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					bvs.Add(bv); 
 				}
 			}
-			Expect(50);
-		} else SynErr(228);
-		while (la.kind == 43 || la.kind == 44) {
-			if (la.kind == 43) {
+			Expect(51);
+		} else SynErr(229);
+		while (la.kind == 44 || la.kind == 45) {
+			if (la.kind == 44) {
 				Get();
 				PossiblyWildFrameExpression(out fe, true);
 				reads.Add(fe); 
@@ -3784,9 +3833,9 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 			x = t; 
 			Expression(out e, true, true);
-			Expect(33);
-			Expression(out e0, true, true);
 			Expect(34);
+			Expression(out e0, true, true);
+			Expect(35);
 			Expression(out e1, allowSemi, allowLambda);
 			e = new ITEExpr(x, e, e0, e1); 
 			break;
@@ -3811,13 +3860,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			SetComprehensionExpr(x, false, out e, allowSemi, allowLambda);
 			break;
 		}
-		case 30: case 31: case 101: {
+		case 31: case 32: case 101: {
 			StmtInExpr(out s);
 			Expression(out e, allowSemi, allowLambda);
 			e = new StmtExpr(s.Tok, s, e); 
 			break;
 		}
-		case 72: case 77: {
+		case 73: case 78: {
 			LetExpr(out e, allowSemi, allowLambda);
 			break;
 		}
@@ -3833,11 +3882,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			MapComprehensionExpr(x, false, out e, allowSemi, allowLambda);
 			break;
 		}
-		case 91: {
+		case 92: {
 			NamedExpr(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(229); break;
+		default: SynErr(230); break;
 		}
 	}
 
@@ -3852,7 +3901,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 106) {
 			HashCall(id, out openParen, out typeArgs, out args);
 		} else if (StartOf(30)) {
-		} else SynErr(230);
+		} else SynErr(231);
 		e = new NameSegment(id, id.val, typeArgs);
 		if (openParen != null) {
 		 e = new ApplySuffix(openParen, e, args);
@@ -3865,23 +3914,23 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken x;  List<Expression> elements;
 		e = dummyExpr;
 		
-		if (la.kind == 45) {
+		if (la.kind == 46) {
 			Get();
 			x = t;  elements = new List<Expression/*!*/>(); 
 			if (StartOf(7)) {
 				Expressions(elements);
 			}
 			e = new SetDisplayExpr(x, true, elements);
-			Expect(46);
-		} else if (la.kind == 47) {
+			Expect(47);
+		} else if (la.kind == 48) {
 			Get();
 			x = t;  elements = new List<Expression/*!*/>(); 
 			if (StartOf(7)) {
 				Expressions(elements);
 			}
 			e = new SeqDisplayExpr(x, elements); 
-			Expect(48);
-		} else SynErr(231);
+			Expect(49);
+		} else SynErr(232);
 	}
 
 	void MultiSetExpr(out Expression e) {
@@ -3891,21 +3940,21 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		
 		Expect(15);
 		x = t; 
-		if (la.kind == 45) {
+		if (la.kind == 46) {
 			Get();
 			elements = new List<Expression/*!*/>(); 
 			if (StartOf(7)) {
 				Expressions(elements);
 			}
 			e = new MultiSetDisplayExpr(x, elements);
-			Expect(46);
-		} else if (la.kind == 49) {
+			Expect(47);
+		} else if (la.kind == 50) {
 			Get();
 			x = t;  elements = new List<Expression/*!*/>(); 
 			Expression(out e, true, true);
 			e = new MultiSetFormingExpr(x, e); 
-			Expect(50);
-		} else SynErr(232);
+			Expect(51);
+		} else SynErr(233);
 	}
 
 	void ConstAtomExpression(out Expression e, bool allowSemi, bool allowLambda) {
@@ -3960,18 +4009,18 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		case 135: {
 			Get();
 			x = t; 
-			Expect(49);
-			Expression(out e, true, true);
 			Expect(50);
+			Expression(out e, true, true);
+			Expect(51);
 			e = new UnaryOpExpr(x, UnaryOpExpr.Opcode.Fresh, e); 
 			break;
 		}
 		case 136: {
 			Get();
 			x = t; 
-			Expect(49);
-			Expression(out e, true, true);
 			Expect(50);
+			Expression(out e, true, true);
+			Expect(51);
 			e = new OldExpr(x, e); 
 			break;
 		}
@@ -3991,17 +4040,17 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Get();
 				x = t; toType = new RealType(); 
 			}
-			Expect(49);
-			Expression(out e, true, true);
 			Expect(50);
+			Expression(out e, true, true);
+			Expect(51);
 			e = new ConversionExpr(x, e, toType); 
 			break;
 		}
-		case 49: {
+		case 50: {
 			ParensExpression(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(233); break;
+		default: SynErr(234); break;
 		}
 	}
 
@@ -4030,7 +4079,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 n = BigInteger.Zero;
 			}
 			
-		} else SynErr(234);
+		} else SynErr(235);
 	}
 
 	void Dec(out Basetypes.BigDec d) {
@@ -4050,12 +4099,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken x;
 		var args = new List<Expression>();
 		
-		Expect(49);
+		Expect(50);
 		x = t; 
 		if (StartOf(7)) {
 			Expressions(args);
 		}
-		Expect(50);
+		Expect(51);
 		if (args.Count == 1) {
 		 e = new ParensExpression(x, args[0]);
 		} else {
@@ -4068,26 +4117,26 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void LambdaArrow(out bool oneShot) {
 		oneShot = true; 
-		if (la.kind == 28) {
+		if (la.kind == 29) {
 			Get();
 			oneShot = false; 
-		} else if (la.kind == 29) {
+		} else if (la.kind == 30) {
 			Get();
 			oneShot = true; 
-		} else SynErr(235);
+		} else SynErr(236);
 	}
 
 	void MapLiteralExpressions(out List<ExpressionPair> elements) {
 		Expression/*!*/ d, r;
 		elements = new List<ExpressionPair/*!*/>(); 
 		Expression(out d, true, true);
-		Expect(94);
+		Expect(95);
 		Expression(out r, true, true);
 		elements.Add(new ExpressionPair(d,r)); 
 		while (la.kind == 22) {
 			Get();
 			Expression(out d, true, true);
-			Expect(94);
+			Expect(95);
 			Expression(out r, true, true);
 			elements.Add(new ExpressionPair(d,r)); 
 		}
@@ -4103,7 +4152,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		
 		IdentTypeOptional(out bv);
 		bvars.Add(bv); 
-		while (la.kind == 45) {
+		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		if (la.kind == 23) {
@@ -4125,19 +4174,19 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		x = t; 
 		Expression(out e, allowSemi, allowLambda);
 		if (la.kind == _lbrace) {
-			Expect(45);
+			Expect(46);
 			usesOptionalBrace = true; 
-			while (la.kind == 32) {
+			while (la.kind == 33) {
 				CaseExpression(out c, true, true);
 				cases.Add(c); 
 			}
-			Expect(46);
+			Expect(47);
 		} else if (StartOf(31)) {
 			while (la.kind == _case) {
 				CaseExpression(out c, allowSemi, allowLambda);
 				cases.Add(c); 
 			}
-		} else SynErr(236);
+		} else SynErr(237);
 		e = new MatchExpr(x, e, cases, usesOptionalBrace); 
 	}
 
@@ -4155,7 +4204,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 124 || la.kind == 125) {
 			Exists();
 			x = t; 
-		} else SynErr(237);
+		} else SynErr(238);
 		QuantifierDomain(out bvars, out attrs, out range);
 		QSep();
 		Expression(out body, allowSemi, allowLambda);
@@ -4182,7 +4231,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			IdentTypeOptional(out bv);
 			bvars.Add(bv); 
 		}
-		while (la.kind == 45) {
+		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		Expect(23);
@@ -4200,11 +4249,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		s = dummyStmt; 
 		if (la.kind == 101) {
 			AssertStmt(out s);
-		} else if (la.kind == 30) {
-			AssumeStmt(out s);
 		} else if (la.kind == 31) {
+			AssumeStmt(out s);
+		} else if (la.kind == 32) {
 			CalcStmt(out s);
-		} else SynErr(238);
+		} else SynErr(239);
 	}
 
 	void LetExpr(out Expression e, bool allowSemi, bool allowLambda) {
@@ -4217,11 +4266,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Attributes attrs = null;
 		e = dummyExpr;
 		
-		if (la.kind == 72) {
+		if (la.kind == 73) {
 			Get();
 			isGhost = true;  x = t; 
 		}
-		Expect(77);
+		Expect(78);
 		if (!isGhost) { x = t; } 
 		CasePattern(out pat);
 		if (isGhost) { pat.Vars.Iter(bv => bv.IsGhost = true); }
@@ -4234,13 +4283,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			letLHSs.Add(pat);
 			
 		}
-		if (la.kind == 94) {
+		if (la.kind == 95) {
 			Get();
-		} else if (la.kind == 45 || la.kind == 96) {
-			while (la.kind == 45) {
+		} else if (la.kind == 25 || la.kind == 46) {
+			while (la.kind == 46) {
 				Attribute(ref attrs);
 			}
-			Expect(96);
+			Expect(25);
 			exact = false;
 			foreach (var lhs in letLHSs) {
 			 if (lhs.Arguments != null) {
@@ -4248,7 +4297,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 }
 			}
 			
-		} else SynErr(239);
+		} else SynErr(240);
 		Expression(out e, false, true);
 		letRHSs.Add(e); 
 		while (la.kind == 22) {
@@ -4256,7 +4305,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Expression(out e, false, true);
 			letRHSs.Add(e); 
 		}
-		Expect(27);
+		Expect(28);
 		Expression(out e, allowSemi, allowLambda);
 		e = new LetExpr(x, letLHSs, letRHSs, e, exact, attrs); 
 	}
@@ -4266,7 +4315,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;
 		Expression expr;
 		
-		Expect(91);
+		Expect(92);
 		x = t; 
 		NoUSIdent(out d);
 		Expect(21);
@@ -4282,12 +4331,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression/*!*/ body;
 		string/*!*/ name = "";
 		
-		Expect(32);
+		Expect(33);
 		x = t; 
 		if (la.kind == 1) {
 			Ident(out id);
 			name = id.val; 
-			if (la.kind == 49) {
+			if (la.kind == 50) {
 				Get();
 				CasePattern(out pat);
 				arguments.Add(pat); 
@@ -4296,9 +4345,9 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					CasePattern(out pat);
 					arguments.Add(pat); 
 				}
-				Expect(50);
+				Expect(51);
 			}
-		} else if (la.kind == 49) {
+		} else if (la.kind == 50) {
 			Get();
 			CasePattern(out pat);
 			arguments.Add(pat); 
@@ -4307,9 +4356,9 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				CasePattern(out pat);
 				arguments.Add(pat); 
 			}
-			Expect(50);
-		} else SynErr(240);
-		Expect(28);
+			Expect(51);
+		} else SynErr(241);
+		Expect(29);
 		Expression(out body, allowSemi, allowLambda);
 		c = new MatchCaseExpr(x, name, arguments, body); 
 	}
@@ -4318,20 +4367,20 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression k; args = new List<Expression>(); typeArgs = null; 
 		Expect(106);
 		id.val = id.val + "#"; 
-		if (la.kind == 51) {
+		if (la.kind == 52) {
 			typeArgs = new List<Type>(); 
 			GenericInstantiation(typeArgs);
 		}
-		Expect(47);
-		Expression(out k, true, true);
 		Expect(48);
-		args.Add(k); 
+		Expression(out k, true, true);
 		Expect(49);
+		args.Add(k); 
+		Expect(50);
 		openParen = t; 
 		if (StartOf(7)) {
 			Expressions(args);
 		}
-		Expect(50);
+		Expect(51);
 	}
 
 	void DotSuffix(out IToken x, out IToken y) {
@@ -4339,7 +4388,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		x = Token.NoToken;
 		y = null;
 		
-		Expect(26);
+		Expect(27);
 		if (la.kind == 1) {
 			Get();
 			x = t; 
@@ -4367,13 +4416,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 }
 			}
 			
-		} else if (la.kind == 44) {
+		} else if (la.kind == 45) {
 			Get();
 			x = t; 
-		} else if (la.kind == 43) {
+		} else if (la.kind == 44) {
 			Get();
 			x = t; 
-		} else SynErr(241);
+		} else SynErr(242);
 	}
 
 
@@ -4388,50 +4437,50 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 	}
 
 	static readonly bool[,] set = {
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_T, _x,_x,_T,_T, _T,_x,_x,_T, _T,_x,_x,_T, _T,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_x, _x,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_T,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_x,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_x, _T,_x,_x,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x}
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_T, _T,_T,_x,_x, _T,_T,_x,_x, _T,_T,_x,_T, _T,_T,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_x, _T,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_T, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _T,_T,_T,_x, _T,_T,_T,_T, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _T,_T,_T,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_x, _T,_T,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_x,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x}
 
 	};
 } // end Parser
 
 
 public class Errors {
-    readonly ErrorReporter reporter;
+	readonly ErrorReporter Reporting;
 	public int ErrorCount;
 
-    public Errors(ErrorReporter reporter) {
-        Contract.Requires(reporter != null);
-        this.reporter = reporter;
+	public Errors(ErrorReporter Reporting) {
+		Contract.Requires(Reporting != null);
+		this.Reporting = Reporting;
 	}
 
 	public void SynErr(string filename, int line, int col, int n) {
@@ -4441,7 +4490,7 @@ public class Errors {
 	public void SynErr(string filename, int line, int col, string msg) {
 		Contract.Requires(msg != null);
 		ErrorCount++;
-        reporter.Error(MessageSource.Parser, filename, line, col, msg);
+		Reporting.Error(MessageSource.Parser, filename, line, col, msg);
 	}
 
 	string GetSyntaxErrorString(int n) {
@@ -4472,78 +4521,78 @@ public class Errors {
 			case 22: s = "comma expected"; break;
 			case 23: s = "verticalbar expected"; break;
 			case 24: s = "doublecolon expected"; break;
-			case 25: s = "bullet expected"; break;
-			case 26: s = "dot expected"; break;
-			case 27: s = "semi expected"; break;
-			case 28: s = "darrow expected"; break;
-			case 29: s = "arrow expected"; break;
-			case 30: s = "assume expected"; break;
-			case 31: s = "calc expected"; break;
-			case 32: s = "case expected"; break;
-			case 33: s = "then expected"; break;
-			case 34: s = "else expected"; break;
-			case 35: s = "decreases expected"; break;
-			case 36: s = "invariant expected"; break;
-			case 37: s = "function expected"; break;
-			case 38: s = "predicate expected"; break;
-			case 39: s = "inductive expected"; break;
-			case 40: s = "lemma expected"; break;
-			case 41: s = "copredicate expected"; break;
-			case 42: s = "modifies expected"; break;
-			case 43: s = "reads expected"; break;
-			case 44: s = "requires expected"; break;
-			case 45: s = "lbrace expected"; break;
-			case 46: s = "rbrace expected"; break;
-			case 47: s = "lbracket expected"; break;
-			case 48: s = "rbracket expected"; break;
-			case 49: s = "openparen expected"; break;
-			case 50: s = "closeparen expected"; break;
-			case 51: s = "openAngleBracket expected"; break;
-			case 52: s = "closeAngleBracket expected"; break;
-			case 53: s = "eq expected"; break;
-			case 54: s = "neq expected"; break;
-			case 55: s = "neqAlt expected"; break;
-			case 56: s = "star expected"; break;
-			case 57: s = "notIn expected"; break;
-			case 58: s = "ellipsis expected"; break;
-			case 59: s = "\"include\" expected"; break;
-			case 60: s = "\"abstract\" expected"; break;
-			case 61: s = "\"module\" expected"; break;
-			case 62: s = "\"exclusively\" expected"; break;
-			case 63: s = "\"refines\" expected"; break;
-			case 64: s = "\"import\" expected"; break;
-			case 65: s = "\"opened\" expected"; break;
-			case 66: s = "\"=\" expected"; break;
-			case 67: s = "\"as\" expected"; break;
-			case 68: s = "\"default\" expected"; break;
-			case 69: s = "\"class\" expected"; break;
-			case 70: s = "\"extends\" expected"; break;
-			case 71: s = "\"trait\" expected"; break;
-			case 72: s = "\"ghost\" expected"; break;
-			case 73: s = "\"static\" expected"; break;
-			case 74: s = "\"protected\" expected"; break;
-			case 75: s = "\"datatype\" expected"; break;
-			case 76: s = "\"codatatype\" expected"; break;
-			case 77: s = "\"var\" expected"; break;
-			case 78: s = "\"newtype\" expected"; break;
-			case 79: s = "\"type\" expected"; break;
-			case 80: s = "\"iterator\" expected"; break;
-			case 81: s = "\"yields\" expected"; break;
-			case 82: s = "\"returns\" expected"; break;
-			case 83: s = "\"method\" expected"; break;
-			case 84: s = "\"colemma\" expected"; break;
-			case 85: s = "\"comethod\" expected"; break;
-			case 86: s = "\"constructor\" expected"; break;
-			case 87: s = "\"free\" expected"; break;
-			case 88: s = "\"ensures\" expected"; break;
-			case 89: s = "\"yield\" expected"; break;
-			case 90: s = "\"`\" expected"; break;
-			case 91: s = "\"label\" expected"; break;
-			case 92: s = "\"break\" expected"; break;
-			case 93: s = "\"where\" expected"; break;
-			case 94: s = "\":=\" expected"; break;
-			case 95: s = "\"return\" expected"; break;
-			case 96: s = "\":|\" expected"; break;
+			case 25: s = "boredSmiley expected"; break;
+			case 26: s = "bullet expected"; break;
+			case 27: s = "dot expected"; break;
+			case 28: s = "semi expected"; break;
+			case 29: s = "darrow expected"; break;
+			case 30: s = "arrow expected"; break;
+			case 31: s = "assume expected"; break;
+			case 32: s = "calc expected"; break;
+			case 33: s = "case expected"; break;
+			case 34: s = "then expected"; break;
+			case 35: s = "else expected"; break;
+			case 36: s = "decreases expected"; break;
+			case 37: s = "invariant expected"; break;
+			case 38: s = "function expected"; break;
+			case 39: s = "predicate expected"; break;
+			case 40: s = "inductive expected"; break;
+			case 41: s = "lemma expected"; break;
+			case 42: s = "copredicate expected"; break;
+			case 43: s = "modifies expected"; break;
+			case 44: s = "reads expected"; break;
+			case 45: s = "requires expected"; break;
+			case 46: s = "lbrace expected"; break;
+			case 47: s = "rbrace expected"; break;
+			case 48: s = "lbracket expected"; break;
+			case 49: s = "rbracket expected"; break;
+			case 50: s = "openparen expected"; break;
+			case 51: s = "closeparen expected"; break;
+			case 52: s = "openAngleBracket expected"; break;
+			case 53: s = "closeAngleBracket expected"; break;
+			case 54: s = "eq expected"; break;
+			case 55: s = "neq expected"; break;
+			case 56: s = "neqAlt expected"; break;
+			case 57: s = "star expected"; break;
+			case 58: s = "notIn expected"; break;
+			case 59: s = "ellipsis expected"; break;
+			case 60: s = "\"include\" expected"; break;
+			case 61: s = "\"abstract\" expected"; break;
+			case 62: s = "\"module\" expected"; break;
+			case 63: s = "\"exclusively\" expected"; break;
+			case 64: s = "\"refines\" expected"; break;
+			case 65: s = "\"import\" expected"; break;
+			case 66: s = "\"opened\" expected"; break;
+			case 67: s = "\"=\" expected"; break;
+			case 68: s = "\"as\" expected"; break;
+			case 69: s = "\"default\" expected"; break;
+			case 70: s = "\"class\" expected"; break;
+			case 71: s = "\"extends\" expected"; break;
+			case 72: s = "\"trait\" expected"; break;
+			case 73: s = "\"ghost\" expected"; break;
+			case 74: s = "\"static\" expected"; break;
+			case 75: s = "\"protected\" expected"; break;
+			case 76: s = "\"datatype\" expected"; break;
+			case 77: s = "\"codatatype\" expected"; break;
+			case 78: s = "\"var\" expected"; break;
+			case 79: s = "\"newtype\" expected"; break;
+			case 80: s = "\"type\" expected"; break;
+			case 81: s = "\"iterator\" expected"; break;
+			case 82: s = "\"yields\" expected"; break;
+			case 83: s = "\"returns\" expected"; break;
+			case 84: s = "\"method\" expected"; break;
+			case 85: s = "\"colemma\" expected"; break;
+			case 86: s = "\"comethod\" expected"; break;
+			case 87: s = "\"constructor\" expected"; break;
+			case 88: s = "\"free\" expected"; break;
+			case 89: s = "\"ensures\" expected"; break;
+			case 90: s = "\"yield\" expected"; break;
+			case 91: s = "\"`\" expected"; break;
+			case 92: s = "\"label\" expected"; break;
+			case 93: s = "\"break\" expected"; break;
+			case 94: s = "\"where\" expected"; break;
+			case 95: s = "\":=\" expected"; break;
+			case 96: s = "\"return\" expected"; break;
 			case 97: s = "\"new\" expected"; break;
 			case 98: s = "\"if\" expected"; break;
 			case 99: s = "\"while\" expected"; break;
@@ -4646,49 +4695,50 @@ public class Errors {
 			case 196: s = "invalid ReturnStmt"; break;
 			case 197: s = "invalid Rhs"; break;
 			case 198: s = "invalid Lhs"; break;
-			case 199: s = "invalid Guard"; break;
-			case 200: s = "this symbol not expected in LoopSpec"; break;
+			case 199: s = "invalid AlternativeBlock"; break;
+			case 200: s = "invalid Guard"; break;
 			case 201: s = "this symbol not expected in LoopSpec"; break;
 			case 202: s = "this symbol not expected in LoopSpec"; break;
-			case 203: s = "invalid LoopSpec"; break;
-			case 204: s = "invalid CaseStatement"; break;
-			case 205: s = "this symbol not expected in CaseStatement"; break;
+			case 203: s = "this symbol not expected in LoopSpec"; break;
+			case 204: s = "invalid LoopSpec"; break;
+			case 205: s = "invalid CaseStatement"; break;
 			case 206: s = "this symbol not expected in CaseStatement"; break;
-			case 207: s = "invalid CasePattern"; break;
-			case 208: s = "invalid CalcOp"; break;
-			case 209: s = "invalid EquivOp"; break;
-			case 210: s = "invalid ImpliesOp"; break;
-			case 211: s = "invalid ExpliesOp"; break;
-			case 212: s = "invalid AndOp"; break;
-			case 213: s = "invalid OrOp"; break;
-			case 214: s = "invalid NegOp"; break;
-			case 215: s = "invalid Forall"; break;
-			case 216: s = "invalid Exists"; break;
-			case 217: s = "invalid QSep"; break;
-			case 218: s = "invalid ImpliesExpliesExpression"; break;
-			case 219: s = "invalid LogicalExpression"; break;
-			case 220: s = "invalid RelOp"; break;
-			case 221: s = "invalid AddOp"; break;
-			case 222: s = "invalid UnaryExpression"; break;
-			case 223: s = "invalid MulOp"; break;
-			case 224: s = "invalid Suffix"; break;
+			case 207: s = "this symbol not expected in CaseStatement"; break;
+			case 208: s = "invalid CasePattern"; break;
+			case 209: s = "invalid CalcOp"; break;
+			case 210: s = "invalid EquivOp"; break;
+			case 211: s = "invalid ImpliesOp"; break;
+			case 212: s = "invalid ExpliesOp"; break;
+			case 213: s = "invalid AndOp"; break;
+			case 214: s = "invalid OrOp"; break;
+			case 215: s = "invalid NegOp"; break;
+			case 216: s = "invalid Forall"; break;
+			case 217: s = "invalid Exists"; break;
+			case 218: s = "invalid QSep"; break;
+			case 219: s = "invalid ImpliesExpliesExpression"; break;
+			case 220: s = "invalid LogicalExpression"; break;
+			case 221: s = "invalid RelOp"; break;
+			case 222: s = "invalid AddOp"; break;
+			case 223: s = "invalid UnaryExpression"; break;
+			case 224: s = "invalid MulOp"; break;
 			case 225: s = "invalid Suffix"; break;
 			case 226: s = "invalid Suffix"; break;
 			case 227: s = "invalid Suffix"; break;
-			case 228: s = "invalid LambdaExpression"; break;
-			case 229: s = "invalid EndlessExpression"; break;
-			case 230: s = "invalid NameSegment"; break;
-			case 231: s = "invalid DisplayExpr"; break;
-			case 232: s = "invalid MultiSetExpr"; break;
-			case 233: s = "invalid ConstAtomExpression"; break;
-			case 234: s = "invalid Nat"; break;
-			case 235: s = "invalid LambdaArrow"; break;
-			case 236: s = "invalid MatchExpression"; break;
-			case 237: s = "invalid QuantifierGuts"; break;
-			case 238: s = "invalid StmtInExpr"; break;
-			case 239: s = "invalid LetExpr"; break;
-			case 240: s = "invalid CaseExpression"; break;
-			case 241: s = "invalid DotSuffix"; break;
+			case 228: s = "invalid Suffix"; break;
+			case 229: s = "invalid LambdaExpression"; break;
+			case 230: s = "invalid EndlessExpression"; break;
+			case 231: s = "invalid NameSegment"; break;
+			case 232: s = "invalid DisplayExpr"; break;
+			case 233: s = "invalid MultiSetExpr"; break;
+			case 234: s = "invalid ConstAtomExpression"; break;
+			case 235: s = "invalid Nat"; break;
+			case 236: s = "invalid LambdaArrow"; break;
+			case 237: s = "invalid MatchExpression"; break;
+			case 238: s = "invalid QuantifierGuts"; break;
+			case 239: s = "invalid StmtInExpr"; break;
+			case 240: s = "invalid LetExpr"; break;
+			case 241: s = "invalid CaseExpression"; break;
+			case 242: s = "invalid DotSuffix"; break;
 
 			default: s = "error " + n; break;
 		}
@@ -4699,19 +4749,19 @@ public class Errors {
 		Contract.Requires(tok != null);
 		Contract.Requires(msg != null);
 		ErrorCount++;
-        reporter.Error(MessageSource.Parser, tok, msg);
+		Reporting.Error(MessageSource.Parser, tok, msg);
 	}
 
 	public void SemErr(string filename, int line, int col, string msg) {
 		Contract.Requires(msg != null);
 		ErrorCount++;
-        reporter.Error(MessageSource.Parser, filename, line, col, msg);
+		Reporting.Error(MessageSource.Parser, filename, line, col, msg);
 	}
 
 	public void Warning(IToken tok, string msg) {
 		Contract.Requires(tok != null);
 		Contract.Requires(msg != null);
-        reporter.Warning(MessageSource.Parser, tok, msg);
+		Reporting.Warning(MessageSource.Parser, tok, msg);
 	}
 } // Errors
 
diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index e242c8bb..5e69bce8 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -38,10 +38,11 @@ namespace Microsoft.Dafny {
       }
     }
 
-    public static string GuardToString(Expression expr) {
+    public static string GuardToString(bool isExistentialGuard, Expression expr) {
+      Contract.Requires(!isExistentialGuard || (expr is ExistsExpr && ((ExistsExpr)expr).Range == null));
       using (var wr = new System.IO.StringWriter()) {
         var pr = new Printer(wr);
-        pr.PrintGuard(expr);
+        pr.PrintGuard(isExistentialGuard, expr);
         return wr.ToString();
       }
     }
@@ -1045,26 +1046,18 @@ namespace Microsoft.Dafny {
     }
 
     void PrintIfStatement(int indent, IfStmt s, bool omitGuard) {
-      while (true) {
-        if (omitGuard) {
-          wr.Write("if ... ");
-        } else {
-          wr.Write("if ");
-          PrintGuard(s.Guard);
-          wr.Write(" ");
-        }
-        PrintStatement(s.Thn, indent);
-        if (s.Els == null) {
-          break;
-        }
-        wr.Write(" else ");
-        if (s.Els is IfStmt) {
-          s = (IfStmt)s.Els;
-        } else {
-          PrintStatement(s.Els, indent);
-          break;
-        }
+      if (omitGuard) {
+        wr.Write("if ... ");
+      } else {
+        wr.Write("if ");
+        PrintGuard(s.IsExistentialGuard, s.Guard);
+        wr.Write(" ");
       }
+      PrintStatement(s.Thn, indent);
+      if (s.Els != null) {
+        wr.Write(" else ");
+        PrintStatement(s.Els, indent);
+      }
     }
 
     void PrintWhileStatement(int indent, WhileStmt s, bool omitGuard, bool omitBody) {
@@ -1073,7 +1066,7 @@ namespace Microsoft.Dafny {
         wr.WriteLine("while ...");
       } else {
         wr.Write("while ");
-        PrintGuard(s.Guard);
+        PrintGuard(false, s.Guard);
         wr.WriteLine();
       }
 
@@ -1094,8 +1087,13 @@ namespace Microsoft.Dafny {
       int caseInd = indent + IndentAmount;
       foreach (var alternative in alternatives) {
         Indent(caseInd);
-        wr.Write("case ");
-        PrintExpression(alternative.Guard, false);
+        wr.Write("case ");
+        if (alternative.IsExistentialGuard) {
+          var exists = (ExistsExpr)alternative.Guard;
+          PrintExistentialGuard(exists);
+        } else {
+          PrintExpression(alternative.Guard, false);
+        }
         wr.WriteLine(" =>");
         foreach (Statement s in alternative.Body) {
           Indent(caseInd + IndentAmount);
@@ -1142,12 +1140,24 @@ namespace Microsoft.Dafny {
       }
     }
 
-    void PrintGuard(Expression guard) {
+    void PrintGuard(bool isExistentialGuard, Expression guard) {
+      Contract.Requires(!isExistentialGuard || (guard is ExistsExpr && ((ExistsExpr)guard).Range == null));
       if (guard == null) {
         wr.Write("*");
+      } else if (isExistentialGuard) {
+        var exists = (ExistsExpr)guard;
+        PrintExistentialGuard(exists);
       } else {
         PrintExpression(guard, false);
       }
+    }
+
+    void PrintExistentialGuard(ExistsExpr guard) {
+      Contract.Requires(guard != null);
+      Contract.Requires(guard.Range == null);
+      PrintQuantifierDomain(guard.BoundVars, guard.Attributes, null);
+      wr.Write(" :| ");
+      PrintExpression(guard.Term, false);
     }
 
     void PrintCalcOp(CalcStmt.CalcOp op) {
diff --git a/Source/Dafny/RefinementTransformer.cs b/Source/Dafny/RefinementTransformer.cs
index 24d1126f..82ddddf1 100644
--- a/Source/Dafny/RefinementTransformer.cs
+++ b/Source/Dafny/RefinementTransformer.cs
@@ -1120,9 +1120,9 @@ namespace Microsoft.Dafny
                 var resultingThen = MergeBlockStmt(skel.Thn, oldIf.Thn);
                 var resultingElse = MergeElse(skel.Els, oldIf.Els);
                 var e = refinementCloner.CloneExpr(oldIf.Guard);
-                var r = new IfStmt(skel.Tok, skel.EndTok, e, resultingThen, resultingElse);
+                var r = new IfStmt(skel.Tok, skel.EndTok, oldIf.IsExistentialGuard, e, resultingThen, resultingElse);
                 body.Add(r);
-                reporter.Info(MessageSource.RefinementTransformer, c.ConditionEllipsis, Printer.GuardToString(e));
+                reporter.Info(MessageSource.RefinementTransformer, c.ConditionEllipsis, Printer.GuardToString(oldIf.IsExistentialGuard, e));
                 i++; j++;
               }
 
@@ -1136,7 +1136,7 @@ namespace Microsoft.Dafny
                 Expression guard;
                 if (c.ConditionOmitted) {
                   guard = refinementCloner.CloneExpr(oldWhile.Guard);
-                  reporter.Info(MessageSource.RefinementTransformer, c.ConditionEllipsis, Printer.GuardToString(oldWhile.Guard));
+                  reporter.Info(MessageSource.RefinementTransformer, c.ConditionEllipsis, Printer.GuardToString(false, oldWhile.Guard));
                 } else {
                   if (oldWhile.Guard != null) {
                     reporter.Error(MessageSource.RefinementTransformer, skel.Guard.tok, "a skeleton while statement with a guard can only replace a while statement with a non-deterministic guard");
@@ -1287,7 +1287,7 @@ namespace Microsoft.Dafny
             var cNew = (IfStmt)cur;
             var cOld = oldS as IfStmt;
             if (cOld != null && cOld.Guard == null) {
-              var r = new IfStmt(cNew.Tok, cNew.EndTok, cNew.Guard, MergeBlockStmt(cNew.Thn, cOld.Thn), MergeElse(cNew.Els, cOld.Els));
+              var r = new IfStmt(cNew.Tok, cNew.EndTok, cNew.IsExistentialGuard, cNew.Guard, MergeBlockStmt(cNew.Thn, cOld.Thn), MergeElse(cNew.Els, cOld.Els));
               body.Add(r);
               i++; j++;
             } else {
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 7a540722..bc94e491 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -1605,7 +1605,7 @@ namespace Microsoft.Dafny
             var subst = new FixpointLemmaBodyCloner(com, kMinusOne, focalPredicates, this.reporter);
             var mainBody = subst.CloneBlockStmt(com.Body);
             var kPositive = new BinaryExpr(com.tok, BinaryExpr.Opcode.Lt, new LiteralExpr(com.tok, 0), new IdentifierExpr(k.tok, k.Name));
-            var condBody = new IfStmt(com.BodyStartTok, mainBody.EndTok, kPositive, mainBody, null);
+            var condBody = new IfStmt(com.BodyStartTok, mainBody.EndTok, false, kPositive, mainBody, null);
             prefixLemma.Body = new BlockStmt(com.tok, condBody.EndTok, new List<Statement>() { condBody });
           }
           // The prefix lemma now has all its components, so it's finally time we resolve it
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 9bc24c30..fa5fdfbe 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -356,7 +356,7 @@ namespace Microsoft.Dafny
         e = BinBoolExpr(tok, BinaryExpr.ResolvedOpcode.NeqCommon, F, cNull);
         var thn = new BlockStmt(tok, tok, new List<Statement>() { s });
         thn.IsGhost = true;
-        s = new IfStmt(tok, tok, e, thn, null);
+        s = new IfStmt(tok, tok, false, e, thn, null);
         s.IsGhost = true;
         // finally, add s to the body
         bodyStatements.Add(s);
diff --git a/Source/Dafny/Scanner.cs b/Source/Dafny/Scanner.cs
index e6c97f22..6e2107c3 100644
--- a/Source/Dafny/Scanner.cs
+++ b/Source/Dafny/Scanner.cs
@@ -267,32 +267,32 @@ public class Scanner {
 		for (int i = 65; i <= 90; ++i) start[i] = 1;
 		for (int i = 95; i <= 95; ++i) start[i] = 1;
 		for (int i = 98; i <= 122; ++i) start[i] = 1;
-		for (int i = 49; i <= 57; ++i) start[i] = 48;
-		start[97] = 49; 
-		start[39] = 50; 
-		start[48] = 51; 
+		for (int i = 49; i <= 57; ++i) start[i] = 49;
+		start[97] = 50; 
+		start[39] = 51; 
+		start[48] = 52; 
 		start[34] = 21; 
 		start[64] = 26; 
 		start[58] = 89; 
 		start[44] = 29; 
 		start[124] = 90; 
-		start[8226] = 31; 
+		start[8226] = 32; 
 		start[46] = 91; 
-		start[59] = 32; 
+		start[59] = 33; 
 		start[61] = 92; 
 		start[45] = 93; 
-		start[123] = 35; 
-		start[125] = 36; 
-		start[91] = 37; 
-		start[93] = 38; 
-		start[40] = 39; 
-		start[41] = 40; 
+		start[123] = 36; 
+		start[125] = 37; 
+		start[91] = 38; 
+		start[93] = 39; 
+		start[40] = 40; 
+		start[41] = 41; 
 		start[60] = 94; 
 		start[62] = 95; 
 		start[33] = 96; 
-		start[8800] = 42; 
-		start[42] = 43; 
-		start[96] = 66; 
+		start[8800] = 43; 
+		start[42] = 44; 
+		start[96] = 67; 
 		start[35] = 69; 
 		start[8804] = 71; 
 		start[8805] = 72; 
@@ -524,55 +524,55 @@ public class Scanner {
 			case "seq": t.kind = 16; break;
 			case "map": t.kind = 17; break;
 			case "imap": t.kind = 18; break;
-			case "assume": t.kind = 30; break;
-			case "calc": t.kind = 31; break;
-			case "case": t.kind = 32; break;
-			case "then": t.kind = 33; break;
-			case "else": t.kind = 34; break;
-			case "decreases": t.kind = 35; break;
-			case "invariant": t.kind = 36; break;
-			case "function": t.kind = 37; break;
-			case "predicate": t.kind = 38; break;
-			case "inductive": t.kind = 39; break;
-			case "lemma": t.kind = 40; break;
-			case "copredicate": t.kind = 41; break;
-			case "modifies": t.kind = 42; break;
-			case "reads": t.kind = 43; break;
-			case "requires": t.kind = 44; break;
-			case "include": t.kind = 59; break;
-			case "abstract": t.kind = 60; break;
-			case "module": t.kind = 61; break;
-			case "exclusively": t.kind = 62; break;
-			case "refines": t.kind = 63; break;
-			case "import": t.kind = 64; break;
-			case "opened": t.kind = 65; break;
-			case "as": t.kind = 67; break;
-			case "default": t.kind = 68; break;
-			case "class": t.kind = 69; break;
-			case "extends": t.kind = 70; break;
-			case "trait": t.kind = 71; break;
-			case "ghost": t.kind = 72; break;
-			case "static": t.kind = 73; break;
-			case "protected": t.kind = 74; break;
-			case "datatype": t.kind = 75; break;
-			case "codatatype": t.kind = 76; break;
-			case "var": t.kind = 77; break;
-			case "newtype": t.kind = 78; break;
-			case "type": t.kind = 79; break;
-			case "iterator": t.kind = 80; break;
-			case "yields": t.kind = 81; break;
-			case "returns": t.kind = 82; break;
-			case "method": t.kind = 83; break;
-			case "colemma": t.kind = 84; break;
-			case "comethod": t.kind = 85; break;
-			case "constructor": t.kind = 86; break;
-			case "free": t.kind = 87; break;
-			case "ensures": t.kind = 88; break;
-			case "yield": t.kind = 89; break;
-			case "label": t.kind = 91; break;
-			case "break": t.kind = 92; break;
-			case "where": t.kind = 93; break;
-			case "return": t.kind = 95; break;
+			case "assume": t.kind = 31; break;
+			case "calc": t.kind = 32; break;
+			case "case": t.kind = 33; break;
+			case "then": t.kind = 34; break;
+			case "else": t.kind = 35; break;
+			case "decreases": t.kind = 36; break;
+			case "invariant": t.kind = 37; break;
+			case "function": t.kind = 38; break;
+			case "predicate": t.kind = 39; break;
+			case "inductive": t.kind = 40; break;
+			case "lemma": t.kind = 41; break;
+			case "copredicate": t.kind = 42; break;
+			case "modifies": t.kind = 43; break;
+			case "reads": t.kind = 44; break;
+			case "requires": t.kind = 45; break;
+			case "include": t.kind = 60; break;
+			case "abstract": t.kind = 61; break;
+			case "module": t.kind = 62; break;
+			case "exclusively": t.kind = 63; break;
+			case "refines": t.kind = 64; break;
+			case "import": t.kind = 65; break;
+			case "opened": t.kind = 66; break;
+			case "as": t.kind = 68; break;
+			case "default": t.kind = 69; break;
+			case "class": t.kind = 70; break;
+			case "extends": t.kind = 71; break;
+			case "trait": t.kind = 72; break;
+			case "ghost": t.kind = 73; break;
+			case "static": t.kind = 74; break;
+			case "protected": t.kind = 75; break;
+			case "datatype": t.kind = 76; break;
+			case "codatatype": t.kind = 77; break;
+			case "var": t.kind = 78; break;
+			case "newtype": t.kind = 79; break;
+			case "type": t.kind = 80; break;
+			case "iterator": t.kind = 81; break;
+			case "yields": t.kind = 82; break;
+			case "returns": t.kind = 83; break;
+			case "method": t.kind = 84; break;
+			case "colemma": t.kind = 85; break;
+			case "comethod": t.kind = 86; break;
+			case "constructor": t.kind = 87; break;
+			case "free": t.kind = 88; break;
+			case "ensures": t.kind = 89; break;
+			case "yield": t.kind = 90; break;
+			case "label": t.kind = 92; break;
+			case "break": t.kind = 93; break;
+			case "where": t.kind = 94; break;
+			case "return": t.kind = 96; break;
 			case "new": t.kind = 97; break;
 			case "if": t.kind = 98; break;
 			case "while": t.kind = 99; break;
@@ -696,7 +696,7 @@ public class Scanner {
 			case 21:
 				if (ch <= 9 || ch >= 11 && ch <= 12 || ch >= 14 && ch <= '!' || ch >= '#' && ch <= '[' || ch >= ']' && ch <= 65535) {AddCh(); goto case 21;}
 				else if (ch == '"') {AddCh(); goto case 28;}
-				else if (ch == 92) {AddCh(); goto case 54;}
+				else if (ch == 92) {AddCh(); goto case 55;}
 				else {goto case 0;}
 			case 22:
 				if (ch >= '0' && ch <= '9' || ch >= 'A' && ch <= 'F' || ch >= 'a' && ch <= 'f') {AddCh(); goto case 23;}
@@ -715,7 +715,7 @@ public class Scanner {
 				else {goto case 0;}
 			case 27:
 				if (ch <= '!' || ch >= '#' && ch <= 65535) {AddCh(); goto case 27;}
-				else if (ch == '"') {AddCh(); goto case 55;}
+				else if (ch == '"') {AddCh(); goto case 56;}
 				else {goto case 0;}
 			case 28:
 				{t.kind = 20; break;}
@@ -726,13 +726,13 @@ public class Scanner {
 			case 31:
 				{t.kind = 25; break;}
 			case 32:
-				{t.kind = 27; break;}
+				{t.kind = 26; break;}
 			case 33:
 				{t.kind = 28; break;}
 			case 34:
 				{t.kind = 29; break;}
 			case 35:
-				{t.kind = 45; break;}
+				{t.kind = 30; break;}
 			case 36:
 				{t.kind = 46; break;}
 			case 37:
@@ -744,117 +744,117 @@ public class Scanner {
 			case 40:
 				{t.kind = 50; break;}
 			case 41:
-				{t.kind = 54; break;}
+				{t.kind = 51; break;}
 			case 42:
 				{t.kind = 55; break;}
 			case 43:
 				{t.kind = 56; break;}
 			case 44:
-				if (ch == 'n') {AddCh(); goto case 45;}
-				else {goto case 0;}
+				{t.kind = 57; break;}
 			case 45:
-				if (ch <= '&' || ch >= '(' && ch <= '/' || ch >= ':' && ch <= '>' || ch == '@' || ch >= '[' && ch <= '^' || ch == '`' || ch >= '{' && ch <= 65535) {apx++; AddCh(); goto case 46;}
+				if (ch == 'n') {AddCh(); goto case 46;}
 				else {goto case 0;}
 			case 46:
+				if (ch <= '&' || ch >= '(' && ch <= '/' || ch >= ':' && ch <= '>' || ch == '@' || ch >= '[' && ch <= '^' || ch == '`' || ch >= '{' && ch <= 65535) {apx++; AddCh(); goto case 47;}
+				else {goto case 0;}
+			case 47:
 				{
 					tlen -= apx;
 					SetScannerBehindT();
-					t.kind = 57; break;}
-			case 47:
-				{t.kind = 58; break;}
+					t.kind = 58; break;}
 			case 48:
+				{t.kind = 59; break;}
+			case 49:
 				recEnd = pos; recKind = 2;
-				if (ch >= '0' && ch <= '9') {AddCh(); goto case 48;}
-				else if (ch == '_') {AddCh(); goto case 56;}
+				if (ch >= '0' && ch <= '9') {AddCh(); goto case 49;}
+				else if (ch == '_') {AddCh(); goto case 57;}
 				else if (ch == '.') {AddCh(); goto case 12;}
 				else {t.kind = 2; break;}
-			case 49:
+			case 50:
 				recEnd = pos; recKind = 1;
 				if (ch == 39 || ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'q' || ch >= 's' && ch <= 'z') {AddCh(); goto case 2;}
-				else if (ch == 'r') {AddCh(); goto case 57;}
+				else if (ch == 'r') {AddCh(); goto case 58;}
 				else {t.kind = 1; t.val = new String(tval, 0, tlen); CheckLiteral(); return t;}
-			case 50:
+			case 51:
 				recEnd = pos; recKind = 1;
-				if (ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'z') {AddCh(); goto case 58;}
-				else if (ch == 39) {AddCh(); goto case 59;}
+				if (ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'z') {AddCh(); goto case 59;}
+				else if (ch == 39) {AddCh(); goto case 60;}
 				else if (ch <= 9 || ch >= 11 && ch <= 12 || ch >= 14 && ch <= '&' || ch >= '(' && ch <= '/' || ch >= ':' && ch <= '>' || ch == '@' || ch == '[' || ch >= ']' && ch <= '^' || ch == '`' || ch >= '{' && ch <= 65535) {AddCh(); goto case 15;}
-				else if (ch == 92) {AddCh(); goto case 53;}
+				else if (ch == 92) {AddCh(); goto case 54;}
 				else {t.kind = 1; t.val = new String(tval, 0, tlen); CheckLiteral(); return t;}
-			case 51:
+			case 52:
 				recEnd = pos; recKind = 2;
-				if (ch >= '0' && ch <= '9') {AddCh(); goto case 48;}
-				else if (ch == '_') {AddCh(); goto case 56;}
+				if (ch >= '0' && ch <= '9') {AddCh(); goto case 49;}
+				else if (ch == '_') {AddCh(); goto case 57;}
 				else if (ch == 'x') {AddCh(); goto case 9;}
 				else if (ch == '.') {AddCh(); goto case 12;}
 				else {t.kind = 2; break;}
-			case 52:
+			case 53:
 				recEnd = pos; recKind = 1;
-				if (ch == 39 || ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'z') {AddCh(); goto case 52;}
+				if (ch == 39 || ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'z') {AddCh(); goto case 53;}
 				else {t.kind = 1; t.val = new String(tval, 0, tlen); CheckLiteral(); return t;}
-			case 53:
+			case 54:
 				if (ch == '"' || ch == 39 || ch == '0' || ch == 92 || ch == 'n' || ch == 'r' || ch == 't') {AddCh(); goto case 15;}
 				else if (ch == 'u') {AddCh(); goto case 16;}
 				else {goto case 0;}
-			case 54:
+			case 55:
 				if (ch == '"' || ch == 39 || ch == '0' || ch == 92 || ch == 'n' || ch == 'r' || ch == 't') {AddCh(); goto case 21;}
 				else if (ch == 'u') {AddCh(); goto case 22;}
 				else {goto case 0;}
-			case 55:
+			case 56:
 				recEnd = pos; recKind = 20;
 				if (ch == '"') {AddCh(); goto case 27;}
 				else {t.kind = 20; break;}
-			case 56:
-				if (ch >= '0' && ch <= '9') {AddCh(); goto case 48;}
-				else {goto case 0;}
 			case 57:
+				if (ch >= '0' && ch <= '9') {AddCh(); goto case 49;}
+				else {goto case 0;}
+			case 58:
 				recEnd = pos; recKind = 1;
 				if (ch == 39 || ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'q' || ch >= 's' && ch <= 'z') {AddCh(); goto case 3;}
-				else if (ch == 'r') {AddCh(); goto case 60;}
+				else if (ch == 'r') {AddCh(); goto case 61;}
 				else {t.kind = 1; t.val = new String(tval, 0, tlen); CheckLiteral(); return t;}
-			case 58:
+			case 59:
 				recEnd = pos; recKind = 1;
-				if (ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'z') {AddCh(); goto case 61;}
-				else if (ch == 39) {AddCh(); goto case 62;}
+				if (ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'z') {AddCh(); goto case 62;}
+				else if (ch == 39) {AddCh(); goto case 63;}
 				else {t.kind = 1; t.val = new String(tval, 0, tlen); CheckLiteral(); return t;}
-			case 59:
+			case 60:
 				recEnd = pos; recKind = 1;
-				if (ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'z') {AddCh(); goto case 61;}
+				if (ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'z') {AddCh(); goto case 62;}
 				else if (ch == 39) {AddCh(); goto case 7;}
 				else {t.kind = 1; t.val = new String(tval, 0, tlen); CheckLiteral(); return t;}
-			case 60:
+			case 61:
 				recEnd = pos; recKind = 1;
 				if (ch == 39 || ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'b' && ch <= 'z') {AddCh(); goto case 4;}
-				else if (ch == 'a') {AddCh(); goto case 63;}
+				else if (ch == 'a') {AddCh(); goto case 64;}
 				else {t.kind = 1; t.val = new String(tval, 0, tlen); CheckLiteral(); return t;}
-			case 61:
+			case 62:
 				recEnd = pos; recKind = 1;
 				if (ch == 39 || ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'z') {AddCh(); goto case 8;}
 				else {t.kind = 1; t.val = new String(tval, 0, tlen); CheckLiteral(); return t;}
-			case 62:
+			case 63:
 				recEnd = pos; recKind = 19;
 				if (ch == 39 || ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'z') {AddCh(); goto case 8;}
 				else {t.kind = 19; break;}
-			case 63:
+			case 64:
 				recEnd = pos; recKind = 1;
 				if (ch == 39 || ch >= '0' && ch <= '9' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'x' || ch == 'z') {AddCh(); goto case 5;}
-				else if (ch == 'y') {AddCh(); goto case 64;}
+				else if (ch == 'y') {AddCh(); goto case 65;}
 				else {t.kind = 1; t.val = new String(tval, 0, tlen); CheckLiteral(); return t;}
-			case 64:
+			case 65:
 				recEnd = pos; recKind = 5;
 				if (ch == 39 || ch == '0' || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'z') {AddCh(); goto case 6;}
-				else if (ch >= '1' && ch <= '9') {AddCh(); goto case 65;}
+				else if (ch >= '1' && ch <= '9') {AddCh(); goto case 66;}
 				else {t.kind = 5; break;}
-			case 65:
+			case 66:
 				recEnd = pos; recKind = 5;
-				if (ch == 39 || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'z') {AddCh(); goto case 52;}
-				else if (ch >= '0' && ch <= '9') {AddCh(); goto case 65;}
+				if (ch == 39 || ch == '?' || ch >= 'A' && ch <= 'Z' || ch == '_' || ch >= 'a' && ch <= 'z') {AddCh(); goto case 53;}
+				else if (ch >= '0' && ch <= '9') {AddCh(); goto case 66;}
 				else {t.kind = 5; break;}
-			case 66:
-				{t.kind = 90; break;}
 			case 67:
-				{t.kind = 94; break;}
+				{t.kind = 91; break;}
 			case 68:
-				{t.kind = 96; break;}
+				{t.kind = 95; break;}
 			case 69:
 				{t.kind = 106; break;}
 			case 70:
@@ -899,47 +899,47 @@ public class Scanner {
 			case 89:
 				recEnd = pos; recKind = 21;
 				if (ch == ':') {AddCh(); goto case 30;}
-				else if (ch == '=') {AddCh(); goto case 67;}
-				else if (ch == '|') {AddCh(); goto case 68;}
+				else if (ch == '|') {AddCh(); goto case 31;}
+				else if (ch == '=') {AddCh(); goto case 68;}
 				else {t.kind = 21; break;}
 			case 90:
 				recEnd = pos; recKind = 23;
 				if (ch == '|') {AddCh(); goto case 81;}
 				else {t.kind = 23; break;}
 			case 91:
-				recEnd = pos; recKind = 26;
+				recEnd = pos; recKind = 27;
 				if (ch == '.') {AddCh(); goto case 97;}
-				else {t.kind = 26; break;}
+				else {t.kind = 27; break;}
 			case 92:
-				recEnd = pos; recKind = 66;
-				if (ch == '>') {AddCh(); goto case 33;}
+				recEnd = pos; recKind = 67;
+				if (ch == '>') {AddCh(); goto case 34;}
 				else if (ch == '=') {AddCh(); goto case 98;}
-				else {t.kind = 66; break;}
+				else {t.kind = 67; break;}
 			case 93:
 				recEnd = pos; recKind = 128;
-				if (ch == '>') {AddCh(); goto case 34;}
+				if (ch == '>') {AddCh(); goto case 35;}
 				else {t.kind = 128; break;}
 			case 94:
-				recEnd = pos; recKind = 51;
+				recEnd = pos; recKind = 52;
 				if (ch == '=') {AddCh(); goto case 99;}
-				else {t.kind = 51; break;}
+				else {t.kind = 52; break;}
 			case 95:
-				recEnd = pos; recKind = 52;
+				recEnd = pos; recKind = 53;
 				if (ch == '=') {AddCh(); goto case 70;}
-				else {t.kind = 52; break;}
+				else {t.kind = 53; break;}
 			case 96:
 				recEnd = pos; recKind = 121;
-				if (ch == '=') {AddCh(); goto case 41;}
-				else if (ch == 'i') {AddCh(); goto case 44;}
+				if (ch == '=') {AddCh(); goto case 42;}
+				else if (ch == 'i') {AddCh(); goto case 45;}
 				else {t.kind = 121; break;}
 			case 97:
 				recEnd = pos; recKind = 137;
-				if (ch == '.') {AddCh(); goto case 47;}
+				if (ch == '.') {AddCh(); goto case 48;}
 				else {t.kind = 137; break;}
 			case 98:
-				recEnd = pos; recKind = 53;
+				recEnd = pos; recKind = 54;
 				if (ch == '>') {AddCh(); goto case 75;}
-				else {t.kind = 53; break;}
+				else {t.kind = 54; break;}
 			case 99:
 				recEnd = pos; recKind = 107;
 				if (ch == '=') {AddCh(); goto case 100;}
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index af8225da..c84f0cec 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -13936,7 +13936,7 @@ namespace Microsoft.Dafny {
           r = SubstBlockStmt((BlockStmt)stmt);
         } else if (stmt is IfStmt) {
           var s = (IfStmt)stmt;
-          r = new IfStmt(s.Tok, s.EndTok, Substitute(s.Guard), SubstBlockStmt(s.Thn), SubstStmt(s.Els));
+          r = new IfStmt(s.Tok, s.EndTok, s.IsExistentialGuard, Substitute(s.Guard), SubstBlockStmt(s.Thn), SubstStmt(s.Els));
         } else if (stmt is AlternativeStmt) {
           var s = (AlternativeStmt)stmt;
           r = new AlternativeStmt(s.Tok, s.EndTok, s.Alternatives.ConvertAll(SubstGuardedAlternative));
@@ -14025,7 +14025,7 @@ namespace Microsoft.Dafny {
 
       protected GuardedAlternative SubstGuardedAlternative(GuardedAlternative alt) {
         Contract.Requires(alt != null);
-        return new GuardedAlternative(alt.Tok, Substitute(alt.Guard), alt.Body.ConvertAll(SubstStmt));
+        return new GuardedAlternative(alt.Tok, alt.IsExistentialGuard, Substitute(alt.Guard), alt.Body.ConvertAll(SubstStmt));
       }
 
       protected MaybeFreeExpression SubstMayBeFreeExpr(MaybeFreeExpression expr) {
diff --git a/Test/dafny0/ExistentialGuards.dfy b/Test/dafny0/ExistentialGuards.dfy
new file mode 100644
index 00000000..001acb55
--- /dev/null
+++ b/Test/dafny0/ExistentialGuards.dfy
@@ -0,0 +1,89 @@
+// RUN: %dafny /dprint:- "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+predicate P(n: int)
+
+predicate R(r: real)
+
+method M0()
+{
+  if x :| P(x) {
+  }
+}
+
+method M1()
+{
+  if x: int :| P(x) {
+  }
+}
+
+method M2()
+{
+  if x, y :| P(x) && R(y) {
+  }
+}
+
+method M3()
+{
+  if x: int, y :| P(x) && R(y) {
+  }
+}
+
+method M4()
+{
+  if x, y: real :| P(x) && R(y) {
+  }
+}
+
+method M5()
+{
+  if x: int, y: real :| P(x) && R(y) {
+  }
+}
+
+method M6()
+{
+  if x {:myattribute x, "hello"} :| P(x) {
+  }
+  if x, y {:myattribute y, "sveika"} :| P(x) && R(y) {
+  }
+  if x: int {:myattribute x, "chello"} :| P(x) {
+  }
+  if x {:myattribute x, "hola"} {:yourattribute x + x, "hej"} :| P(x) {
+  }
+}
+
+method M7()
+{
+  if x :| P(x) {
+  } else if * {
+  } else if y :| R(y) {
+  } else if y :| P(y) {
+  }
+}
+
+method P0(m: int, n: int)
+  requires m < n
+{
+  if {
+    case x :| P(x) =>
+    case x: int :| P(x) =>
+    case x, y :| P(x) && R(y) =>
+    case x: int, y :| P(x) && R(y) =>
+    case m < n =>  // just to be different
+    case x, y: real :| P(x) && R(y) =>
+    case x: int, y: real :| P(x) && R(y) =>
+  }
+}
+
+method P1(m: int, n: int)
+  requires m < n
+{
+  if {
+    case x {:myattribute x, "hello"} :| P(x) =>
+    case x, y {:myattribute y, "sveika"} :| P(x) && R(y) =>
+    case x: int {:myattribute x, "chello"} :| P(x) =>
+    case x {:myattribute x, "hola"} {:yourattribute x + x, "hej"} :| P(x) =>
+    case m < n =>
+  }
+}
diff --git a/Test/dafny0/ExistentialGuards.dfy.expect b/Test/dafny0/ExistentialGuards.dfy.expect
new file mode 100644
index 00000000..cf229553
--- /dev/null
+++ b/Test/dafny0/ExistentialGuards.dfy.expect
@@ -0,0 +1,94 @@
+// Dafny program verifier version 1.9.5.20511, Copyright (c) 2003-2015, Microsoft.
+// Command Line Options: -nologo -countVerificationErrors:0 -useBaseNameForFileName /dprint:- C:\dafny\Test\dafny0\ExistentialGuards.dfy
+// ExistentialGuards.dfy
+
+predicate P(n: int)
+
+predicate R(r: real)
+
+method M0()
+{
+  if x :| P(x) {
+  }
+}
+
+method M1()
+{
+  if x: int :| P(x) {
+  }
+}
+
+method M2()
+{
+  if x, y :| P(x) && R(y) {
+  }
+}
+
+method M3()
+{
+  if x: int, y :| P(x) && R(y) {
+  }
+}
+
+method M4()
+{
+  if x, y: real :| P(x) && R(y) {
+  }
+}
+
+method M5()
+{
+  if x: int, y: real :| P(x) && R(y) {
+  }
+}
+
+method M6()
+{
+  if x {:myattribute x, "hello"} :| P(x) {
+  }
+  if x, y {:myattribute y, "sveika"} :| P(x) && R(y) {
+  }
+  if x: int {:myattribute x, "chello"} :| P(x) {
+  }
+  if x {:myattribute x, "hola"} {:yourattribute x + x, "hej"} :| P(x) {
+  }
+}
+
+method M7()
+{
+  if x :| P(x) {
+  } else if * {
+  } else if y :| R(y) {
+  } else if y :| P(y) {
+  }
+}
+
+method P0(m: int, n: int)
+  requires m < n
+{
+  if {
+    case x :| P(x) =>
+    case x: int :| P(x) =>
+    case x, y :| P(x) && R(y) =>
+    case x: int, y :| P(x) && R(y) =>
+    case m < n =>
+    case x, y: real :| P(x) && R(y) =>
+    case x: int, y: real :| P(x) && R(y) =>
+  }
+}
+
+method P1(m: int, n: int)
+  requires m < n
+{
+  if {
+    case x {:myattribute x, "hello"} :| P(x) =>
+    case x, y {:myattribute y, "sveika"} :| P(x) && R(y) =>
+    case x: int {:myattribute x, "chello"} :| P(x) =>
+    case x {:myattribute x, "hola"} {:yourattribute x + x, "hej"} :| P(x) =>
+    case m < n =>
+  }
+}
+
+Dafny program verifier finished with 22 verified, 0 errors
+Compilation error: Function _module._default.P has no body
+Compilation error: Function _module._default.R has no body
diff --git a/Test/dafny0/Simple.dfy b/Test/dafny0/Simple.dfy
index f7bfcb70..0b6a620e 100644
--- a/Test/dafny0/Simple.dfy
+++ b/Test/dafny0/Simple.dfy
@@ -74,3 +74,30 @@ class CF {
   static protected function method I(): real
   protected static predicate method J()
 }
+
+// test printing of various if statements, including with omitted guards
+module A {
+  method P(x: int, y: int) {
+    if x==2 {
+    } else if * {
+    }
+    if x==10 {
+    }
+    if y==0 {
+    } else if y==1 {
+    } else if * {
+    } else if y==2 {
+    } else if (*) {
+    } else if y == 3 {
+    } else {
+    }
+  }
+}
+module B refines A {
+  method P... {
+    if ... {
+    } else if x==3 {
+    }
+    ...;
+  }
+}
diff --git a/Test/dafny0/Simple.dfy.expect b/Test/dafny0/Simple.dfy.expect
index e6647c8a..d5eb6722 100644
--- a/Test/dafny0/Simple.dfy.expect
+++ b/Test/dafny0/Simple.dfy.expect
@@ -67,6 +67,35 @@ class CF {
   static protected predicate method J()
 }
 
+module A {
+  method P(x: int, y: int)
+  {
+    if x == 2 {
+    } else if * {
+    }
+    if x == 10 {
+    }
+    if y == 0 {
+    } else if y == 1 {
+    } else if * {
+    } else if y == 2 {
+    } else if * {
+    } else if y == 3 {
+    } else {
+    }
+  }
+}
+
+module B refines A {
+  method P ...
+  {
+    if ... {
+    } else if x == 3 {
+    }
+    ...;
+  }
+}
+
 lemma M(x: int)
   ensures x < 8
 {
-- 
cgit v1.2.3


From 27120ddc7adb3a0c789c1ee784d73a4be08de118 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Mon, 5 Oct 2015 08:59:16 -0700
Subject: Implemented resolution, verification, and (poorly performing)
 compilation of existential if guards. Fixed bugs in ghost checks involving
 comprehensions and attributes. Added SubstituteBoundedPool method.

---
 Source/Dafny/Compiler.cs                           |  40 +++--
 Source/Dafny/DafnyAst.cs                           |  13 +-
 Source/Dafny/Resolver.cs                           |  49 +++---
 Source/Dafny/Translator.cs                         | 139 +++++++++++++++--
 Test/dafny0/Compilation.dfy                        |  35 ++++-
 Test/dafny0/Compilation.dfy.expect                 |  13 +-
 Test/dafny0/ExistentialGuards.dfy                  |  86 ++++++++++-
 Test/dafny0/ExistentialGuards.dfy.expect           | 111 ++++++++++++--
 Test/dafny0/ExistentialGuardsResolution.dfy        | 154 +++++++++++++++++++
 Test/dafny0/ExistentialGuardsResolution.dfy.expect | 167 +++++++++++++++++++++
 Test/dafny0/ResolutionErrors.dfy                   |  20 +++
 Test/dafny0/ResolutionErrors.dfy.expect            |   7 +-
 12 files changed, 769 insertions(+), 65 deletions(-)
 create mode 100644 Test/dafny0/ExistentialGuardsResolution.dfy
 create mode 100644 Test/dafny0/ExistentialGuardsResolution.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 13381cc7..aa4ca3ec 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -1455,10 +1455,17 @@ namespace Microsoft.Dafny {
           }
         } else {
           Indent(indent);  wr.Write("if (");
-          TrExpr(s.Guard);
+          TrExpr(s.IsExistentialGuard ? Translator.AlphaRename((ExistsExpr)s.Guard, "eg_d", new Translator(null)) : s.Guard);
           wr.WriteLine(")");
 
-          TrStmt(s.Thn, indent);
+          // We'd like to do "TrStmt(s.Thn, indent)", except we want the scope of any existential variables to come inside the block
+          Indent(indent); wr.WriteLine("{");
+          if (s.IsExistentialGuard) {
+            IntroduceAndAssignBoundVars(indent + IndentAmount, (ExistsExpr)s.Guard);
+          }
+          TrStmtList(s.Thn.Body, indent);
+          Indent(indent); wr.WriteLine("}");
+
           if (s.Els != null) {
             Indent(indent);  wr.WriteLine("else");
             TrStmt(s.Els, indent);
@@ -1467,13 +1474,14 @@ namespace Microsoft.Dafny {
 
       } else if (stmt is AlternativeStmt) {
         var s = (AlternativeStmt)stmt;
-        foreach (var alternative in s.Alternatives) {
-        }
         Indent(indent);
         foreach (var alternative in s.Alternatives) {
           wr.Write("if (");
-          TrExpr(alternative.Guard);
+          TrExpr(alternative.IsExistentialGuard ? Translator.AlphaRename((ExistsExpr)alternative.Guard, "eg_d", new Translator(null)) : alternative.Guard);
           wr.WriteLine(") {");
+          if (alternative.IsExistentialGuard) {
+            IntroduceAndAssignBoundVars(indent + IndentAmount, (ExistsExpr)alternative.Guard);
+          }
           TrStmtList(alternative.Body, indent);
           Indent(indent);
           wr.Write("} else ");
@@ -1766,6 +1774,18 @@ namespace Microsoft.Dafny {
       }
     }
 
+    private void IntroduceAndAssignBoundVars(int indent, ExistsExpr exists) {
+      Contract.Requires(0 <= indent);
+      Contract.Requires(exists != null);
+      Contract.Assume(exists.Bounds != null);  // follows from successful resolution
+      Contract.Assert(exists.Range == null);  // follows from invariant of class IfStmt
+      foreach (var bv in exists.BoundVars) {
+        TrLocalVar(bv, false, indent);
+      }
+      var ivars = exists.BoundVars.ConvertAll(bv => (IVariable)bv);
+      TrAssignSuchThat(indent, ivars, exists.Term, exists.Bounds, exists.tok.line);
+    }
+
     private void TrAssignSuchThat(int indent, List<IVariable> lhss, Expression constraint, List<ComprehensionExpr.BoundedPool> bounds, int debuginfoLine) {
       Contract.Requires(0 <= indent);
       Contract.Requires(lhss != null);
@@ -2155,18 +2175,18 @@ namespace Microsoft.Dafny {
       }
     }
 
-    void TrLocalVar(LocalVariable s, bool alwaysInitialize, int indent) {
-      Contract.Requires(s != null);
-      if (s.IsGhost) {
+    void TrLocalVar(IVariable v, bool alwaysInitialize, int indent) {
+      Contract.Requires(v != null);
+      if (v.IsGhost) {
         // only emit non-ghosts (we get here only for local variables introduced implicitly by call statements)
         return;
       }
 
       Indent(indent);
-      wr.Write("{0} @{1}", TypeName(s.Type), s.CompileName);
+      wr.Write("{0} @{1}", TypeName(v.Type), v.CompileName);
       if (alwaysInitialize) {
         // produce a default value
-        wr.WriteLine(" = {0};", DefaultValue(s.Type));
+        wr.WriteLine(" = {0};", DefaultValue(v.Type));
       } else {
         wr.WriteLine(";");
       }
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 64af1425..667f8407 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -3903,7 +3903,7 @@ namespace Microsoft.Dafny {
       Contract.Invariant(Expr != null);
     }
 
-    public ExprRhs(Expression expr, Attributes attrs = null)
+    public ExprRhs(Expression expr, Attributes attrs = null)  // TODO: these 'attrs' apparently aren't handled correctly in the Cloner, and perhaps not in various visitors either (for example, CheckIsCompilable should not go into attributes)
       : base(expr.tok, attrs)
     {
       Contract.Requires(expr != null);
@@ -7175,9 +7175,16 @@ namespace Microsoft.Dafny {
     public override IEnumerable<Expression> SubExpressions {
       get {
         if (SplitQuantifier == null) {
-          return base.SubExpressions;
+          foreach (var e in base.SubExpressions) {
+            yield return e;
+          }
         } else {
-          return SplitQuantifier;
+          foreach (var e in Attributes.SubExpressions(Attributes)) {
+            yield return e;
+          }
+          foreach (var e in SplitQuantifier) {
+            yield return e;
+          }
         }
       }
     }
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index bc94e491..1798243c 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -2264,12 +2264,14 @@ namespace Microsoft.Dafny
             what = "quantifier";
             whereToLookForBounds = ((QuantifierExpr)e).LogicalBody();
             polarity = e is ExistsExpr;
-          } else if (e is SetComprehension && ((SetComprehension)e).Finite) {
+          } else if (e is SetComprehension) {
             what = "set comprehension";
             whereToLookForBounds = e.Range;
-          } else if (e is MapComprehension && ((MapComprehension)e).Finite) {
+          } else if (e is MapComprehension) {
             what = "map comprehension";
             whereToLookForBounds = e.Range;
+          } else {
+            Contract.Assume(e is LambdaExpr);  // otherwise, unexpected ComprehensionExpr
           }
           if (whereToLookForBounds != null) {
             List<BoundVar> missingBounds;
@@ -2278,9 +2280,9 @@ namespace Microsoft.Dafny
               e.MissingBounds = missingBounds;
 
               if ((e is SetComprehension && !((SetComprehension)e).Finite) || (e is MapComprehension && !((MapComprehension)e).Finite)) {
-                // a possibly infinite set/map has no restrictions on its range
+                // a possibly infinite set/map has no restrictions on its range (unless it's used in a compilable context, which is checked later)
               } else if (e is QuantifierExpr) {
-                // don't report any errors at this time (instead, wait to see if the quantifier is used in a non-ghost context)
+                // a quantifier has no restrictions on its range (unless it's used in a compilable context, which is checked later)
               } else if (e is SetComprehension && e.Type.HasFinitePossibleValues) {
                 // This means the set is finite, regardless of if the Range is bounded.  So, we don't give any error here.
                 // However, if this expression is used in a non-ghost context (which is not yet known at this stage of
@@ -2341,7 +2343,6 @@ namespace Microsoft.Dafny
           var bin = expr as BinaryExpr;
           if (bin != null) {
             bin.ResolvedOp = ResolveOp(bin.Op, bin.E1.Type);
-          
           }
         }
       }
@@ -5647,7 +5648,17 @@ namespace Microsoft.Dafny
           Contract.Assert(s.Guard.Type != null);  // follows from postcondition of ResolveExpression
           ConstrainTypes(s.Guard.Type, Type.Bool, s.Guard, "condition is expected to be of type {0}, but is {1}", Type.Bool, s.Guard.Type);
         }
-        ResolveStatement(s.Thn, codeContext);
+
+        scope.PushMarker();
+        if (s.IsExistentialGuard) {
+          var exists = (ExistsExpr)s.Guard;
+          foreach (var v in exists.BoundVars) {
+            ScopePushAndReport(scope, v, "bound-variable");
+          }
+        }
+        ResolveBlockStatement(s.Thn, codeContext);
+        scope.PopMarker();
+
         if (s.Els != null) {
           ResolveStatement(s.Els, codeContext);
         }
@@ -6525,7 +6536,7 @@ namespace Microsoft.Dafny
       Contract.Requires(alternatives != null);
       Contract.Requires(codeContext != null);
 
-      // first, resolve the guards, which tells us whether or not the entire statement is a ghost statement
+      // first, resolve the guards
       foreach (var alternative in alternatives) {
         int prevErrorCount = reporter.Count(ErrorLevel.Error);
         ResolveExpression(alternative.Guard, new ResolveOpts(codeContext, true));
@@ -6539,6 +6550,12 @@ namespace Microsoft.Dafny
       }
       foreach (var alternative in alternatives) {
         scope.PushMarker();
+        if (alternative.IsExistentialGuard) {
+          var exists = (ExistsExpr)alternative.Guard;
+          foreach (var v in exists.BoundVars) {
+            ScopePushAndReport(scope, v, "bound-variable");
+          }
+        }
         foreach (Statement ss in alternative.Body) {
           ResolveStatement(ss, codeContext);
         }
@@ -9508,9 +9525,9 @@ namespace Microsoft.Dafny
         if (uncompilableBoundVars.Count != 0) {
           string what;
           if (e is SetComprehension) {
-            what = "set comprehensions";
+            what = ((SetComprehension)e).Finite ? "set comprehensions" : "iset comprehensions";
           } else if (e is MapComprehension) {
-            what = "map comprehensions";
+            what = ((MapComprehension)e).Finite ? "map comprehensions" : "imap comprehensions";
           } else {
             Contract.Assume(e is QuantifierExpr);  // otherwise, unexpected ComprehensionExpr (since LambdaExpr is handled separately above)
             Contract.Assert(((QuantifierExpr)e).SplitQuantifier == null); // No split quantifiers during resolution
@@ -9521,15 +9538,11 @@ namespace Microsoft.Dafny
           }
           return;
         }
+        // don't recurse down any attributes
+        if (e.Range != null) { CheckIsCompilable(e.Range); }
+        CheckIsCompilable(e.Term);
+        return;
 
-      } else if (expr is MapComprehension) {
-        var e = (MapComprehension)expr;
-        if (e.MissingBounds != null && !e.Finite) {
-          foreach (var bv in e.MissingBounds) {
-            reporter.Error(MessageSource.Resolver, expr, "imaps in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce a bounded set of values for '{0}'", bv.Name);
-          }
-          return;
-        }
       } else if (expr is NamedExpr) {
         if (!moduleInfo.IsAbstract)
           CheckIsCompilable(((NamedExpr)expr).Body);
@@ -10436,7 +10449,7 @@ namespace Microsoft.Dafny
       } else if (expr is QuantifierExpr) {
         var e = (QuantifierExpr)expr;
         Contract.Assert(e.SplitQuantifier == null); // No split quantifiers during resolution
-        return e.UncompilableBoundVars().Count != 0;
+        return e.UncompilableBoundVars().Count != 0 || UsesSpecFeatures(e.LogicalBody());
       } else if (expr is SetComprehension) {
         var e = (SetComprehension)expr;
         return !e.Finite || e.UncompilableBoundVars().Count != 0 || (e.Range != null && UsesSpecFeatures(e.Range)) || (e.Term != null && UsesSpecFeatures(e.Term));
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index c84f0cec..18b50686 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -4740,7 +4740,7 @@ namespace Microsoft.Dafny {
         var typeMap = Util.Dict(e.TypeArgs, Map(typeArgumentCopies, tp => (Type)new UserDefinedType(tp)));
         var newLocals = Map(typeArgumentCopies, tp => new Bpl.LocalVariable(tp.tok, new TypedIdent(tp.tok, nameTypeParam(tp), predef.Ty)));
         locals.AddRange(newLocals);
-        // Create local variables corresponding to the in-parameters:
+        // Create local variables corresponding to the bound variables:
         var substMap = SetupBoundVarsAsLocals(e.BoundVars, builder, locals, etran, typeMap);
         // Get the body of the quantifier and suitably substitute for the type variables and bound variables
         var body = Substitute(e.LogicalBody(true), null, substMap, typeMap);
@@ -7244,24 +7244,30 @@ namespace Microsoft.Dafny {
       } else if (stmt is IfStmt) {
         AddComment(builder, stmt, "if statement");
         IfStmt s = (IfStmt)stmt;
-        Bpl.Expr guard;
+        Expression guard;
         if (s.Guard == null) {
           guard = null;
         } else {
-          TrStmt_CheckWellformed(s.Guard, builder, locals, etran, true);
-          guard = etran.TrExpr(s.Guard);
+          guard = s.IsExistentialGuard ? AlphaRename((ExistsExpr)s.Guard, "eg$", this) : s.Guard;
+          TrStmt_CheckWellformed(guard, builder, locals, etran, true);
         }
         Bpl.StmtListBuilder b = new Bpl.StmtListBuilder();
         CurrentIdGenerator.Push();
+        if (s.IsExistentialGuard) {
+          var exists = (ExistsExpr)s.Guard;  // the original (that is, not alpha-renamed) guard
+          IntroduceAndAssignExistentialVars(exists, b, builder, locals, etran);
+        }
         Bpl.StmtList thn = TrStmt2StmtList(b, s.Thn, locals, etran);
         CurrentIdGenerator.Pop();
         Bpl.StmtList els;
         Bpl.IfCmd elsIf = null;
+        b = new Bpl.StmtListBuilder();
+        if (s.IsExistentialGuard) {
+          b.Add(new Bpl.AssumeCmd(guard.tok, Bpl.Expr.Not(etran.TrExpr(guard))));
+        }
         if (s.Els == null) {
-          b = new Bpl.StmtListBuilder();
           els = b.Collect(s.Tok);
         } else {
-          b = new Bpl.StmtListBuilder();
           els = TrStmt2StmtList(b, s.Els, locals, etran);
           if (els.BigBlocks.Count == 1) {
             Bpl.BigBlock bb = els.BigBlocks[0];
@@ -7271,7 +7277,7 @@ namespace Microsoft.Dafny {
             }
           }
         }
-        builder.Add(new Bpl.IfCmd(stmt.Tok, guard, thn, elsIf, els));
+        builder.Add(new Bpl.IfCmd(stmt.Tok, guard == null || s.IsExistentialGuard ? null : etran.TrExpr(guard), thn, elsIf, els));
 
       } else if (stmt is AlternativeStmt) {
         AddComment(builder, stmt, "alternative statement");
@@ -7551,6 +7557,26 @@ namespace Microsoft.Dafny {
       }
     }
 
+    private void IntroduceAndAssignExistentialVars(ExistsExpr exists, Bpl.StmtListBuilder builder, Bpl.StmtListBuilder builderOutsideIfConstruct, List<Variable> locals, ExpressionTranslator etran) {
+      Contract.Requires(exists != null);
+      Contract.Requires(exists.Range == null);
+      Contract.Requires(builder != null);
+      Contract.Requires(builderOutsideIfConstruct != null);
+      Contract.Requires(locals != null);
+      Contract.Requires(etran != null);
+      // declare and havoc the bound variables of 'exists' as local variables
+      var iesForHavoc = new List<Bpl.IdentifierExpr>();
+      foreach (var bv in exists.BoundVars) {
+        Bpl.Type varType = TrType(bv.Type);
+        Bpl.Expr wh = GetWhereClause(bv.Tok, new Bpl.IdentifierExpr(bv.Tok, bv.AssignUniqueName(currentDeclaration.IdGenerator), varType), bv.Type, etran);
+        Bpl.Variable local = new Bpl.LocalVariable(bv.Tok, new Bpl.TypedIdent(bv.Tok, bv.AssignUniqueName(currentDeclaration.IdGenerator), varType, wh));
+        locals.Add(local);
+        iesForHavoc.Add(new Bpl.IdentifierExpr(local.tok, local));
+      }
+      builderOutsideIfConstruct.Add(new Bpl.HavocCmd(exists.tok, iesForHavoc));
+      builder.Add(new Bpl.AssumeCmd(exists.tok, etran.TrExpr(exists.Term)));
+    }
+
     void TrStmtList(List<Statement> stmts, Bpl.StmtListBuilder builder, List<Variable> locals, ExpressionTranslator etran) {
       Contract.Requires(stmts != null);
       Contract.Requires(builder != null);
@@ -7564,6 +7590,46 @@ namespace Microsoft.Dafny {
       }
     }
 
+    /// <summary>
+    /// Returns an expression like 'exists' but where the bound variables have been renamed to have
+    /// 'prefix' as a prefix to their previous names.
+    /// Assumes the expression has been resolved.
+    /// </summary>
+    public static Expression AlphaRename(ExistsExpr exists, string prefix, Translator translator) {
+      Contract.Requires(exists != null);
+      Contract.Requires(prefix != null);
+      Contract.Requires(translator != null);
+
+      if (exists.SplitQuantifier != null) {
+        // TODO: what to do?  Substitute(exists.SplitQuantifierExpression);
+      }
+
+      var substMap = new Dictionary<IVariable, Expression>();
+      var var4var = new Dictionary<BoundVar, BoundVar>();
+      var bvars = new List<BoundVar>();
+      foreach (var bv in exists.BoundVars) {
+        var newBv = new BoundVar(bv.tok, prefix + bv.Name, bv.Type);
+        bvars.Add(newBv);
+        var4var.Add(bv, newBv);
+        var ie = new IdentifierExpr(newBv.tok, newBv.Name);
+        ie.Var = newBv;  // resolve here
+        ie.Type = newBv.Type;  // resolve here
+        substMap.Add(bv, ie);
+      }
+      var s = new Substituter(null, substMap, new Dictionary<TypeParameter, Type>(), translator);
+      var range = exists.Range == null ? null : s.Substitute(exists.Range);
+      var term = s.Substitute(exists.Term);
+      var attrs = s.SubstAttributes(exists.Attributes);
+      var ex = new ExistsExpr(exists.tok, exists.TypeArgs, bvars, range, term, attrs);
+      if (exists.Bounds != null) {
+        ex.Bounds = exists.Bounds.ConvertAll(bound => s.SubstituteBoundedPool(bound));
+      }
+      if (exists.MissingBounds != null) {
+        ex.MissingBounds = exists.MissingBounds.ConvertAll(bv => var4var[bv]);
+      }
+      return ex;
+    }
+
     /// <summary>
     /// Generate:
     ///   havoc Heap \ {this} \ _reads \ _new;
@@ -8569,7 +8635,7 @@ namespace Microsoft.Dafny {
     void TrAlternatives(List<GuardedAlternative> alternatives, Bpl.Cmd elseCase0, Bpl.StructuredCmd elseCase1,
                         Bpl.StmtListBuilder builder, List<Variable> locals, ExpressionTranslator etran) {
       Contract.Requires(alternatives != null);
-      Contract.Requires((elseCase0 != null) == (elseCase1 == null));  // ugly way of doing a type union
+      Contract.Requires((elseCase0 == null) != (elseCase1 == null));  // ugly way of doing a type union
       Contract.Requires(builder != null);
       Contract.Requires(locals != null);
       Contract.Requires(etran != null);
@@ -8583,10 +8649,13 @@ namespace Microsoft.Dafny {
         return;
       }
 
+      // alpha-rename any existential guards
+      var guards = alternatives.ConvertAll(alt => alt.IsExistentialGuard ? AlphaRename((ExistsExpr)alt.Guard, "eg$", this) : alt.Guard);
+
       // build the negation of the disjunction of all guards (that is, the conjunction of their negations)
       Bpl.Expr noGuard = Bpl.Expr.True;
-      foreach (var alternative in alternatives) {
-        noGuard = BplAnd(noGuard, Bpl.Expr.Not(etran.TrExpr(alternative.Guard)));
+      foreach (var g in guards) {
+        noGuard = BplAnd(noGuard, Bpl.Expr.Not(etran.TrExpr(g)));
       }
 
       var b = new Bpl.StmtListBuilder();
@@ -8605,8 +8674,13 @@ namespace Microsoft.Dafny {
         CurrentIdGenerator.Push();
         var alternative = alternatives[i];
         b = new Bpl.StmtListBuilder();
-        TrStmt_CheckWellformed(alternative.Guard, b, locals, etran, true);
-        b.Add(new AssumeCmd(alternative.Guard.tok, etran.TrExpr(alternative.Guard)));
+        TrStmt_CheckWellformed(guards[i], b, locals, etran, true);
+        if (alternative.IsExistentialGuard) {
+          var exists = (ExistsExpr)alternative.Guard;  // the original (that is, not alpha-renamed) guard
+          IntroduceAndAssignExistentialVars(exists, b, builder, locals, etran);
+        } else {
+          b.Add(new AssumeCmd(alternative.Guard.tok, etran.TrExpr(alternative.Guard)));
+        }
         foreach (var s in alternative.Body) {
           TrStmt(s, b, locals, etran);
         }
@@ -13705,6 +13779,9 @@ namespace Microsoft.Dafny {
               Contract.Assert(false);  // unexpected ComprehensionExpr
             }
           }
+          if (e.Bounds != null) {
+            ((ComprehensionExpr)newExpr).Bounds = e.Bounds.ConvertAll(bound => SubstituteBoundedPool(bound));
+          }
           // undo any changes to substMap (could be optimized to do this only if newBoundVars != e.BoundVars)
           foreach (var bv in e.BoundVars) {
             substMap.Remove(bv);
@@ -13761,6 +13838,44 @@ namespace Microsoft.Dafny {
         }
       }
 
+      public ComprehensionExpr.BoundedPool SubstituteBoundedPool(ComprehensionExpr.BoundedPool bound) {
+        if (bound == null) {
+          return null;
+        } else if (bound is ComprehensionExpr.ExactBoundedPool) {
+          var b = (ComprehensionExpr.ExactBoundedPool)bound;
+          return new ComprehensionExpr.ExactBoundedPool(Substitute(b.E));
+        } else if (bound is ComprehensionExpr.BoolBoundedPool) {
+          return bound;  // nothing to substitute
+        } else if (bound is ComprehensionExpr.CharBoundedPool) {
+          return bound;  // nothing to substitute
+        } else if (bound is ComprehensionExpr.RefBoundedPool) {
+          return bound;  // nothing to substitute
+        } else if (bound is ComprehensionExpr.IntBoundedPool) {
+          var b = (ComprehensionExpr.IntBoundedPool)bound;
+          return new ComprehensionExpr.IntBoundedPool(b.LowerBound == null ? null : Substitute(b.LowerBound), b.UpperBound == null ? null : Substitute(b.UpperBound));
+        } else if (bound is ComprehensionExpr.SetBoundedPool) {
+          var b = (ComprehensionExpr.SetBoundedPool)bound;
+          return new ComprehensionExpr.SetBoundedPool(Substitute(b.Set));
+        } else if (bound is ComprehensionExpr.SubSetBoundedPool) {
+          var b = (ComprehensionExpr.SubSetBoundedPool)bound;
+          return new ComprehensionExpr.SubSetBoundedPool(Substitute(b.UpperBound));
+        } else if (bound is ComprehensionExpr.SuperSetBoundedPool) {
+          var b = (ComprehensionExpr.SuperSetBoundedPool)bound;
+          return new ComprehensionExpr.SuperSetBoundedPool(Substitute(b.LowerBound));
+        } else if (bound is ComprehensionExpr.MapBoundedPool) {
+          var b = (ComprehensionExpr.MapBoundedPool)bound;
+          return new ComprehensionExpr.MapBoundedPool(Substitute(b.Map));
+        } else if (bound is ComprehensionExpr.SeqBoundedPool) {
+          var b = (ComprehensionExpr.SeqBoundedPool)bound;
+          return new ComprehensionExpr.SeqBoundedPool(Substitute(b.Seq));
+        } else if (bound is ComprehensionExpr.DatatypeBoundedPool) {
+          return bound;  // nothing to substitute
+        } else {
+          Contract.Assume(false);  // unexpected ComprehensionExpr.BoundedPool
+          throw new cce.UnreachableException();  // to please compiler
+        }
+      }
+
       /// <summary>
       /// Return a list of bound variables, of the same length as 'vars' but with possible substitutions.
       /// For any change necessary, update 'substMap' to reflect the new substitution; the caller is responsible for
diff --git a/Test/dafny0/Compilation.dfy b/Test/dafny0/Compilation.dfy
index a2b96996..7f9169da 100644
--- a/Test/dafny0/Compilation.dfy
+++ b/Test/dafny0/Compilation.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny "%s" > "%t"
+// RUN: %dafny /compile:3 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // The tests in this file are designed to run through the compiler.  They contain
@@ -43,6 +43,8 @@ module CoRecursion {
   //   40
   //   41
   //   42
+  //   9
+  //   9
   method Main() {
     var m := 17;
     var cell := new Cell;
@@ -58,6 +60,37 @@ module CoRecursion {
       print l.car, "\n";
       l := l.cdr;
     }
+    var nio := OneLess(0, 10);
+    print nio, "\n";
+    nio := OneLess'(0, 10);
+    print nio, "\n";
+  }
+
+  method OneLess(lo: int, hi: int) returns (m: int)
+    requires lo < hi
+    // This method ensures m == hi - 1, but we don't care to prove it
+    decreases hi - lo
+  {
+    if y :| lo < y < hi {
+      m := OneLess(y, hi);
+    } else {
+      m := lo;
+    }
+  }
+
+  method OneLess'(lo: int, hi: int) returns (m: int)
+    requires lo < hi
+    // This method ensures m == hi - 1, but we don't care to prove it
+    decreases hi - lo
+  {
+    if {
+      case y :| lo < y < hi =>
+        m := OneLess'(y, hi);
+      case lo+1 < hi =>
+        m := OneLess'(lo+1, hi);
+      case lo + 1 == hi =>
+        m := lo;
+    }
   }
 }
 
diff --git a/Test/dafny0/Compilation.dfy.expect b/Test/dafny0/Compilation.dfy.expect
index 0a1938ae..2b76b107 100644
--- a/Test/dafny0/Compilation.dfy.expect
+++ b/Test/dafny0/Compilation.dfy.expect
@@ -1,3 +1,12 @@
 
-Dafny program verifier finished with 46 verified, 0 errors
-Compiled assembly into Compilation.exe
+Dafny program verifier finished with 50 verified, 0 errors
+Program compiled successfully
+Running...
+
+400
+320
+40
+41
+42
+9
+9
diff --git a/Test/dafny0/ExistentialGuards.dfy b/Test/dafny0/ExistentialGuards.dfy
index 001acb55..5afb3979 100644
--- a/Test/dafny0/ExistentialGuards.dfy
+++ b/Test/dafny0/ExistentialGuards.dfy
@@ -2,12 +2,19 @@
 // RUN: %diff "%s.expect" "%t"
 
 predicate P(n: int)
+{
+  n % 2 == 0
+}
 
 predicate R(r: real)
+{
+  0.0 <= r
+}
 
 method M0()
 {
   if x :| P(x) {
+    var y := x + 3;
   }
 }
 
@@ -19,13 +26,19 @@ method M1()
 
 method M2()
 {
-  if x, y :| P(x) && R(y) {
+  var x := true;
+  if x, y :| P(x) && R(y) {  // this declares a new 'x'
+    var z := x + 12;
   }
+  x := x && false;
 }
 
 method M3()
 {
+  var x := true;
   if x: int, y :| P(x) && R(y) {
+    var z := x + y.Trunc;
+    var w := real(x) + y;
   }
 }
 
@@ -53,37 +66,94 @@ method M6()
   }
 }
 
-method M7()
+ghost method M7() returns (z: real, w: real)
+  ensures -2.0 <= z
+  ensures z == w  // error: does not hold
 {
+  var k;
   if x :| P(x) {
+    k, z := 4, 18.0;
   } else if * {
+    z := z + -z;
   } else if y :| R(y) {
+    z := y;
   } else if y :| P(y) {
+    k := y;
+  } else {
+    z :| R(z);
+  }
+  if P(k) {
+    z := 18.0;
+  }
+}
+
+ghost method M8(m: int, n: int)
+  requires forall y :: m <= y < n ==> P(y)
+{
+  var t := -1;
+  var u;
+  if y :| m <= y < n && P(y) {
+    u := y;
+    if * {
+      t := n - y;
+    } else if * {
+      t := y - m;
+    } else if P(y) {
+      t := 8;
+    } else {
+      t := -100;  // will never happen
+    }
+  }
+  if t < 0 && m < n {
+    assert P(m) && !P(m);
+    assert false;
   }
+  assert t < 0 ==> n <= m;
 }
 
 method P0(m: int, n: int)
   requires m < n
 {
+  ghost var even, alsoEven := 4, 8;
   if {
     case x :| P(x) =>
+      even := x;
     case x: int :| P(x) =>
+      even := x;
     case x, y :| P(x) && R(y) =>
+      even, alsoEven := x, y.Trunc;  // this assigns to 'alsoEven' a possibly odd number
     case x: int, y :| P(x) && R(y) =>
+      even := x;
     case m < n =>  // just to be different
     case x, y: real :| P(x) && R(y) =>
+      even := x;
     case x: int, y: real :| P(x) && R(y) =>
+      even := x;
   }
+  assert P(even);
+  assert P(alsoEven);  // error: may not hold
 }
 
 method P1(m: int, n: int)
-  requires m < n
 {
+  if {  // error: missing case
+    case x :| m <= x < n && P(x) =>
+  }
+}
+
+method P2(m: int, n: int)
+  requires forall y :: m <= y < n ==> P(y)
+{
+  if {  // error: missing case
+    case x :| m <= x < n && P(x) =>
+  }
+}
+
+method P3(m: int, n: int)
+  requires m < n && forall y :: m <= y < n ==> P(y)
+{
+  assert P(m);  // lemma that proves that the following 'if' covers all possibilities
   if {
-    case x {:myattribute x, "hello"} :| P(x) =>
-    case x, y {:myattribute y, "sveika"} :| P(x) && R(y) =>
-    case x: int {:myattribute x, "chello"} :| P(x) =>
-    case x {:myattribute x, "hola"} {:yourattribute x + x, "hej"} :| P(x) =>
-    case m < n =>
+    case x :| m <= x < n && P(x) =>
   }
 }
diff --git a/Test/dafny0/ExistentialGuards.dfy.expect b/Test/dafny0/ExistentialGuards.dfy.expect
index cf229553..21461067 100644
--- a/Test/dafny0/ExistentialGuards.dfy.expect
+++ b/Test/dafny0/ExistentialGuards.dfy.expect
@@ -3,12 +3,19 @@
 // ExistentialGuards.dfy
 
 predicate P(n: int)
+{
+  n % 2 == 0
+}
 
 predicate R(r: real)
+{
+  0.0 <= r
+}
 
 method M0()
 {
   if x :| P(x) {
+    var y := x + 3;
   }
 }
 
@@ -20,13 +27,19 @@ method M1()
 
 method M2()
 {
+  var x := true;
   if x, y :| P(x) && R(y) {
+    var z := x + 12;
   }
+  x := x && false;
 }
 
 method M3()
 {
+  var x := true;
   if x: int, y :| P(x) && R(y) {
+    var z := x + y.Trunc;
+    var w := real(x) + y;
   }
 }
 
@@ -54,41 +67,119 @@ method M6()
   }
 }
 
-method M7()
+ghost method M7() returns (z: real, w: real)
+  ensures -2.0 <= z
+  ensures z == w
 {
+  var k;
   if x :| P(x) {
+    k, z := 4, 18.0;
   } else if * {
+    z := z + -z;
   } else if y :| R(y) {
+    z := y;
   } else if y :| P(y) {
+    k := y;
+  } else {
+    z :| R(z);
+  }
+  if P(k) {
+    z := 18.0;
   }
 }
 
+ghost method M8(m: int, n: int)
+  requires forall y :: m <= y < n ==> P(y)
+{
+  var t := -1;
+  var u;
+  if y :| m <= y < n && P(y) {
+    u := y;
+    if * {
+      t := n - y;
+    } else if * {
+      t := y - m;
+    } else if P(y) {
+      t := 8;
+    } else {
+      t := -100;
+    }
+  }
+  if t < 0 && m < n {
+    assert P(m) && !P(m);
+    assert false;
+  }
+  assert t < 0 ==> n <= m;
+}
+
 method P0(m: int, n: int)
   requires m < n
 {
+  ghost var even, alsoEven := 4, 8;
   if {
     case x :| P(x) =>
+      even := x;
     case x: int :| P(x) =>
+      even := x;
     case x, y :| P(x) && R(y) =>
+      even, alsoEven := x, y.Trunc;
     case x: int, y :| P(x) && R(y) =>
+      even := x;
     case m < n =>
     case x, y: real :| P(x) && R(y) =>
+      even := x;
     case x: int, y: real :| P(x) && R(y) =>
+      even := x;
   }
+  assert P(even);
+  assert P(alsoEven);
 }
 
 method P1(m: int, n: int)
-  requires m < n
 {
   if {
-    case x {:myattribute x, "hello"} :| P(x) =>
-    case x, y {:myattribute y, "sveika"} :| P(x) && R(y) =>
-    case x: int {:myattribute x, "chello"} :| P(x) =>
-    case x {:myattribute x, "hola"} {:yourattribute x + x, "hej"} :| P(x) =>
-    case m < n =>
+    case x :| m <= x < n && P(x) =>
+  }
+}
+
+method P2(m: int, n: int)
+  requires forall y :: m <= y < n ==> P(y)
+{
+  if {
+    case x :| m <= x < n && P(x) =>
+  }
+}
+
+method P3(m: int, n: int)
+  requires m < n && forall y :: m <= y < n ==> P(y)
+{
+  assert P(m);
+  if {
+    case x :| m <= x < n && P(x) =>
   }
 }
+ExistentialGuards.dfy(85,10): Error BP5003: A postcondition might not hold on this return path.
+ExistentialGuards.dfy(71,12): Related location: This is the postcondition that might not hold.
+Execution trace:
+    (0,0): anon0
+    (0,0): anon12_Then
+    (0,0): anon9
+    (0,0): anon16_Then
+ExistentialGuards.dfy(134,9): Error: assertion violation
+ExistentialGuards.dfy(6,8): Related location
+Execution trace:
+    (0,0): anon0
+    (0,0): anon20_Then
+    (0,0): anon21_Then
+    (0,0): anon5
+    (0,0): anon17
+ExistentialGuards.dfy(139,2): Error: alternative cases fail to cover all possibilties
+Execution trace:
+    (0,0): anon0
+    (0,0): anon7_Else
+ExistentialGuards.dfy(147,2): Error: alternative cases fail to cover all possibilties
+Execution trace:
+    (0,0): anon0
+    (0,0): anon7_Else
 
-Dafny program verifier finished with 22 verified, 0 errors
-Compilation error: Function _module._default.P has no body
-Compilation error: Function _module._default.R has no body
+Dafny program verifier finished with 24 verified, 4 errors
diff --git a/Test/dafny0/ExistentialGuardsResolution.dfy b/Test/dafny0/ExistentialGuardsResolution.dfy
new file mode 100644
index 00000000..8fce1de5
--- /dev/null
+++ b/Test/dafny0/ExistentialGuardsResolution.dfy
@@ -0,0 +1,154 @@
+// RUN: %dafny /dprint:- "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+predicate P(n: int)
+
+predicate R(r: real)
+
+method M0()
+{
+  if x :| P(x) {
+    var y := x + 3;
+    var x := true;  // error: 'x' is already declared in this scope
+  }
+}
+
+method M1()
+{
+  if x: int :| P(x) {
+    x := x + 1;  // error: 'x' is an immutable variable
+  }
+}
+
+method M2()
+{
+  var x := true;
+  if x, y :| P(x) && R(y) {  // this declares a new 'x'
+    var z := x + 12;
+  }
+  x := x && false;
+}
+
+method M3()
+{
+  var x := true;
+  if x: int, y :| P(x) && R(y) {
+    var z := x + int(y);
+    var w := real(x) + y;
+  }
+  var x := 0.0;  // error: 'x' is already declared in this scope
+}
+
+method M4()
+{
+  if x, y: real :| P(x) && R(y) {
+  }
+}
+
+method M5()
+{
+  if x: int, y: real :| P(x) && R(y) {
+  }
+}
+
+method M6()
+{
+  if x {:myattribute x, "hello"} :| P(x) {
+  }
+  if x, y {:myattribute y, "sveika"} :| P(x) && R(y) {
+  }
+  if x: int {:myattribute x, "chello"} :| P(x) {
+  }
+  if x {:myattribute x, "hola"} {:yourattribute x + x, "hej"} :| P(x) {
+  }
+}
+
+method M7()
+{
+  if x :| P(x) {
+  } else if * {
+  } else if y :| R(y) {
+  } else if y :| P(y) {
+  }
+}
+
+method P0(m: int, n: int)
+  requires m < n
+{
+  var x := true;
+  if {
+    case x :| P(x) =>
+      var t := 3 * x;
+    case x: int :| P(x) =>
+    case x, y :| P(x) && R(y) =>
+      y := y + 1.0;  // error: 'y' is an immutable variable
+    case x: int, y :| P(x) && R(y) =>
+    case m < n =>
+      x := x || m + 5 == n;
+    case x, y: real :| P(x) && R(y) =>
+    case x: int, y: real :| P(x) && R(y) =>
+  }
+  assert x;
+}
+
+method P1(m: int, n: int)
+  requires m < n
+{
+  if {
+    case x {:myattribute x, "hello"} :| P(x) =>
+    case x, y {:myattribute y, "sveika"} :| P(x) && R(y) =>
+    case x: int {:myattribute x, "chello"} :| P(x) =>
+    case x {:myattribute x, "hola"} {:yourattribute x + x, "hej"} :| P(x) =>
+    case m < n =>
+  }
+}
+
+module TypesNotFullyDetermined {
+  method T0()
+  {
+    if x :| true {  // error: type not entirely resolved
+    }
+  }
+  method T1()
+  {
+    if x :| true {
+      var y := x + 3;
+    }
+  }
+}
+
+module Ghost {
+  predicate P(x: int)  // note, P is ghost
+  predicate method R(x: int)
+  method M7() returns (z: int, b: bool)
+  {
+    if * {
+      z := z + -z;
+    } else if y :| 1000 <= y < 2000 && R(y) {
+      z := y;
+    } else if y :| 0 <= y < 100 && P(y) {
+      z := y;  // error: not allowed, because the P in the guard makes this a ghost context
+    } else if y :| 0 <= y < 100 && R(y) {
+      z := y;  // error: this is also in a ghost context, because it depends on the P above
+    }
+
+    if * {
+      z := z + -z;
+    } else if exists y :: 1000 <= y < 2000 && R(y) {
+      z := 0;
+    } else if exists y :: 0 <= y < 100 && P(y) {
+      z := 0;  // error: not allowed, because the P in the guard makes this a ghost context
+    } else if exists y :: 0 <= y < 100 && R(y) {
+      z := 0;  // error: this is also in a ghost context, because it depends on the P above
+    }
+
+    if P(z) {
+      z := 20;  // error: blatant ghost context
+    }
+
+    b := exists y :: 0 <= y < 100 && P(y);  // error: assignment to non-ghost of something that depends on ghost
+    ghost var c;
+    c := exists y :: 0 <= y < 100 && P(y);
+    b := exists y {:myattribute P(y)} :: 0 <= y < 100;
+  }
+}
diff --git a/Test/dafny0/ExistentialGuardsResolution.dfy.expect b/Test/dafny0/ExistentialGuardsResolution.dfy.expect
new file mode 100644
index 00000000..681bb13d
--- /dev/null
+++ b/Test/dafny0/ExistentialGuardsResolution.dfy.expect
@@ -0,0 +1,167 @@
+// Dafny program verifier version 1.9.5.20511, Copyright (c) 2003-2015, Microsoft.
+// Command Line Options: -nologo -countVerificationErrors:0 -useBaseNameForFileName /dprint:- C:\dafny\Test\dafny0\ExistentialGuardsResolution.dfy
+// ExistentialGuardsResolution.dfy
+
+
+module TypesNotFullyDetermined {
+  method T0()
+  {
+    if x :| true {
+    }
+  }
+
+  method T1()
+  {
+    if x :| true {
+      var y := x + 3;
+    }
+  }
+}
+
+module Ghost {
+  predicate P(x: int)
+
+  predicate method R(x: int)
+
+  method M7() returns (z: int, b: bool)
+  {
+    if * {
+      z := z + -z;
+    } else if y :| 1000 <= y < 2000 && R(y) {
+      z := y;
+    } else if y :| 0 <= y < 100 && P(y) {
+      z := y;
+    } else if y :| 0 <= y < 100 && R(y) {
+      z := y;
+    }
+    if * {
+      z := z + -z;
+    } else if exists y :: 1000 <= y < 2000 && R(y) {
+      z := 0;
+    } else if exists y :: 0 <= y < 100 && P(y) {
+      z := 0;
+    } else if exists y :: 0 <= y < 100 && R(y) {
+      z := 0;
+    }
+    if P(z) {
+      z := 20;
+    }
+    b := exists y :: 0 <= y < 100 && P(y);
+    ghost var c;
+    c := exists y :: 0 <= y < 100 && P(y);
+    b := exists y {:myattribute P(y)} :: 0 <= y < 100;
+  }
+}
+predicate P(n: int)
+
+predicate R(r: real)
+
+method M0()
+{
+  if x :| P(x) {
+    var y := x + 3;
+    var x := true;
+  }
+}
+
+method M1()
+{
+  if x: int :| P(x) {
+    x := x + 1;
+  }
+}
+
+method M2()
+{
+  var x := true;
+  if x, y :| P(x) && R(y) {
+    var z := x + 12;
+  }
+  x := x && false;
+}
+
+method M3()
+{
+  var x := true;
+  if x: int, y :| P(x) && R(y) {
+    var z := x + int(y);
+    var w := real(x) + y;
+  }
+  var x := 0.0;
+}
+
+method M4()
+{
+  if x, y: real :| P(x) && R(y) {
+  }
+}
+
+method M5()
+{
+  if x: int, y: real :| P(x) && R(y) {
+  }
+}
+
+method M6()
+{
+  if x {:myattribute x, "hello"} :| P(x) {
+  }
+  if x, y {:myattribute y, "sveika"} :| P(x) && R(y) {
+  }
+  if x: int {:myattribute x, "chello"} :| P(x) {
+  }
+  if x {:myattribute x, "hola"} {:yourattribute x + x, "hej"} :| P(x) {
+  }
+}
+
+method M7()
+{
+  if x :| P(x) {
+  } else if * {
+  } else if y :| R(y) {
+  } else if y :| P(y) {
+  }
+}
+
+method P0(m: int, n: int)
+  requires m < n
+{
+  var x := true;
+  if {
+    case x :| P(x) =>
+      var t := 3 * x;
+    case x: int :| P(x) =>
+    case x, y :| P(x) && R(y) =>
+      y := y + 1.0;
+    case x: int, y :| P(x) && R(y) =>
+    case m < n =>
+      x := x || m + 5 == n;
+    case x, y: real :| P(x) && R(y) =>
+    case x: int, y: real :| P(x) && R(y) =>
+  }
+  assert x;
+}
+
+method P1(m: int, n: int)
+  requires m < n
+{
+  if {
+    case x {:myattribute x, "hello"} :| P(x) =>
+    case x, y {:myattribute y, "sveika"} :| P(x) && R(y) =>
+    case x: int {:myattribute x, "chello"} :| P(x) =>
+    case x {:myattribute x, "hola"} {:yourattribute x + x, "hej"} :| P(x) =>
+    case m < n =>
+  }
+}
+ExistentialGuardsResolution.dfy(109,7): Error: type of bound variable 'x' could not be determined; please specify the type explicitly
+ExistentialGuardsResolution.dfy(130,8): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ExistentialGuardsResolution.dfy(132,8): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ExistentialGuardsResolution.dfy(140,8): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ExistentialGuardsResolution.dfy(142,8): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ExistentialGuardsResolution.dfy(146,8): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ExistentialGuardsResolution.dfy(149,37): Error: function calls are allowed only in specification contexts (consider declaring the function a 'function method')
+ExistentialGuardsResolution.dfy(12,8): Error: Duplicate local-variable name: x
+ExistentialGuardsResolution.dfy(19,4): Error: LHS of assignment must denote a mutable variable
+ExistentialGuardsResolution.dfy(39,6): Error: Duplicate local-variable name: x
+ExistentialGuardsResolution.dfy(84,6): Error: LHS of assignment must denote a mutable variable
+11 resolution/type errors detected in ExistentialGuardsResolution.dfy
diff --git a/Test/dafny0/ResolutionErrors.dfy b/Test/dafny0/ResolutionErrors.dfy
index e935c83d..58ba6701 100644
--- a/Test/dafny0/ResolutionErrors.dfy
+++ b/Test/dafny0/ResolutionErrors.dfy
@@ -1692,3 +1692,23 @@ module LoopResolutionTests {
     }
   }
 }
+
+module UnderspecifiedTypesInAttributes {
+  function method P<T>(x: T): int
+  method M() {
+    var {:myattr var u :| true; 6} v: int;  // error: type of u is underspecified
+    var j {:myattr var u :| true; 6} :| 0 <= j < 100;  // error: type of u is underspecified
+
+    var a := new int[100];
+    forall lp {:myattr var u :| true; 6} | 0 <= lp < 100 {  // error: type of u is underspecified
+      a[lp] := 0;
+    }
+
+    modify {:myattr P(10)} {:myattr var u :| true; 6} a;  // error: type of u is underspecified
+
+    calc {:myattr P(10)} {:myattr var u :| true; 6} // error: type of u is underspecified
+    {
+      5;
+    }
+  }
+}
diff --git a/Test/dafny0/ResolutionErrors.dfy.expect b/Test/dafny0/ResolutionErrors.dfy.expect
index be19eeac..b055184f 100644
--- a/Test/dafny0/ResolutionErrors.dfy.expect
+++ b/Test/dafny0/ResolutionErrors.dfy.expect
@@ -161,6 +161,11 @@ ResolutionErrors.dfy(1673,4): Error: 'decreases *' is not allowed on ghost loops
 ResolutionErrors.dfy(1677,8): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
 ResolutionErrors.dfy(1687,4): Error: 'decreases *' is not allowed on ghost loops
 ResolutionErrors.dfy(1691,29): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
+ResolutionErrors.dfy(1699,17): Error: the type of the bound variable 'u' could not be determined
+ResolutionErrors.dfy(1700,19): Error: the type of the bound variable 'u' could not be determined
+ResolutionErrors.dfy(1703,23): Error: the type of the bound variable 'u' could not be determined
+ResolutionErrors.dfy(1707,36): Error: the type of the bound variable 'u' could not be determined
+ResolutionErrors.dfy(1709,34): Error: the type of the bound variable 'u' could not be determined
 ResolutionErrors.dfy(469,2): Error: More than one anonymous constructor
 ResolutionErrors.dfy(50,13): Error: 'this' is not allowed in a 'static' context
 ResolutionErrors.dfy(87,14): Error: the name 'Benny' denotes a datatype constructor, but does not do so uniquely; add an explicit qualification (for example, 'Abc.Benny')
@@ -224,4 +229,4 @@ ResolutionErrors.dfy(1123,8): Error: new cannot be applied to a trait
 ResolutionErrors.dfy(1144,13): Error: first argument to / must be of numeric type (instead got set<bool>)
 ResolutionErrors.dfy(1151,18): Error: a call to a possibly non-terminating method is allowed only if the calling method is also declared (with 'decreases *') to be possibly non-terminating
 ResolutionErrors.dfy(1166,14): Error: a possibly infinite loop is allowed only if the enclosing method is declared (with 'decreases *') to be possibly non-terminating
-226 resolution/type errors detected in ResolutionErrors.dfy
+231 resolution/type errors detected in ResolutionErrors.dfy
-- 
cgit v1.2.3


From 7d37934cae1f9372acfa994750616e4ecc21854d Mon Sep 17 00:00:00 2001
From: wuestholz <unknown>
Date: Thu, 8 Oct 2015 12:23:54 -0500
Subject: Make the Dafny extension compile on VS 2015 without any old versions.

---
 Source/DafnyExtension/DafnyExtension.csproj        | 80 ++++++++++++++++------
 Source/DafnyExtension/packages.config              | 29 ++++++++
 .../DafnyExtension/source.extension.vsixmanifest   |  3 +-
 Source/DafnyMenu/DafnyMenu.csproj                  | 59 ++++++++++++----
 Source/DafnyMenu/packages.config                   | 29 ++++++++
 Source/DafnyMenu/source.extension.vsixmanifest     |  3 +-
 6 files changed, 166 insertions(+), 37 deletions(-)
 create mode 100644 Source/DafnyExtension/packages.config
 create mode 100644 Source/DafnyMenu/packages.config

(limited to 'Source')

diff --git a/Source/DafnyExtension/DafnyExtension.csproj b/Source/DafnyExtension/DafnyExtension.csproj
index 3dc67098..f7c7c650 100644
--- a/Source/DafnyExtension/DafnyExtension.csproj
+++ b/Source/DafnyExtension/DafnyExtension.csproj
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003" ToolsVersion="4.0">
   <PropertyGroup>
     <MinimumVisualStudioVersion>11.0</MinimumVisualStudioVersion>
@@ -106,7 +106,9 @@
     <Reference Include="Houdini">
       <HintPath>..\..\..\boogie\Binaries\Houdini.dll</HintPath>
     </Reference>
-    <Reference Include="Microsoft.VisualStudio.Language.Intellisense, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
+    <Reference Include="Microsoft.VisualStudio.Language.Intellisense, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Language.11.0.4\lib\net45\Microsoft.VisualStudio.Language.Intellisense.dll</HintPath>
+    </Reference>
     <Reference Include="Model">
       <HintPath>..\..\..\boogie\Binaries\Model.dll</HintPath>
     </Reference>
@@ -124,23 +126,57 @@
     </Reference>
   </ItemGroup>
   <ItemGroup>
-    <Reference Include="Microsoft.VisualStudio.Shell.Interop, Version=7.1.40304.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
-    <Reference Include="Microsoft.VisualStudio.Editor, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.ComponentModelHost, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.Shell.11.0, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.Shell.Immutable.10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.OLE.Interop, Version=7.1.40304.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
-    <Reference Include="Microsoft.VisualStudio.Shell.Interop.11.0, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
-    <Reference Include="Microsoft.VisualStudio.Shell.Interop.10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
-    <Reference Include="Microsoft.VisualStudio.Shell.Interop.8.0, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
-    <Reference Include="Microsoft.VisualStudio.Shell.Interop.9.0, Version=9.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
-    <Reference Include="Microsoft.VisualStudio.CoreUtility, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.TextManager.Interop, Version=7.1.40304.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
-    <Reference Include="Microsoft.VisualStudio.Text.Data, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.Text.Logic, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.Text.UI, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.Text.UI.Wpf, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.Language.StandardClassification, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
+    <Reference Include="Microsoft.VisualStudio.Shell.Interop, Version=7.1.40304.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a">
+      <HintPath>..\packages\VSSDK.Shell.Interop.7.0.4\lib\net20\Microsoft.VisualStudio.Shell.Interop.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Editor, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Editor.11.0.4\lib\net45\Microsoft.VisualStudio.Editor.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.ComponentModelHost, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.ComponentModelHost.11.0.4\lib\net45\Microsoft.VisualStudio.ComponentModelHost.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Shell.11.0, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Shell.11.11.0.4\lib\net45\Microsoft.VisualStudio.Shell.11.0.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Shell.Immutable.10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Shell.Immutable.10.10.0.4\lib\net40\Microsoft.VisualStudio.Shell.Immutable.10.0.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.OLE.Interop, Version=7.1.40304.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a">
+      <HintPath>..\packages\VSSDK.OLE.Interop.7.0.4\lib\net20\Microsoft.VisualStudio.OLE.Interop.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Shell.Interop.11.0, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Shell.Interop.11.11.0.4\lib\net20\Microsoft.VisualStudio.Shell.Interop.11.0.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Shell.Interop.10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Shell.Interop.10.10.0.4\lib\net20\Microsoft.VisualStudio.Shell.Interop.10.0.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Shell.Interop.8.0, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a">
+      <HintPath>..\packages\VSSDK.Shell.Interop.8.8.0.4\lib\net20\Microsoft.VisualStudio.Shell.Interop.8.0.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Shell.Interop.9.0, Version=9.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a">
+      <HintPath>..\packages\VSSDK.Shell.Interop.9.9.0.4\lib\net20\Microsoft.VisualStudio.Shell.Interop.9.0.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.CoreUtility, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.CoreUtility.11.0.4\lib\net45\Microsoft.VisualStudio.CoreUtility.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.TextManager.Interop, Version=7.1.40304.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a">
+      <HintPath>..\packages\VSSDK.TextManager.Interop.7.0.4\lib\net20\Microsoft.VisualStudio.TextManager.Interop.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Text.Data, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Text.11.0.4\lib\net45\Microsoft.VisualStudio.Text.Data.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Text.Logic, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Text.11.0.4\lib\net45\Microsoft.VisualStudio.Text.Logic.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Text.UI, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Text.11.0.4\lib\net45\Microsoft.VisualStudio.Text.UI.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Text.UI.Wpf, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Text.11.0.4\lib\net45\Microsoft.VisualStudio.Text.UI.Wpf.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Language.StandardClassification, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Language.11.0.4\lib\net45\Microsoft.VisualStudio.Language.StandardClassification.dll</HintPath>
+    </Reference>
   </ItemGroup>
   <ItemGroup>
     <Reference Include="PresentationCore" />
@@ -148,7 +184,6 @@
     <Reference Include="System" />
     <Reference Include="System.ComponentModel.Composition" />
     <Reference Include="System.Core" />
-    <Reference Include="System.Xaml" />
     <Reference Include="WindowsBase" />
   </ItemGroup>
   <ItemGroup>
@@ -200,6 +235,9 @@
     </Content>
   </ItemGroup>
   <ItemGroup>
+    <None Include="packages.config">
+      <SubType>Designer</SubType>
+    </None>
     <None Include="source.extension.vsixmanifest">
       <SubType>Designer</SubType>
     </None>
@@ -250,4 +288,4 @@ copy /y "..\Binaries\z3.exe" "$(ProjectDir)"</PreBuildEvent>
   <Target Name="AfterBuild">
   </Target>
   -->
-</Project>
\ No newline at end of file
+</Project>
diff --git a/Source/DafnyExtension/packages.config b/Source/DafnyExtension/packages.config
new file mode 100644
index 00000000..60f856c5
--- /dev/null
+++ b/Source/DafnyExtension/packages.config
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="VSSDK.ComponentModelHost" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.ComponentModelHost.11" version="11.0.3" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.CoreUtility" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.CoreUtility.11" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.DTE" version="7.0.4" targetFramework="net45" />
+  <package id="VSSDK.Editor" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.IDE" version="7.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.IDE.10" version="10.0.4" targetFramework="net45" />
+  <package id="VSSDK.IDE.11" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.IDE.8" version="8.0.4" targetFramework="net45" />
+  <package id="VSSDK.IDE.9" version="9.0.4" targetFramework="net45" />
+  <package id="VSSDK.Language" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.Language.11" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.OLE.Interop" version="7.0.4" targetFramework="net45" />
+  <package id="VSSDK.Shell.11" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.Shell.Immutable.10" version="10.0.4" targetFramework="net45" />
+  <package id="VSSDK.Shell.Immutable.11" version="11.0.4" targetFramework="net45" />
+  <package id="VSSDK.Shell.Interop" version="7.0.4" targetFramework="net45" />
+  <package id="VSSDK.Shell.Interop.10" version="10.0.4" targetFramework="net45" />
+  <package id="VSSDK.Shell.Interop.11" version="11.0.4" targetFramework="net45" />
+  <package id="VSSDK.Shell.Interop.8" version="8.0.4" targetFramework="net45" />
+  <package id="VSSDK.Shell.Interop.9" version="9.0.4" targetFramework="net45" />
+  <package id="VSSDK.Text" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.Text.11" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.TextManager.Interop" version="7.0.4" targetFramework="net45" />
+  <package id="VSSDK.TextManager.Interop.8" version="8.0.4" targetFramework="net45" />
+</packages>
diff --git a/Source/DafnyExtension/source.extension.vsixmanifest b/Source/DafnyExtension/source.extension.vsixmanifest
index b87e2452..66e4deda 100644
--- a/Source/DafnyExtension/source.extension.vsixmanifest
+++ b/Source/DafnyExtension/source.extension.vsixmanifest
@@ -7,7 +7,8 @@
     <License>Z3-LICENSE.txt</License>
   </Metadata>
   <Installation InstalledByMsi="false">
-    <InstallationTarget Version="[11.0,13.0)" Id="Microsoft.VisualStudio.Pro" />
+    <InstallationTarget Version="[11.0,15.0)" Id="Microsoft.VisualStudio.Pro" />
+    <InstallationTarget Version="[14.0,15.0)" Id="Microsoft.VisualStudio.Community" />
   </Installation>
   <Dependencies>
     <Dependency Id="Microsoft.Framework.NDP" DisplayName="Microsoft .NET Framework" d:Source="Manual" Version="4.5" />
diff --git a/Source/DafnyMenu/DafnyMenu.csproj b/Source/DafnyMenu/DafnyMenu.csproj
index 503b3d0c..2a222038 100644
--- a/Source/DafnyMenu/DafnyMenu.csproj
+++ b/Source/DafnyMenu/DafnyMenu.csproj
@@ -62,22 +62,50 @@
   </ItemGroup>
   <ItemGroup>
     <Reference Include="Microsoft.VisualStudio.Shell.Interop, Version=7.1.40304.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
-    <Reference Include="Microsoft.VisualStudio.Editor, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.ComponentModelHost, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.Shell.11.0, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
+    <Reference Include="Microsoft.VisualStudio.Editor, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Editor.11.0.4\lib\net45\Microsoft.VisualStudio.Editor.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.ComponentModelHost, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.ComponentModelHost.11.0.4\lib\net45\Microsoft.VisualStudio.ComponentModelHost.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Shell.11.0, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Shell.11.11.0.4\lib\net45\Microsoft.VisualStudio.Shell.11.0.dll</HintPath>
+    </Reference>
     <Reference Include="Microsoft.VisualStudio.Shell.Immutable.10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.OLE.Interop, Version=7.1.40304.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
-    <Reference Include="Microsoft.VisualStudio.Shell.Interop.11.0, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
-    <Reference Include="Microsoft.VisualStudio.Shell.Interop.10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
-    <Reference Include="Microsoft.VisualStudio.Shell.Interop.8.0, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
-    <Reference Include="Microsoft.VisualStudio.Shell.Interop.9.0, Version=9.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
-    <Reference Include="Microsoft.VisualStudio.CoreUtility, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
+    <Reference Include="Microsoft.VisualStudio.OLE.Interop, Version=7.1.40304.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a">
+      <HintPath>..\packages\VSSDK.OLE.Interop.7.0.4\lib\net20\Microsoft.VisualStudio.OLE.Interop.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Shell.Interop.11.0, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Shell.Interop.11.11.0.4\lib\net20\Microsoft.VisualStudio.Shell.Interop.11.0.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Shell.Interop.10.0, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Shell.Interop.10.10.0.4\lib\net20\Microsoft.VisualStudio.Shell.Interop.10.0.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Shell.Interop.8.0, Version=8.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a">
+      <HintPath>..\packages\VSSDK.Shell.Interop.8.8.0.4\lib\net20\Microsoft.VisualStudio.Shell.Interop.8.0.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Shell.Interop.9.0, Version=9.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a">
+      <HintPath>..\packages\VSSDK.Shell.Interop.9.9.0.4\lib\net20\Microsoft.VisualStudio.Shell.Interop.9.0.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.CoreUtility, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.CoreUtility.11.0.4\lib\net45\Microsoft.VisualStudio.CoreUtility.dll</HintPath>
+    </Reference>
     <Reference Include="Microsoft.VisualStudio.TextManager.Interop, Version=7.1.40304.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
-    <Reference Include="Microsoft.VisualStudio.Text.Data, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.Text.Logic, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.Text.UI, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.Text.UI.Wpf, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
-    <Reference Include="Microsoft.VisualStudio.Language.StandardClassification, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL" />
+    <Reference Include="Microsoft.VisualStudio.Text.Data, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Text.11.0.4\lib\net45\Microsoft.VisualStudio.Text.Data.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Text.Logic, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Text.11.0.4\lib\net45\Microsoft.VisualStudio.Text.Logic.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Text.UI, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Text.11.0.4\lib\net45\Microsoft.VisualStudio.Text.UI.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Text.UI.Wpf, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Text.11.0.4\lib\net45\Microsoft.VisualStudio.Text.UI.Wpf.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.VisualStudio.Language.StandardClassification, Version=11.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\VSSDK.Language.11.0.4\lib\net45\Microsoft.VisualStudio.Language.StandardClassification.dll</HintPath>
+    </Reference>
   </ItemGroup>
   <ItemGroup>
     <Reference Include="PresentationCore" />
@@ -127,6 +155,9 @@
     </EmbeddedResource>
   </ItemGroup>
   <ItemGroup>
+    <None Include="packages.config">
+      <SubType>Designer</SubType>
+    </None>
     <None Include="source.extension.vsixmanifest">
       <SubType>Designer</SubType>
     </None>
diff --git a/Source/DafnyMenu/packages.config b/Source/DafnyMenu/packages.config
new file mode 100644
index 00000000..60f856c5
--- /dev/null
+++ b/Source/DafnyMenu/packages.config
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="VSSDK.ComponentModelHost" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.ComponentModelHost.11" version="11.0.3" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.CoreUtility" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.CoreUtility.11" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.DTE" version="7.0.4" targetFramework="net45" />
+  <package id="VSSDK.Editor" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.IDE" version="7.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.IDE.10" version="10.0.4" targetFramework="net45" />
+  <package id="VSSDK.IDE.11" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.IDE.8" version="8.0.4" targetFramework="net45" />
+  <package id="VSSDK.IDE.9" version="9.0.4" targetFramework="net45" />
+  <package id="VSSDK.Language" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.Language.11" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.OLE.Interop" version="7.0.4" targetFramework="net45" />
+  <package id="VSSDK.Shell.11" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.Shell.Immutable.10" version="10.0.4" targetFramework="net45" />
+  <package id="VSSDK.Shell.Immutable.11" version="11.0.4" targetFramework="net45" />
+  <package id="VSSDK.Shell.Interop" version="7.0.4" targetFramework="net45" />
+  <package id="VSSDK.Shell.Interop.10" version="10.0.4" targetFramework="net45" />
+  <package id="VSSDK.Shell.Interop.11" version="11.0.4" targetFramework="net45" />
+  <package id="VSSDK.Shell.Interop.8" version="8.0.4" targetFramework="net45" />
+  <package id="VSSDK.Shell.Interop.9" version="9.0.4" targetFramework="net45" />
+  <package id="VSSDK.Text" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.Text.11" version="11.0.4" targetFramework="net45" developmentDependency="true" />
+  <package id="VSSDK.TextManager.Interop" version="7.0.4" targetFramework="net45" />
+  <package id="VSSDK.TextManager.Interop.8" version="8.0.4" targetFramework="net45" />
+</packages>
diff --git a/Source/DafnyMenu/source.extension.vsixmanifest b/Source/DafnyMenu/source.extension.vsixmanifest
index 7beeb69e..814374ee 100644
--- a/Source/DafnyMenu/source.extension.vsixmanifest
+++ b/Source/DafnyMenu/source.extension.vsixmanifest
@@ -6,7 +6,8 @@
     <Description xml:space="preserve">This is a menu for interacting with Dafny.</Description>
   </Metadata>
   <Installation InstalledByMsi="false">
-    <InstallationTarget Version="[11.0,13.0)" Id="Microsoft.VisualStudio.Pro" />
+    <InstallationTarget Version="[11.0,15.0)" Id="Microsoft.VisualStudio.Pro" />
+    <InstallationTarget Version="[14.0,15.0)" Id="Microsoft.VisualStudio.Community" />
   </Installation>
   <Dependencies>
     <Dependency Id="Microsoft.Framework.NDP" DisplayName="Microsoft .NET Framework" d:Source="Manual" Version="4.5" />
-- 
cgit v1.2.3


From c5094e85c027730aa0ef6466766a8e5c99d83c11 Mon Sep 17 00:00:00 2001
From: wuestholz <unknown>
Date: Thu, 8 Oct 2015 12:26:37 -0500
Subject: DafnyExtension: Fix concurrency issue.

---
 Source/DafnyExtension/ResolverTagger.cs | 79 ++++++++++++++++-----------------
 1 file changed, 38 insertions(+), 41 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyExtension/ResolverTagger.cs b/Source/DafnyExtension/ResolverTagger.cs
index 22706338..b348e7d6 100644
--- a/Source/DafnyExtension/ResolverTagger.cs
+++ b/Source/DafnyExtension/ResolverTagger.cs
@@ -189,7 +189,7 @@ namespace DafnyLanguage
     {
       get
       {
-        return _verificationErrors.Values.Where(ec => ec.RequestId == MostRecentRequestId).SelectMany(ec => ec.Errors.Reverse());
+        return _verificationErrors.Values.Where(ec => ec.RequestId == MostRecentRequestId).SelectMany(ec => ec.Errors.Reverse()).ToList();
       }
     }
 
@@ -354,49 +354,46 @@ namespace DafnyLanguage
 
     public void UpdateErrorList(ITextSnapshot snapshot)
     {
-      lock (this) 
+      if (_errorProvider != null && !m_disposed)
       {
-        if (_errorProvider != null && !m_disposed)
-        {
-          _errorProvider.SuspendRefresh();  // reduce flickering
-          _errorProvider.Tasks.Clear();
-          foreach (var err in AllErrors)
-          { 
-            var lineNum = 0;
-            var columnNum = 0;
-            if (err.Span != null) {
-              var span = err.Span.GetSpan(snapshot);
-              lineNum = snapshot.GetLineNumberFromPosition(span.Start.Position);
-              var line = snapshot.GetLineFromPosition(span.Start.Position);
-              columnNum = span.Start - line.Start;
-            } else {
-              lineNum = err.Line;
-              columnNum = err.Column;
-            }
-            
-            ErrorTask task = new ErrorTask()
-            {
-              Category = TaskCategory.BuildCompile,
-              ErrorCategory = CategoryConversion(err.Category),
-              Text = err.Message,
-              Line = lineNum,
-              Column = columnNum
-            };
-            if (err.Filename != null) {
-              task.Document = err.Filename;
-            } 
-            else if (_document != null)
-            {
-              task.Document = _document.FilePath;
-            }
-            if (err.Category != ErrorCategory.ProcessError && err.Category != ErrorCategory.InternalError)
-            {
-              task.Navigate += new EventHandler(NavigateHandler);
-            }
-            _errorProvider.Tasks.Add(task);
+        _errorProvider.SuspendRefresh();  // reduce flickering
+        _errorProvider.Tasks.Clear();
+        foreach (var err in AllErrors)
+        { 
+          var lineNum = 0;
+          var columnNum = 0;
+          if (err.Span != null) {
+            var span = err.Span.GetSpan(snapshot);
+            lineNum = snapshot.GetLineNumberFromPosition(span.Start.Position);
+            var line = snapshot.GetLineFromPosition(span.Start.Position);
+            columnNum = span.Start - line.Start;
+          } else {
+            lineNum = err.Line;
+            columnNum = err.Column;
+          }
+          
+          ErrorTask task = new ErrorTask()
+          {
+            Category = TaskCategory.BuildCompile,
+            ErrorCategory = CategoryConversion(err.Category),
+            Text = err.Message,
+            Line = lineNum,
+            Column = columnNum
+          };
+          if (err.Filename != null) {
+            task.Document = err.Filename;
+          } 
+          else if (_document != null)
+          {
+            task.Document = _document.FilePath;
+          }
+          if (err.Category != ErrorCategory.ProcessError && err.Category != ErrorCategory.InternalError)
+          {
+            task.Navigate += new EventHandler(NavigateHandler);
           }
-          _errorProvider.ResumeRefresh();
+          _errorProvider.Tasks.Add(task);
         }
+        _errorProvider.ResumeRefresh();
       }
       var chng = TagsChanged;
       if (chng != null)
-- 
cgit v1.2.3


From eaf726c56d304e3a9e969112b5f403269a244234 Mon Sep 17 00:00:00 2001
From: wuestholz <unknown>
Date: Thu, 8 Oct 2015 19:42:49 +0200
Subject: DafnyExtension: Re-added assembly reference.

---
 Source/DafnyExtension/DafnyExtension.csproj | 1 +
 1 file changed, 1 insertion(+)

(limited to 'Source')

diff --git a/Source/DafnyExtension/DafnyExtension.csproj b/Source/DafnyExtension/DafnyExtension.csproj
index f7c7c650..08040853 100644
--- a/Source/DafnyExtension/DafnyExtension.csproj
+++ b/Source/DafnyExtension/DafnyExtension.csproj
@@ -184,6 +184,7 @@
     <Reference Include="System" />
     <Reference Include="System.ComponentModel.Composition" />
     <Reference Include="System.Core" />
+    <Reference Include="System.Xaml" />
     <Reference Include="WindowsBase" />
   </ItemGroup>
   <ItemGroup>
-- 
cgit v1.2.3


From be08f2949d674bd757a804795de1dd37c95177f3 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Mon, 12 Oct 2015 11:48:14 -0700
Subject: Version 1.9.6.21012

---
 Source/version.cs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'Source')

diff --git a/Source/version.cs b/Source/version.cs
index 1234a75b..7a6b0213 100644
--- a/Source/version.cs
+++ b/Source/version.cs
@@ -1,4 +1,4 @@
 using System.Reflection;
-// Version 1.9.5, year 2013+2 month 05 day 11
-[assembly: AssemblyVersion("1.9.5.20511")]
-[assembly: AssemblyFileVersion("1.9.5.20511")]
+// Version 1.9.6, year 2013+2 month 10 day 12
+[assembly: AssemblyVersion("1.9.6.21012")]
+[assembly: AssemblyFileVersion("1.9.6.21012")]
-- 
cgit v1.2.3


From 88f5ac86bda56381f81be032a0011e34aeca50a8 Mon Sep 17 00:00:00 2001
From: Bryan Parno <parno@microsoft.com>
Date: Mon, 19 Oct 2015 22:53:41 -0700
Subject: Improve Dafny's ability to find fueled functions by checking the
 function itself, as well as the signature and body of other functions.

---
 Source/Dafny/DafnyAst.cs    | 20 ++++++++++++++++++++
 Source/Dafny/Resolver.cs    |  7 +++++++
 Test/dafny0/Fuel.dfy        | 39 +++++++++++++++++++++++++++++++++++++++
 Test/dafny0/Fuel.dfy.expect | 14 +++++++++++++-
 4 files changed, 79 insertions(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 667f8407..871d644d 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -3202,7 +3202,27 @@ namespace Microsoft.Dafny {
       this.Decreases = decreases;
       this.Body = body;
       this.SignatureEllipsis = signatureEllipsis;
+
+      if (attributes != null) {
+        List<Expression> args = Attributes.FindExpressions(attributes, "fuel");
+        if (args != null) {
+          if (args.Count == 1) {
+            LiteralExpr literal = args[0] as LiteralExpr;
+            if (literal != null && literal.Value is BigInteger) {
+              this.IsFueled = true;
+            }
+          } else if (args.Count == 2) {
+            LiteralExpr literalLow = args[0] as LiteralExpr;
+            LiteralExpr literalHigh = args[1] as LiteralExpr;
+
+            if (literalLow != null && literalLow.Value is BigInteger && literalHigh != null && literalHigh.Value is BigInteger) {
+              this.IsFueled = true;
+            }
+          }
+        }
+      }
     }
+          
 
     bool ICodeContext.IsGhost { get { return this.IsGhost; } }
     List<TypeParameter> ICodeContext.TypeArgs { get { return this.TypeArgs; } }
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 1798243c..6ded74d5 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -444,6 +444,13 @@ namespace Microsoft.Dafny
           } else if (clbl is IteratorDecl) {
             body = ((IteratorDecl)clbl).Body;
             CheckForFuelAdjustments(clbl.Tok, ((IteratorDecl)clbl).Attributes, module);
+          } else if (clbl is Function) {            
+            CheckForFuelAdjustments(clbl.Tok, ((Function)clbl).Attributes, module);
+            var c = new FuelAdjustment_Visitor(this);
+            var bodyExpr = ((Function)clbl).Body;
+            if (bodyExpr != null) {
+              c.Visit(bodyExpr, new FuelAdjustment_Context(module));
+            }
           }
           if (body != null) {
             var c = new FuelAdjustment_Visitor(this);
diff --git a/Test/dafny0/Fuel.dfy b/Test/dafny0/Fuel.dfy
index c8a1fc2f..abbc831e 100644
--- a/Test/dafny0/Fuel.dfy
+++ b/Test/dafny0/Fuel.dfy
@@ -421,3 +421,42 @@ module TestModule9 {
     }
 }
 
+// Test fuel when it's applied to a non-recursive function directly (to simulate opaque)
+module TestModule10 {
+    function {:fuel 0,0} abs(x:int) : int
+    {
+        if x < 0 then -1 * x else x
+    }
+
+    method test1(y:int, z:int)
+        requires y > 5;
+        requires z < 0;
+    {
+        assert abs(z) == -1*z;  // error: Cannot see the body of abs
+        assert abs(y) == y;     // error: Cannot see the body of abs
+        assert abs(-1) == 1;    // lit bypasses fuel, so this should succeed
+    }
+}
+
+// Test fuel when it's mentioned in other functions function to simulate a local opaque
+module TestModule11 {
+    function abs(x:int) : int
+    {
+        if x < 0 then -1 * x else x
+    }
+
+    function {:fuel abs,0,0} abs'(x:int) : int
+    {
+        abs(x)
+    }
+
+    method test1(y:int, z:int)
+        requires y > 5;
+        requires z < 0;
+    {
+        assert abs'(z) == -1*z;  // error: Cannot see the body of abs
+        assert abs'(y) == y;     // error: Cannot see the body of abs
+        assert abs'(-1) == 1;    // lit bypasses fuel, so this should succeed
+    }
+}
+
diff --git a/Test/dafny0/Fuel.dfy.expect b/Test/dafny0/Fuel.dfy.expect
index 90fe877d..0c128941 100644
--- a/Test/dafny0/Fuel.dfy.expect
+++ b/Test/dafny0/Fuel.dfy.expect
@@ -89,7 +89,19 @@ Fuel.dfy(398,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
 Fuel.dfy(407,38): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Fuel.dfy(435,22): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Fuel.dfy(436,22): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Fuel.dfy(457,23): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Fuel.dfy(458,23): Error: assertion violation
 Execution trace:
     (0,0): anon0
 
-Dafny program verifier finished with 51 verified, 24 errors
+Dafny program verifier finished with 56 verified, 28 errors
-- 
cgit v1.2.3


From cb760d823372f0d6a45469cb7840cad9df023232 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Thu, 22 Oct 2015 21:46:42 -0700
Subject: Fixed bug introduced in changeset 7ebdf9cd4154

---
 Source/Dafny/Translator.cs         | 12 ++++++------
 Test/dafny4/Regression1.dfy        |  9 +++++++++
 Test/dafny4/Regression1.dfy.expect |  2 ++
 3 files changed, 17 insertions(+), 6 deletions(-)
 create mode 100644 Test/dafny4/Regression1.dfy
 create mode 100644 Test/dafny4/Regression1.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 18b50686..7d3f570d 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -13760,9 +13760,9 @@ namespace Microsoft.Dafny {
           }
 
           var newBoundVars = CreateBoundVarSubstitutions(e.BoundVars, expr is ForallExpr || expr is ExistsExpr || expr is SetComprehension);
-          Expression newRange = e.Range == null ? null : Substitute(e.Range);
-          Expression newTerm = Substitute(e.Term);
-          Attributes newAttrs = SubstAttributes(e.Attributes);
+          var newRange = e.Range == null ? null : Substitute(e.Range);
+          var newTerm = Substitute(e.Term);
+          var newAttrs = SubstAttributes(e.Attributes);
           if (newBoundVars != e.BoundVars || newRange != e.Range || newTerm != e.Term || newAttrs != e.Attributes) {
             if (e is SetComprehension) {
               newExpr = new SetComprehension(expr.tok, ((SetComprehension)e).Finite, newBoundVars, newRange, newTerm, newAttrs);
@@ -13778,9 +13778,9 @@ namespace Microsoft.Dafny {
             } else {
               Contract.Assert(false);  // unexpected ComprehensionExpr
             }
-          }
-          if (e.Bounds != null) {
-            ((ComprehensionExpr)newExpr).Bounds = e.Bounds.ConvertAll(bound => SubstituteBoundedPool(bound));
+            if (e.Bounds != null) {
+              ((ComprehensionExpr)newExpr).Bounds = e.Bounds.ConvertAll(bound => SubstituteBoundedPool(bound));
+            }
           }
           // undo any changes to substMap (could be optimized to do this only if newBoundVars != e.BoundVars)
           foreach (var bv in e.BoundVars) {
diff --git a/Test/dafny4/Regression1.dfy b/Test/dafny4/Regression1.dfy
new file mode 100644
index 00000000..ebd8cf6d
--- /dev/null
+++ b/Test/dafny4/Regression1.dfy
@@ -0,0 +1,9 @@
+// RUN: %dafny /compile:0 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+ghost method M() {
+  var x :=
+// In the following line, why are the range and term copied in Substitute?
+//    var loo := 100; map y | 0 <= y < 100 :: y+1;
+    var loo := 100; imap y: int | true :: 3;
+}
diff --git a/Test/dafny4/Regression1.dfy.expect b/Test/dafny4/Regression1.dfy.expect
new file mode 100644
index 00000000..069e7767
--- /dev/null
+++ b/Test/dafny4/Regression1.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 2 verified, 0 errors
-- 
cgit v1.2.3


From ad8e5120533bbc694ecd81fccfa095a18a79cb84 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Fri, 23 Oct 2015 15:57:43 -0700
Subject: Refactored resolution of datatype updates, preparing for a change of
 syntax

---
 Source/Dafny/Resolver.cs | 171 ++++++++++++++++++++++++++---------------------
 1 file changed, 96 insertions(+), 75 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 6ded74d5..3cb98f65 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -7613,90 +7613,29 @@ namespace Microsoft.Dafny
           expr.Type = e.Seq.Type;
 
         } else if (e.Seq.Type.IsDatatype) {
-          var dt = e.Seq.Type.AsDatatype;
-          DatatypeCtor ctor = null;
-
-          // Let en = e and e(n-1) = en.Seq
-          // We're currently looking at e = e(n-1)[en.Index := en.Value]
-          // Let e(n-2) = e(n-1).Seq, e(n-3) = e(n-2).Seq, etc.
-          // Let's extract e = e0[e1.Index := e1.Value]...[en.Index := en.Value]
-          var IndexToValue = new Dictionary<string,Tuple<DatatypeDestructor,Expression>>();
+          // combine a nest of datatype updates into one single DatatypeUpdate expression
+          var memberUpdates = new List<Tuple<IToken, string, Expression>>();
           Expression eIter = e;
           while (eIter is SeqUpdateExpr) {
             var ei = (SeqUpdateExpr)eIter;
-
-            if (!(ei.Index is NameSegment|| (ei.Index is LiteralExpr && ((LiteralExpr)ei.Index).Value is BigInteger))) {
-              reporter.Error(MessageSource.Resolver, expr, "datatype updates must be to datatype destructors");
+            if (ei.Index is NameSegment) {
+              var seg = (NameSegment)ei.Index;
+              memberUpdates.Add(new Tuple<IToken,string,Expression>(ei.Index.tok, seg.Name, ei.Value));
+            } else if (ei.Index is LiteralExpr && ((LiteralExpr)ei.Index).Value is BigInteger) {
+              var lit = (LiteralExpr)ei.Index;
+              var nm = lit.tok.val;  // note, take the string of digits, not the parsed integer
+              memberUpdates.Add(new Tuple<IToken,string,Expression>(ei.Index.tok, nm, ei.Value));
             } else {
-              string destructor_str = null;
-
-              if (ei.Index is NameSegment) {
-                var seg = (NameSegment)ei.Index;
-                destructor_str = seg.Name;
-              } else {
-                Contract.Assert(ei.Index is LiteralExpr && ((LiteralExpr)ei.Index).Value is BigInteger);
-                destructor_str = ((LiteralExpr)ei.Index).tok.val;  // note, take the string of digits, not the parsed integer
-              }
-
-              Contract.Assert(destructor_str != null);
-              if (IndexToValue.ContainsKey(destructor_str)) {
-                // Don't bother trying to optimize this case; we'd have to drop one of the updates,
-                // which makes resolving the dropped update an annoyance.
-                reporter.Warning(MessageSource.Resolver, ei.tok, "update to {0} overwritten by another update to {1}", destructor_str, destructor_str);
-                break;
-              }
-              MemberDecl member;
-              if (!datatypeMembers[dt].TryGetValue(destructor_str, out member)) {
-                reporter.Error(MessageSource.Resolver, expr, "member {0} does not exist in datatype {1}", destructor_str, dt.Name);
-              } else {
-                DatatypeDestructor destructor = (DatatypeDestructor)member;
-                if (ctor != null && ctor != destructor.EnclosingCtor) {
-                  // Don't bother optimizing case where destructors come from different constructors
-                  break;
-                }
-                IndexToValue.Add(destructor_str, Tuple.Create(destructor, ei.Value));
-                ctor = destructor.EnclosingCtor;
-              }
+              reporter.Error(MessageSource.Resolver, expr, "datatype updates must be to datatype destructors");
             }
             eIter = ei.Seq;
           }
-          if (ctor != null) {
-            var e0 = eIter;
-
-            // Rewrite an update of the form "dt[dtor := E]" to be "let d' := dt in dtCtr(E, d'.dtor2, d'.dtor3,...)"
-            // Wrapping it in a let expr avoids exponential growth in the size of the expression
-            // More generally, rewrite "E0[dtor1 := E1][dtor2 := E2]...[dtorn := En]" to
-            //   "let d' := E0 in dtCtr(...mixtures of Ek and d'.dtorj...)"
-
-            // Create a unique name for d', the variable we introduce in the let expression
-            string tmpName = FreshTempVarName("dt_update_tmp#", opts.codeContext);
-            IdentifierExpr tmpVarIdExpr = new IdentifierExpr(e0.tok, tmpName);
-            BoundVar tmpVarBv = new BoundVar(e0.tok, tmpName, e0.Type);
-
-            // Build the arguments to the datatype constructor, using the updated value in the appropriate slot
-            List<Expression> ctor_args = new List<Expression>();
-            foreach (Formal d in ctor.Formals) {
-              Expression v = null;
-              foreach (var dvPair in IndexToValue.Values) {
-                var destructor = dvPair.Item1;
-                if (d == destructor.CorrespondingFormal) {
-                  Contract.Assert(v == null);
-                  v = dvPair.Item2;
-                }
-              }
-              ctor_args.Add(v ?? new ExprDotName(expr.tok, tmpVarIdExpr, d.Name, null));
-            }
-
-            DatatypeValue ctor_call = new DatatypeValue(expr.tok, ctor.EnclosingDatatype.Name, ctor.Name, ctor_args);
-
-            CasePattern tmpVarPat = new CasePattern(e0.tok, tmpVarBv);
-            LetExpr let = new LetExpr(e0.tok, new List<CasePattern>() { tmpVarPat }, new List<Expression>() { e0 }, ctor_call, true);
-
-            ResolveExpression(let, opts);
+          var let = ResolveDatatypeUpdate(expr.tok, eIter, e.Seq.Type.AsDatatype, memberUpdates, true, opts);
+          if (let != null) {
             e.ResolvedUpdateExpr = let;
-
-            expr.Type = e0.Type;
+            expr.Type = e.Seq.Type;
           }
+
         } else {
           reporter.Error(MessageSource.Resolver, expr, "update requires a sequence, map, or datatype (got {0})", e.Seq.Type);
         }
@@ -8138,6 +8077,88 @@ namespace Microsoft.Dafny
       }
     }
 
+    /// <summary>
+    /// Attempts to produce a let expression from the given datatype updates.  Returns that let expression upon success, and null otherwise.
+    /// </summary>
+    Expression ResolveDatatypeUpdate(IToken tok, Expression orig, DatatypeDecl dt, List<Tuple<IToken, string, Expression>> memberUpdates, bool sequentialUpdates, ResolveOpts opts) {
+      Contract.Requires(tok != null);
+      Contract.Requires(orig != null);
+      Contract.Requires(dt != null);
+      Contract.Requires(memberUpdates != null);
+      Contract.Requires(opts != null);
+
+      // Let en = e and e(n-1) = en.Seq
+      // We're currently looking at e = e(n-1)[en.Index := en.Value]
+      // Let e(n-2) = e(n-1).Seq, e(n-3) = e(n-2).Seq, etc.
+      // Let's extract e = e0[e1.Index := e1.Value]...[en.Index := en.Value]
+      DatatypeCtor ctor = null;
+      Tuple<IToken, string, Expression> ctorSource = default(Tuple<IToken, string, Expression>);  // relevant only if "ctor" is non-null
+      var memberNames = new HashSet<string>();
+      var updates = new Dictionary<Formal, Expression>();
+      foreach (var entry in memberUpdates) {
+        var destructor_str = entry.Item2;
+        if (memberNames.Contains(destructor_str)) {
+          if (sequentialUpdates) {
+            reporter.Warning(MessageSource.Resolver, entry.Item1, "update to '{0}' overwritten by another update to '{0}'", destructor_str);
+          } else {
+            reporter.Error(MessageSource.Resolver, entry.Item1, "duplicate update member '{0}'", destructor_str);
+          }
+        } else {
+          memberNames.Add(destructor_str);
+          MemberDecl member;
+          if (!datatypeMembers[dt].TryGetValue(destructor_str, out member)) {
+            reporter.Error(MessageSource.Resolver, entry.Item1, "member '{0}' does not exist in datatype '{1}'", destructor_str, dt.Name);
+          } else {
+            var destructor = (DatatypeDestructor)member;
+            if (ctor != null && ctor != destructor.EnclosingCtor) {
+              if (sequentialUpdates) {
+                // This would eventually give rise to a verification error.  However, since the 'sequentialUpdates' case is being depricated,
+                // we don't mind giving resolution error about this now.
+              }
+              reporter.Error(MessageSource.Resolver, entry.Item1, "updated datatype members must belong to the same constructor " +
+                "('{0}' belongs to '{1}' and '{2}' belongs to '{3}'", entry.Item2, destructor.EnclosingCtor.Name, ctorSource.Item2, ctor.Name);
+            } else {
+              updates.Add(destructor.CorrespondingFormal, entry.Item3);
+              ctor = destructor.EnclosingCtor;
+              ctorSource = entry;
+            }
+          }
+        }
+      }
+
+      if (ctor != null) {
+        // Rewrite an update of the form "dt[dtor := E]" to be "let d' := dt in dtCtr(E, d'.dtor2, d'.dtor3,...)"
+        // Wrapping it in a let expr avoids exponential growth in the size of the expression
+        // More generally, rewrite "E0[dtor1 := E1][dtor2 := E2]...[dtorn := En]" where "E0" is "orig" to
+        //   "let d' := E0 in dtCtr(...mixtures of Ek and d'.dtorj...)"
+
+        // Create a unique name for d', the variable we introduce in the let expression
+        var tmpName = FreshTempVarName("dt_update_tmp#", opts.codeContext);
+        var tmpVarIdExpr = new IdentifierExpr(tok, tmpName);
+        var tmpVarBv = new BoundVar(tok, tmpName, orig.Type);
+
+        // Build the arguments to the datatype constructor, using the updated value in the appropriate slot
+        var ctor_args = new List<Expression>();
+        foreach (Formal d in ctor.Formals) {
+          Expression v;
+          if (updates.TryGetValue(d, out v)) {
+            ctor_args.Add(v);
+          } else {
+            ctor_args.Add(new ExprDotName(tok, tmpVarIdExpr, d.Name, null));
+          }
+        }
+
+        DatatypeValue ctor_call = new DatatypeValue(tok, ctor.EnclosingDatatype.Name, ctor.Name, ctor_args);
+
+        CasePattern tmpVarPat = new CasePattern(tok, tmpVarBv);
+        LetExpr let = new LetExpr(tok, new List<CasePattern>() { tmpVarPat }, new List<Expression>() { orig }, ctor_call, true);
+
+        ResolveExpression(let, opts);
+        return let;
+      }
+      return null;
+    }
+
     void ResolveMatchExpr(Expression expr, ResolveOpts opts) {
       var me = (MatchExpr)expr;
       DesugarMatchExprWithTupleExpression(me);
-- 
cgit v1.2.3


From 628acc07a07bd5516551dc2caa2c4612f70d2688 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Fri, 23 Oct 2015 18:30:11 -0700
Subject: Introduced new datatype update syntax:  D.(f := E) The old syntax,
 D[f := E], is still supported for a short while, but generates a warning
 about that syntax being deprecated. The new syntax also supports multiple
 updates:  D.(f := E0, g := E1, h := E2)

---
 Source/Dafny/Cloner.cs                          |   4 +
 Source/Dafny/Dafny.atg                          |  52 ++++++---
 Source/Dafny/DafnyAst.cs                        |  25 ++++-
 Source/Dafny/Parser.cs                          | 140 +++++++++++++++---------
 Source/Dafny/Printer.cs                         |  21 +++-
 Source/Dafny/Resolver.cs                        |  27 ++++-
 Source/Dafny/Rewriter.cs                        |   4 +
 Test/dafny0/DatatypeUpdate.dfy                  |  50 ++++++++-
 Test/dafny0/DatatypeUpdate.dfy.expect           |  13 ++-
 Test/dafny0/DatatypeUpdateResolution.dfy        |  20 ++++
 Test/dafny0/DatatypeUpdateResolution.dfy.expect |   5 +
 11 files changed, 280 insertions(+), 81 deletions(-)
 create mode 100644 Test/dafny0/DatatypeUpdateResolution.dfy
 create mode 100644 Test/dafny0/DatatypeUpdateResolution.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index 9a93a340..1c4275c5 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -323,6 +323,10 @@ namespace Microsoft.Dafny
         var e = (SeqUpdateExpr)expr;
         return new SeqUpdateExpr(Tok(e.tok), CloneExpr(e.Seq), CloneExpr(e.Index), CloneExpr(e.Value));
 
+      } else if (expr is DatatypeUpdateExpr) {
+        var e = (DatatypeUpdateExpr)expr;
+        return new DatatypeUpdateExpr(Tok(e.tok), CloneExpr(e.Root), e.Updates.ConvertAll(t => Tuple.Create(Tok(t.Item1), t.Item2, CloneExpr(t.Item3))));
+
       } else if (expr is FunctionCallExpr) {
         var e = (FunctionCallExpr)expr;
         return new FunctionCallExpr(Tok(e.tok), e.Name, CloneExpr(e.Receiver), e.OpenParen == null ? null : Tok(e.OpenParen), e.Args.ConvertAll(CloneExpr));
diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index 66dff8a2..5fa1085d 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -16,7 +16,7 @@ COMPILER Dafny
 /*--------------------------------------------------------------------------*/
 readonly Expression/*!*/ dummyExpr;
 readonly AssignmentRhs/*!*/ dummyRhs;
-readonly FrameExpression/*!*/ dummyFrameExpr;
+readonly FrameExpression/*!*/ dummyFrameExpr;  
 readonly Statement/*!*/ dummyStmt;
 readonly ModuleDecl theModule;
 readonly BuiltIns theBuiltIns;
@@ -2791,8 +2791,17 @@ Suffix<ref Expression e>
      Expression e0 = null;  Expression e1 = null;  Expression ee;  bool anyDots = false;
      List<Expression> multipleLengths = null; bool takeRest = false; // takeRest is relevant only if multipleLengths is non-null
      List<Expression> multipleIndices = null;
+     List<Tuple<IToken, string, Expression>> updates;
+     Expression v;
   .)
-  ( DotSuffix<out id, out x>                   (. if (x != null) {
+  ( "."
+    ( "("                                             (. x = t; updates = new List<Tuple<IToken, string, Expression>>(); .)
+        MemberBindingUpdate<out id, out v>            (. updates.Add(Tuple.Create(id, id.val, v)); .)
+        { "," MemberBindingUpdate<out id, out v>      (. updates.Add(Tuple.Create(id, id.val, v)); .)
+        }
+      ")"
+      (. e = new DatatypeUpdateExpr(x, e, updates); .)
+    | DotSuffix<out id, out x>                 (. if (x != null) {
                                                     // process id as a Suffix in its own right
                                                     e = new ExprDotName(id, e, id.val, null);
                                                     id = x;  // move to the next Suffix
@@ -2801,17 +2810,18 @@ Suffix<ref Expression e>
                                                .)
 
 
-    ( IF(IsGenericInstantiation())
-      (. typeArgs = new List<Type>(); .)
-      GenericInstantiation<typeArgs>
-    | HashCall<id, out openParen, out typeArgs, out args>
-    | /* empty */
+      ( IF(IsGenericInstantiation())
+        (. typeArgs = new List<Type>(); .)
+        GenericInstantiation<typeArgs>
+      | HashCall<id, out openParen, out typeArgs, out args>
+      | /* empty */
+      )
+      (. e = new ExprDotName(id, e, id.val, typeArgs);
+         if (openParen != null) {
+           e = new ApplySuffix(openParen, e, args);
+         }
+      .)
     )
-    (. e = new ExprDotName(id, e, id.val, typeArgs);
-       if (openParen != null) {
-         e = new ApplySuffix(openParen, e, args);
-       }
-    .)
   | "["                                        (. x = t; .)
       ( Expression<out ee, true, true>         (. e0 = ee; .)
         ( ".."                                 (. anyDots = true; .)
@@ -2969,10 +2979,10 @@ Ident<out IToken/*!*/ x>
   ident            (. x = t; .)
   .
 // Identifier or sequence of digits
-// Parse one of the following:
-//      . ident
-//      . digits
-//      . digits . digits
+// Parse one of the following, which are supposed to follow a ".":
+//        ident
+//        digits
+//        digits . digits
 // In the first two cases, x returns as the token for the ident/digits and y returns as null.
 // In the third case, x and y return as the tokens for the first and second digits.
 // This parser production solves a problem where the scanner might parse a real number instead
@@ -2982,7 +2992,6 @@ DotSuffix<out IToken x, out IToken y>
      x = Token.NoToken;
      y = null;
   .)
-  "."
   ( ident          (. x = t; .)
   | digits         (. x = t; .)
   | decimaldigits  (. x = t;
@@ -3008,6 +3017,15 @@ DotSuffix<out IToken x, out IToken y>
   | "reads"       (. x = t; .)
   )
   .
+MemberBindingUpdate<out IToken id, out Expression e>
+= (. id = Token.NoToken; e = dummyExpr; .)
+  ( ident          (. id = t; .)
+  | digits         (. id = t; .)
+  )
+  ":="
+  Expression<out e, true, true>
+  .
+
 // Identifier, disallowing leading underscores
 NoUSIdent<out IToken/*!*/ x>
 = (. Contract.Ensures(Contract.ValueAtReturn(out x) != null); .)
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 871d644d..16b29c2b 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -6204,7 +6204,6 @@ namespace Microsoft.Dafny {
       }
     }
 
-
     public override IEnumerable<Expression> SubExpressions {
       get { yield return Obj; }
     }
@@ -7785,6 +7784,30 @@ namespace Microsoft.Dafny {
     }
   }
 
+  public class DatatypeUpdateExpr : ConcreteSyntaxExpression
+  {
+    public readonly Expression Root;
+    public readonly List<Tuple<IToken, string, Expression>> Updates;
+    public DatatypeUpdateExpr(IToken tok, Expression root, List<Tuple<IToken, string, Expression>> updates)
+      : base(tok) {
+      Contract.Requires(tok != null);
+      Contract.Requires(root != null);
+      Contract.Requires(updates != null);
+      Contract.Requires(updates.Count != 0);
+      Root = root;
+      Updates = updates;
+    }
+
+    public override IEnumerable<Expression> SubExpressions {
+      get {
+        yield return Root;
+        foreach (var update in Updates) {
+          yield return update.Item3;
+        }
+      }
+    }
+  }
+
 
   /// <summary>
   /// An AutoGeneratedExpression is simply a wrapper around an expression.  This expression tells the generation of hover text (in the Dafny IDE)
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index c79c1051..6a5f32ab 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -88,7 +88,7 @@ public class Parser {
 
 readonly Expression/*!*/ dummyExpr;
 readonly AssignmentRhs/*!*/ dummyRhs;
-readonly FrameExpression/*!*/ dummyFrameExpr;
+readonly FrameExpression/*!*/ dummyFrameExpr;  
 readonly Statement/*!*/ dummyStmt;
 readonly ModuleDecl theModule;
 readonly BuiltIns theBuiltIns;
@@ -3640,28 +3640,45 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression e0 = null;  Expression e1 = null;  Expression ee;  bool anyDots = false;
 		List<Expression> multipleLengths = null; bool takeRest = false; // takeRest is relevant only if multipleLengths is non-null
 		List<Expression> multipleIndices = null;
+		List<Tuple<IToken, string, Expression>> updates;
+		Expression v;
 		
 		if (la.kind == 27) {
-			DotSuffix(out id, out x);
-			if (x != null) {
-			 // process id as a Suffix in its own right
-			 e = new ExprDotName(id, e, id.val, null);
-			 id = x;  // move to the next Suffix
-			}
-			IToken openParen = null;  List<Type> typeArgs = null;  List<Expression> args = null;
-			
-			if (IsGenericInstantiation()) {
-				typeArgs = new List<Type>(); 
-				GenericInstantiation(typeArgs);
-			} else if (la.kind == 106) {
-				HashCall(id, out openParen, out typeArgs, out args);
+			Get();
+			if (la.kind == 50) {
+				Get();
+				x = t; updates = new List<Tuple<IToken, string, Expression>>(); 
+				MemberBindingUpdate(out id, out v);
+				updates.Add(Tuple.Create(id, id.val, v)); 
+				while (la.kind == 22) {
+					Get();
+					MemberBindingUpdate(out id, out v);
+					updates.Add(Tuple.Create(id, id.val, v)); 
+				}
+				Expect(51);
+				e = new DatatypeUpdateExpr(x, e, updates); 
 			} else if (StartOf(30)) {
-			} else SynErr(225);
-			e = new ExprDotName(id, e, id.val, typeArgs);
-			if (openParen != null) {
-			 e = new ApplySuffix(openParen, e, args);
-			}
-			
+				DotSuffix(out id, out x);
+				if (x != null) {
+				 // process id as a Suffix in its own right
+				 e = new ExprDotName(id, e, id.val, null);
+				 id = x;  // move to the next Suffix
+				}
+				IToken openParen = null;  List<Type> typeArgs = null;  List<Expression> args = null;
+				
+				if (IsGenericInstantiation()) {
+					typeArgs = new List<Type>(); 
+					GenericInstantiation(typeArgs);
+				} else if (la.kind == 106) {
+					HashCall(id, out openParen, out typeArgs, out args);
+				} else if (StartOf(31)) {
+				} else SynErr(225);
+				e = new ExprDotName(id, e, id.val, typeArgs);
+				if (openParen != null) {
+				 e = new ApplySuffix(openParen, e, args);
+				}
+				
+			} else SynErr(226);
 		} else if (la.kind == 48) {
 			Get();
 			x = t; 
@@ -3709,7 +3726,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 						multipleIndices.Add(ee);
 						
 					}
-				} else SynErr(226);
+				} else SynErr(227);
 			} else if (la.kind == 137) {
 				Get();
 				anyDots = true; 
@@ -3717,7 +3734,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					Expression(out ee, true, true);
 					e1 = ee; 
 				}
-			} else SynErr(227);
+			} else SynErr(228);
 			if (multipleIndices != null) {
 			 e = new MultiSelectExpr(x, e, multipleIndices);
 			 // make sure an array class with this dimensionality exists
@@ -3761,7 +3778,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			Expect(51);
 			e = new ApplySuffix(openParen, e, args); 
-		} else SynErr(228);
+		} else SynErr(229);
 	}
 
 	void ISetDisplayExpr(IToken/*!*/ setToken, bool finite, out Expression e) {
@@ -3803,7 +3820,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				}
 			}
 			Expect(51);
-		} else SynErr(229);
+		} else SynErr(230);
 		while (la.kind == 44 || la.kind == 45) {
 			if (la.kind == 44) {
 				Get();
@@ -3886,7 +3903,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			NamedExpr(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(230); break;
+		default: SynErr(231); break;
 		}
 	}
 
@@ -3900,8 +3917,8 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			GenericInstantiation(typeArgs);
 		} else if (la.kind == 106) {
 			HashCall(id, out openParen, out typeArgs, out args);
-		} else if (StartOf(30)) {
-		} else SynErr(231);
+		} else if (StartOf(31)) {
+		} else SynErr(232);
 		e = new NameSegment(id, id.val, typeArgs);
 		if (openParen != null) {
 		 e = new ApplySuffix(openParen, e, args);
@@ -3930,7 +3947,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			e = new SeqDisplayExpr(x, elements); 
 			Expect(49);
-		} else SynErr(232);
+		} else SynErr(233);
 	}
 
 	void MultiSetExpr(out Expression e) {
@@ -3954,7 +3971,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Expression(out e, true, true);
 			e = new MultiSetFormingExpr(x, e); 
 			Expect(51);
-		} else SynErr(233);
+		} else SynErr(234);
 	}
 
 	void ConstAtomExpression(out Expression e, bool allowSemi, bool allowLambda) {
@@ -4050,7 +4067,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			ParensExpression(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(234); break;
+		default: SynErr(235); break;
 		}
 	}
 
@@ -4079,7 +4096,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 n = BigInteger.Zero;
 			}
 			
-		} else SynErr(235);
+		} else SynErr(236);
 	}
 
 	void Dec(out Basetypes.BigDec d) {
@@ -4123,7 +4140,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 30) {
 			Get();
 			oneShot = true; 
-		} else SynErr(236);
+		} else SynErr(237);
 	}
 
 	void MapLiteralExpressions(out List<ExpressionPair> elements) {
@@ -4181,12 +4198,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				cases.Add(c); 
 			}
 			Expect(47);
-		} else if (StartOf(31)) {
+		} else if (StartOf(32)) {
 			while (la.kind == _case) {
 				CaseExpression(out c, allowSemi, allowLambda);
 				cases.Add(c); 
 			}
-		} else SynErr(237);
+		} else SynErr(238);
 		e = new MatchExpr(x, e, cases, usesOptionalBrace); 
 	}
 
@@ -4204,7 +4221,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 124 || la.kind == 125) {
 			Exists();
 			x = t; 
-		} else SynErr(238);
+		} else SynErr(239);
 		QuantifierDomain(out bvars, out attrs, out range);
 		QSep();
 		Expression(out body, allowSemi, allowLambda);
@@ -4253,7 +4270,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			AssumeStmt(out s);
 		} else if (la.kind == 32) {
 			CalcStmt(out s);
-		} else SynErr(239);
+		} else SynErr(240);
 	}
 
 	void LetExpr(out Expression e, bool allowSemi, bool allowLambda) {
@@ -4297,7 +4314,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 }
 			}
 			
-		} else SynErr(240);
+		} else SynErr(241);
 		Expression(out e, false, true);
 		letRHSs.Add(e); 
 		while (la.kind == 22) {
@@ -4357,7 +4374,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				arguments.Add(pat); 
 			}
 			Expect(51);
-		} else SynErr(241);
+		} else SynErr(242);
 		Expect(29);
 		Expression(out body, allowSemi, allowLambda);
 		c = new MatchCaseExpr(x, name, arguments, body); 
@@ -4383,12 +4400,24 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expect(51);
 	}
 
+	void MemberBindingUpdate(out IToken id, out Expression e) {
+		id = Token.NoToken; e = dummyExpr; 
+		if (la.kind == 1) {
+			Get();
+			id = t; 
+		} else if (la.kind == 2) {
+			Get();
+			id = t; 
+		} else SynErr(243);
+		Expect(95);
+		Expression(out e, true, true);
+	}
+
 	void DotSuffix(out IToken x, out IToken y) {
 		Contract.Ensures(Contract.ValueAtReturn(out x) != null);
 		x = Token.NoToken;
 		y = null;
 		
-		Expect(27);
 		if (la.kind == 1) {
 			Get();
 			x = t; 
@@ -4422,7 +4451,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 44) {
 			Get();
 			x = t; 
-		} else SynErr(242);
+		} else SynErr(244);
 	}
 
 
@@ -4467,6 +4496,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		{_x,_x,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
 		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
 		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
+		{_x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
 		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x},
 		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x}
 
@@ -4725,20 +4755,22 @@ public class Errors {
 			case 226: s = "invalid Suffix"; break;
 			case 227: s = "invalid Suffix"; break;
 			case 228: s = "invalid Suffix"; break;
-			case 229: s = "invalid LambdaExpression"; break;
-			case 230: s = "invalid EndlessExpression"; break;
-			case 231: s = "invalid NameSegment"; break;
-			case 232: s = "invalid DisplayExpr"; break;
-			case 233: s = "invalid MultiSetExpr"; break;
-			case 234: s = "invalid ConstAtomExpression"; break;
-			case 235: s = "invalid Nat"; break;
-			case 236: s = "invalid LambdaArrow"; break;
-			case 237: s = "invalid MatchExpression"; break;
-			case 238: s = "invalid QuantifierGuts"; break;
-			case 239: s = "invalid StmtInExpr"; break;
-			case 240: s = "invalid LetExpr"; break;
-			case 241: s = "invalid CaseExpression"; break;
-			case 242: s = "invalid DotSuffix"; break;
+			case 229: s = "invalid Suffix"; break;
+			case 230: s = "invalid LambdaExpression"; break;
+			case 231: s = "invalid EndlessExpression"; break;
+			case 232: s = "invalid NameSegment"; break;
+			case 233: s = "invalid DisplayExpr"; break;
+			case 234: s = "invalid MultiSetExpr"; break;
+			case 235: s = "invalid ConstAtomExpression"; break;
+			case 236: s = "invalid Nat"; break;
+			case 237: s = "invalid LambdaArrow"; break;
+			case 238: s = "invalid MatchExpression"; break;
+			case 239: s = "invalid QuantifierGuts"; break;
+			case 240: s = "invalid StmtInExpr"; break;
+			case 241: s = "invalid LetExpr"; break;
+			case 242: s = "invalid CaseExpression"; break;
+			case 243: s = "invalid MemberBindingUpdate"; break;
+			case 244: s = "invalid DotSuffix"; break;
 
 			default: s = "error " + n; break;
 		}
diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index 5e69bce8..54de4905 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -1509,7 +1509,26 @@ namespace Microsoft.Dafny {
           PrintExpression(e.Value, false);
           wr.Write("]");
           if (parensNeeded) { wr.Write(")"); }
-        }
+        }
+
+      } else if (expr is DatatypeUpdateExpr) {
+        var e = (DatatypeUpdateExpr)expr;
+        // determine if parens are needed
+        int opBindingStrength = 0x70;
+        bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
+
+        if (parensNeeded) { wr.Write("("); }
+        PrintExpr(e.Root, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent);
+        wr.Write(".(");
+        var sep = "";
+        foreach (var update in e.Updates) {
+          wr.Write("{0}{1} := ", sep, update.Item2);
+          PrintExpression(update.Item3, false);
+          sep = ", ";
+        }
+        wr.Write(")");
+        if (parensNeeded) { wr.Write(")"); }
+
       } else if (expr is ApplyExpr) {
         var e = (ApplyExpr)expr;
         // determine if parens are needed
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 3cb98f65..74ff60e7 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -7632,12 +7632,27 @@ namespace Microsoft.Dafny
           }
           var let = ResolveDatatypeUpdate(expr.tok, eIter, e.Seq.Type.AsDatatype, memberUpdates, true, opts);
           if (let != null) {
+            reporter.Warning(MessageSource.Resolver, expr.tok, "datatype update syntax D[f := E] is deprecated; the new syntax is D.(f := E)");
             e.ResolvedUpdateExpr = let;
             expr.Type = e.Seq.Type;
           }
 
         } else {
-          reporter.Error(MessageSource.Resolver, expr, "update requires a sequence, map, or datatype (got {0})", e.Seq.Type);
+          reporter.Error(MessageSource.Resolver, expr, "update requires a sequence, map, multiset, or datatype (got {0})", e.Seq.Type);
+        }
+
+      } else if (expr is DatatypeUpdateExpr) {
+        var e = (DatatypeUpdateExpr)expr;
+        ResolveExpression(e.Root, opts);
+        var ty = e.Root.Type;
+        if (!ty.IsDatatype) {
+          reporter.Error(MessageSource.Resolver, expr, "datatype update expression requires a root expression of a datatype (got {0})", ty);
+        } else {
+          var let = ResolveDatatypeUpdate(expr.tok, e.Root, ty.AsDatatype, e.Updates, false, opts);
+          if (let != null) {
+            e.ResolvedExpression = let;
+            expr.Type = ty;
+          }
         }
 
       } else if (expr is FunctionCallExpr) {
@@ -8080,9 +8095,9 @@ namespace Microsoft.Dafny
     /// <summary>
     /// Attempts to produce a let expression from the given datatype updates.  Returns that let expression upon success, and null otherwise.
     /// </summary>
-    Expression ResolveDatatypeUpdate(IToken tok, Expression orig, DatatypeDecl dt, List<Tuple<IToken, string, Expression>> memberUpdates, bool sequentialUpdates, ResolveOpts opts) {
+    Expression ResolveDatatypeUpdate(IToken tok, Expression root, DatatypeDecl dt, List<Tuple<IToken, string, Expression>> memberUpdates, bool sequentialUpdates, ResolveOpts opts) {
       Contract.Requires(tok != null);
-      Contract.Requires(orig != null);
+      Contract.Requires(root != null);
       Contract.Requires(dt != null);
       Contract.Requires(memberUpdates != null);
       Contract.Requires(opts != null);
@@ -8129,13 +8144,13 @@ namespace Microsoft.Dafny
       if (ctor != null) {
         // Rewrite an update of the form "dt[dtor := E]" to be "let d' := dt in dtCtr(E, d'.dtor2, d'.dtor3,...)"
         // Wrapping it in a let expr avoids exponential growth in the size of the expression
-        // More generally, rewrite "E0[dtor1 := E1][dtor2 := E2]...[dtorn := En]" where "E0" is "orig" to
+        // More generally, rewrite "E0[dtor1 := E1][dtor2 := E2]...[dtorn := En]" where "E0" is "root" to
         //   "let d' := E0 in dtCtr(...mixtures of Ek and d'.dtorj...)"
 
         // Create a unique name for d', the variable we introduce in the let expression
         var tmpName = FreshTempVarName("dt_update_tmp#", opts.codeContext);
         var tmpVarIdExpr = new IdentifierExpr(tok, tmpName);
-        var tmpVarBv = new BoundVar(tok, tmpName, orig.Type);
+        var tmpVarBv = new BoundVar(tok, tmpName, root.Type);
 
         // Build the arguments to the datatype constructor, using the updated value in the appropriate slot
         var ctor_args = new List<Expression>();
@@ -8151,7 +8166,7 @@ namespace Microsoft.Dafny
         DatatypeValue ctor_call = new DatatypeValue(tok, ctor.EnclosingDatatype.Name, ctor.Name, ctor_args);
 
         CasePattern tmpVarPat = new CasePattern(tok, tmpVarBv);
-        LetExpr let = new LetExpr(tok, new List<CasePattern>() { tmpVarPat }, new List<Expression>() { orig }, ctor_call, true);
+        LetExpr let = new LetExpr(tok, new List<CasePattern>() { tmpVarPat }, new List<Expression>() { root }, ctor_call, true);
 
         ResolveExpression(let, opts);
         return let;
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index fa5fdfbe..39c8f667 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -959,6 +959,10 @@ namespace Microsoft.Dafny
         reqs.AddRange(generateAutoReqs(e.Seq));
         reqs.AddRange(generateAutoReqs(e.Index));
         reqs.AddRange(generateAutoReqs(e.Value));
+      } else if (expr is DatatypeUpdateExpr) {
+        foreach (var ee in expr.SubExpressions) {
+          reqs.AddRange(generateAutoReqs(ee));
+        }
       } else if (expr is FunctionCallExpr) {
         FunctionCallExpr e = (FunctionCallExpr)expr;
 
diff --git a/Test/dafny0/DatatypeUpdate.dfy b/Test/dafny0/DatatypeUpdate.dfy
index 76cce5ce..b7905928 100644
--- a/Test/dafny0/DatatypeUpdate.dfy
+++ b/Test/dafny0/DatatypeUpdate.dfy
@@ -1,6 +1,6 @@
 // RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
-
+module OldSyntax {
 datatype MyDataType = MyConstructor(myint:int, mybool:bool) 
                     | MyOtherConstructor(otherbool:bool) 
                     | MyNumericConstructor(42:int)
@@ -35,3 +35,51 @@ method UpdateNumNam(nn: NumericNames, y: int) returns (pp: NumericNames)
 {
   pp := nn[010 := y];  // not to be confused with a field name 10
 }
+}
+
+module NewSyntax {
+datatype MyDataType = MyConstructor(myint:int, mybool:bool) 
+                    | MyOtherConstructor(otherbool:bool) 
+                    | MyNumericConstructor(42:int)
+
+method test(foo:MyDataType, x:int) returns (abc:MyDataType, def:MyDataType, ghi:MyDataType, jkl:MyDataType)
+    requires foo.MyConstructor?;
+    ensures abc == foo.(myint := x + 2);
+    ensures def == foo.(otherbool := !foo.mybool);
+    ensures ghi == foo.(myint := 2).(mybool := false);
+    //ensures jkl == foo.(non_destructor := 5);      // Resolution error: no non_destructor in MyDataType
+    ensures jkl == foo.(42 := 7);
+{
+    abc := MyConstructor(x + 2, foo.mybool); 
+    abc := foo.(myint := x + 2);
+    def := MyOtherConstructor(!foo.mybool);
+    ghi := MyConstructor(2, false);
+    jkl := foo.(42 := 7);
+
+    assert abc.(myint := abc.myint - 2) == foo.(myint := x);
+}
+
+// regression test (for a previous bug in the Translator.Substituter):
+datatype Dt = Ctor(x: int, y: bool)
+function F(d: Dt): Dt
+{
+  d.(x := 5)
+}
+
+datatype NumericNames = NumNam(010: int, 10: real, f: bool)
+
+method UpdateNumNam(nn: NumericNames, y: int) returns (pp: NumericNames)
+{
+  pp := nn.(010 := y);  // not to be confused with a field name 10
+}
+
+method MultipleUpdates(nn: NumericNames, y: int) returns (pp: NumericNames)
+  ensures pp.010 == y
+{
+  if * {
+    pp := nn.(10 := 0.10, 010 := y);
+  } else {
+    pp := nn.(010 := y, f := true, 10 := 0.10);
+  }
+}
+}
diff --git a/Test/dafny0/DatatypeUpdate.dfy.expect b/Test/dafny0/DatatypeUpdate.dfy.expect
index 790f6509..9a924214 100644
--- a/Test/dafny0/DatatypeUpdate.dfy.expect
+++ b/Test/dafny0/DatatypeUpdate.dfy.expect
@@ -1,2 +1,13 @@
+DatatypeUpdate.dfy(10,22): Warning: datatype update syntax D[f := E] is deprecated; the new syntax is D.(f := E)
+DatatypeUpdate.dfy(11,22): Warning: datatype update syntax D[f := E] is deprecated; the new syntax is D.(f := E)
+DatatypeUpdate.dfy(12,22): Warning: datatype update syntax D[f := E] is deprecated; the new syntax is D.(f := E)
+DatatypeUpdate.dfy(12,34): Warning: datatype update syntax D[f := E] is deprecated; the new syntax is D.(f := E)
+DatatypeUpdate.dfy(14,22): Warning: datatype update syntax D[f := E] is deprecated; the new syntax is D.(f := E)
+DatatypeUpdate.dfy(17,14): Warning: datatype update syntax D[f := E] is deprecated; the new syntax is D.(f := E)
+DatatypeUpdate.dfy(20,14): Warning: datatype update syntax D[f := E] is deprecated; the new syntax is D.(f := E)
+DatatypeUpdate.dfy(22,14): Warning: datatype update syntax D[f := E] is deprecated; the new syntax is D.(f := E)
+DatatypeUpdate.dfy(22,45): Warning: datatype update syntax D[f := E] is deprecated; the new syntax is D.(f := E)
+DatatypeUpdate.dfy(29,3): Warning: datatype update syntax D[f := E] is deprecated; the new syntax is D.(f := E)
+DatatypeUpdate.dfy(36,10): Warning: datatype update syntax D[f := E] is deprecated; the new syntax is D.(f := E)
 
-Dafny program verifier finished with 5 verified, 0 errors
+Dafny program verifier finished with 12 verified, 0 errors
diff --git a/Test/dafny0/DatatypeUpdateResolution.dfy b/Test/dafny0/DatatypeUpdateResolution.dfy
new file mode 100644
index 00000000..26142fa8
--- /dev/null
+++ b/Test/dafny0/DatatypeUpdateResolution.dfy
@@ -0,0 +1,20 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+datatype MyDataType = MyConstructor(myint:int, mybool:bool) 
+                    | MyOtherConstructor(otherbool:bool) 
+                    | MyNumericConstructor(42:int)
+datatype SomeOtherType = S_O_T(non_destructor: int)
+
+method test(foo:MyDataType, x:int) returns (abc:MyDataType, def:MyDataType, ghi:MyDataType, jkl:MyDataType)
+  requires foo.MyConstructor?
+  ensures abc == foo.(myint := x + 2)
+  ensures jkl == foo.(non_destructor := 5)      // error: 'non_destructor' is not a destructor in MyDataType
+  ensures jkl == foo.(mybool := true, 40 := 100, myint := 200)  // error: '40' is not a destructor
+{
+  abc := MyConstructor(x + 2, foo.mybool).(myint := x + 3);
+  abc := foo.(myint := x + 2, mybool := true).(mybool := false);  // allowed
+  def := MyOtherConstructor(!foo.mybool).(otherbool := true, otherbool := true);  // error: duplicated member
+  ghi := MyConstructor(2, false).(otherbool := true);  // allowed, and will generate verification error
+  jkl := foo.(42 := 7, otherbool := true);  // error: members are from different constructors
+}
diff --git a/Test/dafny0/DatatypeUpdateResolution.dfy.expect b/Test/dafny0/DatatypeUpdateResolution.dfy.expect
new file mode 100644
index 00000000..db3e1fe2
--- /dev/null
+++ b/Test/dafny0/DatatypeUpdateResolution.dfy.expect
@@ -0,0 +1,5 @@
+DatatypeUpdateResolution.dfy(12,22): Error: member 'non_destructor' does not exist in datatype 'MyDataType'
+DatatypeUpdateResolution.dfy(13,38): Error: member '40' does not exist in datatype 'MyDataType'
+DatatypeUpdateResolution.dfy(17,61): Error: duplicate update member 'otherbool'
+DatatypeUpdateResolution.dfy(19,23): Error: updated datatype members must belong to the same constructor ('otherbool' belongs to 'MyOtherConstructor' and '42' belongs to 'MyNumericConstructor'
+4 resolution/type errors detected in DatatypeUpdateResolution.dfy
-- 
cgit v1.2.3


From 736969063f99babb854a2ac7c2c2b0d11a8fc253 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Sat, 24 Oct 2015 17:43:46 -0700
Subject: In method and iterator specifications, inline top-level predicates
 (except protected predicated in cross-module calls) like in other places.

---
 Source/Dafny/Translator.cs                         | 166 +++++++++++----------
 Test/dafny0/TriggerInPredicate.dfy.expect          |   1 +
 Test/dafny2/SnapshotableTrees.dfy.expect           |   9 +-
 .../triggers-prevent-some-inlining.dfy.expect      |   2 +
 4 files changed, 98 insertions(+), 80 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 7d3f570d..172005cc 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -1466,13 +1466,15 @@ namespace Microsoft.Dafny {
 
     /// <summary>
     /// Returns true if the body of function "f" is available in module "context".
-    /// This happens when "f" has a body, "f" is not opaque, and either "f" is declared
-    /// in module "context" or "f" is not protected.
+    /// This happens when the following conditions all hold:
+    ///   - "f" has a body
+    ///   - "f" is not opaque
+    ///   - "f" is declared as protected, then "context" is the current module and parameter "revealProtectedBody" is passed in as "true".
     /// </summary>
-    static bool FunctionBodyIsAvailable(Function f, ModuleDefinition context) {
+    static bool FunctionBodyIsAvailable(Function f, ModuleDefinition context, bool revealProtectedBody) {
       Contract.Requires(f != null);
       Contract.Requires(context != null);
-      return f.Body != null && !IsOpaqueFunction(f) && (f.EnclosingClass.Module == context || !f.IsProtected);
+      return f.Body != null && !IsOpaqueFunction(f) && (!f.IsProtected || (revealProtectedBody && f.EnclosingClass.Module == context));
     }
     static bool IsOpaqueFunction(Function f) {
       Contract.Requires(f != null);
@@ -1571,8 +1573,7 @@ namespace Microsoft.Dafny {
             req.Add(Requires(p.E.tok, true, etran.TrExpr(p.E), null, comment));
             comment = null;
           } else {
-            bool splitHappened;  // we actually don't care
-            foreach (var s in TrSplitExpr(p.E, etran, kind == MethodTranslationKind.InterModuleCall ? 0 : int.MaxValue, true, out splitHappened)) {
+            foreach (var s in TrSplitExprForMethodSpec(p.E, etran, kind)) {
               if (kind == MethodTranslationKind.IntraModuleCall && RefinementToken.IsInherited(s.E.tok, currentModule)) {
                 // this precondition was inherited into this module, so just ignore it
               } else {
@@ -1589,8 +1590,7 @@ namespace Microsoft.Dafny {
             ens.Add(Ensures(p.E.tok, true, etran.TrExpr(p.E), null, comment));
             comment = null;
           } else {
-            bool splitHappened;  // we actually don't care
-            foreach (var s in TrSplitExpr(p.E, etran, kind == MethodTranslationKind.InterModuleCall ? 0 : int.MaxValue, true, out splitHappened)) {
+            foreach (var s in TrSplitExprForMethodSpec(p.E, etran, kind)) {
               if (kind == MethodTranslationKind.Implementation && RefinementToken.IsInherited(s.E.tok, currentModule)) {
                 // this postcondition was inherited into this module, so just ignore it
               } else {
@@ -2966,7 +2966,7 @@ namespace Microsoft.Dafny {
         {
             var functionHeight = currentModule.CallGraph.GetSCCRepresentativeId(f);
             var splits = new List<SplitExprInfo>();
-            bool splitHappened/*we actually don't care*/ = TrSplitExpr(p, splits, true, functionHeight,false, etran);
+            bool splitHappened/*we actually don't care*/ = TrSplitExpr(p, splits, true, functionHeight, true, false, etran);
             foreach (var s in splits)
             {
                 if (s.IsChecked && !RefinementToken.IsInherited(s.E.tok, currentModule))
@@ -3975,7 +3975,7 @@ namespace Microsoft.Dafny {
       foreach (Expression p in f.Ens) {
         var functionHeight = currentModule.CallGraph.GetSCCRepresentativeId(f);
         var splits = new List<SplitExprInfo>();
-        bool splitHappened /*we actually don't care*/ = TrSplitExpr(p, splits, true, functionHeight, true, etran);
+        bool splitHappened /*we actually don't care*/ = TrSplitExpr(p, splits, true, functionHeight, true, true, etran);
         foreach (var s in splits) {
           if (s.IsChecked && !RefinementToken.IsInherited(s.E.tok, currentModule)) {
             ens.Add(Ensures(s.E.tok, false, s.E, null, null));
@@ -6233,8 +6233,7 @@ namespace Microsoft.Dafny {
             req.Add(Requires(p.E.tok, true, etran.TrExpr(p.E), null, comment));
             comment = null;
           } else {
-            bool splitHappened;  // we actually don't care
-            foreach (var s in TrSplitExpr(p.E, etran, kind == MethodTranslationKind.InterModuleCall ? 0 : int.MaxValue, true /* kind == MethodTranslationKind.Implementation */, out splitHappened)) {
+            foreach (var s in TrSplitExprForMethodSpec(p.E, etran, kind)) {
               if (s.IsOnlyChecked && bodyKind) {
                 // don't include in split
               } else if (s.IsOnlyFree && !bodyKind) {
@@ -6254,8 +6253,7 @@ namespace Microsoft.Dafny {
           if (p.IsFree && !DafnyOptions.O.DisallowSoundnessCheating) {
             ens.Add(Ensures(p.E.tok, true, etran.TrExpr(p.E), null, null));
           } else {
-            bool splitHappened;  // we actually don't care
-            foreach (var s in TrSplitExpr(p.E, etran, kind == MethodTranslationKind.InterModuleCall ? 0 : int.MaxValue, true /* kind == MethodTranslationKind.Implementation */ , out splitHappened)) {
+            foreach (var s in TrSplitExprForMethodSpec(p.E, etran, kind)) {
               var post = s.E;
               if (kind == MethodTranslationKind.Implementation && RefinementToken.IsInherited(s.E.tok, currentModule)) {
                 // this postcondition was inherited into this module, so make it into the form "$_reverifyPost ==> s.E"
@@ -11115,7 +11113,7 @@ namespace Microsoft.Dafny {
           result = translator.CondApplyUnbox(e.tok, result, e.Function.ResultType, e.Type);
           
           bool callIsLit = argsAreLit 
-            && Translator.FunctionBodyIsAvailable(e.Function, translator.currentModule)
+            && Translator.FunctionBodyIsAvailable(e.Function, translator.currentModule, true)
             && !e.Function.Reads.Any(); // Function could depend on external values
           if (callIsLit) {
             result = MaybeLit(result, ty);
@@ -12754,18 +12752,20 @@ namespace Microsoft.Dafny {
       Contract.Ensures(Contract.Result<List<SplitExprInfo>>() != null);
 
       var splits = new List<SplitExprInfo>();
-      splitHappened = TrSplitExpr(expr, splits, true, int.MaxValue, apply_induction, etran);
+      splitHappened = TrSplitExpr(expr, splits, true, int.MaxValue, true, apply_induction, etran);
       return splits;
     }
 
-    List<SplitExprInfo/*!*/>/*!*/ TrSplitExpr(Expression expr, ExpressionTranslator etran, int heightLimit, bool apply_induction, out bool splitHappened)
+    List<SplitExprInfo> TrSplitExprForMethodSpec(Expression expr, ExpressionTranslator etran, MethodTranslationKind kind)
     {
       Contract.Requires(expr != null);
       Contract.Requires(etran != null);
       Contract.Ensures(Contract.Result<List<SplitExprInfo>>() != null);
 
       var splits = new List<SplitExprInfo>();
-      splitHappened = TrSplitExpr(expr, splits, true, heightLimit, apply_induction, etran);
+      var apply_induction = true;/*kind == MethodTranslationKind.Implementation*/;
+      bool splitHappened;  // we don't actually care
+      splitHappened = TrSplitExpr(expr, splits, true, int.MaxValue, kind != MethodTranslationKind.InterModuleCall, apply_induction, etran);
       return splits;
     }
 
@@ -12795,7 +12795,7 @@ namespace Microsoft.Dafny {
     /// if its body is available in the current context and its height is less than "heightLimit" (if "heightLimit" is
     /// passed in as 0, then no functions will be inlined).
     /// </summary>
-    bool TrSplitExpr(Expression expr, List<SplitExprInfo/*!*/>/*!*/ splits, bool position, int heightLimit, bool apply_induction, ExpressionTranslator etran) {
+    bool TrSplitExpr(Expression expr, List<SplitExprInfo/*!*/>/*!*/ splits, bool position, int heightLimit, bool inlineProtectedFunctions, bool apply_induction, ExpressionTranslator etran) {
       Contract.Requires(expr != null);
       Contract.Requires(expr.Type.IsBoolType || (expr is BoxingCastExpr && ((BoxingCastExpr)expr).E.Type.IsBoolType));
       Contract.Requires(splits != null);
@@ -12804,7 +12804,7 @@ namespace Microsoft.Dafny {
       if (expr is BoxingCastExpr) {
         var bce = (BoxingCastExpr)expr;
         var ss = new List<SplitExprInfo>();
-        if (TrSplitExpr(bce.E, ss, position, heightLimit, apply_induction, etran)) {
+        if (TrSplitExpr(bce.E, ss, position, heightLimit, inlineProtectedFunctions, apply_induction, etran)) {
           foreach (var s in ss) {
             splits.Add(new SplitExprInfo(s.Kind, CondApplyBox(s.E.tok, s.E, bce.FromType, bce.ToType)));
           }
@@ -12813,22 +12813,22 @@ namespace Microsoft.Dafny {
 
       } else if (expr is ConcreteSyntaxExpression) {
         var e = (ConcreteSyntaxExpression)expr;
-        return TrSplitExpr(e.ResolvedExpression, splits, position, heightLimit, apply_induction, etran);
+        return TrSplitExpr(e.ResolvedExpression, splits, position, heightLimit, inlineProtectedFunctions, apply_induction, etran);
 
       } else if (expr is LetExpr) {
         var e = (LetExpr)expr;
         if (e.Exact) {
-          return TrSplitExpr(etran.GetSubstitutedBody(e), splits, position, heightLimit, apply_induction, etran);
+          return TrSplitExpr(etran.GetSubstitutedBody(e), splits, position, heightLimit, inlineProtectedFunctions, apply_induction, etran);
         } else {
           var d = LetDesugaring(e);
-          return TrSplitExpr(d, splits, position, heightLimit, apply_induction, etran);
+          return TrSplitExpr(d, splits, position, heightLimit, inlineProtectedFunctions, apply_induction, etran);
         }
 
       } else if (expr is UnaryOpExpr) {
         var e = (UnaryOpExpr)expr;
         if (e.Op == UnaryOpExpr.Opcode.Not) {
           var ss = new List<SplitExprInfo>();
-          if (TrSplitExpr(e.E, ss, !position, heightLimit, apply_induction, etran)) {
+          if (TrSplitExpr(e.E, ss, !position, heightLimit, inlineProtectedFunctions, apply_induction, etran)) {
             foreach (var s in ss) {
               splits.Add(new SplitExprInfo(s.Kind, Bpl.Expr.Unary(s.E.tok, UnaryOperator.Opcode.Not, s.E)));
             }
@@ -12839,13 +12839,13 @@ namespace Microsoft.Dafny {
       } else if (expr is BinaryExpr) {
         var bin = (BinaryExpr)expr;
         if (position && bin.ResolvedOp == BinaryExpr.ResolvedOpcode.And) {
-          TrSplitExpr(bin.E0, splits, position, heightLimit, apply_induction, etran);
-          TrSplitExpr(bin.E1, splits, position, heightLimit, apply_induction, etran);
+          TrSplitExpr(bin.E0, splits, position, heightLimit, inlineProtectedFunctions, apply_induction, etran);
+          TrSplitExpr(bin.E1, splits, position, heightLimit, inlineProtectedFunctions, apply_induction, etran);
           return true;
 
         } else  if (!position && bin.ResolvedOp == BinaryExpr.ResolvedOpcode.Or) {
-          TrSplitExpr(bin.E0, splits, position, heightLimit, apply_induction, etran);
-          TrSplitExpr(bin.E1, splits, position, heightLimit, apply_induction, etran);
+          TrSplitExpr(bin.E0, splits, position, heightLimit, inlineProtectedFunctions, apply_induction, etran);
+          TrSplitExpr(bin.E1, splits, position, heightLimit, inlineProtectedFunctions, apply_induction, etran);
           return true;
 
         } else if (bin.ResolvedOp == BinaryExpr.ResolvedOpcode.Imp) {
@@ -12853,14 +12853,14 @@ namespace Microsoft.Dafny {
           if (position) {
             var lhs = etran.TrExpr(bin.E0);
             var ss = new List<SplitExprInfo>();
-            TrSplitExpr(bin.E1, ss, position, heightLimit, apply_induction, etran);
+            TrSplitExpr(bin.E1, ss, position, heightLimit, inlineProtectedFunctions, apply_induction, etran);
             foreach (var s in ss) {
               // as the source location in the following implication, use that of the translated "s"
               splits.Add(new SplitExprInfo(s.Kind, Bpl.Expr.Binary(s.E.tok, BinaryOperator.Opcode.Imp, lhs, s.E)));
             }
           } else {
             var ss = new List<SplitExprInfo>();
-            TrSplitExpr(bin.E0, ss, !position, heightLimit, apply_induction, etran);
+            TrSplitExpr(bin.E0, ss, !position, heightLimit, inlineProtectedFunctions, apply_induction, etran);
             var rhs = etran.TrExpr(bin.E1);
             foreach (var s in ss) {
               // as the source location in the following implication, use that of the translated "s"
@@ -12907,8 +12907,8 @@ namespace Microsoft.Dafny {
         var ssThen = new List<SplitExprInfo>();
         var ssElse = new List<SplitExprInfo>();
 
-        TrSplitExpr(ite.Thn, ssThen, position, heightLimit, apply_induction, etran);
-        TrSplitExpr(ite.Els, ssElse, position, heightLimit, apply_induction, etran);
+        TrSplitExpr(ite.Thn, ssThen, position, heightLimit, inlineProtectedFunctions, apply_induction, etran);
+        TrSplitExpr(ite.Els, ssElse, position, heightLimit, inlineProtectedFunctions, apply_induction, etran);
 
         var op = position ? BinaryOperator.Opcode.Imp : BinaryOperator.Opcode.And;
         var test = etran.TrExpr(ite.Test);
@@ -12934,14 +12934,14 @@ namespace Microsoft.Dafny {
         if (position) {
           var conclusion = etran.TrExpr(e.GetSConclusion());
           var ss = new List<SplitExprInfo>();
-          TrSplitExpr(e.E, ss, position, heightLimit, apply_induction, etran);
+          TrSplitExpr(e.E, ss, position, heightLimit, inlineProtectedFunctions, apply_induction, etran);
           foreach (var s in ss) {
             // as the source location in the following implication, use that of the translated "s"
             splits.Add(new SplitExprInfo(s.Kind, Bpl.Expr.Binary(s.E.tok, BinaryOperator.Opcode.Imp, conclusion, s.E)));
           }
         } else {
           var ss = new List<SplitExprInfo>();
-          TrSplitExpr(e.GetSConclusion(), ss, !position, heightLimit, apply_induction, etran);
+          TrSplitExpr(e.GetSConclusion(), ss, !position, heightLimit, inlineProtectedFunctions, apply_induction, etran);
           var rhs = etran.TrExpr(e.E);
           foreach (var s in ss) {
             // as the source location in the following implication, use that of the translated "s"
@@ -12952,7 +12952,7 @@ namespace Microsoft.Dafny {
 
       } else if (expr is OldExpr) {
         var e = (OldExpr)expr;
-        return TrSplitExpr(e.E, splits, position, heightLimit, apply_induction, etran.Old);
+        return TrSplitExpr(e.E, splits, position, heightLimit, inlineProtectedFunctions, apply_induction, etran.Old);
 
       } else if (expr is FunctionCallExpr && position) {
         var fexp = (FunctionCallExpr)expr;
@@ -12961,22 +12961,17 @@ namespace Microsoft.Dafny {
         var module = f.EnclosingClass.Module;
         var functionHeight = module.CallGraph.GetSCCRepresentativeId(f);
 
-        if (module == currentModule && functionHeight < heightLimit && f.Body != null && !(f.Body.Resolved is MatchExpr)) {
+        if (functionHeight < heightLimit && f.Body != null && !(f.Body.Resolved is MatchExpr)) {
           if (RefinementToken.IsInherited(fexp.tok, currentModule) &&
               f is Predicate && ((Predicate)f).BodyOrigin == Predicate.BodyOriginKind.DelayedDefinition &&
               (codeContext == null || !codeContext.MustReverify)) {
             // The function was inherited as body-less but is now given a body. Don't inline the body (since, apparently, everything
             // that needed to be proved about the function was proved already in the previous module, even without the body definition).
-          } else if (!FunctionBodyIsAvailable(f, currentModule)) {
+          } else if (!FunctionBodyIsAvailable(f, currentModule, inlineProtectedFunctions)) {
             // Don't inline opaque functions or foreign protected functions
           } else if (Attributes.Contains(f.Attributes, "no_inline")) {
             // User manually prevented inlining
-          } else if (CanSafelyInline(fexp, f)) {
-            // inline this body
-            var body = GetSubstitutedBody(fexp, f, false);
-            var typeSpecializedBody = GetSubstitutedBody(fexp, f, true);
-            var typeSpecializedResultType = Resolver.SubstType(f.ResultType, fexp.TypeArgumentSubstitutions);
-
+          } else {
             // Produce, for a "body" split into b0, b1, b2:
             //     checked F#canCall(args) ==> F(args) || b0
             //     checked F#canCall(args) ==> F(args) || b1
@@ -12999,49 +12994,62 @@ namespace Microsoft.Dafny {
             // F(args)
             fargs = etran.TrExpr(fexp);
 
-            // recurse on body
-            var ss = new List<SplitExprInfo>();
-            TrSplitExpr(typeSpecializedBody, ss, position, functionHeight, apply_induction, etran);
-            var needsTokenAdjust = TrSplitNeedsTokenAdjustment(typeSpecializedBody);
-            foreach (var s in ss) {
-              if (s.IsChecked) {
-                var unboxedConjunct = CondApplyUnbox(s.E.tok, s.E, typeSpecializedResultType, expr.Type);
-                var bodyOrConjunct = Bpl.Expr.Or(fargs, unboxedConjunct);
-                var tok = needsTokenAdjust ? (IToken)new ForceCheckToken(typeSpecializedBody.tok) : (IToken)new NestedToken(fexp.tok, s.E.tok);
-                var p = Bpl.Expr.Binary(tok, BinaryOperator.Opcode.Imp, canCall, bodyOrConjunct);
-                splits.Add(new SplitExprInfo(SplitExprInfo.K.Checked, p));
+            if (!CanSafelyInline(fexp, f)) {
+              // Skip inlining, as it would cause arbitrary expressions to pop up in the trigger
+              // TODO this should appear at the outmost call site, not at the innermost. See SnapshotableTrees.dfy
+              reporter.Info(MessageSource.Translator, fexp.tok, "Some instances of this call cannot safely be inlined.");
+              // F#canCall(args) ==> F(args)
+              var p = Bpl.Expr.Binary(fargs.tok, BinaryOperator.Opcode.Imp, canCall, fargs);
+              splits.Add(new SplitExprInfo(SplitExprInfo.K.Checked, p));
+              // F#canCall(args) && F(args)
+              var fr = Bpl.Expr.And(canCall, fargs);
+              splits.Add(new SplitExprInfo(SplitExprInfo.K.Free, fr));
+
+            } else {
+              // inline this body
+              var typeSpecializedBody = GetSubstitutedBody(fexp, f);
+              var typeSpecializedResultType = Resolver.SubstType(f.ResultType, fexp.TypeArgumentSubstitutions);
+
+              // recurse on body
+              var ss = new List<SplitExprInfo>();
+              TrSplitExpr(typeSpecializedBody, ss, position, functionHeight, inlineProtectedFunctions, apply_induction, etran);
+              var needsTokenAdjust = TrSplitNeedsTokenAdjustment(typeSpecializedBody);
+              foreach (var s in ss) {
+                if (s.IsChecked) {
+                  var unboxedConjunct = CondApplyUnbox(s.E.tok, s.E, typeSpecializedResultType, expr.Type);
+                  var bodyOrConjunct = Bpl.Expr.Or(fargs, unboxedConjunct);
+                  var tok = needsTokenAdjust ? (IToken)new ForceCheckToken(typeSpecializedBody.tok) : (IToken)new NestedToken(fexp.tok, s.E.tok);
+                  var p = Bpl.Expr.Binary(tok, BinaryOperator.Opcode.Imp, canCall, bodyOrConjunct);
+                  splits.Add(new SplitExprInfo(SplitExprInfo.K.Checked, p));
+                }
               }
-            }
 
-            // allocatedness for arguments to the inlined call in body
-            if (typeSpecializedBody is FunctionCallExpr) {
-              FunctionCallExpr e = (FunctionCallExpr)typeSpecializedBody;
-              for (int i = 0; i < e.Args.Count; i++) {
-                Expression ee = e.Args[i];
-                Type t = e.Function.Formals[i].Type;
-                Expr tr_ee = etran.TrExpr(ee);
-                Bpl.Expr wh = GetWhereClause(e.tok, tr_ee, cce.NonNull(ee.Type), etran);
-                if (wh != null) { fargs = Bpl.Expr.And(fargs, wh); }
+              // allocatedness for arguments to the inlined call in body
+              if (typeSpecializedBody is FunctionCallExpr) {
+                FunctionCallExpr e = (FunctionCallExpr)typeSpecializedBody;
+                for (int i = 0; i < e.Args.Count; i++) {
+                  Expression ee = e.Args[i];
+                  Type t = e.Function.Formals[i].Type;
+                  Expr tr_ee = etran.TrExpr(ee);
+                  Bpl.Expr wh = GetWhereClause(e.tok, tr_ee, cce.NonNull(ee.Type), etran);
+                  if (wh != null) { fargs = Bpl.Expr.And(fargs, wh); }
+                }
               }
-            }
 
-            // body
-            var trBody = etran.TrExpr(typeSpecializedBody);
-            trBody = CondApplyUnbox(trBody.tok, trBody, typeSpecializedResultType, expr.Type);
-            // F#canCall(args) && F(args) && (b0 && b1 && b2)
-            var fr = Bpl.Expr.And(canCall, BplAnd(fargs, trBody));
-            splits.Add(new SplitExprInfo(SplitExprInfo.K.Free, fr));
+              // body
+              var trBody = etran.TrExpr(typeSpecializedBody);
+              trBody = CondApplyUnbox(trBody.tok, trBody, typeSpecializedResultType, expr.Type);
+              // F#canCall(args) && F(args) && (b0 && b1 && b2)
+              var fr = Bpl.Expr.And(canCall, BplAnd(fargs, trBody));
+              splits.Add(new SplitExprInfo(SplitExprInfo.K.Free, fr));
+            }
 
             return true;
-          } else {
-            // Skip inlining, as it would cause arbitrary expressions to pop up in the trigger
-            // TODO this should appear at the outmost call site, not at the innermost. See SnapshotableTrees.dfy
-            reporter.Info(MessageSource.Translator, fexp.tok, "Some instances of this call cannot safely be inlined.");
           }
         }
 
       } else if (expr is QuantifierExpr && ((QuantifierExpr)expr).SplitQuantifier != null) {
-        return TrSplitExpr(((QuantifierExpr)expr).SplitQuantifierExpression, splits, position, heightLimit, apply_induction, etran);
+        return TrSplitExpr(((QuantifierExpr)expr).SplitQuantifierExpression, splits, position, heightLimit, inlineProtectedFunctions, apply_induction, etran);
       } else if (((position && expr is ForallExpr) || (!position && expr is ExistsExpr))
         /* NB: only for type arg less quantifiers for now: */
             && ((QuantifierExpr)expr).TypeArgs.Count == 0) {
@@ -13220,14 +13228,14 @@ namespace Microsoft.Dafny {
       }
     }
 
-    private Expression GetSubstitutedBody(FunctionCallExpr fexp, Function f, bool specializeTypeParameters) {
+    private Expression GetSubstitutedBody(FunctionCallExpr fexp, Function f) {
       Contract.Requires(fexp != null);
       Contract.Requires(f != null);
       var substMap = new Dictionary<IVariable, Expression>();
       Contract.Assert(fexp.Args.Count == f.Formals.Count);
       for (int i = 0; i < f.Formals.Count; i++) {
         Formal p = f.Formals[i];
-        var formalType = specializeTypeParameters ? Resolver.SubstType(p.Type, fexp.TypeArgumentSubstitutions) : p.Type;
+        var formalType = Resolver.SubstType(p.Type, fexp.TypeArgumentSubstitutions);
         Expression arg = fexp.Args[i];
         arg = new BoxingCastExpr(arg, cce.NonNull(arg.Type), formalType);
         arg.Type = formalType;  // resolve here
@@ -13238,7 +13246,7 @@ namespace Microsoft.Dafny {
         var pp = (PrefixPredicate)f;
         body = PrefixSubstitution(pp, body);
       }
-      body = Substitute(body, fexp.Receiver, substMap, specializeTypeParameters ? fexp.TypeArgumentSubstitutions : null);
+      body = Substitute(body, fexp.Receiver, substMap, fexp.TypeArgumentSubstitutions);
       return body;
     }
 
diff --git a/Test/dafny0/TriggerInPredicate.dfy.expect b/Test/dafny0/TriggerInPredicate.dfy.expect
index b3fb9cc0..b3d4ff34 100644
--- a/Test/dafny0/TriggerInPredicate.dfy.expect
+++ b/Test/dafny0/TriggerInPredicate.dfy.expect
@@ -2,5 +2,6 @@ TriggerInPredicate.dfy(6,32): Info: Not generating triggers for "A(x, y)".
 TriggerInPredicate.dfy(6,32): Info: Not generating triggers for "z".
 TriggerInPredicate.dfy(9,20): Info: Some instances of this call cannot safely be inlined.
 TriggerInPredicate.dfy(9,20): Info: Some instances of this call cannot safely be inlined.
+TriggerInPredicate.dfy(9,20): Info: Some instances of this call cannot safely be inlined.
 
 Dafny program verifier finished with 8 verified, 0 errors
diff --git a/Test/dafny2/SnapshotableTrees.dfy.expect b/Test/dafny2/SnapshotableTrees.dfy.expect
index 808fe0f9..68b4ff73 100644
--- a/Test/dafny2/SnapshotableTrees.dfy.expect
+++ b/Test/dafny2/SnapshotableTrees.dfy.expect
@@ -1,8 +1,15 @@
 SnapshotableTrees.dfy(68,23): Error BP5002: A precondition for this call might not hold.
 SnapshotableTrees.dfy(648,15): Related location: This is the precondition that might not hold.
+SnapshotableTrees.dfy(545,15): Related location
+Execution trace:
+    (0,0): anon0
+    (0,0): anon3_Then
+SnapshotableTrees.dfy(68,23): Error BP5002: A precondition for this call might not hold.
+SnapshotableTrees.dfy(648,15): Related location: This is the precondition that might not hold.
+SnapshotableTrees.dfy(548,18): Related location
 Execution trace:
     (0,0): anon0
     (0,0): anon3_Then
 
-Dafny program verifier finished with 65 verified, 1 error
+Dafny program verifier finished with 65 verified, 2 errors
 Compiled assembly into SnapshotableTrees.exe
diff --git a/Test/triggers/triggers-prevent-some-inlining.dfy.expect b/Test/triggers/triggers-prevent-some-inlining.dfy.expect
index 4c24893e..0b6f3e30 100644
--- a/Test/triggers/triggers-prevent-some-inlining.dfy.expect
+++ b/Test/triggers/triggers-prevent-some-inlining.dfy.expect
@@ -3,5 +3,7 @@ triggers-prevent-some-inlining.dfy(24,10): Info: Some instances of this call can
 triggers-prevent-some-inlining.dfy(25,10): Info: Some instances of this call cannot safely be inlined.
 triggers-prevent-some-inlining.dfy(24,10): Info: Some instances of this call cannot safely be inlined.
 triggers-prevent-some-inlining.dfy(25,10): Info: Some instances of this call cannot safely be inlined.
+triggers-prevent-some-inlining.dfy(24,10): Info: Some instances of this call cannot safely be inlined.
+triggers-prevent-some-inlining.dfy(25,10): Info: Some instances of this call cannot safely be inlined.
 
 Dafny program verifier finished with 4 verified, 0 errors
-- 
cgit v1.2.3


From 516f8a5ab59dd2bf7c813b09824a7e2cda004538 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Sat, 24 Oct 2015 18:38:16 -0700
Subject: In Visual Studio, be willing to display both resolution warnings and
 verification errors (previously, verification errors were masked by
 resolution warnings)

---
 Source/DafnyExtension/ResolverTagger.cs | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyExtension/ResolverTagger.cs b/Source/DafnyExtension/ResolverTagger.cs
index b348e7d6..58a46196 100644
--- a/Source/DafnyExtension/ResolverTagger.cs
+++ b/Source/DafnyExtension/ResolverTagger.cs
@@ -199,13 +199,19 @@ namespace DafnyLanguage
       {
         lock (this)
         {
-          if (_resolutionErrors != null && _resolutionErrors.Any())
-          {
-            return _resolutionErrors;
+          bool anyResolutionErrors = false;
+          if (_resolutionErrors != null) {
+            foreach (var err in _resolutionErrors) {
+              if (CategoryConversion(err.Category) == TaskErrorCategory.Error) {
+                anyResolutionErrors = true;
+              }
+              yield return err;
+            }
           }
-          else
-          {
-            return VerificationErrors;
+          if (!anyResolutionErrors) {
+            foreach (var err in VerificationErrors) {
+              yield return err;
+            }
           }
         }
       }
-- 
cgit v1.2.3


From b35216f55d22123ae4c35eacf28e99a2b6dbbfaf Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Sat, 24 Oct 2015 18:39:19 -0700
Subject: Make /autoTriggers:1 be the default in Visual Studio

---
 Source/DafnyExtension/DafnyDriver.cs | 1 +
 1 file changed, 1 insertion(+)

(limited to 'Source')

diff --git a/Source/DafnyExtension/DafnyDriver.cs b/Source/DafnyExtension/DafnyDriver.cs
index 30b0bd52..2ad05e85 100644
--- a/Source/DafnyExtension/DafnyDriver.cs
+++ b/Source/DafnyExtension/DafnyDriver.cs
@@ -37,6 +37,7 @@ namespace DafnyLanguage
       if (Dafny.DafnyOptions.O == null) {
         var options = new Dafny.DafnyOptions();
         options.ProverKillTime = 10;
+        options.AutoTriggers = true;
         options.ErrorTrace = 0;
         options.VcsCores = Math.Max(1, System.Environment.ProcessorCount - 1);
         options.ModelViewFile = "-";
-- 
cgit v1.2.3


From 5e4bcf8e63a3351dc3f0f9bc6cbff8176adddd8b Mon Sep 17 00:00:00 2001
From: wuestholz <unknown>
Date: Mon, 26 Oct 2015 17:36:25 -0500
Subject: DafnyExtension: Add menu item for automatic induction (mainly
 developed by Rustan).

---
 Source/DafnyExtension/DafnyDriver.cs |  7 +++++++
 Source/DafnyExtension/MenuProxy.cs   |  8 ++++++++
 Source/DafnyMenu/DafnyMenu.vsct      | 14 ++++++++++++--
 Source/DafnyMenu/DafnyMenuPackage.cs | 31 ++++++++++++++++++++++++++++++-
 Source/DafnyMenu/PkgCmdID.cs         |  3 ++-
 5 files changed, 59 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyExtension/DafnyDriver.cs b/Source/DafnyExtension/DafnyDriver.cs
index 2ad05e85..27471d56 100644
--- a/Source/DafnyExtension/DafnyDriver.cs
+++ b/Source/DafnyExtension/DafnyDriver.cs
@@ -251,6 +251,13 @@ namespace DafnyLanguage
       return Dafny.DafnyOptions.Clo.VerifySnapshots;
     }
 
+    public static bool ChangeAutomaticInduction() {
+      var old = Dafny.DafnyOptions.O.Induction;
+      // toggle between modes 1 and 3
+      Dafny.DafnyOptions.O.Induction = old == 1 ? 3 : 1;
+      return Dafny.DafnyOptions.O.Induction == 3;
+    }
+
     public static bool Verify(Dafny.Program dafnyProgram, ResolverTagger resolver, string uniqueIdPrefix, string requestId, ErrorReporterDelegate er) {
       Dafny.Translator translator = new Dafny.Translator(dafnyProgram.reporter);
       translator.InsertChecksums = true;
diff --git a/Source/DafnyExtension/MenuProxy.cs b/Source/DafnyExtension/MenuProxy.cs
index 9ddc8344..0e061cd3 100644
--- a/Source/DafnyExtension/MenuProxy.cs
+++ b/Source/DafnyExtension/MenuProxy.cs
@@ -33,6 +33,14 @@ namespace DafnyLanguage
              && 0 < DafnyDriver.IncrementalVerificationMode();
     }
 
+    public bool ToggleAutomaticInduction(IWpfTextView activeTextView) {
+      return DafnyDriver.ChangeAutomaticInduction();
+    }
+
+    public bool AutomaticInductionCommandEnabled(IWpfTextView activeTextView) {
+      return activeTextView != null;
+    }
+
     public bool StopVerifierCommandEnabled(IWpfTextView activeTextView)
     {
       DafnyLanguage.ProgressTagger tagger;
diff --git a/Source/DafnyMenu/DafnyMenu.vsct b/Source/DafnyMenu/DafnyMenu.vsct
index 4c9a4913..02ffcf48 100644
--- a/Source/DafnyMenu/DafnyMenu.vsct
+++ b/Source/DafnyMenu/DafnyMenu.vsct
@@ -112,6 +112,15 @@
         </Strings>
       </Button>
 
+      <Button guid="guidDafnyMenuCmdSet" id="cmdidToggleAutomaticInduction" priority="0x0106" type="Button">
+        <Parent guid="guidDafnyMenuCmdSet" id="DafnyMenuGroup" />
+        <CommandFlag>DynamicVisibility</CommandFlag>
+        <CommandFlag>TextChanges</CommandFlag>
+        <Strings>
+          <ButtonText>Disable automatic induction</ButtonText>
+        </Strings>
+      </Button>
+
       <Button guid="guidDafnyMenuCmdSet" id="cmdidToggleBVD" priority="0x010a" type="Button">
         <Parent guid="guidDafnyMenuCmdSet" id="DafnyMenuGroup" />
         <CommandFlag>DynamicVisibility</CommandFlag>
@@ -122,7 +131,7 @@
         </Strings>
       </Button>
 
-      <Button guid="guidDafnyMenuCmdSet" id="cmdidDiagnoseTimeouts" priority="0x0106" type="Button">
+      <Button guid="guidDafnyMenuCmdSet" id="cmdidDiagnoseTimeouts" priority="0x0107" type="Button">
         <Parent guid="guidDafnyMenuCmdSet" id="DafnyMenuGroup" />
         <CommandFlag>DynamicVisibility</CommandFlag>
         <CommandFlag>DefaultInvisible</CommandFlag>
@@ -164,7 +173,8 @@
       <IDSymbol name="cmdidToggleSnapshotVerification" value="0x0103" />
       <IDSymbol name="cmdidToggleBVD" value="0x0104" />
       <IDSymbol name="cmdidToggleMoreAdvancedSnapshotVerification" value="0x0105" />
-      <IDSymbol name="cmdidDiagnoseTimeouts" value="0x0106" />
+      <IDSymbol name="cmdidToggleAutomaticInduction" value="0x0106" />
+      <IDSymbol name="cmdidDiagnoseTimeouts" value="0x0107" />
     </GuidSymbol>
 
     <!--
diff --git a/Source/DafnyMenu/DafnyMenuPackage.cs b/Source/DafnyMenu/DafnyMenuPackage.cs
index 58c8f0ab..0addda47 100644
--- a/Source/DafnyMenu/DafnyMenuPackage.cs
+++ b/Source/DafnyMenu/DafnyMenuPackage.cs
@@ -28,6 +28,12 @@ namespace DafnyLanguage.DafnyMenu
     bool MoreAdvancedSnapshotVerificationCommandEnabled(IWpfTextView activeTextView);
 
 
+    bool ToggleAutomaticInduction(IWpfTextView activeTextView);
+
+
+    bool AutomaticInductionCommandEnabled(IWpfTextView activeTextView);
+
+    
     bool StopVerifierCommandEnabled(IWpfTextView activeTextView);
 
 
@@ -93,6 +99,7 @@ namespace DafnyLanguage.DafnyMenu
     private OleMenuCommand stopVerifierCommand;
     private OleMenuCommand toggleSnapshotVerificationCommand;
     private OleMenuCommand toggleMoreAdvancedSnapshotVerificationCommand;
+    private OleMenuCommand toggleAutomaticInductionCommand;
     private OleMenuCommand toggleBVDCommand;
     private OleMenuCommand diagnoseTimeoutsCommand;
 
@@ -158,6 +165,12 @@ namespace DafnyLanguage.DafnyMenu
         toggleMoreAdvancedSnapshotVerificationCommand.BeforeQueryStatus += toggleMoreAdvancedSnapshotVerificationCommand_BeforeQueryStatus;
         mcs.AddCommand(toggleMoreAdvancedSnapshotVerificationCommand);
 
+        var toggleAutomaticInductionCommandID = new CommandID(GuidList.guidDafnyMenuCmdSet, (int)PkgCmdIDList.cmdidToggleAutomaticInduction);
+        toggleAutomaticInductionCommand = new OleMenuCommand(ToggleAutomaticInductionCallback, toggleAutomaticInductionCommandID);
+        toggleAutomaticInductionCommand.Enabled = true;
+        toggleAutomaticInductionCommand.BeforeQueryStatus += toggleAutomaticInductionCommand_BeforeQueryStatus;
+        mcs.AddCommand(toggleAutomaticInductionCommand);
+
         var showErrorModelCommandID = new CommandID(GuidList.guidDafnyMenuCmdSet, (int)PkgCmdIDList.cmdidToggleBVD);
         toggleBVDCommand = new OleMenuCommand(ToggleBVDCallback, showErrorModelCommandID);
         toggleBVDCommand.Enabled = true;
@@ -234,6 +247,14 @@ namespace DafnyLanguage.DafnyMenu
       }
     }
 
+    void ToggleAutomaticInductionCallback(object sender, EventArgs e) {
+      var atv = ActiveTextView;
+      if (MenuProxy != null && atv != null) {
+        var nowAutomatic = MenuProxy.ToggleAutomaticInduction(atv);
+        toggleAutomaticInductionCommand.Text = (nowAutomatic ? "Disable" : "Enable") + " automatic induction";
+      }
+    }
+
     void stopVerifierCommand_BeforeQueryStatus(object sender, EventArgs e)
     {
       var atv = ActiveTextView;
@@ -334,6 +355,14 @@ namespace DafnyLanguage.DafnyMenu
       }
     }
 
+    private void toggleAutomaticInductionCommand_BeforeQueryStatus(object sender, EventArgs e) {
+      var atv = ActiveTextView;
+      if (MenuProxy != null && atv != null) {
+        var visible = MenuProxy.AutomaticInductionCommandEnabled(atv);
+        toggleAutomaticInductionCommand.Visible = visible;
+      }
+    }
+
     void ToggleBVDCallback(object sender, EventArgs e)
     {
       BVDDisabled = !BVDDisabled;
@@ -379,7 +408,7 @@ namespace DafnyLanguage.DafnyMenu
         var window = this.FindToolWindow(typeof(BvdToolWindow), 0, true);
         if ((window == null) || (window.Frame == null))
         {
-          throw new NotSupportedException("Can not create BvdToolWindow.");
+          throw new NotSupportedException("Cannot create BvdToolWindow.");
         }
 
         BvdToolWindow.BVD.HideMenuStrip();
diff --git a/Source/DafnyMenu/PkgCmdID.cs b/Source/DafnyMenu/PkgCmdID.cs
index 427dd888..ba4b786d 100644
--- a/Source/DafnyMenu/PkgCmdID.cs
+++ b/Source/DafnyMenu/PkgCmdID.cs
@@ -13,6 +13,7 @@ namespace DafnyLanguage.DafnyMenu
     public static uint cmdidToggleSnapshotVerification = 0x103;
     public const uint cmdidToggleBVD = 0x104;
     public static uint cmdidToggleMoreAdvancedSnapshotVerification = 0x105;
-    public static uint cmdidDiagnoseTimeouts = 0x106;
+    public static uint cmdidToggleAutomaticInduction = 0x106;
+    public static uint cmdidDiagnoseTimeouts = 0x107;
   };
 }
\ No newline at end of file
-- 
cgit v1.2.3


From 1dc2166ec1b1de5a19e0de3100eb82527c531b08 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Mon, 26 Oct 2015 16:40:27 -0700
Subject: Fixed location of blue dots to appear after semi-colons, not just
 before them.

---
 Source/Dafny/Translator.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 172005cc..47dfb96a 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -3585,7 +3585,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(tok != null);
       Contract.Ensures(Contract.Result<Bpl.Cmd>() != null);
       var col = tok.col + (isEndToken ? tok.val.Length : 0);
-      string description = ErrorReporter.ErrorToString_Internal(additionalInfo == null ? "" : ": ", tok.filename, tok.line, tok.col, additionalInfo ?? "");
+      string description = ErrorReporter.ErrorToString_Internal(additionalInfo == null ? "" : ": ", tok.filename, tok.line, col, additionalInfo ?? "");
       QKeyValue kv = new QKeyValue(tok, "captureState", new List<object>() { description }, null);
       return new Bpl.AssumeCmd(tok, Bpl.Expr.True, kv);
     }
-- 
cgit v1.2.3


From 461d6b17aed0bd81adc86d4ce2148c0f1d790bbc Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Thu, 29 Oct 2015 16:08:48 -0700
Subject: Fix issue 91 - Change how we compute the bounds of quantified
 variables so that it does not depend on the order they appeared.

---
 Source/Dafny/Resolver.cs                   | 42 ++++++++++++++++-------
 Test/dafny0/NonGhostQuantifiers.dfy.expect |  6 +---
 Test/dafny4/Bug91.dfy                      | 53 ++++++++++++++++++++++++++++++
 Test/dafny4/Bug91.dfy.expect               |  2 ++
 4 files changed, 87 insertions(+), 16 deletions(-)
 create mode 100644 Test/dafny4/Bug91.dfy
 create mode 100644 Test/dafny4/Bug91.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 74ff60e7..21476ede 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -9715,8 +9715,28 @@ namespace Microsoft.Dafny
         var c = GetImpliedTypeConstraint(bv, bv.Type, null);
         expr = polarity ? Expression.CreateAnd(c, expr) : Expression.CreateImplies(c, expr);
       }
-      var all = DiscoverAllBounds_Aux_MultipleVars(bvars, expr, polarity);
-      var bests = all.ConvertAll(tup => ComprehensionExpr.BoundedPool.GetBest(tup.Item2, onlyFiniteBounds));
+      List<ComprehensionExpr.BoundedPool> knownBounds = null;
+      var orgCount = bvars.Count;
+      var bests = new List<ComprehensionExpr.BoundedPool>();
+      bool changed = true;
+      // compute the bounds of the BV until no new information is obtained.
+      while (changed) {
+        changed = false;
+        var all = DiscoverAllBounds_Aux_MultipleVars(bvars, expr, polarity, knownBounds);
+        bests = all.ConvertAll(tup => ComprehensionExpr.BoundedPool.GetBest(tup.Item2, onlyFiniteBounds));
+        // check to see if we found new bounds in this iteration
+        int count = 0;
+        for (int i = 0; i < bests.Count; i++) {
+          if (bests[i] == null) {
+            count++;
+          }
+        }
+        if (count >0 && count != orgCount) {
+          changed = true;
+          knownBounds = bests;
+          orgCount = count;
+        }
+      }
       missingBounds = new List<VT>();
       for (var i = 0; i < bvars.Count; i++) {
         if (bests[i] == null) {
@@ -9728,24 +9748,24 @@ namespace Microsoft.Dafny
 
     public static List<ComprehensionExpr.BoundedPool> DiscoverAllBounds_SingleVar<VT>(VT v, Expression expr) where VT : IVariable {
       expr = Expression.CreateAnd(GetImpliedTypeConstraint(v, v.Type, null), expr);
-      return DiscoverAllBounds_Aux_SingleVar(new List<VT> { v }, 0, expr, true);
+      return DiscoverAllBounds_Aux_SingleVar(new List<VT> { v }, 0, expr, true, null);
     }
 
-    private static List<Tuple<VT, List<ComprehensionExpr.BoundedPool>>> DiscoverAllBounds_Aux_MultipleVars<VT>(List<VT> bvars, Expression expr, bool polarity) where VT : IVariable {
+    private static List<Tuple<VT, List<ComprehensionExpr.BoundedPool>>> DiscoverAllBounds_Aux_MultipleVars<VT>(List<VT> bvars, Expression expr, bool polarity, List<ComprehensionExpr.BoundedPool> knownBounds) where VT : IVariable {
       Contract.Requires(bvars != null);
       Contract.Requires(expr != null);
       var bb = new List<Tuple<VT, List<ComprehensionExpr.BoundedPool>>>();
       for (var j = 0; j < bvars.Count; j++) {
-        var bounds = DiscoverAllBounds_Aux_SingleVar(bvars, j, expr, polarity);
+        var bounds = DiscoverAllBounds_Aux_SingleVar(bvars, j, expr, polarity, knownBounds);
         bb.Add(new Tuple<VT, List<ComprehensionExpr.BoundedPool>>(bvars[j], bounds));
       }
       return bb;
     }
 
     /// <summary>
-    /// Returns a list of (possibly partial) bounds for "bvars[j]", each of which can be written without mentioning any variable in "bvars[j..]".
+    /// Returns a list of (possibly partial) bounds for "bvars[j]", each of which can be written without mentioning any variable in "bvars[j..]" that is not bounded.
     /// </summary>
-    private static List<ComprehensionExpr.BoundedPool> DiscoverAllBounds_Aux_SingleVar<VT>(List<VT> bvars, int j, Expression expr, bool polarity) where VT : IVariable {
+    private static List<ComprehensionExpr.BoundedPool> DiscoverAllBounds_Aux_SingleVar<VT>(List<VT> bvars, int j, Expression expr, bool polarity, List<ComprehensionExpr.BoundedPool> knownBounds) where VT : IVariable {
       Contract.Requires(bvars != null);
       Contract.Requires(0 <= j && j < bvars.Count);
       Contract.Requires(expr != null);
@@ -9774,7 +9794,7 @@ namespace Microsoft.Dafny
         }
         var e0 = c.E0;
         var e1 = c.E1;
-        int whereIsBv = SanitizeForBoundDiscovery(bvars, j, c.ResolvedOp, ref e0, ref e1);
+        int whereIsBv = SanitizeForBoundDiscovery(bvars, j, c.ResolvedOp, knownBounds, ref e0, ref e1);
         if (whereIsBv < 0) {
           continue;
         }
@@ -9870,7 +9890,7 @@ namespace Microsoft.Dafny
     /// The other of "e0" and "e1" is an expression whose free variables are not among "boundVars[bvi..]".
     /// Ensures that the resulting "e0" and "e1" are not ConcreteSyntaxExpression's.
     /// </summary>
-    static int SanitizeForBoundDiscovery<VT>(List<VT> boundVars, int bvi, BinaryExpr.ResolvedOpcode op, ref Expression e0, ref Expression e1) where VT : IVariable {
+    static int SanitizeForBoundDiscovery<VT>(List<VT> boundVars, int bvi, BinaryExpr.ResolvedOpcode op, List<ComprehensionExpr.BoundedPool> knownBounds, ref Expression e0, ref Expression e1) where VT : IVariable {
       Contract.Requires(e0 != null);
       Contract.Requires(e1 != null);
       Contract.Requires(boundVars != null);
@@ -9965,10 +9985,10 @@ namespace Microsoft.Dafny
       }
 
       // Finally, check that the other side does not contain "bv" or any of the bound variables
-      // listed after "bv" in the quantifier.
+      // listed after "bv" in the quantifier that is not bounded.
       var fv = FreeVariables(thatSide);
       for (int i = bvi; i < boundVars.Count; i++) {
-        if (fv.Contains(boundVars[i])) {
+        if (fv.Contains(boundVars[i]) && (knownBounds == null || knownBounds[i] == null)) {
           return -1;
         }
       }
diff --git a/Test/dafny0/NonGhostQuantifiers.dfy.expect b/Test/dafny0/NonGhostQuantifiers.dfy.expect
index 6b737add..0abf0b6c 100644
--- a/Test/dafny0/NonGhostQuantifiers.dfy.expect
+++ b/Test/dafny0/NonGhostQuantifiers.dfy.expect
@@ -11,11 +11,7 @@ NonGhostQuantifiers.dfy(16,5): Error: quantifiers in non-ghost contexts must be
 NonGhostQuantifiers.dfy(45,4): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'n'
 NonGhostQuantifiers.dfy(49,4): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'd'
 NonGhostQuantifiers.dfy(53,4): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'n'
-NonGhostQuantifiers.dfy(77,5): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'i'
-NonGhostQuantifiers.dfy(81,5): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'j'
-NonGhostQuantifiers.dfy(91,5): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'j'
-NonGhostQuantifiers.dfy(106,5): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'j'
 NonGhostQuantifiers.dfy(114,10): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'y'
 NonGhostQuantifiers.dfy(123,8): Error: quantifiers in non-ghost contexts must be compilable, but Dafny's heuristics can't figure out how to produce or compile a bounded set of values for 'x'
 NonGhostQuantifiers.dfy(140,8): Error: Assignment to non-ghost variable is not allowed in this context (because this is a ghost method or because the statement is guarded by a specification-only expression)
-20 resolution/type errors detected in NonGhostQuantifiers.dfy
+16 resolution/type errors detected in NonGhostQuantifiers.dfy
diff --git a/Test/dafny4/Bug91.dfy b/Test/dafny4/Bug91.dfy
new file mode 100644
index 00000000..75f8de22
--- /dev/null
+++ b/Test/dafny4/Bug91.dfy
@@ -0,0 +1,53 @@
+// RUN: %dafny /compile:0  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+type SendState = map<int, seq<int>>
+
+function UnAckedMessages(s:SendState) : set<int>
+{
+    set m,dst | dst in s && m in s[dst] :: m
+}
+
+predicate UnAckedMessage2(s:SendState, m:int)
+{
+    exists dst :: dst in s && m in s[dst]
+}
+
+/* the following bound can't be determined since we only know what to do with binary operations
+function UnAckedMessagesA(s:SendState) : set<int>
+{
+    set m | UnAckedMessage2(s, m) :: m
+}
+*/
+
+function UnAckedMessagesForDst(s:SendState, dst:int) : set<int>
+    requires dst in s;
+{
+    set m | m in s[dst] :: m
+}
+
+function UnAckedMessages3(s:SendState) : set<int>
+{
+    set m,dst | dst in s && m in UnAckedMessagesForDst(s, dst) :: m
+}
+
+function SeqToSet<T>(s:seq<T>) : set<T>
+{
+    set i | i in s 
+}
+/* does not verify, with element may not in domain error
+function UnAckedMessages4(s:SendState) : set<int>
+{
+    set m,dst | m in SeqToSet(s[dst]) && dst in s :: m
+}
+*/
+
+function UnAckedLists(s:SendState) : set<seq<int>>
+{
+    set dst | dst in s :: s[dst]
+}
+
+function UnAckedMessages5(s:SendState) : set<int>
+{
+    set m, list | list in UnAckedLists(s) && m in list :: m
+}
\ No newline at end of file
diff --git a/Test/dafny4/Bug91.dfy.expect b/Test/dafny4/Bug91.dfy.expect
new file mode 100644
index 00000000..76f19e0d
--- /dev/null
+++ b/Test/dafny4/Bug91.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 7 verified, 0 errors
-- 
cgit v1.2.3


From 2b7d31bb3e0276028a8bc50c4933ea60fed5fb60 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Wed, 4 Nov 2015 10:36:54 -0800
Subject: Fix issue89. Copy the out param to a local before use it in an
 anonymous method that is generated by LetExpr. Change the compiler so that
 each stmt writes to its own buffer before add it to the program's buffer so
 that we can insert the above mentioned copy instruction before the stmt.

---
 Source/Dafny/Compiler.cs          | 1151 +++++++++++++++++++------------------
 Source/DafnyDriver/DafnyDriver.cs |    4 +-
 Test/dafny4/Bug89.dfy             |   15 +
 Test/dafny4/Bug89.dfy.expect      |    6 +
 4 files changed, 610 insertions(+), 566 deletions(-)
 create mode 100644 Test/dafny4/Bug89.dfy
 create mode 100644 Test/dafny4/Bug89.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index aa4ca3ec..f992d6c0 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -14,18 +14,11 @@ using System.Text;
 
 namespace Microsoft.Dafny {
   public class Compiler {
-    public Compiler(TextWriter wr) {
-      Contract.Requires(wr != null);
-      this.wr = wr;
+    public Compiler() {
+  
     }
 
-    [ContractInvariantMethod]
-    void ObjectInvariant()
-    {
-      Contract.Invariant(wr!=null);
-    }
-
-    TextWriter wr;
+    StringBuilder copyInstrWriter = new StringBuilder(); // a buffer that stores copy instructions generated by letExpr that uses out param.
     Method enclosingMethod;  // non-null when a method body is being translated
 
     FreshIdGenerator idGenerator = new FreshIdGenerator();
@@ -50,7 +43,7 @@ namespace Microsoft.Dafny {
     public int ErrorCount;
     public TextWriter ErrorWriter = Console.Out;
 
-    void Error(string msg, params object[] args) {
+    void Error(string msg, TextWriter wr, params object[] args) {
       Contract.Requires(msg != null);
       Contract.Requires(args != null);
 
@@ -60,7 +53,7 @@ namespace Microsoft.Dafny {
       ErrorCount++;
     }
 
-    void ReadRuntimeSystem() {
+    void ReadRuntimeSystem(TextWriter wr) {
       string codebase = cce.NonNull( System.IO.Path.GetDirectoryName(cce.NonNull(System.Reflection.Assembly.GetExecutingAssembly().Location)));
       string path = System.IO.Path.Combine(codebase, "DafnyRuntime.cs");
       using (TextReader rd = new StreamReader(new FileStream(path, System.IO.FileMode.Open, System.IO.FileAccess.Read)))
@@ -75,16 +68,16 @@ namespace Microsoft.Dafny {
     }
 
     readonly int IndentAmount = 2;
-    void Indent(int ind) {
+    void Indent(int ind, TextWriter wr) {
       Contract.Requires(0 <= ind);
       string spaces = "          ";
       for (; spaces.Length < ind; ind -= spaces.Length) {
         wr.Write(spaces);
       }
-      wr.Write(spaces.Substring(0, ind));
+     wr.Write(spaces.Substring(0, ind));
     }
 
-    public void Compile(Program program) {
+    public void Compile(Program program, TextWriter wr) {
       Contract.Requires(program != null);
       wr.WriteLine("// Dafny program {0} compiled into C#", program.Name);
       wr.WriteLine("// To recompile, use 'csc' with: /r:System.Numerics.dll");
@@ -92,8 +85,8 @@ namespace Microsoft.Dafny {
       wr.WriteLine("// You might also want to include compiler switches like:");
       wr.WriteLine("//     /debug /nowarn:0164 /nowarn:0219");
       wr.WriteLine();
-      ReadRuntimeSystem();
-      CompileBuiltIns(program.BuiltIns);
+      ReadRuntimeSystem(wr);
+      CompileBuiltIns(program.BuiltIns, wr);
 
       foreach (ModuleDefinition m in program.CompileModules) {
         if (m.IsAbstract) {
@@ -117,33 +110,33 @@ namespace Microsoft.Dafny {
           wr.WriteLine();
           if (d is OpaqueTypeDecl) {
             var at = (OpaqueTypeDecl)d;
-            Error("Opaque type ('{0}') cannot be compiled", at.FullName);
+            Error("Opaque type ('{0}') cannot be compiled", wr, at.FullName);
           } else if (d is TypeSynonymDecl) {
             // do nothing, just bypass type synonyms in the compiler
           } else if (d is NewtypeDecl) {
             var nt = (NewtypeDecl)d;
-            Indent(indent);
+            Indent(indent, wr);
             wr.WriteLine("public class @{0} {{", nt.CompileName);
             if (nt.NativeType != null) {
-              Indent(indent + IndentAmount);
+              Indent(indent + IndentAmount, wr);
               wr.WriteLine("public static System.Collections.Generic.IEnumerable<{0}> IntegerRange(BigInteger lo, BigInteger hi) {{", nt.NativeType.Name);
-              Indent(indent + 2 * IndentAmount);
+              Indent(indent + 2 * IndentAmount, wr);
               wr.WriteLine("for (var j = lo; j < hi; j++) {{ yield return ({0})j; }}", nt.NativeType.Name);
-              Indent(indent + IndentAmount);
+              Indent(indent + IndentAmount, wr);
               wr.WriteLine("}");
             }
-            Indent(indent);
+            Indent(indent, wr);
             wr.WriteLine("}");
           } else if (d is DatatypeDecl) {
             var dt = (DatatypeDecl)d;
-            Indent(indent);
+            Indent(indent, wr);
             wr.Write("public abstract class Base_{0}", dt.CompileName);
             if (dt.TypeArgs.Count != 0) {
               wr.Write("<{0}>", TypeParameters(dt.TypeArgs));
             }
             wr.WriteLine(" { }");
-            CompileDatatypeConstructors(dt, indent);
-            CompileDatatypeStruct(dt, indent);
+            CompileDatatypeConstructors(dt, indent, wr);
+            CompileDatatypeStruct(dt, indent, wr);
           } else if (d is IteratorDecl) {
             var iter = (IteratorDecl)d;
             // An iterator is compiled as follows:
@@ -169,7 +162,7 @@ namespace Microsoft.Dafny {
             //     }
             //   }
 
-            Indent(indent);
+            Indent(indent, wr);
             wr.Write("public class @{0}", iter.CompileName);
             if (iter.TypeArgs.Count != 0) {
               wr.Write("<{0}>", TypeParameters(iter.TypeArgs));
@@ -181,58 +174,58 @@ namespace Microsoft.Dafny {
             foreach (var member in iter.Members) {
               var f = member as Field;
               if (f != null && !f.IsGhost) {
-                Indent(ind);
-                wr.WriteLine("public {0} @{1} = {2};", TypeName(f.Type), f.CompileName, DefaultValue(f.Type));
+                Indent(ind, wr);
+                wr.WriteLine("public {0} @{1} = {2};", TypeName(f.Type, wr), f.CompileName, DefaultValue(f.Type, wr));
               } else if (member is Constructor) {
                 Contract.Assert(ct == null);  // we're expecting just one constructor
                 ct = (Constructor)member;
               }
             }
             Contract.Assert(ct != null);  // we do expect a constructor
-            Indent(ind); wr.WriteLine("System.Collections.Generic.IEnumerator<object> __iter;");
+            Indent(ind, wr); wr.WriteLine("System.Collections.Generic.IEnumerator<object> __iter;");
 
             // here's the initializer method
-            Indent(ind); wr.Write("public void @{0}(", ct.CompileName);
+            Indent(ind, wr); wr.Write("public void @{0}(", ct.CompileName);
             string sep = "";
             foreach (var p in ct.Ins) {
               if (!p.IsGhost) {
                 // here we rely on the parameters and the corresponding fields having the same names
-                wr.Write("{0}{1} @{2}", sep, TypeName(p.Type), p.CompileName);
+                wr.Write("{0}{1} @{2}", sep, TypeName(p.Type, wr), p.CompileName);
                 sep = ", ";
               }
             }
             wr.WriteLine(") {");
             foreach (var p in ct.Ins) {
               if (!p.IsGhost) {
-                Indent(ind + IndentAmount);
+                Indent(ind + IndentAmount, wr);
                 wr.WriteLine("this.@{0} = @{0};", p.CompileName);
               }
             }
-            Indent(ind + IndentAmount); wr.WriteLine("__iter = TheIterator();");
-            Indent(ind);  wr.WriteLine("}");
+            Indent(ind + IndentAmount, wr); wr.WriteLine("__iter = TheIterator();");
+            Indent(ind, wr);  wr.WriteLine("}");
             // here are the enumerator methods
-            Indent(ind); wr.WriteLine("public void MoveNext(out bool more) { more = __iter.MoveNext(); }");
-            Indent(ind); wr.WriteLine("private System.Collections.Generic.IEnumerator<object> TheIterator() {");
+            Indent(ind, wr); wr.WriteLine("public void MoveNext(out bool more) { more = __iter.MoveNext(); }");
+            Indent(ind, wr); wr.WriteLine("private System.Collections.Generic.IEnumerator<object> TheIterator() {");
             if (iter.Body == null) {
-              Error("Iterator {0} has no body", iter.FullName);
+              Error("Iterator {0} has no body", wr, iter.FullName);
             } else {
-              TrStmt(iter.Body, ind + IndentAmount);
+              wr.Write(TrStmt(iter.Body, ind + IndentAmount).ToString());
             }
-            Indent(ind + IndentAmount); wr.WriteLine("yield break;");
-            Indent(ind); wr.WriteLine("}");
+            Indent(ind + IndentAmount, wr); wr.WriteLine("yield break;");
+            Indent(ind, wr); wr.WriteLine("}");
             // end of the class
-            Indent(indent); wr.WriteLine("}");
+            Indent(indent, wr); wr.WriteLine("}");
 
           }
           else if (d is TraitDecl)
           {
               //writing the trait
               var trait = (TraitDecl)d;
-              Indent(indent);
+              Indent(indent, wr);
               wr.Write("public interface @{0}", trait.CompileName);
               wr.WriteLine(" {");
-              CompileClassMembers(trait, false, indent + IndentAmount);
-              Indent(indent); wr.WriteLine("}");
+              CompileClassMembers(trait, false, indent + IndentAmount, wr);
+              Indent(indent, wr); wr.WriteLine("}");
 
               //writing the _Companion class
               List<MemberDecl> members = new List<MemberDecl>();
@@ -252,27 +245,27 @@ namespace Microsoft.Dafny {
                       }
                   }
               }
-              Indent(indent);
+              Indent(indent, wr);
               wr.Write("public class @_Companion_{0}", trait.CompileName);
               wr.WriteLine(" {");
-              CompileClassMembers(trait, true, indent + IndentAmount);
-              Indent(indent); wr.WriteLine("}");
+              CompileClassMembers(trait, true, indent + IndentAmount, wr);
+              Indent(indent, wr); wr.WriteLine("}");
           }
           else if (d is ClassDecl) {
             var cl = (ClassDecl)d;
-            Indent(indent);
+            Indent(indent, wr);
             wr.Write("public class @{0}", cl.CompileName);
             if (cl.TypeArgs.Count != 0) {
               wr.Write("<{0}>", TypeParameters(cl.TypeArgs));
             }
             string sep = " : ";
             foreach (var trait in cl.TraitsTyp) {
-              wr.Write("{0}{1}", sep, TypeName(trait));
+              wr.Write("{0}{1}", sep, TypeName(trait, wr));
               sep = ", ";
             }
             wr.WriteLine(" {");
-            CompileClassMembers(cl, false, indent+IndentAmount);
-            Indent(indent);  wr.WriteLine("}");
+            CompileClassMembers(cl, false, indent+IndentAmount, wr);
+            Indent(indent, wr);  wr.WriteLine("}");
           } else if (d is ModuleDecl) {
             // nop
           } else { Contract.Assert(false); }
@@ -283,15 +276,15 @@ namespace Microsoft.Dafny {
       }
     }
 
-    void CompileBuiltIns(BuiltIns builtIns) {
+    void CompileBuiltIns(BuiltIns builtIns, TextWriter wr) {
       wr.WriteLine("namespace Dafny {");
-      Indent(IndentAmount);
+      Indent(IndentAmount, wr);
       wr.WriteLine("public partial class Helpers {");
       foreach (var decl in builtIns.SystemModule.TopLevelDecls) {
         if (decl is ArrayClassDecl) {
           int dims = ((ArrayClassDecl)decl).Dims;
           // public static T[,] InitNewArray2<T>(BigInteger size0, BigInteger size1) {
-          Indent(3 * IndentAmount);
+          Indent(3 * IndentAmount, wr);
           wr.Write("public static T[");
           RepeatWrite(wr, dims, "", ",");
           wr.Write("] InitNewArray{0}<T>(", dims);
@@ -299,52 +292,52 @@ namespace Microsoft.Dafny {
           wr.WriteLine(") {");
           // int s0 = (int)size0;
           for (int i = 0; i < dims; i++) {
-            Indent(4 * IndentAmount);
+            Indent(4 * IndentAmount, wr);
             wr.WriteLine("int s{0} = (int)size{0};", i);
           }
           // T[,] a = new T[s0, s1];
-          Indent(4 * IndentAmount);
+          Indent(4 * IndentAmount, wr);
           wr.Write("T[");
           RepeatWrite(wr, dims, "", ",");
           wr.Write("] a = new T[");
           RepeatWrite(wr, dims, "s{0}", ",");
           wr.WriteLine("];");
           // BigInteger[,] b = a as BigInteger[,];
-          Indent(4 * IndentAmount);
+          Indent(4 * IndentAmount, wr);
           wr.Write("BigInteger[");
           RepeatWrite(wr, dims, "", ",");
           wr.Write("] b = a as BigInteger[");
           RepeatWrite(wr, dims, "", ",");
           wr.WriteLine("];");
           // if (b != null) {
-          Indent(4 * IndentAmount);
+          Indent(4 * IndentAmount, wr);
           wr.WriteLine("if (b != null) {");
           // BigInteger z = new BigInteger(0);
-          Indent(5 * IndentAmount);
+          Indent(5 * IndentAmount, wr);
           wr.WriteLine("BigInteger z = new BigInteger(0);");
           // for (int i0 = 0; i0 < s0; i0++)
           //   for (int i1 = 0; i1 < s1; i1++)
           for (int i = 0; i < dims; i++) {
-            Indent((5+i) * IndentAmount);
+            Indent((5+i) * IndentAmount, wr);
             wr.WriteLine("for (int i{0} = 0; i{0} < s{0}; i{0}++)", i);
           }
           // b[i0,i1] = z;
-          Indent((5+dims) * IndentAmount);
+          Indent((5+dims) * IndentAmount, wr);
           wr.Write("b[");
           RepeatWrite(wr, dims, "i{0}", ",");
           wr.WriteLine("] = z;");
           // }
-          Indent(4 * IndentAmount);
+          Indent(4 * IndentAmount, wr);
           wr.WriteLine("}");
           // return a;
-          Indent(4 * IndentAmount);
+          Indent(4 * IndentAmount, wr);
           wr.WriteLine("return a;");
           // }
-          Indent(3 * IndentAmount);
+          Indent(3 * IndentAmount, wr);
           wr.WriteLine("}");  // end of method
         }
       }
-      Indent(IndentAmount);
+      Indent(IndentAmount, wr);
       wr.WriteLine("}");  // end of class Helpers
       wr.WriteLine("}");  // end of namespace
     }
@@ -359,7 +352,7 @@ namespace Microsoft.Dafny {
       }
     }
 
-    void CompileDatatypeConstructors(DatatypeDecl dt, int indent)
+    void CompileDatatypeConstructors(DatatypeDecl dt, int indent, TextWriter wr)
     {
       Contract.Requires(dt != null);
 
@@ -372,20 +365,20 @@ namespace Microsoft.Dafny {
         //   public Dt__Lazy(Computer c) { this.c = c; }
         //   public Base_Dt<T> Get() { return c(); }
         // }
-        Indent(indent);
+        Indent(indent, wr);
         wr.WriteLine("public class {0}__Lazy{1} : Base_{0}{1} {{", dt.CompileName, typeParams);
         int ind = indent + IndentAmount;
-        Indent(ind);
+        Indent(ind, wr);
         wr.WriteLine("public delegate Base_{0}{1} Computer();", dt.CompileName, typeParams);
-        Indent(ind);
+        Indent(ind, wr);
         wr.WriteLine("public delegate Computer ComputerComputer();");
-        Indent(ind);
+        Indent(ind, wr);
         wr.WriteLine("Computer c;");
-        Indent(ind);
+        Indent(ind, wr);
         wr.WriteLine("public {0}__Lazy(Computer c) {{ this.c = c; }}", dt.CompileName);
-        Indent(ind);
+        Indent(ind, wr);
         wr.WriteLine("public Base_{0}{1} Get() {{ return c(); }}", dt.CompileName, typeParams);
-        Indent(indent);
+        Indent(indent, wr);
         wr.WriteLine("}");
       }
 
@@ -407,7 +400,7 @@ namespace Microsoft.Dafny {
         //     // ...
         //   }
         // }
-        Indent(indent);
+        Indent(indent, wr);
         wr.Write("public class {0}", DtCtorDeclarationName(ctor, dt.TypeArgs));
         wr.WriteLine(" : Base_{0}{1} {{", dt.CompileName, typeParams);
         int ind = indent + IndentAmount;
@@ -415,32 +408,32 @@ namespace Microsoft.Dafny {
         int i = 0;
         foreach (Formal arg in ctor.Formals) {
           if (!arg.IsGhost) {
-            Indent(ind);
-            wr.WriteLine("public readonly {0} @{1};", TypeName(arg.Type), FormalName(arg, i));
+            Indent(ind, wr);
+            wr.WriteLine("public readonly {0} @{1};", TypeName(arg.Type, wr), FormalName(arg, i));
             i++;
           }
         }
 
-        Indent(ind);
+        Indent(ind, wr);
         wr.Write("public {0}(", DtCtorDeclartionName(ctor));
-        WriteFormals("", ctor.Formals);
+        WriteFormals("", ctor.Formals, wr);
         wr.WriteLine(") {");
         i = 0;
         foreach (Formal arg in ctor.Formals) {
           if (!arg.IsGhost) {
-            Indent(ind + IndentAmount);
+            Indent(ind + IndentAmount, wr);
             wr.WriteLine("this.@{0} = @{0};", FormalName(arg, i));
             i++;
           }
         }
-        Indent(ind);  wr.WriteLine("}");
+        Indent(ind, wr);  wr.WriteLine("}");
 
         // Equals method
-        Indent(ind); wr.WriteLine("public override bool Equals(object other) {");
-        Indent(ind + IndentAmount);
+        Indent(ind, wr); wr.WriteLine("public override bool Equals(object other) {");
+        Indent(ind + IndentAmount, wr);
         wr.Write("var oth = other as {0}", DtCtorName(ctor, dt.TypeArgs));
         wr.WriteLine(";");
-        Indent(ind + IndentAmount);
+        Indent(ind + IndentAmount, wr);
         wr.Write("return oth != null");
         i = 0;
         foreach (Formal arg in ctor.Formals) {
@@ -455,56 +448,56 @@ namespace Microsoft.Dafny {
           }
         }
         wr.WriteLine(";");
-        Indent(ind); wr.WriteLine("}");
+        Indent(ind, wr); wr.WriteLine("}");
 
         // GetHashCode method (Uses the djb2 algorithm)
-        Indent(ind); wr.WriteLine("public override int GetHashCode() {");
-        Indent(ind + IndentAmount); wr.WriteLine("ulong hash = 5381;");
-        Indent(ind + IndentAmount); wr.WriteLine("hash = ((hash << 5) + hash) + {0};", constructorIndex);
+        Indent(ind, wr); wr.WriteLine("public override int GetHashCode() {");
+        Indent(ind + IndentAmount, wr); wr.WriteLine("ulong hash = 5381;");
+        Indent(ind + IndentAmount, wr); wr.WriteLine("hash = ((hash << 5) + hash) + {0};", constructorIndex);
         i = 0;
         foreach (Formal arg in ctor.Formals) {
           if (!arg.IsGhost) {
             string nm = FormalName(arg, i);
-            Indent(ind + IndentAmount); wr.WriteLine("hash = ((hash << 5) + hash) + ((ulong)this.@{0}.GetHashCode());", nm);
+            Indent(ind + IndentAmount, wr); wr.WriteLine("hash = ((hash << 5) + hash) + ((ulong)this.@{0}.GetHashCode());", nm);
             i++;
           }
         }
-        Indent(ind + IndentAmount); wr.WriteLine("return (int) hash;");
-        Indent(ind); wr.WriteLine("}");
+        Indent(ind + IndentAmount, wr); wr.WriteLine("return (int) hash;");
+        Indent(ind, wr); wr.WriteLine("}");
 
         if (dt is IndDatatypeDecl) {
-          Indent(ind); wr.WriteLine("public override string ToString() {");
+          Indent(ind, wr); wr.WriteLine("public override string ToString() {");
           string nm;
           if (dt is TupleTypeDecl) {
             nm = "";
           } else {
             nm = (dt.Module.IsDefaultModule ? "" : dt.Module.CompileName + ".") + dt.CompileName + "." + ctor.CompileName;
           }
-          Indent(ind + IndentAmount); wr.WriteLine("string s = \"{0}\";", nm);
+          Indent(ind + IndentAmount, wr); wr.WriteLine("string s = \"{0}\";", nm);
           if (ctor.Formals.Count != 0) {
-            Indent(ind + IndentAmount); wr.WriteLine("s += \"(\";");
+            Indent(ind + IndentAmount, wr); wr.WriteLine("s += \"(\";");
             i = 0;
             foreach (var arg in ctor.Formals) {
               if (!arg.IsGhost) {
                 if (i != 0) {
-                  Indent(ind + IndentAmount); wr.WriteLine("s += \", \";");
+                  Indent(ind + IndentAmount, wr); wr.WriteLine("s += \", \";");
                 }
-                Indent(ind + IndentAmount); wr.WriteLine("s += @{0}.ToString();", FormalName(arg, i));
+                Indent(ind + IndentAmount, wr); wr.WriteLine("s += @{0}.ToString();", FormalName(arg, i));
                 i++;
               }
             }
-            Indent(ind + IndentAmount); wr.WriteLine("s += \")\";");
+            Indent(ind + IndentAmount, wr); wr.WriteLine("s += \")\";");
           }
-          Indent(ind + IndentAmount); wr.WriteLine("return s;");
-          Indent(ind); wr.WriteLine("}");
+          Indent(ind + IndentAmount, wr); wr.WriteLine("return s;");
+          Indent(ind, wr); wr.WriteLine("}");
         }
 
-        Indent(indent);  wr.WriteLine("}");
+        Indent(indent, wr); wr.WriteLine("}");
       }
       constructorIndex++;
     }
 
-    void CompileDatatypeStruct(DatatypeDecl dt, int indent) {
+    void CompileDatatypeStruct(DatatypeDecl dt, int indent, TextWriter wr) {
       Contract.Requires(dt != null);
 
       // public struct Dt<T> : IDatatype{
@@ -548,46 +541,46 @@ namespace Microsoft.Dafny {
         DtT += DtT_TypeArgs;
       }
 
-      Indent(indent);
+      Indent(indent, wr);
       wr.WriteLine("public struct @{0} {{", DtT);
       int ind = indent + IndentAmount;
 
-      Indent(ind);
+      Indent(ind, wr);
       wr.WriteLine("Base_{0} _d;", DtT);
 
-      Indent(ind);
+      Indent(ind, wr);
       wr.WriteLine("public Base_{0} _D {{", DtT);
-      Indent(ind + IndentAmount);
+      Indent(ind + IndentAmount, wr);
       wr.WriteLine("get {");
-      Indent(ind + 2 * IndentAmount);
+      Indent(ind + 2 * IndentAmount, wr);
       wr.WriteLine("if (_d == null) {");
-      Indent(ind + 3 * IndentAmount);
+      Indent(ind + 3 * IndentAmount, wr);
       wr.WriteLine("_d = Default;");
       if (dt is CoDatatypeDecl) {
         string typeParams = dt.TypeArgs.Count == 0 ? "" : string.Format("<{0}>", TypeParameters(dt.TypeArgs));
-        Indent(ind + 2 * IndentAmount);
+        Indent(ind + 2 * IndentAmount, wr);
         wr.WriteLine("}} else if (_d is {0}__Lazy{1}) {{", dt.CompileName, typeParams);
-        Indent(ind + 3 * IndentAmount);
+        Indent(ind + 3 * IndentAmount, wr);
         wr.WriteLine("_d = (({0}__Lazy{1})_d).Get();", dt.CompileName, typeParams);
       }
-      Indent(ind + 2 * IndentAmount);  wr.WriteLine("}");
-      Indent(ind + 2 * IndentAmount);  wr.WriteLine("return _d;");
-      Indent(ind + IndentAmount);  wr.WriteLine("}");
-      Indent(ind);  wr.WriteLine("}");
+      Indent(ind + 2 * IndentAmount, wr); wr.WriteLine("}");
+      Indent(ind + 2 * IndentAmount, wr); wr.WriteLine("return _d;");
+      Indent(ind + IndentAmount, wr); wr.WriteLine("}");
+      Indent(ind, wr); wr.WriteLine("}");
 
-      Indent(ind);
+      Indent(ind, wr);
       wr.WriteLine("public @{0}(Base_{1} d) {{ this._d = d; }}", dt.CompileName, DtT);
 
-      Indent(ind);
+      Indent(ind, wr);
       wr.WriteLine("static Base_{0} theDefault;", DtT);
 
-      Indent(ind);
+      Indent(ind, wr);
       wr.WriteLine("public static Base_{0} Default {{", DtT);
-      Indent(ind + IndentAmount);
+      Indent(ind + IndentAmount, wr);
       wr.WriteLine("get {");
-      Indent(ind + 2 * IndentAmount);
+      Indent(ind + 2 * IndentAmount, wr);
       wr.WriteLine("if (theDefault == null) {");
-      Indent(ind + 3 * IndentAmount);
+      Indent(ind + 3 * IndentAmount, wr);
       wr.Write("theDefault = ");
 
       DatatypeCtor defaultCtor;
@@ -601,55 +594,55 @@ namespace Microsoft.Dafny {
       string sep = "";
       foreach (Formal f in defaultCtor.Formals) {
         if (!f.IsGhost) {
-          wr.Write("{0}{1}", sep, DefaultValue(f.Type));
+          wr.Write("{0}{1}", sep, DefaultValue(f.Type, wr));
           sep = ", ";
         }
       }
       wr.Write(")");
 
       wr.WriteLine(";");
-      Indent(ind + 2 * IndentAmount);
+      Indent(ind + 2 * IndentAmount, wr);
       wr.WriteLine("}");
-      Indent(ind + 2 * IndentAmount);
+      Indent(ind + 2 * IndentAmount, wr);
       wr.WriteLine("return theDefault;");
-      Indent(ind + IndentAmount); wr.WriteLine("}");
+      Indent(ind + IndentAmount, wr); wr.WriteLine("}");
 
-      Indent(ind);  wr.WriteLine("}");
+      Indent(ind, wr); wr.WriteLine("}");
 
-      Indent(ind);  wr.WriteLine("public override bool Equals(object other) {");
-      Indent(ind + IndentAmount);
+      Indent(ind, wr); wr.WriteLine("public override bool Equals(object other) {");
+      Indent(ind + IndentAmount, wr);
       wr.WriteLine("return other is @{0} && _D.Equals(((@{0})other)._D);", DtT);
-      Indent(ind);  wr.WriteLine("}");
+      Indent(ind, wr); wr.WriteLine("}");
 
-      Indent(ind);
+      Indent(ind, wr);
       wr.WriteLine("public override int GetHashCode() { return _D.GetHashCode(); }");
       if (dt is IndDatatypeDecl) {
-        Indent(ind);
+        Indent(ind, wr);
         wr.WriteLine("public override string ToString() { return _D.ToString(); }");
       }
 
       // query properties
       foreach (var ctor in dt.Ctors) {
         //   public bool is_Ctor0 { get { return _D is Dt_Ctor0; } }
-        Indent(ind);
+        Indent(ind, wr);
         wr.WriteLine("public bool is_{0} {{ get {{ return _D is {1}_{0}{2}; }} }}", ctor.CompileName, dt.CompileName, DtT_TypeArgs);
       }
       if (dt.HasFinitePossibleValues) {
-        Indent(ind);
+        Indent(ind, wr);
         wr.WriteLine("public static System.Collections.Generic.IEnumerable<@{0}> AllSingletonConstructors {{", DtT);
-        Indent(ind + IndentAmount);
+        Indent(ind + IndentAmount, wr);
         wr.WriteLine("get {");
         foreach (var ctr in dt.Ctors) {
           if (ctr.Formals.Count == 0) {
-            Indent(ind + IndentAmount + IndentAmount);
+            Indent(ind + IndentAmount + IndentAmount, wr);
             wr.WriteLine("yield return new @{0}(new {2}_{1}());", DtT, ctr.CompileName, dt.CompileName);
           }
         }
-        Indent(ind + IndentAmount + IndentAmount);
+        Indent(ind + IndentAmount + IndentAmount, wr);
         wr.WriteLine("yield break;");
-        Indent(ind + IndentAmount);
+        Indent(ind + IndentAmount, wr);
         wr.WriteLine("}");
-        Indent(ind);
+        Indent(ind, wr);
         wr.WriteLine("}");
       }
 
@@ -658,17 +651,17 @@ namespace Microsoft.Dafny {
         foreach (var arg in ctor.Formals) {
           if (!arg.IsGhost && arg.HasName) {
             //   public T0 @Dtor0 { get { return ((DT_Ctor)_D).@Dtor0; } }
-            Indent(ind);
-            wr.WriteLine("public {0} dtor_{1} {{ get {{ return (({2}_{3}{4})_D).@{1}; }} }}", TypeName(arg.Type), arg.CompileName, dt.CompileName, ctor.CompileName, DtT_TypeArgs);
+            Indent(ind, wr);
+            wr.WriteLine("public {0} dtor_{1} {{ get {{ return (({2}_{3}{4})_D).@{1}; }} }}", TypeName(arg.Type, wr), arg.CompileName, dt.CompileName, ctor.CompileName, DtT_TypeArgs);
           }
         }
       }
 
-      Indent(indent);
+      Indent(indent, wr);
       wr.WriteLine("}");
     }
 
-    int WriteFormals(string sep, List<Formal/*!*/>/*!*/ formals)
+    int WriteFormals(string sep, List<Formal/*!*/>/*!*/ formals, TextWriter wr)
     {
       Contract.Requires(sep != null);
       Contract.Requires(cce.NonNullElements(formals));
@@ -676,7 +669,7 @@ namespace Microsoft.Dafny {
       foreach (Formal arg in formals) {
         if (!arg.IsGhost) {
           string name = FormalName(arg, i);
-          wr.Write("{0}{1}{2} @{3}", sep, arg.InParam ? "" : "out ", TypeName(arg.Type), name);
+          wr.Write("{0}{1}{2} @{3}", sep, arg.InParam ? "" : "out ", TypeName(arg.Type, wr), name);
           sep = ", ";
           i++;
         }
@@ -732,13 +725,13 @@ namespace Microsoft.Dafny {
       return s;
     }
 
-    string DtCtorName(DatatypeCtor ctor, List<Type> typeArgs) {
+    string DtCtorName(DatatypeCtor ctor, List<Type> typeArgs, TextWriter wr) {
       Contract.Requires(ctor != null);
       Contract.Ensures(Contract.Result<string>() != null);
 
       var s = DtCtorName(ctor);
       if (typeArgs != null && typeArgs.Count != 0) {
-        s += "<" + TypeNames(typeArgs) + ">";
+        s += "<" + TypeNames(typeArgs, wr) + ">";
       }
       return s;
     }
@@ -776,7 +769,7 @@ namespace Microsoft.Dafny {
       }
     }
 
-    void CompileClassMembers(ClassDecl c, bool forCompanionClass, int indent) {
+    void CompileClassMembers(ClassDecl c, bool forCompanionClass, int indent, TextWriter wr) {
       Contract.Requires(c != null);
       Contract.Requires(!forCompanionClass || c is TraitDecl);
       Contract.Requires(0 <= indent);
@@ -785,9 +778,9 @@ namespace Microsoft.Dafny {
         if (member is Field) {
           var f = (Field)member;
           // every field is inherited
-          Indent(indent);
-          wr.WriteLine("public {0} @_{1};", TypeName(f.Type), f.CompileName);
-          wr.Write("public {0} @{1}", TypeName(f.Type), f.CompileName);
+          Indent(indent, wr);
+          wr.WriteLine("public {0} @_{1};", TypeName(f.Type, wr), f.CompileName);
+          wr.Write("public {0} @{1}", TypeName(f.Type, wr), f.CompileName);
           wr.WriteLine(" {");
           wr.WriteLine(" get { ");
           wr.Write("return this.@_{0};", f.CompileName);
@@ -799,11 +792,11 @@ namespace Microsoft.Dafny {
         } else if (member is Function) {
           var f = (Function)member;
           Contract.Assert(f.Body != null);
-          CompileFunction(indent, f);
+          CompileFunction(indent, f, wr);
         } else if (member is Method) {
           var method = (Method)member;
           Contract.Assert(method.Body != null);
-          CompileMethod(c, indent, method);
+          CompileMethod(c, indent, method, wr);
         } else {
           Contract.Assert(false);  // unexpected member
         }
@@ -814,12 +807,12 @@ namespace Microsoft.Dafny {
           if (f.IsGhost || forCompanionClass) {
             // emit nothing
           } else if (c is TraitDecl) {
-            Indent(indent);
-            wr.Write("{0} @{1}", TypeName(f.Type), f.CompileName);
+            Indent(indent, wr);
+            wr.Write("{0} @{1}", TypeName(f.Type, wr), f.CompileName);
             wr.WriteLine(" { get; set; }");
           } else {
-            Indent(indent);
-            wr.WriteLine("public {0} @{1} = {2};", TypeName(f.Type), f.CompileName, DefaultValue(f.Type));
+            Indent(indent, wr);
+            wr.WriteLine("public {0} @{1} = {2};", TypeName(f.Type, wr), f.CompileName, DefaultValue(f.Type, wr));
           }
         } else if (member is Function) {
           var f = (Function)member;
@@ -828,29 +821,29 @@ namespace Microsoft.Dafny {
             if (forCompanionClass || Attributes.Contains(f.Attributes, "axiom")) {
               // suppress error message (in the case of "forCompanionClass", the non-forCompanionClass call will produce the error message)
             } else {
-              Error("Function {0} has no body", f.FullName);
+              Error("Function {0} has no body", wr, f.FullName);
             }
           } else if (f.IsGhost) {
             // nothing to compile, but we do check for assumes
             if (f.Body == null) {
               Contract.Assert(c is TraitDecl && !f.IsStatic);
             } else {
-              var v = new CheckHasNoAssumes_Visitor(this);
+              var v = new CheckHasNoAssumes_Visitor(this, wr);
               v.Visit(f.Body);
             }
           } else if (c is TraitDecl && !forCompanionClass) {
             // include it, unless it's static
             if (!f.IsStatic) {
-              Indent(indent);
-              wr.Write("{0} @{1}", TypeName(f.ResultType), f.CompileName);
+              Indent(indent, wr);
+              wr.Write("{0} @{1}", TypeName(f.ResultType, wr), f.CompileName);
               wr.Write("(");
-              WriteFormals("", f.Formals);
+              WriteFormals("", f.Formals, wr);
               wr.WriteLine(");");
             }
           } else if (forCompanionClass && !f.IsStatic) {
             // companion classes only has static members
           } else {
-            CompileFunction(indent, f);
+            CompileFunction(indent, f, wr);
           }
         } else if (member is Method) {
           var m = (Method)member;
@@ -859,30 +852,30 @@ namespace Microsoft.Dafny {
             if (forCompanionClass || Attributes.Contains(m.Attributes, "axiom")) {
               // suppress error message (in the case of "forCompanionClass", the non-forCompanionClass call will produce the error message)
             } else {
-              Error("Method {0} has no body", m.FullName);
+              Error("Method {0} has no body", wr, m.FullName);
             }
           } else if (m.IsGhost) {
             // nothing to compile, but we do check for assumes
             if (m.Body == null) {
               Contract.Assert(c is TraitDecl && !m.IsStatic);
             } else {
-              var v = new CheckHasNoAssumes_Visitor(this);
+              var v = new CheckHasNoAssumes_Visitor(this, wr);
               v.Visit(m.Body);
             }
           } else if (c is TraitDecl && !forCompanionClass) {
             // include it, unless it's static
             if (!m.IsStatic) {
-              Indent(indent);
+              Indent(indent, wr);
               wr.Write("void @{0}", m.CompileName);
               wr.Write("(");
-              int nIns = WriteFormals("", m.Ins);
-              WriteFormals(nIns == 0 ? "" : ", ", m.Outs);
+              int nIns = WriteFormals("", m.Ins, wr);
+              WriteFormals(nIns == 0 ? "" : ", ", m.Outs, wr);
               wr.WriteLine(");");
             }
           } else if (forCompanionClass && !m.IsStatic) {
             // companion classes only has static members
           } else {
-            CompileMethod(c, indent, m);
+            CompileMethod(c, indent, m, wr);
           }
         } else {
           Contract.Assert(false); throw new cce.UnreachableException();  // unexpected member
@@ -890,59 +883,59 @@ namespace Microsoft.Dafny {
       }
     }
 
-    private void CompileFunction(int indent, Function f) {
-      Indent(indent);
-      wr.Write("public {0}{1} @{2}", f.IsStatic ? "static " : "", TypeName(f.ResultType), f.CompileName);
+    private void CompileFunction(int indent, Function f, TextWriter wr) {
+      Indent(indent, wr);
+      wr.Write("public {0}{1} @{2}", f.IsStatic ? "static " : "", TypeName(f.ResultType, wr), f.CompileName);
       if (f.TypeArgs.Count != 0) {
         wr.Write("<{0}>", TypeParameters(f.TypeArgs));
       }
       wr.Write("(");
-      WriteFormals("", f.Formals);
+      WriteFormals("", f.Formals, wr);
       wr.WriteLine(") {");
-      CompileReturnBody(f.Body, indent + IndentAmount);
-      Indent(indent); wr.WriteLine("}");
+      CompileReturnBody(f.Body, indent + IndentAmount, wr);
+      Indent(indent, wr); wr.WriteLine("}");
     }
 
-    private void CompileMethod(ClassDecl c, int indent, Method m) {
-      Indent(indent);
+    private void CompileMethod(ClassDecl c, int indent, Method m, TextWriter wr) {
+      Indent(indent, wr);
       wr.Write("public {0}void @{1}", m.IsStatic ? "static " : "", m.CompileName);
       if (m.TypeArgs.Count != 0) {
         wr.Write("<{0}>", TypeParameters(m.TypeArgs));
       }
       wr.Write("(");
-      int nIns = WriteFormals("", m.Ins);
-      WriteFormals(nIns == 0 ? "" : ", ", m.Outs);
+      int nIns = WriteFormals("", m.Ins, wr);
+      WriteFormals(nIns == 0 ? "" : ", ", m.Outs, wr);
       wr.WriteLine(")");
-      Indent(indent); wr.WriteLine("{");
+      Indent(indent, wr); wr.WriteLine("{");
       foreach (Formal p in m.Outs) {
         if (!p.IsGhost) {
-          Indent(indent + IndentAmount);
-          wr.WriteLine("@{0} = {1};", p.CompileName, DefaultValue(p.Type));
+          Indent(indent + IndentAmount, wr);
+          wr.WriteLine("@{0} = {1};", p.CompileName, DefaultValue(p.Type, wr));
         }
       }
       if (m.Body == null) {
-        Error("Method {0} has no body", m.FullName);
+        Error("Method {0} has no body", wr, m.FullName);
       } else {
         if (m.IsTailRecursive) {
-          Indent(indent); wr.WriteLine("TAIL_CALL_START: ;");
+          Indent(indent, wr); wr.WriteLine("TAIL_CALL_START: ;");
           if (!m.IsStatic) {
-            Indent(indent + IndentAmount); wr.WriteLine("var _this = this;");
+            Indent(indent + IndentAmount, wr); wr.WriteLine("var _this = this;");
           }
         }
         Contract.Assert(enclosingMethod == null);
         enclosingMethod = m;
-        TrStmtList(m.Body.Body, indent);
+        TrStmtList(m.Body.Body, indent, wr);
         Contract.Assert(enclosingMethod == m);
         enclosingMethod = null;
       }
-      Indent(indent); wr.WriteLine("}");
+      Indent(indent, wr); wr.WriteLine("}");
 
       // allow the Main method to be an instance method
       if (!m.IsStatic && IsMain(m)) {
-        Indent(indent);
+        Indent(indent, wr);
         wr.WriteLine("public static void Main(string[] args) {");
         Contract.Assert(m.EnclosingClass == c);
-        Indent(indent + IndentAmount);
+        Indent(indent + IndentAmount, wr);
         wr.Write("@{0} b = new @{0}", c.CompileName);
         if (c.TypeArgs.Count != 0) {
           // instantiate every parameter, it doesn't particularly matter how
@@ -955,12 +948,12 @@ namespace Microsoft.Dafny {
           wr.Write(">");
         }
         wr.WriteLine("();");
-        Indent(indent + IndentAmount); wr.WriteLine("b.@Main();");
-        Indent(indent); wr.WriteLine("}");
+        Indent(indent + IndentAmount, wr); wr.WriteLine("b.@Main();");
+        Indent(indent, wr); wr.WriteLine("}");
       }
     }
 
-    void TrCasePatternOpt(CasePattern pat, Expression rhs, string rhs_string, int indent) {
+    void TrCasePatternOpt(CasePattern pat, Expression rhs, string rhs_string, int indent, TextWriter wr, bool inLetExprBody) {
       Contract.Requires(pat != null);
       Contract.Requires(pat.Var != null || rhs != null);
       if (pat.Var != null) {
@@ -970,10 +963,10 @@ namespace Microsoft.Dafny {
         // var x := G;
         var bv = pat.Var;
         if (!bv.IsGhost) {
-          Indent(indent);
-          wr.Write("{0} {1} = ", TypeName(bv.Type), "@" + bv.CompileName);
+          Indent(indent, wr);
+          wr.Write("{0} {1} = ", TypeName(bv.Type, wr), "@" + bv.CompileName);
           if (rhs != null) {
-            TrExpr(rhs);
+            TrExpr(rhs, wr, inLetExprBody);
           } else {
             wr.Write(rhs_string);
           }
@@ -992,9 +985,9 @@ namespace Microsoft.Dafny {
 
         // Create the temporary variable to hold G
         var tmp_name = idGenerator.FreshId("_let_tmp_rhs");
-        Indent(indent);
-        wr.Write("{0} {1} = ", TypeName(rhs.Type), tmp_name);
-        TrExpr(rhs);
+        Indent(indent, wr);
+        wr.Write("{0} {1} = ", TypeName(rhs.Type, wr), tmp_name);
+        TrExpr(rhs, wr, inLetExprBody);
         wr.WriteLine(";");
 
         var k = 0;  // number of non-ghost formals processed
@@ -1005,21 +998,21 @@ namespace Microsoft.Dafny {
             // nothing to compile, but do a sanity check
             Contract.Assert(!Contract.Exists(arg.Vars, bv => !bv.IsGhost));
           } else {            
-            TrCasePatternOpt(arg, null, string.Format("(({0})({1})._D).@{2}", DtCtorName(ctor, ((DatatypeValue)pat.Expr).InferredTypeArgs), tmp_name, FormalName(formal, k)), indent);
+            TrCasePatternOpt(arg, null, string.Format("(({0})({1})._D).@{2}", DtCtorName(ctor, ((DatatypeValue)pat.Expr).InferredTypeArgs, wr), tmp_name, FormalName(formal, k)), indent, wr, inLetExprBody);
             k++;
           }
         }
       }
     }
 
-    void ReturnExpr(Expression expr, int indent) {
-      Indent(indent);
+    void ReturnExpr(Expression expr, int indent, TextWriter wr, bool inLetExprBody) {
+      Indent(indent, wr);
       wr.Write("return ");
-      TrExpr(expr);
+      TrExpr(expr, wr, inLetExprBody);
       wr.WriteLine(";");
     }
 
-    void TrExprOpt(Expression expr, int indent) {
+    void TrExprOpt(Expression expr, int indent, TextWriter wr, bool inLetExprBody) {
       Contract.Requires(expr != null);
       if (expr is LetExpr) {
         var e = (LetExpr)expr;
@@ -1027,25 +1020,25 @@ namespace Microsoft.Dafny {
           for (int i = 0; i < e.LHSs.Count; i++) {
             var lhs = e.LHSs[i];
             if (Contract.Exists(lhs.Vars, bv => !bv.IsGhost)) {
-              TrCasePatternOpt(lhs, e.RHSs[i], null, indent);
+              TrCasePatternOpt(lhs, e.RHSs[i], null, indent, wr, inLetExprBody);
             }            
           }
-          TrExprOpt(e.Body, indent);
+          TrExprOpt(e.Body, indent, wr, inLetExprBody);
         } else {
           // We haven't optimized the other cases, so fallback to normal compilation
-          ReturnExpr(e, indent);
+          ReturnExpr(e, indent, wr, inLetExprBody);
         }
       } else if (expr is ITEExpr) {
         ITEExpr e = (ITEExpr)expr;
-        Indent(indent);
+        Indent(indent, wr);
         wr.Write("if (");
-        TrExpr(e.Test);
+        TrExpr(e.Test, wr, inLetExprBody);
         wr.Write(") {\n");
-        TrExprOpt(e.Thn, indent + IndentAmount);
-        Indent(indent);
+        TrExprOpt(e.Thn, indent + IndentAmount, wr, inLetExprBody);
+        Indent(indent, wr);
         wr.WriteLine("} else {");
-        TrExprOpt(e.Els, indent + IndentAmount);
-        Indent(indent);
+        TrExprOpt(e.Els, indent + IndentAmount, wr, inLetExprBody);
+        Indent(indent, wr);
         wr.WriteLine("}");
       } else if (expr is MatchExpr) {
         var e = (MatchExpr)expr;   
@@ -1060,9 +1053,9 @@ namespace Microsoft.Dafny {
         //     ...
         //   }
         string source = idGenerator.FreshId("_source");
-        Indent(indent);
-        wr.Write("{0} {1} = ", TypeName(e.Source.Type), source);
-        TrExpr(e.Source);
+        Indent(indent, wr);
+        wr.Write("{0} {1} = ", TypeName(e.Source.Type, wr), source);
+        TrExpr(e.Source, wr, inLetExprBody);
         wr.WriteLine(";");        
 
         if (e.Cases.Count == 0) {
@@ -1073,28 +1066,28 @@ namespace Microsoft.Dafny {
           var sourceType = (UserDefinedType)e.Source.Type.NormalizeExpand();
           foreach (MatchCaseExpr mc in e.Cases) {
             //Indent(indent);
-            MatchCasePrelude(source, sourceType, cce.NonNull(mc.Ctor), mc.Arguments, i, e.Cases.Count, indent);
-            TrExprOpt(mc.Body, indent + IndentAmount);
+            MatchCasePrelude(source, sourceType, cce.NonNull(mc.Ctor), mc.Arguments, i, e.Cases.Count, indent, wr);
+            TrExprOpt(mc.Body, indent + IndentAmount, wr, inLetExprBody);
             i++;
           }
-          Indent(indent);
+          Indent(indent, wr);
           wr.WriteLine("}");
         }        
       }  else if (expr is StmtExpr) {
         var e = (StmtExpr)expr;
-        TrExprOpt(e.E, indent);
+        TrExprOpt(e.E, indent, wr, inLetExprBody);
       } else {
         // We haven't optimized any other cases, so fallback to normal compilation
-        ReturnExpr(expr, indent);
+        ReturnExpr(expr, indent, wr, inLetExprBody);
       }
     }
 
-    void CompileReturnBody(Expression body, int indent) {
+    void CompileReturnBody(Expression body, int indent, TextWriter wr) {
       Contract.Requires(0 <= indent);
       body = body.Resolved;
       //Indent(indent);
       //wr.Write("return ");
-      TrExprOpt(body, indent);
+      TrExprOpt(body, indent, wr, false);
       //wr.WriteLine(";");
     }
 
@@ -1113,23 +1106,23 @@ namespace Microsoft.Dafny {
       return null;
     }
 
-    string TypeName_Companion(Type type) {
+    string TypeName_Companion(Type type, TextWriter wr) {
       Contract.Requires(type != null);
       var udt = type as UserDefinedType;
       if (udt != null && udt.ResolvedClass is TraitDecl) {
         string s = udt.FullCompanionCompileName;
         if (udt.TypeArgs.Count != 0) {
           if (udt.TypeArgs.Exists(argType => argType is ObjectType)) {
-            Error("compilation does not support type 'object' as a type parameter; consider introducing a ghost");
+            Error("compilation does not support type 'object' as a type parameter; consider introducing a ghost", wr);
           }
-          s += "<" + TypeNames(udt.TypeArgs) + ">";
+          s += "<" + TypeNames(udt.TypeArgs, wr) + ">";
         }
         return s;
       } else {
-        return TypeName(type);
+        return TypeName(type, wr);
       }
     }
-    string TypeName(Type type)
+    string TypeName(Type type, TextWriter wr)
     {
       Contract.Requires(type != null);
       Contract.Ensures(Contract.Result<string>() != null);
@@ -1153,14 +1146,14 @@ namespace Microsoft.Dafny {
         if (nativeType != null) {
           return nativeType.Name;
         }
-        return TypeName(xType.AsNewtype.BaseType);
+        return TypeName(xType.AsNewtype.BaseType, wr);
       } else if (xType is ObjectType) {
         return "object";
       } else if (xType.IsArrayType) {
         ArrayClassDecl at = xType.AsArrayType;
         Contract.Assert(at != null);  // follows from type.IsArrayType
         Type elType = UserDefinedType.ArrayElementType(xType);
-        string name = TypeName(elType) + "[";
+        string name = TypeName(elType, wr) + "[";
         for (int i = 1; i < at.Dims; i++) {
           name += ",";
         }
@@ -1184,54 +1177,60 @@ namespace Microsoft.Dafny {
           }
           s = rc.FullCompileName;
         }
-        return TypeName_UDT(s, udt.TypeArgs);
+        return TypeName_UDT(s, udt.TypeArgs, wr);
       } else if (xType is SetType) {
         Type argType = ((SetType)xType).Arg;
         if (argType is ObjectType) {
-          Error("compilation of set<object> is not supported; consider introducing a ghost");
+          Error("compilation of set<object> is not supported; consider introducing a ghost", wr);
         }
-        return DafnySetClass + "<" + TypeName(argType) + ">";
+        return DafnySetClass + "<" + TypeName(argType, wr) + ">";
       } else if (xType is SeqType) {
         Type argType = ((SeqType)xType).Arg;
         if (argType is ObjectType) {
-          Error("compilation of seq<object> is not supported; consider introducing a ghost");
+          Error("compilation of seq<object> is not supported; consider introducing a ghost", wr);
         }
-        return DafnySeqClass + "<" + TypeName(argType) + ">";
+        return DafnySeqClass + "<" + TypeName(argType, wr) + ">";
       } else if (xType is MultiSetType) {
         Type argType = ((MultiSetType)xType).Arg;
         if (argType is ObjectType) {
-          Error("compilation of seq<object> is not supported; consider introducing a ghost");
+          Error("compilation of seq<object> is not supported; consider introducing a ghost", wr);
         }
-        return DafnyMultiSetClass + "<" + TypeName(argType) + ">";
+        return DafnyMultiSetClass + "<" + TypeName(argType, wr) + ">";
       } else if (xType is MapType) {
         Type domType = ((MapType)xType).Domain;
         Type ranType = ((MapType)xType).Range;
         if (domType is ObjectType || ranType is ObjectType) {
-          Error("compilation of map<object, _> or map<_, object> is not supported; consider introducing a ghost");
+          Error("compilation of map<object, _> or map<_, object> is not supported; consider introducing a ghost", wr);
         }
-        return DafnyMapClass + "<" + TypeName(domType) + "," + TypeName(ranType) + ">";
+        return DafnyMapClass + "<" + TypeName(domType, wr) + "," + TypeName(ranType, wr) + ">";
       } else {
         Contract.Assert(false); throw new cce.UnreachableException();  // unexpected type
       }
     }
 
-    string TypeName_UDT(string fullCompileName, List<Type> typeArgs) {
+    string TypeName_UDT(string fullCompileName, List<Type> typeArgs, TextWriter wr) {
       Contract.Requires(fullCompileName != null);
       Contract.Requires(typeArgs != null);
       string s = "@" + fullCompileName;
       if (typeArgs.Count != 0) {
         if (typeArgs.Exists(argType => argType is ObjectType)) {
-          Error("compilation does not support type 'object' as a type parameter; consider introducing a ghost");
+          Error("compilation does not support type 'object' as a type parameter; consider introducing a ghost", wr);
         }
-        s += "<" + TypeNames(typeArgs) + ">";
+        s += "<" + TypeNames(typeArgs, wr) + ">";
       }
       return s;
     }
 
-    string/*!*/ TypeNames(List<Type/*!*/>/*!*/ types) {
+    string/*!*/ TypeNames(List<Type/*!*/>/*!*/ types, TextWriter wr) {
       Contract.Requires(cce.NonNullElements(types));
       Contract.Ensures(Contract.Result<string>() != null);
-      return Util.Comma(types, TypeName);
+      string res = "";
+      string c = "";
+      foreach (var t in types) {
+        res += c + TypeName(t, wr);
+        c = ",";
+      }
+      return res;
     }
 
     string/*!*/ TypeParameters(List<TypeParameter/*!*/>/*!*/ targs) {
@@ -1241,7 +1240,7 @@ namespace Microsoft.Dafny {
       return Util.Comma(targs, tp => "@" + tp.CompileName);
     }
 
-    string DefaultValue(Type type)
+    string DefaultValue(Type type, TextWriter wr)
     {
       Contract.Requires(type != null);
       Contract.Ensures(Contract.Result<string>() != null);
@@ -1264,9 +1263,9 @@ namespace Microsoft.Dafny {
         if (xType.AsNewtype.NativeType != null) {
           return "0";
         }
-        return DefaultValue(xType.AsNewtype.BaseType);
+        return DefaultValue(xType.AsNewtype.BaseType, wr);
       } else if (xType.IsRefType) {
-        return string.Format("({0})null", TypeName(xType));
+        return string.Format("({0})null", TypeName(xType, wr));
       } else if (xType.IsDatatype) {
         var udt = (UserDefinedType)xType;
         var s = "@" + udt.FullCompileName;
@@ -1287,7 +1286,7 @@ namespace Microsoft.Dafny {
           s = "@" + rc.FullCompileName;
         }
         if (udt.TypeArgs.Count != 0) {
-          s += "<" + TypeNames(udt.TypeArgs) + ">";
+          s += "<" + TypeNames(udt.TypeArgs, wr) + ">";
         }
         return string.Format("new {0}()", s);
       } else if (xType.IsTypeParameter) {
@@ -1295,18 +1294,18 @@ namespace Microsoft.Dafny {
         string s = "default(@" + udt.FullCompileName;
         if (udt.TypeArgs.Count != 0)
         {
-          s += "<" + TypeNames(udt.TypeArgs) + ">";
+          s += "<" + TypeNames(udt.TypeArgs, wr) + ">";
         }
         s += ")";
         return s;
       } else if (xType is SetType) {
-        return DafnySetClass + "<" + TypeName(((SetType)xType).Arg) + ">.Empty";
+        return DafnySetClass + "<" + TypeName(((SetType)xType).Arg, wr) + ">.Empty";
       } else if (xType is MultiSetType) {
-        return DafnyMultiSetClass + "<" + TypeName(((MultiSetType)xType).Arg) + ">.Empty";
+        return DafnyMultiSetClass + "<" + TypeName(((MultiSetType)xType).Arg, wr) + ">.Empty";
       } else if (xType is SeqType) {
-        return DafnySeqClass + "<" + TypeName(((SeqType)xType).Arg) + ">.Empty";
+        return DafnySeqClass + "<" + TypeName(((SeqType)xType).Arg, wr) + ">.Empty";
       } else if (xType is MapType) {
-        return TypeName(xType)+".Empty";
+        return TypeName(xType, wr) + ".Empty";
       } else if (xType is ArrowType) {
         return "null";
       } else {
@@ -1319,59 +1318,61 @@ namespace Microsoft.Dafny {
     public class CheckHasNoAssumes_Visitor : BottomUpVisitor
     {
       readonly Compiler compiler;
-      public CheckHasNoAssumes_Visitor(Compiler c) {
+      TextWriter wr;
+      public CheckHasNoAssumes_Visitor(Compiler c, TextWriter wr) {
         Contract.Requires(c != null);
         compiler = c;
+        this.wr = wr;
       }
       protected override void VisitOneStmt(Statement stmt) {
         if (stmt is AssumeStmt) {
-          compiler.Error("an assume statement cannot be compiled (line {0})", stmt.Tok.line);
+          compiler.Error("an assume statement cannot be compiled (line {0})", wr, stmt.Tok.line);
         } else if (stmt is AssignSuchThatStmt) {
           var s = (AssignSuchThatStmt)stmt;
           if (s.AssumeToken != null) {
-            compiler.Error("an assume statement cannot be compiled (line {0})", s.AssumeToken.line);
+            compiler.Error("an assume statement cannot be compiled (line {0})", wr, s.AssumeToken.line);
           }
         } else if (stmt is ForallStmt) {
           var s = (ForallStmt)stmt;
           if (s.Body == null) {
-            compiler.Error("a forall statement without a body cannot be compiled (line {0})", stmt.Tok.line);
+            compiler.Error("a forall statement without a body cannot be compiled (line {0})", wr, stmt.Tok.line);
           }
         } else if (stmt is WhileStmt) {
           var s = (WhileStmt)stmt;
           if (s.Body == null) {
-            compiler.Error("a while statement without a body cannot be compiled (line {0})", stmt.Tok.line);
+            compiler.Error("a while statement without a body cannot be compiled (line {0})", wr, stmt.Tok.line);
           }
         }
       }
     }
 
-    void TrStmt(Statement stmt, int indent)
+    TextWriter TrStmt(Statement stmt, int indent)
     {
       Contract.Requires(stmt != null);
+      TextWriter wr = new StringWriter();
       if (stmt.IsGhost) {
-        var v = new CheckHasNoAssumes_Visitor(this);
+        var v = new CheckHasNoAssumes_Visitor(this, wr);
         v.Visit(stmt);
-        Indent(indent); wr.WriteLine("{ }");
-        return;
+        Indent(indent, wr); wr.WriteLine("{ }");
+        return wr;
       }
-
       if (stmt is PrintStmt) {
         PrintStmt s = (PrintStmt)stmt;
         foreach (var arg in s.Args) {
-          Indent(indent);
+          Indent(indent, wr);
           wr.Write("System.Console.Write(");
-          TrExpr(arg);
+          TrExpr(arg, wr, false);
           wr.WriteLine(");");
         }
       } else if (stmt is BreakStmt) {
         var s = (BreakStmt)stmt;
-        Indent(indent);
+        Indent(indent, wr);
         wr.WriteLine("goto after_{0};", s.TargetStmt.Labels.Data.AssignUniqueId("after_", idGenerator));
       } else if (stmt is ProduceStmt) {
         var s = (ProduceStmt)stmt;
         if (s.hiddenUpdate != null)
-          TrStmt(s.hiddenUpdate, indent);
-        Indent(indent);
+          wr.Write(TrStmt(s.hiddenUpdate, indent).ToString());
+        Indent(indent, wr);
         if (s is YieldStmt) {
           wr.WriteLine("yield return null;");
         } else {
@@ -1381,7 +1382,7 @@ namespace Microsoft.Dafny {
         var s = (UpdateStmt)stmt;
         var resolved = s.ResolvedStatements;
         if (resolved.Count == 1) {
-          TrStmt(resolved[0], indent);
+          wr.Write(TrStmt(resolved[0], indent).ToString());
         } else {
           // multi-assignment
           Contract.Assert(s.Lhss.Count == resolved.Count);
@@ -1393,17 +1394,17 @@ namespace Microsoft.Dafny {
               var lhs = s.Lhss[i];
               var rhs = s.Rhss[i];
               if (!(rhs is HavocRhs)) {
-                lvalues.Add(CreateLvalue(lhs, indent));
+                lvalues.Add(CreateLvalue(lhs, indent, wr));
 
                 string target = idGenerator.FreshId("_rhs");
                 rhss.Add(target);
-                TrRhs("var " + target, null, rhs, indent);
+                TrRhs("var " + target, null, rhs, indent, wr);
               }
             }
           }
           Contract.Assert(lvalues.Count == rhss.Count);
           for (int i = 0; i < lvalues.Count; i++) {
-            Indent(indent);
+            Indent(indent, wr);
             wr.WriteLine("{0} = {1};", lvalues[i], rhss[i]);
           }
         }
@@ -1411,32 +1412,32 @@ namespace Microsoft.Dafny {
       } else if (stmt is AssignStmt) {
         AssignStmt s = (AssignStmt)stmt;
         Contract.Assert(!(s.Lhs is SeqSelectExpr) || ((SeqSelectExpr)s.Lhs).SelectOne);  // multi-element array assignments are not allowed
-        TrRhs(null, s.Lhs, s.Rhs, indent);
+        TrRhs(null, s.Lhs, s.Rhs, indent, wr);
 
       } else if (stmt is AssignSuchThatStmt) {
         var s = (AssignSuchThatStmt)stmt;
         if (s.AssumeToken != null) {
           // Note, a non-ghost AssignSuchThatStmt may contain an assume
-          Error("an assume statement cannot be compiled (line {0})", s.AssumeToken.line);
+          Error("an assume statement cannot be compiled (line {0})", wr, s.AssumeToken.line);
         } else if (s.MissingBounds != null) {
           foreach (var bv in s.MissingBounds) {
-            Error("this assign-such-that statement is too advanced for the current compiler; Dafny's heuristics cannot find any bound for variable '{0}' (line {1})", bv.Name, s.Tok.line);
+            Error("this assign-such-that statement is too advanced for the current compiler; Dafny's heuristics cannot find any bound for variable '{0}' (line {1})", wr, bv.Name, s.Tok.line);
           }
         } else {
           Contract.Assert(s.Bounds != null);  // follows from s.MissingBounds == null
           TrAssignSuchThat(indent,
             s.Lhss.ConvertAll(lhs => ((IdentifierExpr)lhs.Resolved).Var),  // the resolver allows only IdentifierExpr left-hand sides
-            s.Expr, s.Bounds, s.Tok.line);
+            s.Expr, s.Bounds, s.Tok.line, wr, false);
         }
 
       } else if (stmt is CallStmt) {
         CallStmt s = (CallStmt)stmt;
-        TrCallStmt(s, null, indent);
+        wr.Write(TrCallStmt(s, null, indent).ToString());
 
       } else if (stmt is BlockStmt) {
-        Indent(indent);  wr.WriteLine("{");
-        TrStmtList(((BlockStmt)stmt).Body, indent);
-        Indent(indent);  wr.WriteLine("}");
+        Indent(indent, wr); wr.WriteLine("{");
+        TrStmtList(((BlockStmt)stmt).Body, indent, wr);
+        Indent(indent, wr); wr.WriteLine("}");
 
       } else if (stmt is IfStmt) {
         IfStmt s = (IfStmt)stmt;
@@ -1445,45 +1446,45 @@ namespace Microsoft.Dafny {
           if (s.Els == null) {
             // let's compile the "else" branch, since that involves no work
             // (still, let's leave a marker in the source code to indicate that this is what we did)
-            Indent(indent);
+            Indent(indent, wr);
             wr.WriteLine("if (!false) { }");
           } else {
             // let's compile the "then" branch
-            Indent(indent);
+            Indent(indent, wr);
             wr.WriteLine("if (true)");
-            TrStmt(s.Thn, indent);
+            wr.Write(TrStmt(s.Thn, indent).ToString());
           }
         } else {
-          Indent(indent);  wr.Write("if (");
-          TrExpr(s.IsExistentialGuard ? Translator.AlphaRename((ExistsExpr)s.Guard, "eg_d", new Translator(null)) : s.Guard);
+          Indent(indent, wr); wr.Write("if (");
+          TrExpr(s.IsExistentialGuard ? Translator.AlphaRename((ExistsExpr)s.Guard, "eg_d", new Translator(null)) : s.Guard, wr, false);
           wr.WriteLine(")");
 
           // We'd like to do "TrStmt(s.Thn, indent)", except we want the scope of any existential variables to come inside the block
-          Indent(indent); wr.WriteLine("{");
+          Indent(indent, wr); wr.WriteLine("{");
           if (s.IsExistentialGuard) {
-            IntroduceAndAssignBoundVars(indent + IndentAmount, (ExistsExpr)s.Guard);
+            IntroduceAndAssignBoundVars(indent + IndentAmount, (ExistsExpr)s.Guard, wr);
           }
-          TrStmtList(s.Thn.Body, indent);
-          Indent(indent); wr.WriteLine("}");
+          TrStmtList(s.Thn.Body, indent, wr);
+          Indent(indent, wr); wr.WriteLine("}");
 
           if (s.Els != null) {
-            Indent(indent);  wr.WriteLine("else");
-            TrStmt(s.Els, indent);
+            Indent(indent, wr); wr.WriteLine("else");
+            wr.Write(TrStmt(s.Els, indent).ToString());
           }
         }
 
       } else if (stmt is AlternativeStmt) {
         var s = (AlternativeStmt)stmt;
-        Indent(indent);
+        Indent(indent, wr);
         foreach (var alternative in s.Alternatives) {
           wr.Write("if (");
-          TrExpr(alternative.IsExistentialGuard ? Translator.AlphaRename((ExistsExpr)alternative.Guard, "eg_d", new Translator(null)) : alternative.Guard);
+          TrExpr(alternative.IsExistentialGuard ? Translator.AlphaRename((ExistsExpr)alternative.Guard, "eg_d", new Translator(null)) : alternative.Guard, wr, false);
           wr.WriteLine(") {");
           if (alternative.IsExistentialGuard) {
-            IntroduceAndAssignBoundVars(indent + IndentAmount, (ExistsExpr)alternative.Guard);
+            IntroduceAndAssignBoundVars(indent + IndentAmount, (ExistsExpr)alternative.Guard, wr);
           }
-          TrStmtList(alternative.Body, indent);
-          Indent(indent);
+          TrStmtList(alternative.Body, indent, wr);
+          Indent(indent, wr);
           wr.Write("} else ");
         }
         wr.WriteLine("{ /*unreachable alternative*/ }");
@@ -1491,38 +1492,38 @@ namespace Microsoft.Dafny {
       } else if (stmt is WhileStmt) {
         WhileStmt s = (WhileStmt)stmt;
         if (s.Body == null) {
-          return;
+          return wr;
         }
         if (s.Guard == null) {
-          Indent(indent);
+          Indent(indent, wr);
           wr.WriteLine("while (false) { }");
         } else {
-          Indent(indent);
+          Indent(indent, wr);
           wr.Write("while (");
-          TrExpr(s.Guard);
+          TrExpr(s.Guard, wr, false);
           wr.WriteLine(")");
-          TrStmt(s.Body, indent);
+          wr.Write(TrStmt(s.Body, indent).ToString());
         }
 
       } else if (stmt is AlternativeLoopStmt) {
         var s = (AlternativeLoopStmt)stmt;
         if (s.Alternatives.Count != 0) {
-          Indent(indent);
+          Indent(indent, wr);
           wr.WriteLine("while (true) {");
           int ind = indent + IndentAmount;
           foreach (var alternative in s.Alternatives) {
           }
-          Indent(ind);
+          Indent(ind, wr);
           foreach (var alternative in s.Alternatives) {
             wr.Write("if (");
-            TrExpr(alternative.Guard);
+            TrExpr(alternative.Guard, wr, false);
             wr.WriteLine(") {");
-            TrStmtList(alternative.Body, ind);
-            Indent(ind);
+            TrStmtList(alternative.Body, ind, wr);
+            Indent(ind, wr);
             wr.Write("} else ");
           }
           wr.WriteLine("{ break; }");
-          Indent(indent);
+          Indent(indent, wr);
           wr.WriteLine("}");
         }
 
@@ -1530,17 +1531,17 @@ namespace Microsoft.Dafny {
         var s = (ForallStmt)stmt;
         if (s.Kind != ForallStmt.ParBodyKind.Assign) {
           // Call and Proof have no side effects, so they can simply be optimized away.
-          return;
+          return wr;
         } else if (s.BoundVars.Count == 0) {
           // the bound variables just spell out a single point, so the forall statement is equivalent to one execution of the body
-          TrStmt(s.Body, indent);
-          return;
+          wr.Write(TrStmt(s.Body, indent).ToString());
+          return wr;
         }
         var s0 = (AssignStmt)s.S0;
         if (s0.Rhs is HavocRhs) {
           // The forall statement says to havoc a bunch of things.  This can be efficiently compiled
           // into doing nothing.
-          return;
+          return wr;
         }
         var rhs = ((ExprRhs)s0.Rhs).Expr;
 
@@ -1584,29 +1585,29 @@ namespace Microsoft.Dafny {
         if (s0.Lhs is MemberSelectExpr) {
           var lhs = (MemberSelectExpr)s0.Lhs;
           L = 2;
-          tupleTypeArgs = TypeName(lhs.Obj.Type);
+          tupleTypeArgs = TypeName(lhs.Obj.Type, wr);
         } else if (s0.Lhs is SeqSelectExpr) {
           var lhs = (SeqSelectExpr)s0.Lhs;
           L = 3;
           // note, we might as well do the BigInteger-to-int cast for array indices here, before putting things into the Tuple rather than when they are extracted from the Tuple
-          tupleTypeArgs = TypeName(lhs.Seq.Type) + ",int";
+          tupleTypeArgs = TypeName(lhs.Seq.Type, wr) + ",int";
         } else {
           var lhs = (MultiSelectExpr)s0.Lhs;
           L = 2 + lhs.Indices.Count;
           if (8 < L) {
-            Error("compiler currently does not support assignments to more-than-6-dimensional arrays in forall statements");
-            return;
+            Error("compiler currently does not support assignments to more-than-6-dimensional arrays in forall statements", wr);
+            return wr;
           }
-          tupleTypeArgs = TypeName(lhs.Array.Type);
+          tupleTypeArgs = TypeName(lhs.Array.Type, wr);
           for (int i = 0; i < lhs.Indices.Count; i++) {
             // note, we might as well do the BigInteger-to-int cast for array indices here, before putting things into the Tuple rather than when they are extracted from the Tuple
             tupleTypeArgs += ",int";
           }
         }
-        tupleTypeArgs += "," + TypeName(rhs.Type);
+        tupleTypeArgs += "," + TypeName(rhs.Type, wr);
 
         // declare and construct "ingredients"
-        Indent(indent);
+        Indent(indent, wr);
         wr.WriteLine("var {0} = new System.Collections.Generic.List<System.Tuple<{1}>>();", ingredients, tupleTypeArgs);
 
         var n = s.BoundVars.Count;
@@ -1616,38 +1617,38 @@ namespace Microsoft.Dafny {
           var bound = s.Bounds[i];
           var bv = s.BoundVars[i];
           if (bound is ComprehensionExpr.BoolBoundedPool) {
-            Indent(ind);
+            Indent(ind, wr);
             wr.Write("foreach (var @{0} in Dafny.Helpers.AllBooleans) {{ ", bv.CompileName);
           } else if (bound is ComprehensionExpr.CharBoundedPool) {
-            Indent(ind);
+            Indent(ind, wr);
             wr.Write("foreach (var @{0} in Dafny.Helpers.AllChars) {{ ", bv.CompileName);
           } else if (bound is ComprehensionExpr.IntBoundedPool) {
             var b = (ComprehensionExpr.IntBoundedPool)bound;
-            Indent(ind);
+            Indent(ind, wr);
             if (AsNativeType(bv.Type) != null) {
               wr.Write("foreach (var @{0} in @{1}.IntegerRange(", bv.CompileName, bv.Type.AsNewtype.FullCompileName);
             } else {
               wr.Write("foreach (var @{0} in Dafny.Helpers.IntegerRange(", bv.CompileName);
             }
-            TrExpr(b.LowerBound);
+            TrExpr(b.LowerBound, wr, false);
             wr.Write(", ");
-            TrExpr(b.UpperBound);
+            TrExpr(b.UpperBound, wr, false);
             wr.Write(")) { ");
           } else if (bound is ComprehensionExpr.SetBoundedPool) {
             var b = (ComprehensionExpr.SetBoundedPool)bound;
-            Indent(ind);
+            Indent(ind, wr);
             wr.Write("foreach (var @{0} in (", bv.CompileName);
-            TrExpr(b.Set);
+            TrExpr(b.Set, wr, false);
             wr.Write(").Elements) { ");
           } else if (bound is ComprehensionExpr.SeqBoundedPool) {
             var b = (ComprehensionExpr.SeqBoundedPool)bound;
-            Indent(ind);
+            Indent(ind, wr);
             wr.Write("foreach (var @{0} in (", bv.CompileName);
-            TrExpr(b.Seq);
+            TrExpr(b.Seq, wr, false);
             wr.Write(").UniqueElements) { ");
           } else if (bound is ComprehensionExpr.DatatypeBoundedPool) {
             var b = (ComprehensionExpr.DatatypeBoundedPool)bound;
-            wr.Write("foreach (var @{0} in {1}.AllSingletonConstructors) {{", bv.CompileName, TypeName(bv.Type));
+            wr.Write("foreach (var @{0} in {1}.AllSingletonConstructors) {{", bv.CompileName, TypeName(bv.Type, wr));
           } else {
             Contract.Assert(false); throw new cce.UnreachableException();  // unexpected BoundedPool type
           }
@@ -1657,55 +1658,55 @@ namespace Microsoft.Dafny {
         // if (range) {
         //   ingredients.Add(new L-Tuple( LHS0(w,x,y,z), LHS1(w,x,y,z), ..., RHS(w,x,y,z) ));
         // }
-        Indent(indent + n * IndentAmount);
+        Indent(indent + n * IndentAmount, wr);
         wr.Write("if (");
         foreach (var bv in s.BoundVars) {
           if (bv.Type.NormalizeExpand() is NatType) {
             wr.Write("0 <= {0} && ", bv.CompileName);
           }
         }
-        TrExpr(s.Range);
+        TrExpr(s.Range, wr, false);
         wr.WriteLine(") {");
 
         var indFinal = indent + (n + 1) * IndentAmount;
-        Indent(indFinal);
+        Indent(indFinal, wr);
         wr.Write("{0}.Add(new System.Tuple<{1}>(", ingredients, tupleTypeArgs);
         if (s0.Lhs is MemberSelectExpr) {
           var lhs = (MemberSelectExpr)s0.Lhs;
-          TrExpr(lhs.Obj);
+          TrExpr(lhs.Obj, wr, false);
         } else if (s0.Lhs is SeqSelectExpr) {
           var lhs = (SeqSelectExpr)s0.Lhs;
-          TrExpr(lhs.Seq);
+          TrExpr(lhs.Seq, wr, false);
           wr.Write(", (int)(");
-          TrExpr(lhs.E0);
+          TrExpr(lhs.E0, wr, false);
           wr.Write(")");
         } else {
           var lhs = (MultiSelectExpr)s0.Lhs;
-          TrExpr(lhs.Array);
+          TrExpr(lhs.Array, wr, false);
           for (int i = 0; i < lhs.Indices.Count; i++) {
             wr.Write(", (int)(");
-            TrExpr(lhs.Indices[i]);
+            TrExpr(lhs.Indices[i], wr, false);
             wr.Write(")");
           }
         }
         wr.Write(", ");
-        TrExpr(rhs);
+        TrExpr(rhs, wr, false);
         wr.WriteLine("));");
 
-        Indent(indent + n * IndentAmount);
+        Indent(indent + n * IndentAmount, wr);
         wr.WriteLine("}");
 
         for (int i = n; 0 <= --i; ) {
-          Indent(indent + i * IndentAmount);
+          Indent(indent + i * IndentAmount, wr);
           wr.WriteLine("}");
         }
 
         //   foreach (L-Tuple l in ingredients) {
         //     LHS[ l0, l1, l2, ..., l(L-2) ] = l(L-1);
         //   }
-        Indent(indent);
+        Indent(indent, wr);
         wr.WriteLine("foreach (var {0} in {1}) {{", tup, ingredients);
-        Indent(indent + IndentAmount);
+        Indent(indent + IndentAmount, wr);
         if (s0.Lhs is MemberSelectExpr) {
           var lhs = (MemberSelectExpr)s0.Lhs;
           wr.WriteLine("{0}.Item1.@{1} = {0}.Item2;", tup, lhs.MemberName);
@@ -1722,7 +1723,7 @@ namespace Microsoft.Dafny {
           }
           wr.WriteLine("] = {0}.Item{1};", tup, L);
         }
-        Indent(indent);
+        Indent(indent, wr);
         wr.WriteLine("}");
 
       } else if (stmt is MatchStmt) {
@@ -1739,54 +1740,56 @@ namespace Microsoft.Dafny {
         // }
         if (s.Cases.Count != 0) {
           string source = idGenerator.FreshId("_source");
-          Indent(indent);
-          wr.Write("{0} {1} = ", TypeName(cce.NonNull(s.Source.Type)), source);
-          TrExpr(s.Source);
+          Indent(indent, wr);
+          wr.Write("{0} {1} = ", TypeName(cce.NonNull(s.Source.Type), wr), source);
+          TrExpr(s.Source, wr, false);
           wr.WriteLine(";");
 
           int i = 0;
           var sourceType = (UserDefinedType)s.Source.Type.NormalizeExpand();
           foreach (MatchCaseStmt mc in s.Cases) {
-            MatchCasePrelude(source, sourceType, cce.NonNull(mc.Ctor), mc.Arguments, i, s.Cases.Count, indent);
-            TrStmtList(mc.Body, indent);
+            MatchCasePrelude(source, sourceType, cce.NonNull(mc.Ctor), mc.Arguments, i, s.Cases.Count, indent, wr);
+            TrStmtList(mc.Body, indent, wr);
             i++;
           }
-          Indent(indent); wr.WriteLine("}");
+          Indent(indent, wr); wr.WriteLine("}");
         }
 
       } else if (stmt is VarDeclStmt) {
         var s = (VarDeclStmt)stmt;
         foreach (var local in s.Locals) {
-          TrLocalVar(local, true, indent);
+          TrLocalVar(local, true, indent, wr);
         }
         if (s.Update != null) {
-          TrStmt(s.Update, indent);
+          wr.Write(TrStmt(s.Update, indent).ToString());
         }
 
       } else if (stmt is ModifyStmt) {
         var s = (ModifyStmt)stmt;
         if (s.Body != null) {
-          TrStmt(s.Body, indent);
+          wr.Write(TrStmt(s.Body, indent).ToString());
         }
 
       } else {
         Contract.Assert(false); throw new cce.UnreachableException();  // unexpected statement
       }
+
+      return wr;
     }
 
-    private void IntroduceAndAssignBoundVars(int indent, ExistsExpr exists) {
+    private void IntroduceAndAssignBoundVars(int indent, ExistsExpr exists, TextWriter wr) {
       Contract.Requires(0 <= indent);
       Contract.Requires(exists != null);
       Contract.Assume(exists.Bounds != null);  // follows from successful resolution
       Contract.Assert(exists.Range == null);  // follows from invariant of class IfStmt
       foreach (var bv in exists.BoundVars) {
-        TrLocalVar(bv, false, indent);
+        TrLocalVar(bv, false, indent, wr);
       }
       var ivars = exists.BoundVars.ConvertAll(bv => (IVariable)bv);
-      TrAssignSuchThat(indent, ivars, exists.Term, exists.Bounds, exists.tok.line);
+      TrAssignSuchThat(indent, ivars, exists.Term, exists.Bounds, exists.tok.line, wr, false);
     }
 
-    private void TrAssignSuchThat(int indent, List<IVariable> lhss, Expression constraint, List<ComprehensionExpr.BoundedPool> bounds, int debuginfoLine) {
+    private void TrAssignSuchThat(int indent, List<IVariable> lhss, Expression constraint, List<ComprehensionExpr.BoundedPool> bounds, int debuginfoLine, TextWriter wr, bool inLetExprBody) {
       Contract.Requires(0 <= indent);
       Contract.Requires(lhss != null);
       Contract.Requires(constraint != null);
@@ -1828,7 +1831,7 @@ namespace Microsoft.Dafny {
       int ind = indent;
       bool needIterLimit = lhss.Count != 1 && bounds.Exists(bnd => !bnd.IsFinite);
       if (needIterLimit) {
-        Indent(indent);
+        Indent(indent, wr);
         wr.WriteLine("for (var {0} = new BigInteger(5); ; {0} *= 2) {{", iterLimit);
         ind += IndentAmount;
       }
@@ -1837,11 +1840,11 @@ namespace Microsoft.Dafny {
         var bound = bounds[i];
         var bv = lhss[i];
         if (needIterLimit) {
-          Indent(ind);
+          Indent(ind, wr);
           wr.WriteLine("var {0}_{1} = {0};", iterLimit, i);
         }
         var tmpVar = idGenerator.FreshId("_assign_such_that_");
-        Indent(ind);
+        Indent(ind, wr);
         if (bound is ComprehensionExpr.BoolBoundedPool) {
           wr.WriteLine("foreach (var {0} in Dafny.Helpers.AllBooleans) {{ @{1} = {0};", tmpVar, bv.CompileName);
         } else if (bound is ComprehensionExpr.CharBoundedPool) {
@@ -1856,13 +1859,13 @@ namespace Microsoft.Dafny {
           if (b.LowerBound == null) {
             wr.Write("null");
           } else {
-            TrExpr(b.LowerBound);
+            TrExpr(b.LowerBound, wr, inLetExprBody);
           }
           wr.Write(", ");
           if (b.UpperBound == null) {
             wr.Write("null");
           } else {
-            TrExpr(b.UpperBound);
+            TrExpr(b.UpperBound, wr, inLetExprBody);
           }
           wr.WriteLine(")) {{ @{1} = {0};", tmpVar, bv.CompileName);
         } else if (bound is AssignSuchThatStmt.WiggleWaggleBound) {
@@ -1870,54 +1873,54 @@ namespace Microsoft.Dafny {
         } else if (bound is ComprehensionExpr.SetBoundedPool) {
           var b = (ComprehensionExpr.SetBoundedPool)bound;
           wr.Write("foreach (var {0} in (", tmpVar);
-          TrExpr(b.Set);
+          TrExpr(b.Set, wr, inLetExprBody);
           wr.WriteLine(").Elements) {{ @{0} = {1};", bv.CompileName, tmpVar);
         } else if (bound is ComprehensionExpr.SubSetBoundedPool) {
           var b = (ComprehensionExpr.SubSetBoundedPool)bound;
           wr.Write("foreach (var {0} in (", tmpVar);
-          TrExpr(b.UpperBound);
+          TrExpr(b.UpperBound, wr, inLetExprBody);
           wr.WriteLine(").AllSubsets) {{ @{0} = {1};", bv.CompileName, tmpVar);
         } else if (bound is ComprehensionExpr.MapBoundedPool) {
           var b = (ComprehensionExpr.MapBoundedPool)bound;
           wr.Write("foreach (var {0} in (", tmpVar);
-          TrExpr(b.Map);
+          TrExpr(b.Map, wr, inLetExprBody);
           wr.WriteLine(").Domain) {{ @{0} = {1};", bv.CompileName, tmpVar);
         } else if (bound is ComprehensionExpr.SeqBoundedPool) {
           var b = (ComprehensionExpr.SeqBoundedPool)bound;
           wr.Write("foreach (var {0} in (", tmpVar);
-          TrExpr(b.Seq);
+          TrExpr(b.Seq, wr, inLetExprBody);
           wr.WriteLine(").Elements) {{ @{0} = {1};", bv.CompileName, tmpVar);
         } else if (bound is ComprehensionExpr.DatatypeBoundedPool) {
           var b = (ComprehensionExpr.DatatypeBoundedPool)bound;
-          wr.WriteLine("foreach (var {0} in {1}.AllSingletonConstructors) {{ @{2} = {0};", tmpVar, TypeName(bv.Type), bv.CompileName);
+          wr.WriteLine("foreach (var {0} in {1}.AllSingletonConstructors) {{ @{2} = {0};", tmpVar, TypeName(bv.Type, wr), bv.CompileName);
         } else {
           Contract.Assert(false); throw new cce.UnreachableException();  // unexpected BoundedPool type
         }
         if (needIterLimit) {
-          Indent(ind + IndentAmount);
+          Indent(ind + IndentAmount, wr);
           wr.WriteLine("if ({0}_{1} == 0) {{ break; }}  {0}_{1}--;", iterLimit, i);
         }
       }
-      Indent(ind);
+      Indent(ind, wr);
       wr.Write("if (");
-      TrExpr(constraint);
+      TrExpr(constraint, wr, inLetExprBody);
       wr.WriteLine(") {");
-      Indent(ind + IndentAmount);
+      Indent(ind + IndentAmount, wr);
       wr.WriteLine("goto {0};", doneLabel);
-      Indent(ind);
+      Indent(ind, wr);
       wr.WriteLine("}");
-      Indent(indent);
+      Indent(indent, wr);
       for (int i = 0; i < n; i++) {
         wr.Write(i == 0 ? "}" : " }");
       }
       wr.WriteLine(needIterLimit ? " }" : "");
-      Indent(indent);
+      Indent(indent, wr);
       wr.WriteLine("throw new System.Exception(\"assign-such-that search produced no value (line {0})\");", debuginfoLine);
-      Indent(indent);
+      Indent(indent, wr);
       wr.WriteLine("{0}: ;", doneLabel);
     }
 
-    string CreateLvalue(Expression lhs, int indent) {
+    string CreateLvalue(Expression lhs, int indent, TextWriter wr) {
       lhs = lhs.Resolved;
       if (lhs is IdentifierExpr) {
         var ll = (IdentifierExpr)lhs;
@@ -1925,9 +1928,9 @@ namespace Microsoft.Dafny {
       } else if (lhs is MemberSelectExpr) {
         var ll = (MemberSelectExpr)lhs;
         string obj = idGenerator.FreshId("_obj");
-        Indent(indent);
+        Indent(indent, wr);
         wr.Write("var {0} = ", obj);
-        TrExpr(ll.Obj);
+        TrExpr(ll.Obj, wr, false);
         wr.WriteLine(";");
         return string.Format("{0}.@{1}", obj, ll.Member.CompileName);
       } else if (lhs is SeqSelectExpr) {
@@ -1935,31 +1938,31 @@ namespace Microsoft.Dafny {
         var c = idGenerator.FreshNumericId("_arr+_index");
         string arr = "_arr" + c;
         string index = "_index" + c;
-        Indent(indent);
+        Indent(indent, wr);
         wr.Write("var {0} = ", arr);
-        TrExpr(ll.Seq);
+        TrExpr(ll.Seq, wr, false);
         wr.WriteLine(";");
-        Indent(indent);
+        Indent(indent, wr);
         wr.Write("var {0} = ", index);
-        TrExpr(ll.E0);
+        TrExpr(ll.E0, wr, false);
         wr.WriteLine(";");
         return string.Format("{0}[(int){1}]", arr, index);
       } else {
         var ll = (MultiSelectExpr)lhs;
         var c = idGenerator.FreshNumericId("_arr+_index");
         string arr = "_arr" + c;
-        Indent(indent);
+        Indent(indent, wr);
         wr.Write("var {0} = ", arr);
-        TrExpr(ll.Array);
+        TrExpr(ll.Array, wr, false);
         wr.WriteLine(";");
         string fullString = arr + "[";
         string sep = "";
         int i = 0;
         foreach (var idx in ll.Indices) {
           string index = "_index" + i + "_" + c;
-          Indent(indent);
+          Indent(indent, wr);
           wr.Write("var {0} = ", index);
-          TrExpr(idx);
+          TrExpr(idx, wr, false);
           wr.WriteLine(";");
           fullString += sep + "(int)" + index;
           sep = ", ";
@@ -1969,21 +1972,21 @@ namespace Microsoft.Dafny {
       }
     }
 
-    void TrRhs(string target, Expression targetExpr, AssignmentRhs rhs, int indent) {
+    void TrRhs(string target, Expression targetExpr, AssignmentRhs rhs, int indent, TextWriter wr) {
       Contract.Requires((target == null) != (targetExpr == null));
       var tRhs = rhs as TypeRhs;
       if (tRhs != null && tRhs.InitCall != null) {
         string nw = idGenerator.FreshId("_nw");
-        Indent(indent);
+        Indent(indent, wr);
         wr.Write("var {0} = ", nw);
-        TrAssignmentRhs(rhs);  // in this case, this call will not require us to spill any let variables first
+        TrAssignmentRhs(rhs, wr);  // in this case, this call will not require us to spill any let variables first
         wr.WriteLine(";");
-        TrCallStmt(tRhs.InitCall, nw, indent);
-        Indent(indent);
+        wr.Write(TrCallStmt(tRhs.InitCall, nw, indent).ToString());
+        Indent(indent, wr);
         if (target != null) {
           wr.Write(target);
         } else {
-          TrExpr(targetExpr);
+          TrExpr(targetExpr, wr, false);
         }
         wr.WriteLine(" = {0};", nw);
       } else if (rhs is HavocRhs) {
@@ -1994,22 +1997,23 @@ namespace Microsoft.Dafny {
           foreach (Expression dim in tRhs.ArrayDimensions) {
           }
         }
-        Indent(indent);
+        Indent(indent, wr);
         if (target != null) {
           wr.Write(target);
         } else {
-          TrExpr(targetExpr);
+          TrExpr(targetExpr, wr, false);
         }
         wr.Write(" = ");
-        TrAssignmentRhs(rhs);
+        TrAssignmentRhs(rhs, wr);
         wr.WriteLine(";");
       }
     }
 
-    void TrCallStmt(CallStmt s, string receiverReplacement, int indent) {
+    TextWriter TrCallStmt(CallStmt s, string receiverReplacement, int indent) {
       Contract.Requires(s != null);
       Contract.Assert(s.Method != null);  // follows from the fact that stmt has been successfully resolved
 
+      StringWriter wr = new StringWriter();
       if (s.Method == enclosingMethod && enclosingMethod.IsTailRecursive) {
         // compile call as tail-recursive
 
@@ -2026,9 +2030,9 @@ namespace Microsoft.Dafny {
 
           string inTmp = idGenerator.FreshId("_in");
           inTmps.Add(inTmp);
-          Indent(indent);
+          Indent(indent, wr);
           wr.Write("var {0} = ", inTmp);
-          TrExpr(s.Receiver);
+          TrExpr(s.Receiver, wr, false);
           wr.WriteLine(";");
         }
         for (int i = 0; i < s.Method.Ins.Count; i++) {
@@ -2036,29 +2040,29 @@ namespace Microsoft.Dafny {
           if (!p.IsGhost) {
             string inTmp = idGenerator.FreshId("_in");
             inTmps.Add(inTmp);
-            Indent(indent);
+            Indent(indent, wr);
             wr.Write("var {0} = ", inTmp);
-            TrExpr(s.Args[i]);
+            TrExpr(s.Args[i], wr, false);
             wr.WriteLine(";");
           }
         }
         // Now, assign to the formals
         int n = 0;
         if (!s.Method.IsStatic) {
-          Indent(indent);
+          Indent(indent, wr);
           wr.WriteLine("_this = {0};", inTmps[n]);
           n++;
         }
         foreach (var p in s.Method.Ins) {
           if (!p.IsGhost) {
-            Indent(indent);
+            Indent(indent, wr);
             wr.WriteLine("{0} = {1};", p.CompileName, inTmps[n]);
             n++;
           }
         }
         Contract.Assert(n == inTmps.Count);
         // finally, the jump back to the head of the method
-        Indent(indent);
+        Indent(indent, wr);
         wr.WriteLine("goto TAIL_CALL_START;");
 
       } else {
@@ -2069,7 +2073,7 @@ namespace Microsoft.Dafny {
         for (int i = 0; i < s.Method.Outs.Count; i++) {
           Formal p = s.Method.Outs[i];
           if (!p.IsGhost) {
-            lvalues.Add(CreateLvalue(s.Lhs[i], indent));
+            lvalues.Add(CreateLvalue(s.Lhs[i], indent, wr));
           }
         }
         var outTmps = new List<string>();
@@ -2078,8 +2082,8 @@ namespace Microsoft.Dafny {
           if (!p.IsGhost) {
             string target = idGenerator.FreshId("_out");
             outTmps.Add(target);
-            Indent(indent);
-            wr.WriteLine("{0} {1};", TypeName(s.Lhs[i].Type), target);
+            Indent(indent, wr);
+            wr.WriteLine("{0} {1};", TypeName(s.Lhs[i].Type, wr), target);
           }
         }
         Contract.Assert(lvalues.Count == outTmps.Count);
@@ -2090,14 +2094,14 @@ namespace Microsoft.Dafny {
           }
         }
         if (receiverReplacement != null) {
-          Indent(indent);
+          Indent(indent, wr);
           wr.Write("@" + receiverReplacement);
         } else if (s.Method.IsStatic) {
-          Indent(indent);
-          wr.Write(TypeName_Companion(s.Receiver.Type));
+          Indent(indent, wr);
+          wr.Write(TypeName_Companion(s.Receiver.Type, wr));
         } else {
-          Indent(indent);
-          TrParenExpr(s.Receiver);
+          Indent(indent, wr);
+          TrParenExpr(s.Receiver, wr, false);
         }
         wr.Write(".@{0}(", s.Method.CompileName);
 
@@ -2106,7 +2110,7 @@ namespace Microsoft.Dafny {
           Formal p = s.Method.Ins[i];
           if (!p.IsGhost) {
             wr.Write(sep);
-            TrExpr(s.Args[i]);
+            TrExpr(s.Args[i], wr, false);
             sep = ", ";
           }
         }
@@ -2119,44 +2123,45 @@ namespace Microsoft.Dafny {
 
         // assign to the actual LHSs
         for (int j = 0; j < lvalues.Count; j++) {
-          Indent(indent);
+          Indent(indent, wr);
           wr.WriteLine("{0} = {1};", lvalues[j], outTmps[j]);
         }
       }
+      return wr;
     }
 
     /// <summary>
     /// Before calling TrAssignmentRhs(rhs), the caller must have spilled the let variables declared in "rhs".
     /// </summary>
-    void TrAssignmentRhs(AssignmentRhs rhs) {
+    void TrAssignmentRhs(AssignmentRhs rhs, TextWriter wr) {
       Contract.Requires(rhs != null);
       Contract.Requires(!(rhs is HavocRhs));
       if (rhs is ExprRhs) {
         ExprRhs e = (ExprRhs)rhs;
-        TrExpr(e.Expr);
+        TrExpr(e.Expr, wr, false);
 
       } else {
         TypeRhs tp = (TypeRhs)rhs;
         if (tp.ArrayDimensions == null) {
-          wr.Write("new {0}()", TypeName(tp.EType));
+          wr.Write("new {0}()", TypeName(tp.EType, wr));
         } else {
           if (tp.EType.IsIntegerType || tp.EType.IsTypeParameter) {
             // Because the default constructor for BigInteger does not generate a valid BigInteger, we have
             // to excplicitly initialize the elements of an integer array.  This is all done in a helper routine.
-            wr.Write("Dafny.Helpers.InitNewArray{0}<{1}>", tp.ArrayDimensions.Count, TypeName(tp.EType));
+            wr.Write("Dafny.Helpers.InitNewArray{0}<{1}>", tp.ArrayDimensions.Count, TypeName(tp.EType, wr));
             string prefix = "(";
             foreach (Expression dim in tp.ArrayDimensions) {
               wr.Write(prefix);
-              TrParenExpr(dim);
+              TrParenExpr(dim, wr, false);
               prefix = ", ";
             }
             wr.Write(")");
           } else {
-            wr.Write("new {0}", TypeName(tp.EType));
+            wr.Write("new {0}", TypeName(tp.EType, wr));
             string prefix = "[";
             foreach (Expression dim in tp.ArrayDimensions) {
               wr.Write("{0}(int)", prefix);
-              TrParenExpr(dim);
+              TrParenExpr(dim, wr, false);
               prefix = ", ";
             }
             wr.Write("]");
@@ -2165,34 +2170,43 @@ namespace Microsoft.Dafny {
       }
     }
 
-    void TrStmtList(List<Statement/*!*/>/*!*/ stmts, int indent) {Contract.Requires(cce.NonNullElements(stmts));
+    void TrStmtList(List<Statement/*!*/>/*!*/ stmts, int indent, TextWriter writer) {Contract.Requires(cce.NonNullElements(stmts));
       foreach (Statement ss in stmts) {
-        TrStmt(ss, indent + IndentAmount);
+        copyInstrWriter.Clear();
+        TextWriter wr = TrStmt(ss, indent + IndentAmount);
+        // write out any copy instructions that copies the out param
+        // used in letexpr to a local
+        string copyInstr = copyInstrWriter.ToString();
+        if (copyInstr != "") {
+          Indent(indent + IndentAmount, writer);
+          writer.Write(copyInstrWriter.ToString());
+        }
+        writer.Write(wr.ToString());
         if (ss.Labels != null) {
-          Indent(indent);  // labels are not indented as much as the statements
-          wr.WriteLine("after_{0}: ;", ss.Labels.Data.AssignUniqueId("after_", idGenerator));
+          Indent(indent, writer);  // labels are not indented as much as the statements
+          writer.WriteLine("after_{0}: ;", ss.Labels.Data.AssignUniqueId("after_", idGenerator));
         }
       }
     }
 
-    void TrLocalVar(IVariable v, bool alwaysInitialize, int indent) {
+    void TrLocalVar(IVariable v, bool alwaysInitialize, int indent, TextWriter wr) {
       Contract.Requires(v != null);
       if (v.IsGhost) {
         // only emit non-ghosts (we get here only for local variables introduced implicitly by call statements)
         return;
       }
 
-      Indent(indent);
-      wr.Write("{0} @{1}", TypeName(v.Type), v.CompileName);
+      Indent(indent, wr);
+      wr.Write("{0} @{1}", TypeName(v.Type, wr), v.CompileName);
       if (alwaysInitialize) {
         // produce a default value
-        wr.WriteLine(" = {0};", DefaultValue(v.Type));
+        wr.WriteLine(" = {0};", DefaultValue(v.Type, wr));
       } else {
         wr.WriteLine(";");
       }
     }
 
-    void MatchCasePrelude(string source, UserDefinedType sourceType, DatatypeCtor ctor, List<BoundVar/*!*/>/*!*/ arguments, int caseIndex, int caseCount, int indent) {
+    void MatchCasePrelude(string source, UserDefinedType sourceType, DatatypeCtor ctor, List<BoundVar/*!*/>/*!*/ arguments, int caseIndex, int caseCount, int indent, TextWriter wr) {
       Contract.Requires(source != null);
       Contract.Requires(sourceType != null);
       Contract.Requires(ctor != null);
@@ -2201,7 +2215,7 @@ namespace Microsoft.Dafny {
       // if (source.is_Ctor0) {
       //   FormalType f0 = ((Dt_Ctor0)source._D).a0;
       //   ...
-      Indent(indent);
+      Indent(indent, wr);
       wr.Write("{0}if (", caseIndex == 0 ? "" : "} else ");
       if (caseIndex == caseCount - 1) {
         wr.Write("true");
@@ -2216,9 +2230,9 @@ namespace Microsoft.Dafny {
         if (!arg.IsGhost) {
           BoundVar bv = arguments[m];
           // FormalType f0 = ((Dt_Ctor0)source._D).a0;
-          Indent(indent + IndentAmount);
+          Indent(indent + IndentAmount, wr);
           wr.WriteLine("{0} @{1} = (({2}){3}._D).@{4};",
-            TypeName(bv.Type), bv.CompileName, DtCtorName(ctor, sourceType.TypeArgs), source, FormalName(arg, k));
+            TypeName(bv.Type, wr), bv.CompileName, DtCtorName(ctor, sourceType.TypeArgs, wr), source, FormalName(arg, k));
           k++;
         }
       }
@@ -2229,51 +2243,51 @@ namespace Microsoft.Dafny {
     /// <summary>
     /// Before calling TrParenExpr(expr), the caller must have spilled the let variables declared in "expr".
     /// </summary>
-    void TrParenExpr(string prefix, Expression expr) {
+    void TrParenExpr(string prefix, Expression expr, TextWriter wr, bool inLetExprBody) {
       Contract.Requires(prefix != null);
       Contract.Requires(expr != null);
       wr.Write(prefix);
-      TrParenExpr(expr);
+      TrParenExpr(expr, wr, inLetExprBody);
     }
 
     /// <summary>
     /// Before calling TrParenExpr(expr), the caller must have spilled the let variables declared in "expr".
     /// </summary>
-    void TrParenExpr(Expression expr) {
+    void TrParenExpr(Expression expr, TextWriter wr, bool inLetExprBody) {
       Contract.Requires(expr != null);
       wr.Write("(");
-      TrExpr(expr);
+      TrExpr(expr, wr, inLetExprBody);
       wr.Write(")");
     }
 
     /// <summary>
     /// Before calling TrExprList(exprs), the caller must have spilled the let variables declared in expressions in "exprs".
     /// </summary>
-    void TrExprList(List<Expression/*!*/>/*!*/ exprs) {
+    void TrExprList(List<Expression/*!*/>/*!*/ exprs, TextWriter wr, bool inLetExprBody) {
       Contract.Requires(cce.NonNullElements(exprs));
       wr.Write("(");
       string sep = "";
       foreach (Expression e in exprs) {
         wr.Write(sep);
-        TrExpr(e);
+        TrExpr(e, wr, inLetExprBody);
         sep = ", ";
       }
       wr.Write(")");
     }
-    void TrExprPairList(List<ExpressionPair/*!*/>/*!*/ exprs) {
+    void TrExprPairList(List<ExpressionPair/*!*/>/*!*/ exprs, TextWriter wr, bool inLetExprBody) {
       Contract.Requires(cce.NonNullElements(exprs));
       wr.Write("(");
       string sep = "";
       foreach (ExpressionPair p in exprs) {
         wr.Write(sep);
         wr.Write("new Dafny.Pair<");
-        wr.Write(TypeName(p.A.Type));
+        wr.Write(TypeName(p.A.Type, wr));
         wr.Write(",");
-        wr.Write(TypeName(p.B.Type));
+        wr.Write(TypeName(p.B.Type, wr));
         wr.Write(">(");
-        TrExpr(p.A);
+        TrExpr(p.A, wr, inLetExprBody);
         wr.Write(",");
-        TrExpr(p.B);
+        TrExpr(p.B, wr, inLetExprBody);
         wr.Write(")");
         sep = ", ";
       }
@@ -2283,13 +2297,13 @@ namespace Microsoft.Dafny {
     /// <summary>
     /// Before calling TrExpr(expr), the caller must have spilled the let variables declared in "expr".
     /// </summary>
-    void TrExpr(Expression expr)
+    void TrExpr(Expression expr, TextWriter wr, bool inLetExprBody)
     {
       Contract.Requires(expr != null);
       if (expr is LiteralExpr) {
         LiteralExpr e = (LiteralExpr)expr;
         if (e.Value == null) {
-          wr.Write("({0})null", TypeName(e.Type));
+          wr.Write("({0})null", TypeName(e.Type, wr));
         } else if (e.Value is bool) {
           wr.Write((bool)e.Value ? "true" : "false");
         } else if (e is CharLiteralExpr) {
@@ -2330,41 +2344,49 @@ namespace Microsoft.Dafny {
 
       } else if (expr is IdentifierExpr) {
         var e = (IdentifierExpr)expr;
-        wr.Write("@" + e.Var.CompileName);
-
+        if (e.Var is Formal && inLetExprBody && !((Formal)e.Var).InParam) {
+          // out param in letExpr body, need to copy it to a temp since
+          // letExpr body is translated to an anonymous function that doesn't
+          // allow out parameters
+          var name = string.Format("_pat_let_tv{0}", GetUniqueAstNumber(e));
+          wr.Write("@" + name);
+          copyInstrWriter.Append("var @" + name + "= @" + e.Var.CompileName + ";\n");
+        } else {
+          wr.Write("@" + e.Var.CompileName);
+        }
       } else if (expr is SetDisplayExpr) {
         var e = (SetDisplayExpr)expr;
         var elType = e.Type.AsSetType.Arg;
-        wr.Write("{0}<{1}>.FromElements", DafnySetClass, TypeName(elType));
-        TrExprList(e.Elements);
+        wr.Write("{0}<{1}>.FromElements", DafnySetClass, TypeName(elType, wr));
+        TrExprList(e.Elements, wr, inLetExprBody);
 
       } else if (expr is MultiSetDisplayExpr) {
         var e = (MultiSetDisplayExpr)expr;
         var elType = e.Type.AsMultiSetType.Arg;
-        wr.Write("{0}<{1}>.FromElements", DafnyMultiSetClass, TypeName(elType));
-        TrExprList(e.Elements);
+        wr.Write("{0}<{1}>.FromElements", DafnyMultiSetClass, TypeName(elType, wr));
+        TrExprList(e.Elements, wr, inLetExprBody);
 
       } else if (expr is SeqDisplayExpr) {
         var e = (SeqDisplayExpr)expr;
         var elType = e.Type.AsSeqType.Arg;
-        wr.Write("{0}<{1}>.FromElements", DafnySeqClass, TypeName(elType));
-        TrExprList(e.Elements);
+        wr.Write("{0}<{1}>.FromElements", DafnySeqClass, TypeName(elType, wr));
+        TrExprList(e.Elements, wr, inLetExprBody);
 
       } else if (expr is MapDisplayExpr) {
         MapDisplayExpr e = (MapDisplayExpr)expr;
-        wr.Write("{0}.FromElements", TypeName(e.Type));
-        TrExprPairList(e.Elements);
+        wr.Write("{0}.FromElements", TypeName(e.Type, wr));
+        TrExprPairList(e.Elements, wr, inLetExprBody);
 
       } else if (expr is MemberSelectExpr) {
         MemberSelectExpr e = (MemberSelectExpr)expr;
         SpecialField sf = e.Member as SpecialField;
         if (sf != null) {
           wr.Write(sf.PreString);
-          TrParenExpr(e.Obj);
+          TrParenExpr(e.Obj, wr, inLetExprBody);
           wr.Write(".@{0}", sf.CompiledName);
           wr.Write(sf.PostString);
         } else {
-          TrParenExpr(e.Obj);
+          TrParenExpr(e.Obj, wr, inLetExprBody);
           wr.Write(".@{0}", e.Member.CompileName);
         }
 
@@ -2374,50 +2396,50 @@ namespace Microsoft.Dafny {
         if (e.Seq.Type.IsArrayType) {
           if (e.SelectOne) {
             Contract.Assert(e.E0 != null && e.E1 == null);
-            TrParenExpr(e.Seq);
+            TrParenExpr(e.Seq, wr, inLetExprBody);
             wr.Write("[(int)");
-            TrParenExpr(e.E0);
+            TrParenExpr(e.E0, wr, inLetExprBody);
             wr.Write("]");
           } else {
-            TrParenExpr("Dafny.Helpers.SeqFromArray", e.Seq);
+            TrParenExpr("Dafny.Helpers.SeqFromArray", e.Seq, wr, inLetExprBody);
             if (e.E1 != null) {
-              TrParenExpr(".Take", e.E1);
+              TrParenExpr(".Take", e.E1, wr, inLetExprBody);
             }
             if (e.E0 != null) {
-              TrParenExpr(".Drop", e.E0);
+              TrParenExpr(".Drop", e.E0, wr, inLetExprBody);
             }
           }
         } else if (e.SelectOne) {
           Contract.Assert(e.E0 != null && e.E1 == null);
-          TrParenExpr(e.Seq);
-          TrParenExpr(".Select", e.E0);
+          TrParenExpr(e.Seq, wr, inLetExprBody);
+          TrParenExpr(".Select", e.E0, wr, inLetExprBody);
         } else {
-          TrParenExpr(e.Seq);
+          TrParenExpr(e.Seq, wr, inLetExprBody);
           if (e.E1 != null) {
-            TrParenExpr(".Take", e.E1);
+            TrParenExpr(".Take", e.E1, wr, inLetExprBody);
           }
           if (e.E0 != null) {
-            TrParenExpr(".Drop", e.E0);
+            TrParenExpr(".Drop", e.E0, wr, inLetExprBody);
           }
         }
       } else if (expr is MultiSetFormingExpr) {
         var e = (MultiSetFormingExpr)expr;
-        wr.Write("{0}<{1}>", DafnyMultiSetClass, TypeName(e.E.Type.AsCollectionType.Arg));
+        wr.Write("{0}<{1}>", DafnyMultiSetClass, TypeName(e.E.Type.AsCollectionType.Arg, wr));
         var eeType = e.E.Type.NormalizeExpand();
         if (eeType is SeqType) {
-          TrParenExpr(".FromSeq", e.E);
+          TrParenExpr(".FromSeq", e.E, wr, inLetExprBody);
         } else if (eeType is SetType) {
-          TrParenExpr(".FromSet", e.E);
+          TrParenExpr(".FromSet", e.E, wr, inLetExprBody);
         } else {
           Contract.Assert(false); throw new cce.UnreachableException();
         }
       } else if (expr is MultiSelectExpr) {
         MultiSelectExpr e = (MultiSelectExpr)expr;
-        TrParenExpr(e.Array);
+        TrParenExpr(e.Array, wr, inLetExprBody);
         string prefix = "[";
         foreach (Expression idx in e.Indices) {
           wr.Write("{0}(int)", prefix);
-          TrParenExpr(idx);
+          TrParenExpr(idx, wr, inLetExprBody);
           prefix = ", ";
         }
         wr.Write("]");
@@ -2426,47 +2448,47 @@ namespace Microsoft.Dafny {
         SeqUpdateExpr e = (SeqUpdateExpr)expr;
         if (e.ResolvedUpdateExpr != null)
         {
-          TrExpr(e.ResolvedUpdateExpr);
+          TrExpr(e.ResolvedUpdateExpr, wr, inLetExprBody);
         }
         else
         {
-          TrParenExpr(e.Seq);
+          TrParenExpr(e.Seq, wr, inLetExprBody);
           wr.Write(".Update(");
-          TrExpr(e.Index);
+          TrExpr(e.Index, wr, inLetExprBody);
           wr.Write(", ");
-          TrExpr(e.Value);
+          TrExpr(e.Value, wr, inLetExprBody);
           wr.Write(")");
         }
 
       } else if (expr is FunctionCallExpr) {
         FunctionCallExpr e = (FunctionCallExpr)expr;
-        CompileFunctionCallExpr(e, wr, TrExpr);
+        CompileFunctionCallExpr(e, wr, wr, inLetExprBody, TrExpr);
 
       } else if (expr is ApplyExpr) {
         var e = expr as ApplyExpr;
         wr.Write("Dafny.Helpers.Id<");
-        wr.Write(TypeName(e.Function.Type));
+        wr.Write(TypeName(e.Function.Type, wr));
         wr.Write(">(");
-        TrExpr(e.Function);
+        TrExpr(e.Function, wr, inLetExprBody);
         wr.Write(")");
-        TrExprList(e.Args);
+        TrExprList(e.Args, wr, inLetExprBody);
 
       } else if (expr is DatatypeValue) {
         DatatypeValue dtv = (DatatypeValue)expr;
         Contract.Assert(dtv.Ctor != null);  // since dtv has been successfully resolved
-        var typeParams = dtv.InferredTypeArgs.Count == 0 ? "" : string.Format("<{0}>", TypeNames(dtv.InferredTypeArgs));
+        var typeParams = dtv.InferredTypeArgs.Count == 0 ? "" : string.Format("<{0}>", TypeNames(dtv.InferredTypeArgs, wr));
 
         wr.Write("new {0}{1}(", DtName(dtv.Ctor.EnclosingDatatype), typeParams);
         if (!dtv.IsCoCall) {
           // For an ordinary constructor (that is, one that does not guard any co-recursive calls), generate:
           //   new Dt_Cons<T>( args )
-          wr.Write("new {0}(", DtCtorName(dtv.Ctor, dtv.InferredTypeArgs));
+          wr.Write("new {0}(", DtCtorName(dtv.Ctor, dtv.InferredTypeArgs, wr));
           string sep = "";
           for (int i = 0; i < dtv.Arguments.Count; i++) {
             Formal formal = dtv.Ctor.Formals[i];
             if (!formal.IsGhost) {
               wr.Write(sep);
-              TrExpr(dtv.Arguments[i]);
+              TrExpr(dtv.Arguments[i], wr, inLetExprBody);
               sep = ", ";
             }
           }
@@ -2495,17 +2517,17 @@ namespace Microsoft.Dafny {
                 arg = varName;
 
                 wr.Write("var {0} = ", varName);
-                TrExpr(actual);
+                TrExpr(actual, wr, inLetExprBody);
                 wr.Write("; ");
               } else {
                 var sw = new StringWriter();
-                CompileFunctionCallExpr(fce, sw, (exp) => {
+                CompileFunctionCallExpr(fce, sw, wr, inLetExprBody, (exp, wrr, inLetExpr) => {
                   string varName = idGenerator.FreshId("_ac");
                   sw.Write(varName);
 
-                  wr.Write("var {0} = ", varName);
-                  TrExpr(exp);
-                  wr.Write("; ");
+                  wrr.Write("var {0} = ", varName);
+                  TrExpr(exp, wrr, inLetExpr);
+                  wrr.Write("; ");
 
                 });
                 arg = sw.ToString();
@@ -2517,7 +2539,7 @@ namespace Microsoft.Dafny {
 
           wr.Write("return () => { return ");
 
-          wr.Write("new {0}({1}", DtCtorName(dtv.Ctor, dtv.InferredTypeArgs), args);
+          wr.Write("new {0}({1}", DtCtorName(dtv.Ctor, dtv.InferredTypeArgs, wr), args);
           wr.Write("); }; })())");
         }
         wr.Write(")");
@@ -2530,11 +2552,11 @@ namespace Microsoft.Dafny {
         switch (e.Op) {
           case UnaryOpExpr.Opcode.Not:
             wr.Write("!");
-            TrParenExpr(e.E);
+            TrParenExpr(e.E, wr, inLetExprBody);
             break;
           case UnaryOpExpr.Opcode.Cardinality:
             wr.Write("new BigInteger(");
-            TrParenExpr(e.E);
+            TrParenExpr(e.E, wr, inLetExprBody);
             wr.Write(".Length)");
             break;
           default:
@@ -2552,7 +2574,7 @@ namespace Microsoft.Dafny {
           if (AsNativeType(e.E.Type) != null) {
             wr.Write("new BigInteger");
           }
-          TrParenExpr(e.E);
+          TrParenExpr(e.E, wr, inLetExprBody);
         };
         Action toIntCast = () => {
           Contract.Assert(toInt);
@@ -2568,7 +2590,7 @@ namespace Microsoft.Dafny {
         } else if (!fromInt && toInt) {
           // real -> int
           toIntCast();
-          TrParenExpr(e.E);
+          TrParenExpr(e.E, wr, inLetExprBody);
           wr.Write(".ToBigInteger()");
         } else if (AsNativeType(e.ToType) != null) {
           toIntCast();
@@ -2580,14 +2602,14 @@ namespace Microsoft.Dafny {
             wr.Write("(" + (BigInteger)lit.Value + AsNativeType(e.ToType).Suffix + ")");
           } else if ((u != null && u.Op == UnaryOpExpr.Opcode.Cardinality) || (m != null && m.MemberName == "Length" && m.Obj.Type.IsArrayType)) {
             // Optimize .Length to avoid intermediate BigInteger
-            TrParenExpr((u != null) ? u.E : m.Obj);
+            TrParenExpr((u != null) ? u.E : m.Obj, wr, inLetExprBody);
             if (AsNativeType(e.ToType).UpperBound <= new BigInteger(0x80000000U)) {
               wr.Write(".Length");
             } else {
               wr.Write(".LongLength");
             }
           } else {
-            TrParenExpr(e.E);
+            TrParenExpr(e.E, wr, inLetExprBody);
           }
         } else if (e.ToType.IsIntegerType && AsNativeType(e.E.Type) != null) {
           fromIntAsBigInteger();
@@ -2595,7 +2617,7 @@ namespace Microsoft.Dafny {
           Contract.Assert(fromInt == toInt);
           Contract.Assert(AsNativeType(e.ToType) == null);
           Contract.Assert(AsNativeType(e.E.Type) == null);
-          TrParenExpr(e.E);
+          TrParenExpr(e.E, wr, inLetExprBody);
         }
 
       } else if (expr is BinaryExpr) {
@@ -2664,9 +2686,9 @@ namespace Microsoft.Dafny {
             if (expr.Type.IsIntegerType || (AsNativeType(expr.Type) != null && AsNativeType(expr.Type).LowerBound < BigInteger.Zero)) {
               string suffix = AsNativeType(expr.Type) != null ? ("_" + AsNativeType(expr.Type).Name) : "";
               wr.Write("Dafny.Helpers.EuclideanDivision" + suffix + "(");
-              TrParenExpr(e.E0);
+              TrParenExpr(e.E0, wr, inLetExprBody);
               wr.Write(", ");
-              TrExpr(e.E1);
+              TrExpr(e.E1, wr, inLetExprBody);
               wr.Write(")");
             } else {
               opString = "/";  // for reals
@@ -2676,9 +2698,9 @@ namespace Microsoft.Dafny {
             if (expr.Type.IsIntegerType || (AsNativeType(expr.Type) != null && AsNativeType(expr.Type).LowerBound < BigInteger.Zero)) {
               string suffix = AsNativeType(expr.Type) != null ? ("_" + AsNativeType(expr.Type).Name) : "";
               wr.Write("Dafny.Helpers.EuclideanModulus" + suffix + "(");
-              TrParenExpr(e.E0);
+              TrParenExpr(e.E0, wr, inLetExprBody);
               wr.Write(", ");
-              TrExpr(e.E1);
+              TrExpr(e.E1, wr, inLetExprBody);
               wr.Write(")");
             } else {
               opString = "%";  // for reals
@@ -2713,18 +2735,18 @@ namespace Microsoft.Dafny {
           case BinaryExpr.ResolvedOpcode.InSet:
           case BinaryExpr.ResolvedOpcode.InMultiSet:
           case BinaryExpr.ResolvedOpcode.InMap:
-            TrParenExpr(e.E1);
+            TrParenExpr(e.E1, wr, inLetExprBody);
             wr.Write(".Contains(");
-            TrExpr(e.E0);
+            TrExpr(e.E0, wr, inLetExprBody);
             wr.Write(")");
             break;
           case BinaryExpr.ResolvedOpcode.NotInSet:
           case BinaryExpr.ResolvedOpcode.NotInMultiSet:
           case BinaryExpr.ResolvedOpcode.NotInMap:
             wr.Write("!");
-            TrParenExpr(e.E1);
+            TrParenExpr(e.E1, wr, inLetExprBody);
             wr.Write(".Contains(");
-            TrExpr(e.E0);
+            TrExpr(e.E0, wr, inLetExprBody);
             wr.Write(")");
             break;
           case BinaryExpr.ResolvedOpcode.Union:
@@ -2744,16 +2766,16 @@ namespace Microsoft.Dafny {
           case BinaryExpr.ResolvedOpcode.Concat:
             callString = "Concat";  break;
           case BinaryExpr.ResolvedOpcode.InSeq:
-            TrParenExpr(e.E1);
+            TrParenExpr(e.E1, wr, inLetExprBody);
             wr.Write(".Contains(");
-            TrExpr(e.E0);
+            TrExpr(e.E0, wr, inLetExprBody);
             wr.Write(")");
             break;
           case BinaryExpr.ResolvedOpcode.NotInSeq:
             wr.Write("!");
-            TrParenExpr(e.E1);
+            TrParenExpr(e.E1, wr, inLetExprBody);
             wr.Write(".Contains(");
-            TrExpr(e.E0);
+            TrExpr(e.E0, wr, inLetExprBody);
             wr.Write(")");
             break;
 
@@ -2767,17 +2789,17 @@ namespace Microsoft.Dafny {
             wr.Write("(" + nativeType.Name + ")(");
           }
           wr.Write(preOpString);
-          TrParenExpr(e.E0);
+          TrParenExpr(e.E0, wr, inLetExprBody);
           wr.Write(" {0} ", opString);
-          TrParenExpr(e.E1);
+          TrParenExpr(e.E1, wr, inLetExprBody);
           if (needsCast) {
             wr.Write(")");
           }
         } else if (callString != null) {
           wr.Write(preOpString);
-          TrParenExpr(e.E0);
+          TrParenExpr(e.E0, wr, inLetExprBody);
           wr.Write(".@{0}(", callString);
-          TrExpr(e.E1);
+          TrExpr(e.E1, wr, inLetExprBody);
           wr.Write(")");
         }
 
@@ -2800,17 +2822,18 @@ namespace Microsoft.Dafny {
             if (Contract.Exists(lhs.Vars, bv => !bv.IsGhost)) {
               var rhsName = string.Format("_pat_let{0}_{1}", GetUniqueAstNumber(e), i);
               wr.Write("Dafny.Helpers.Let<");
-              wr.Write(TypeName(e.RHSs[i].Type) + "," + TypeName(e.Body.Type));
+              wr.Write(TypeName(e.RHSs[i].Type, wr) + "," + TypeName(e.Body.Type, wr));
               wr.Write(">(");
-              TrExpr(e.RHSs[i]);
+              TrExpr(e.RHSs[i], wr, inLetExprBody);
               wr.Write(", " + rhsName + " => ");
               neededCloseParens++;
-              var c = TrCasePattern(lhs, rhsName, e.Body.Type);
+              var c = TrCasePattern(lhs, rhsName, e.Body.Type, wr);
               Contract.Assert(c != 0);  // we already checked that there's at least one non-ghost
               neededCloseParens += c;
             }
           }
-          TrExpr(e.Body);
+          
+          TrExpr(e.Body, wr, true);
           for (int i = 0; i < neededCloseParens; i++) {
             wr.Write(")");
           }
@@ -2819,7 +2842,7 @@ namespace Microsoft.Dafny {
           //    ghost var x,y :| Constraint; E
           // is compiled just like E is, because the resolver has already checked that x,y (or other ghost variables, for that matter) don't
           // occur in E (moreover, the verifier has checked that values for x,y satisfying Constraint exist).
-          TrExpr(e.Body);
+          TrExpr(e.Body, wr, inLetExprBody);
         } else {
           // The Dafny "let" expression
           //    var x,y :| Constraint; E
@@ -2834,17 +2857,17 @@ namespace Microsoft.Dafny {
           Contract.Assert(e.RHSs.Count == 1);  // checked by resolution
           if (e.Constraint_MissingBounds != null) {
             foreach (var bv in e.Constraint_MissingBounds) {
-              Error("this let-such-that expression is too advanced for the current compiler; Dafny's heuristics cannot find any bound for variable '{0}' (line {1})", bv.Name, e.tok.line);
+              Error("this let-such-that expression is too advanced for the current compiler; Dafny's heuristics cannot find any bound for variable '{0}' (line {1})", wr, bv.Name, e.tok.line);
             }
           } else {
-            wr.Write("Dafny.Helpers.Let<int," + TypeName(e.Body.Type) + ">(0, _let_dummy_" + GetUniqueAstNumber(e) + " => {");
+            wr.Write("Dafny.Helpers.Let<int," + TypeName(e.Body.Type, wr) + ">(0, _let_dummy_" + GetUniqueAstNumber(e) + " => {");
             foreach (var bv in e.BoundVars) {
-              wr.Write("{0} @{1}", TypeName(bv.Type), bv.CompileName);
-              wr.WriteLine(" = {0};", DefaultValue(bv.Type));
+              wr.Write("{0} @{1}", TypeName(bv.Type, wr), bv.CompileName);
+              wr.WriteLine(" = {0};", DefaultValue(bv.Type, wr));
             }
-            TrAssignSuchThat(0, new List<IVariable>(e.BoundVars).ConvertAll(bv => (IVariable)bv), e.RHSs[0], e.Constraint_Bounds, e.tok.line);
+            TrAssignSuchThat(0, new List<IVariable>(e.BoundVars).ConvertAll(bv => (IVariable)bv), e.RHSs[0], e.Constraint_Bounds, e.tok.line, wr, inLetExprBody);
             wr.Write(" return ");
-            TrExpr(e.Body);
+            TrExpr(e.Body, wr, true);
             wr.Write("; })");
           }
         }
@@ -2864,7 +2887,7 @@ namespace Microsoft.Dafny {
         // }(src)
 
         string source = idGenerator.FreshId("_source");
-        wr.Write("new Dafny.Helpers.Function<{0}, {1}>(delegate ({0} {2}) {{ ", TypeName(e.Source.Type), TypeName(e.Type), source);
+        wr.Write("new Dafny.Helpers.Function<{0}, {1}>(delegate ({0} {2}) {{ ", TypeName(e.Source.Type, wr), TypeName(e.Type, wr), source);
 
         if (e.Cases.Count == 0) {
           // the verifier would have proved we never get here; still, we need some code that will compile
@@ -2873,9 +2896,9 @@ namespace Microsoft.Dafny {
           int i = 0;
           var sourceType = (UserDefinedType)e.Source.Type.NormalizeExpand();
           foreach (MatchCaseExpr mc in e.Cases) {
-            MatchCasePrelude(source, sourceType, cce.NonNull(mc.Ctor), mc.Arguments, i, e.Cases.Count, 0);
+            MatchCasePrelude(source, sourceType, cce.NonNull(mc.Ctor), mc.Arguments, i, e.Cases.Count, 0, wr);
             wr.Write("return ");
-            TrExpr(mc.Body);
+            TrExpr(mc.Body, wr, inLetExprBody);
             wr.Write("; ");
             i++;
           }
@@ -2883,7 +2906,7 @@ namespace Microsoft.Dafny {
         }
         // We end with applying the source expression to the delegate we just built
         wr.Write("})(");
-        TrExpr(e.Source);
+        TrExpr(e.Source, wr, inLetExprBody);
         wr.Write(")");
 
       } else if (expr is QuantifierExpr) {
@@ -2905,24 +2928,24 @@ namespace Microsoft.Dafny {
           } else if (bound is ComprehensionExpr.IntBoundedPool) {
             var b = (ComprehensionExpr.IntBoundedPool)bound;
             wr.Write("Dafny.Helpers.QuantInt(");
-            TrExpr(b.LowerBound);
+            TrExpr(b.LowerBound, wr, inLetExprBody);
             wr.Write(", ");
-            TrExpr(b.UpperBound);
+            TrExpr(b.UpperBound, wr, inLetExprBody);
             wr.Write(", ");
           } else if (bound is ComprehensionExpr.SetBoundedPool) {
             var b = (ComprehensionExpr.SetBoundedPool)bound;
             wr.Write("Dafny.Helpers.QuantSet(");
-            TrExpr(b.Set);
+            TrExpr(b.Set, wr, inLetExprBody);
             wr.Write(", ");
           } else if (bound is ComprehensionExpr.MapBoundedPool) {
             var b = (ComprehensionExpr.MapBoundedPool)bound;
             wr.Write("Dafny.Helpers.QuantMap(");
-            TrExpr(b.Map);
+            TrExpr(b.Map, wr, inLetExprBody);
             wr.Write(", ");
           } else if (bound is ComprehensionExpr.SeqBoundedPool) {
             var b = (ComprehensionExpr.SeqBoundedPool)bound;
             wr.Write("Dafny.Helpers.QuantSeq(");
-            TrExpr(b.Seq);
+            TrExpr(b.Seq, wr, inLetExprBody);
             wr.Write(", ");
           } else if (bound is ComprehensionExpr.DatatypeBoundedPool) {
             var b = (ComprehensionExpr.DatatypeBoundedPool)bound;
@@ -2935,7 +2958,7 @@ namespace Microsoft.Dafny {
           wr.Write("{0}, ", expr is ForallExpr ? "true" : "false");
           wr.Write("@{0} => ", bv.CompileName);
         }
-        TrExpr(e.LogicalBody(true));
+        TrExpr(e.LogicalBody(true), wr, inLetExprBody);
         for (int i = 0; i < n; i++) {
           wr.Write(")");
         }
@@ -2959,7 +2982,7 @@ namespace Microsoft.Dafny {
         //   return Dafny.Set<G>.FromCollection(_coll);
         // })()
         Contract.Assert(e.Bounds != null);  // the resolver would have insisted on finding bounds
-        var typeName = TypeName(e.Type.AsSetType.Arg);
+        var typeName = TypeName(e.Type.AsSetType.Arg, wr);
         wr.Write("((Dafny.Helpers.ComprehensionDelegate<{0}>)delegate() {{ ", typeName);
         wr.Write("var _coll = new System.Collections.Generic.List<{0}>(); ", typeName);
         var n = e.BoundVars.Count;
@@ -2978,36 +3001,36 @@ namespace Microsoft.Dafny {
             } else {
               wr.Write("foreach (var @{0} in Dafny.Helpers.IntegerRange(", bv.CompileName);
             }
-            TrExpr(b.LowerBound);
+            TrExpr(b.LowerBound, wr, inLetExprBody);
             wr.Write(", ");
-            TrExpr(b.UpperBound);
+            TrExpr(b.UpperBound, wr, inLetExprBody);
             wr.Write(")) { ");
           } else if (bound is ComprehensionExpr.SetBoundedPool) {
             var b = (ComprehensionExpr.SetBoundedPool)bound;
             wr.Write("foreach (var @{0} in (", bv.CompileName);
-            TrExpr(b.Set);
+            TrExpr(b.Set, wr, inLetExprBody);
             wr.Write(").Elements) { ");
           } else if (bound is ComprehensionExpr.MapBoundedPool) {
             var b = (ComprehensionExpr.MapBoundedPool)bound;
             wr.Write("foreach (var @{0} in (", bv.CompileName);
-            TrExpr(b.Map);
+            TrExpr(b.Map, wr, inLetExprBody);
             wr.Write(").Domain) { ");
           } else if (bound is ComprehensionExpr.SeqBoundedPool) {
             var b = (ComprehensionExpr.SeqBoundedPool)bound;
             wr.Write("foreach (var @{0} in (", bv.CompileName);
-            TrExpr(b.Seq);
+            TrExpr(b.Seq, wr, inLetExprBody);
             wr.Write(").Elements) { ");
           } else if (bound is ComprehensionExpr.DatatypeBoundedPool) {
             var b = (ComprehensionExpr.DatatypeBoundedPool)bound;
-            wr.Write("foreach (var @{0} in {1}.AllSingletonConstructors) {{", bv.CompileName, TypeName(bv.Type));
+            wr.Write("foreach (var @{0} in {1}.AllSingletonConstructors) {{", bv.CompileName, TypeName(bv.Type, wr));
           } else {
             Contract.Assert(false); throw new cce.UnreachableException();  // unexpected BoundedPool type
           }
         }
         wr.Write("if (");
-        TrExpr(e.Range);
+        TrExpr(e.Range, wr, inLetExprBody);
         wr.Write(") { _coll.Add(");
-        TrExpr(e.Term);
+        TrExpr(e.Term, wr, inLetExprBody);
         wr.Write("); }");
         for (int i = 0; i < n; i++) {
           wr.Write("}");
@@ -3034,8 +3057,8 @@ namespace Microsoft.Dafny {
         //   return Dafny.Map<U, V>.FromElements(_coll);
         // })()
         Contract.Assert(e.Bounds != null);  // the resolver would have insisted on finding bounds
-        var domtypeName = TypeName(e.Type.AsMapType.Domain);
-        var rantypeName = TypeName(e.Type.AsMapType.Range);
+        var domtypeName = TypeName(e.Type.AsMapType.Domain, wr);
+        var rantypeName = TypeName(e.Type.AsMapType.Range, wr);
         wr.Write("((Dafny.Helpers.MapComprehensionDelegate<{0},{1}>)delegate() {{ ", domtypeName, rantypeName);
         wr.Write("var _coll = new System.Collections.Generic.List<Dafny.Pair<{0},{1}>>(); ", domtypeName, rantypeName);
         var n = e.BoundVars.Count;
@@ -3053,34 +3076,34 @@ namespace Microsoft.Dafny {
           } else {
             wr.Write("foreach (var @{0} in Dafny.Helpers.IntegerRange(", bv.CompileName);
           }
-          TrExpr(b.LowerBound);
+          TrExpr(b.LowerBound, wr, inLetExprBody);
           wr.Write(", ");
-          TrExpr(b.UpperBound);
+          TrExpr(b.UpperBound, wr, inLetExprBody);
           wr.Write(")) { ");
         } else if (bound is ComprehensionExpr.SetBoundedPool) {
           var b = (ComprehensionExpr.SetBoundedPool)bound;
           wr.Write("foreach (var @{0} in (", bv.CompileName);
-          TrExpr(b.Set);
+          TrExpr(b.Set, wr, inLetExprBody);
           wr.Write(").Elements) { ");
         } else if (bound is ComprehensionExpr.MapBoundedPool) {
           var b = (ComprehensionExpr.MapBoundedPool)bound;
           wr.Write("foreach (var @{0} in (", bv.CompileName);
-          TrExpr(b.Map);
+          TrExpr(b.Map, wr, inLetExprBody);
           wr.Write(").Domain) { ");
         } else if (bound is ComprehensionExpr.SeqBoundedPool) {
           var b = (ComprehensionExpr.SeqBoundedPool)bound;
           wr.Write("foreach (var @{0} in (", bv.CompileName);
-          TrExpr(b.Seq);
+          TrExpr(b.Seq, wr, inLetExprBody);
           wr.Write(").Elements) { ");
         } else {
           // TODO: handle ComprehensionExpr.SubSetBoundedPool
           Contract.Assert(false); throw new cce.UnreachableException();  // unexpected BoundedPool type
         }
         wr.Write("if (");
-        TrExpr(e.Range);
+        TrExpr(e.Range, wr, inLetExprBody);
         wr.Write(") { ");
         wr.Write("_coll.Add(new Dafny.Pair<{0},{1}>(@{2},", domtypeName, rantypeName, bv.CompileName);
-        TrExpr(e.Term);
+        TrExpr(e.Term, wr, inLetExprBody);
         wr.Write(")); }");
         wr.Write("}");
         wr.Write("return Dafny.Map<{0},{1}>.FromCollection(_coll); ", domtypeName, rantypeName);
@@ -3109,46 +3132,46 @@ namespace Microsoft.Dafny {
 
         var su = new Translator.Substituter(null, sm, new Dictionary<TypeParameter, Type>(), null);
 
-        BetaRedex(bvars, fexprs, expr.Type, () => {
+        BetaRedex(bvars, fexprs, expr.Type, wr, inLetExprBody, () => {
           wr.Write("(");
           wr.Write(Util.Comma(e.BoundVars, bv => "@" + bv.CompileName));
           wr.Write(") => ");
-          TrExpr(su.Substitute(e.Body));
+          TrExpr(su.Substitute(e.Body), wr, inLetExprBody);
         });
 
       } else if (expr is StmtExpr) {
         var e = (StmtExpr)expr;
-        TrExpr(e.E);
+        TrExpr(e.E, wr, inLetExprBody);
 
       } else if (expr is ITEExpr) {
         ITEExpr e = (ITEExpr)expr;
         wr.Write("(");
-        TrExpr(e.Test);
+        TrExpr(e.Test, wr, inLetExprBody);
         wr.Write(") ? (");
-        TrExpr(e.Thn);
+        TrExpr(e.Thn, wr, inLetExprBody);
         wr.Write(") : (");
-        TrExpr(e.Els);
+        TrExpr(e.Els, wr, inLetExprBody);
         wr.Write(")");
 
       } else if (expr is ConcreteSyntaxExpression) {
         var e = (ConcreteSyntaxExpression)expr;
-        TrExpr(e.ResolvedExpression);
+        TrExpr(e.ResolvedExpression, wr, inLetExprBody);
 
       } else if (expr is NamedExpr) {
-        TrExpr(((NamedExpr)expr).Body);
+        TrExpr(((NamedExpr)expr).Body, wr, inLetExprBody);
       } else {
         Contract.Assert(false); throw new cce.UnreachableException();  // unexpected expression
       }
     }
 
-    int TrCasePattern(CasePattern pat, string rhsString, Type bodyType) {
+    int TrCasePattern(CasePattern pat, string rhsString, Type bodyType, TextWriter wr) {
       Contract.Requires(pat != null);
       Contract.Requires(rhsString != null);
       int c = 0;
       if (pat.Var != null) {
         var bv = pat.Var;
         if (!bv.IsGhost) {
-          wr.Write("Dafny.Helpers.Let<" + TypeName(bv.Type) + "," + TypeName(bodyType) + ">");
+          wr.Write("Dafny.Helpers.Let<" + TypeName(bv.Type, wr) + "," + TypeName(bodyType, wr) + ">");
           wr.Write("(" + rhsString + ", @" + bv.CompileName + " => ");
           c++;
         }
@@ -3164,7 +3187,7 @@ namespace Microsoft.Dafny {
             // nothing to compile, but do a sanity check
             Contract.Assert(!Contract.Exists(arg.Vars, bv => !bv.IsGhost));
           } else {
-            c += TrCasePattern(arg, string.Format("(({0})({1})._D).@{2}", DtCtorName(ctor, ((DatatypeValue)pat.Expr).InferredTypeArgs), rhsString, FormalName(formal, k)), bodyType);
+            c += TrCasePattern(arg, string.Format("(({0})({1})._D).@{2}", DtCtorName(ctor, ((DatatypeValue)pat.Expr).InferredTypeArgs, wr), rhsString, FormalName(formal, k)), bodyType, wr);
             k++;
           }
         }
@@ -3172,40 +3195,40 @@ namespace Microsoft.Dafny {
       return c;
     }
 
-    delegate void FCE_Arg_Translator(Expression e);
+    delegate void FCE_Arg_Translator(Expression e, TextWriter wr, bool inLetExpr=false);
 
-    void CompileFunctionCallExpr(FunctionCallExpr e, TextWriter twr, FCE_Arg_Translator tr) {
+   void CompileFunctionCallExpr(FunctionCallExpr e, TextWriter twr, TextWriter wr, bool inLetExprBody, FCE_Arg_Translator tr) {
       Function f = cce.NonNull(e.Function);
       if (f.IsStatic) {
-        twr.Write(TypeName_Companion(e.Receiver.Type));
+        twr.Write(TypeName_Companion(e.Receiver.Type, wr));
       } else {
         twr.Write("(");
-        tr(e.Receiver);
+        tr(e.Receiver, wr, inLetExprBody);
         twr.Write(")");
       }
       twr.Write(".@{0}", f.CompileName);
       if (f.TypeArgs.Count != 0) {
           List<Type> typeArgs = f.TypeArgs.ConvertAll(ta => e.TypeArgumentSubstitutions[ta]);
-          twr.Write("<" + TypeNames(typeArgs) + ">");
+          twr.Write("<" + TypeNames(typeArgs, wr) + ">");
       }
       twr.Write("(");
       string sep = "";
       for (int i = 0; i < e.Args.Count; i++) {
         if (!e.Function.Formals[i].IsGhost) {
           twr.Write(sep);
-          tr(e.Args[i]);
+          tr(e.Args[i], wr);
           sep = ", ";
         }
       }
       twr.Write(")");
     }
 
-    void BetaRedex(List<BoundVar> bvars, List<Expression> exprs, Type bodyType, Action makeBody) {
+    void BetaRedex(List<BoundVar> bvars, List<Expression> exprs, Type bodyType, TextWriter wr, bool inLetExprBody, Action makeBody) {
       Contract.Requires(bvars != null);
       Contract.Requires(exprs != null);
       Contract.Requires(bvars.Count == exprs.Count);
       wr.Write("Dafny.Helpers.Id<");
-      wr.Write(TypeName_UDT(ArrowType.Arrow_FullCompileName, Util.Snoc(bvars.ConvertAll(bv => bv.Type), bodyType)));
+      wr.Write(TypeName_UDT(ArrowType.Arrow_FullCompileName, Util.Snoc(bvars.ConvertAll(bv => bv.Type), bodyType), wr));
       wr.Write(">((");
       wr.Write(Util.Comma(bvars, bv => "@" + bv.CompileName));
       wr.Write(") => ");
@@ -3213,7 +3236,7 @@ namespace Microsoft.Dafny {
       makeBody();
 
       wr.Write(")");
-      TrExprList(exprs);
+      TrExprList(exprs, wr, inLetExprBody);
     }
 
   }
diff --git a/Source/DafnyDriver/DafnyDriver.cs b/Source/DafnyDriver/DafnyDriver.cs
index 8282edc7..6cfbe7e1 100644
--- a/Source/DafnyDriver/DafnyDriver.cs
+++ b/Source/DafnyDriver/DafnyDriver.cs
@@ -300,14 +300,14 @@ namespace Microsoft.Dafny
 
       // Compile the Dafny program into a string that contains the C# program
       StringWriter sw = new StringWriter();
-      Dafny.Compiler compiler = new Dafny.Compiler(sw);
+      Dafny.Compiler compiler = new Dafny.Compiler();
       compiler.ErrorWriter = outputWriter;
       var hasMain = compiler.HasMain(dafnyProgram);
       if (DafnyOptions.O.RunAfterCompile && !hasMain) {
         // do no more
         return;
       }
-      compiler.Compile(dafnyProgram);
+      compiler.Compile(dafnyProgram, sw);
       var csharpProgram = sw.ToString();
       bool completeProgram = compiler.ErrorCount == 0;
 
diff --git a/Test/dafny4/Bug89.dfy b/Test/dafny4/Bug89.dfy
new file mode 100644
index 00000000..12aec5f4
--- /dev/null
+++ b/Test/dafny4/Bug89.dfy
@@ -0,0 +1,15 @@
+// RUN: %dafny  /compile:3 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+method F() returns(x:int)
+  ensures x == 6;
+{
+  x := 5;
+  x := (var y := 1; y + x);
+}
+
+method Main()
+{
+  var x := F();
+  print x;
+}
\ No newline at end of file
diff --git a/Test/dafny4/Bug89.dfy.expect b/Test/dafny4/Bug89.dfy.expect
new file mode 100644
index 00000000..5221a5d1
--- /dev/null
+++ b/Test/dafny4/Bug89.dfy.expect
@@ -0,0 +1,6 @@
+
+Dafny program verifier finished with 4 verified, 0 errors
+Program compiled successfully
+Running...
+
+6
\ No newline at end of file
-- 
cgit v1.2.3


From d3c778854c2dc792a2dfbd9c5b05d667d18fb4c4 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Wed, 4 Nov 2015 16:27:42 -0800
Subject: Fix issue 104. Use ResolvedExpression to compute subexpressions for
 DatatypeUpdateExpr if ResovedExpression is not null.

---
 Source/Dafny/DafnyAst.cs      | 12 +++++++++---
 Test/dafny4/Bug104.dfy        | 12 ++++++++++++
 Test/dafny4/Bug104.dfy.expect |  3 +++
 3 files changed, 24 insertions(+), 3 deletions(-)
 create mode 100644 Test/dafny4/Bug104.dfy
 create mode 100644 Test/dafny4/Bug104.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 16b29c2b..fdbd484e 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -7800,9 +7800,15 @@ namespace Microsoft.Dafny {
 
     public override IEnumerable<Expression> SubExpressions {
       get {
-        yield return Root;
-        foreach (var update in Updates) {
-          yield return update.Item3;
+        if (ResolvedExpression == null) {
+          yield return Root;
+          foreach (var update in Updates) {
+            yield return update.Item3;
+          }
+        } else {
+          foreach (var e in ResolvedExpression.SubExpressions) {
+            yield return e;
+          }
         }
       }
     }
diff --git a/Test/dafny4/Bug104.dfy b/Test/dafny4/Bug104.dfy
new file mode 100644
index 00000000..ffabbb92
--- /dev/null
+++ b/Test/dafny4/Bug104.dfy
@@ -0,0 +1,12 @@
+// RUN: %dafny /compile:0 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+datatype PartRealPartGhost = PartRealPartGhost(x:int, ghost y:int) 
+
+method UpdateField() 
+{
+ var v := PartRealPartGhost(3, 4);
+ ghost var g := 5;
+ v := v[y := g];
+ v := v.(y := g);
+}
\ No newline at end of file
diff --git a/Test/dafny4/Bug104.dfy.expect b/Test/dafny4/Bug104.dfy.expect
new file mode 100644
index 00000000..1cc43cbf
--- /dev/null
+++ b/Test/dafny4/Bug104.dfy.expect
@@ -0,0 +1,3 @@
+Bug104.dfy(10,7): Warning: datatype update syntax D[f := E] is deprecated; the new syntax is D.(f := E)
+
+Dafny program verifier finished with 2 verified, 0 errors
-- 
cgit v1.2.3


From 78d8881d6b579e14005a0a520ada8ded698c904e Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Thu, 5 Nov 2015 05:18:50 -0800
Subject: In the VS IDE, don't generate hover-text information for
 auto-generated identifiers

---
 Source/DafnyExtension/IdentifierTagger.cs | 10 +++++-----
 Source/DafnyExtension/OutliningTagger.cs  |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyExtension/IdentifierTagger.cs b/Source/DafnyExtension/IdentifierTagger.cs
index 51f837f7..998a2d7f 100644
--- a/Source/DafnyExtension/IdentifierTagger.cs
+++ b/Source/DafnyExtension/IdentifierTagger.cs
@@ -381,7 +381,7 @@ namespace DafnyLanguage
         Contract.Requires(prog != null);
         Contract.Requires(tok != null);
         Contract.Requires(v != null);
-        if (InMainFile(prog, tok)) {
+        if (InMainFileAndUserDefined(prog, tok)) {
           regions.Add(new IdRegion(tok, v, isDefinition, kind, context));
         }
       }
@@ -391,7 +391,7 @@ namespace DafnyLanguage
         Contract.Requires(tok != null);
         Contract.Requires(decl != null);
         Contract.Requires(kind != null);
-        if (InMainFile(prog, tok)) {
+        if (InMainFileAndUserDefined(prog, tok)) {
           regions.Add(new IdRegion(tok, decl, showType, kind, isDefinition, context));
         }
       }
@@ -401,7 +401,7 @@ namespace DafnyLanguage
         Contract.Requires(prog != null);
         Contract.Requires(tok != null);
         Contract.Requires(text != null);
-        if (InMainFile(prog, tok)) {
+        if (InMainFileAndUserDefined(prog, tok)) {
           regions.Add(new IdRegion(tok, OccurrenceKind.AdditionalInformation, text, length));
         }
       }
@@ -457,10 +457,10 @@ namespace DafnyLanguage
 
   public abstract class DafnyRegion
   {
-    public static bool InMainFile(Microsoft.Dafny.Program prog, Bpl.IToken tok) {
+    public static bool InMainFileAndUserDefined(Microsoft.Dafny.Program prog, Bpl.IToken tok) {
       Contract.Requires(prog != null);
       Contract.Requires(tok != null);
-      return object.Equals(prog.FullName, tok.filename);
+      return object.Equals(prog.FullName, tok.filename) && !(tok is AutoGeneratedToken);
     }
   }
 
diff --git a/Source/DafnyExtension/OutliningTagger.cs b/Source/DafnyExtension/OutliningTagger.cs
index ea611594..fc06d4bf 100644
--- a/Source/DafnyExtension/OutliningTagger.cs
+++ b/Source/DafnyExtension/OutliningTagger.cs
@@ -201,7 +201,7 @@ namespace DafnyLanguage
       public static void Add(List<OutliningRegion> regions, Microsoft.Dafny.Program prog, Dafny.INamedRegion decl, string kind) {
         Contract.Requires(regions != null);
         Contract.Requires(prog != null);
-        if (InMainFile(prog, decl.BodyStartTok)) {
+        if (InMainFileAndUserDefined(prog, decl.BodyStartTok)) {
           regions.Add(new OutliningRegion(decl, kind));
         }
       }
-- 
cgit v1.2.3


From 23067608f2d8855abd64982cabfe7f0c7f8e4f5a Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Fri, 6 Nov 2015 13:51:08 -0800
Subject: Fix issue 99. When annotate a quantifier expr that has a
 SplitQuantifier, we need exclude the private terms (the ones that includes
 the quantifier expr's bv) from it exported terms.

---
 Source/Dafny/Triggers/TriggersCollector.cs |  4 ++--
 Test/dafny4/Bug99.dfy                      | 11 +++++++++++
 Test/dafny4/Bug99.dfy.expect               |  2 ++
 3 files changed, 15 insertions(+), 2 deletions(-)
 create mode 100644 Test/dafny4/Bug99.dfy
 create mode 100644 Test/dafny4/Bug99.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index c25f65b9..698ea3b5 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -201,8 +201,8 @@ namespace Microsoft.Dafny.Triggers {
           (expr is UnaryOpExpr && (((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Cardinality)) || // FIXME || ((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Fresh doesn't work, as fresh is a pretty tricky predicate when it's not about datatypes. See translator.cs:10944
           (expr is BinaryExpr && (((BinaryExpr)expr).Op == BinaryExpr.Opcode.NotIn || ((BinaryExpr)expr).Op == BinaryExpr.Opcode.In))) {
         annotation = AnnotatePotentialCandidate(expr);
-      } else if (expr is QuantifierExpr && ((QuantifierExpr)expr).SplitQuantifier == null) {
-        annotation = AnnotateQuantifier((QuantifierExpr)expr);
+      } else if (expr is QuantifierExpr) {
+          annotation = AnnotateQuantifier((QuantifierExpr)expr);
       } else if (expr is LetExpr) {
         annotation = AnnotateLetExpr((LetExpr)expr);
       } else if (expr is IdentifierExpr) {
diff --git a/Test/dafny4/Bug99.dfy b/Test/dafny4/Bug99.dfy
new file mode 100644
index 00000000..3f95ce9f
--- /dev/null
+++ b/Test/dafny4/Bug99.dfy
@@ -0,0 +1,11 @@
+// RUN: %dafny  /autoTriggers:1 /compile:0 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+predicate P(e:int, p:int) { true }
+predicate Q(i:int, t:int)
+
+lemma Tester(x:int)
+{
+    assert forall i :: Q(i, x) ==> (forall p {:trigger P(i, p)} :: P(i, p));
+		
+}
diff --git a/Test/dafny4/Bug99.dfy.expect b/Test/dafny4/Bug99.dfy.expect
new file mode 100644
index 00000000..73ba063c
--- /dev/null
+++ b/Test/dafny4/Bug99.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 4 verified, 0 errors
-- 
cgit v1.2.3


From 324c2f4bf8842cce7922e7ff7972216dfc06546f Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Tue, 10 Nov 2015 15:53:39 -0800
Subject: Fix issue 101. Instead of swapping operands for Exp opcode in
 BinaryExpr, swap them when the expr is first created in parser or for
 calcstmt. This avoids problems of operands being swapped again when the expr
 is copied.

---
 Source/Dafny/Dafny.atg        |  7 +++++--
 Source/Dafny/DafnyAst.cs      | 17 ++++++++---------
 Source/Dafny/Parser.cs        |  5 +++--
 Test/dafny4/Bug101.dfy        | 19 +++++++++++++++++++
 Test/dafny4/Bug101.dfy.expect |  8 ++++++++
 5 files changed, 43 insertions(+), 13 deletions(-)
 create mode 100644 Test/dafny4/Bug101.dfy
 create mode 100644 Test/dafny4/Bug101.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index 5fa1085d..ff3b75a3 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -2175,10 +2175,13 @@ ImpliesExpliesExpression<out Expression e0, bool allowSemi, bool allowLambda>
     ( ImpliesOp                                               (. x = t; .)
       ImpliesExpression<out e1, allowSemi, allowLambda>       (. e0 = new BinaryExpr(x, BinaryExpr.Opcode.Imp, e0, e1); .)
     | ExpliesOp                                               (. x = t; .)
-      LogicalExpression<out e1, allowSemi, allowLambda>       (. e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e0, e1); .)
+      LogicalExpression<out e1, allowSemi, allowLambda>       (. // The order of operands is reversed so that it can be turned into implication during resolution 
+			                                                           e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e1, e0); .)
       { IF(IsExpliesOp())  /* read a reverse implication as far as possible */
         ExpliesOp                                             (. x = t; .)
-        LogicalExpression<out e1, allowSemi, allowLambda>     (. e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e0, e1); .)
+        LogicalExpression<out e1, allowSemi, allowLambda>     (. //The order of operands is reversed so that it can be turned into implication during resolution
+				                                                         e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e1, e0); 
+																															.)
       }
     )
   ]
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index fdbd484e..9ed3b7e0 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -4885,7 +4885,12 @@ namespace Microsoft.Dafny {
 
       public override Expression StepExpr(Expression line0, Expression line1)
       {
-        return new BinaryExpr(line0.tok, Op, line0, line1);
+        if (Op == BinaryExpr.Opcode.Exp) {
+          // The order of operands is reversed so that it can be turned into implication during resolution 
+          return new BinaryExpr(line0.tok, Op, line1, line0);
+        } else {
+          return new BinaryExpr(line0.tok, Op, line0, line1);
+        }
       }
 
       public override string ToString()
@@ -6779,14 +6784,8 @@ namespace Microsoft.Dafny {
       Contract.Requires(e0 != null);
       Contract.Requires(e1 != null);
       this.Op = op;
-      if (op == Opcode.Exp) {
-        // The order of operands is reversed so that it can be turned into implication during resolution
-        this.E0 = e1;
-        this.E1 = e0;
-      } else {
-        this.E0 = e0;
-        this.E1 = e1;
-      }
+      this.E0 = e0;
+      this.E1 = e1;
     }
 
     /// <summary>
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index 6a5f32ab..b6a59f4e 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -3267,12 +3267,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				ExpliesOp();
 				x = t; 
 				LogicalExpression(out e1, allowSemi, allowLambda);
-				e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e0, e1); 
+				e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e1, e0); 
 				while (IsExpliesOp()) {
 					ExpliesOp();
 					x = t; 
 					LogicalExpression(out e1, allowSemi, allowLambda);
-					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e0, e1); 
+					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e1, e0); 
+					
 				}
 			} else SynErr(219);
 		}
diff --git a/Test/dafny4/Bug101.dfy b/Test/dafny4/Bug101.dfy
new file mode 100644
index 00000000..878ed57a
--- /dev/null
+++ b/Test/dafny4/Bug101.dfy
@@ -0,0 +1,19 @@
+// RUN: %dafny /compile:0 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+predicate P(i:int) { true }
+
+lemma Tester()
+{
+//    forall i ensures false ==> P(i) {}
+    forall i ensures P(i) <== false {}
+    assert forall i :: P(i) ==> false;
+    assert P(0);
+    assert false;
+}
+
+
+
+
+
+
diff --git a/Test/dafny4/Bug101.dfy.expect b/Test/dafny4/Bug101.dfy.expect
new file mode 100644
index 00000000..a4e5f4b3
--- /dev/null
+++ b/Test/dafny4/Bug101.dfy.expect
@@ -0,0 +1,8 @@
+Bug101.dfy(10,11): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+    (0,0): anon6_Else
+    (0,0): anon7_Then
+    (0,0): anon5
+
+Dafny program verifier finished with 2 verified, 1 error
-- 
cgit v1.2.3


From 7cc9a11d13a1d43d6e7beb4f874bb086f73804c4 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Wed, 11 Nov 2015 17:36:24 -0800
Subject: Fixed compilation of equality between reference types

---
 Source/Dafny/Compiler.cs           | 14 +++++-----
 Test/dafny0/Compilation.dfy        | 55 +++++++++++++++++++++++++++++++++++++-
 Test/dafny0/Compilation.dfy.expect |  6 ++++-
 3 files changed, 66 insertions(+), 9 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index f992d6c0..2786133e 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -2637,27 +2637,27 @@ namespace Microsoft.Dafny {
             opString = "&&";  break;
 
           case BinaryExpr.ResolvedOpcode.EqCommon: {
-            if (e.E0.Type.IsDatatype || e.E0.Type.IsTypeParameter || e.E0.Type.SupportsEquality) {
-              callString = "Equals";
-            } else if (e.E0.Type.IsRefType) {
+            if (e.E0.Type.IsRefType) {
               // Dafny's type rules are slightly different C#, so we may need a cast here.
               // For example, Dafny allows x==y if x:array<T> and y:array<int> and T is some
               // type parameter.
               opString = "== (object)";
+            } else if (e.E0.Type.IsDatatype || e.E0.Type.IsTypeParameter || e.E0.Type.SupportsEquality) {
+              callString = "Equals";
             } else {
               opString = "==";
             }
             break;
           }
           case BinaryExpr.ResolvedOpcode.NeqCommon: {
-            if (e.E0.Type.IsDatatype || e.E0.Type.IsTypeParameter || e.E0.Type.SupportsEquality) {
-              preOpString = "!";
-              callString = "Equals";
-            } else if (e.E0.Type.IsRefType) {
+            if (e.E0.Type.IsRefType) {
               // Dafny's type rules are slightly different C#, so we may need a cast here.
               // For example, Dafny allows x==y if x:array<T> and y:array<int> and T is some
               // type parameter.
               opString = "!= (object)";
+            } else if (e.E0.Type.IsDatatype || e.E0.Type.IsTypeParameter || e.E0.Type.SupportsEquality) {
+              preOpString = "!";
+              callString = "Equals";
             } else {
               opString = "!=";
             }
diff --git a/Test/dafny0/Compilation.dfy b/Test/dafny0/Compilation.dfy
index 7f9169da..965f0787 100644
--- a/Test/dafny0/Compilation.dfy
+++ b/Test/dafny0/Compilation.dfy
@@ -45,7 +45,7 @@ module CoRecursion {
   //   42
   //   9
   //   9
-  method Main() {
+  method TestMain() {
     var m := 17;
     var cell := new Cell;
     cell.data := 40;
@@ -260,3 +260,56 @@ class DigitUnderscore_Names {
     this.10 := 20;
   }
 }
+
+// ------------------------------------------------------------------
+
+method Main()
+{
+  CoRecursion.TestMain();
+  EqualityTests.TestMain();
+}
+
+// ------------------------------------------------------------------
+
+module EqualityTests {
+  class C<T> {
+  }
+
+  method TestMain()
+  {
+    // regression tests:
+    var a: C<int>, b: C<int> := null, null;
+    if a == null {
+      print "a is null\n";
+    }
+    if a != null {
+      print "a is not null\n";
+    }
+    if a == b {
+      print "a and b are equal\n";
+    }
+    if a != b {
+      print "a and b are not equal\n";
+    }
+
+    var H := new real[10];
+    ArrayTests(H);
+  }
+
+  method ArrayTests<T>(H: array<T>)
+  {
+    var G := new int[10];
+    if G == H {  // this comparison is allowed in Dafny, but requires a cast in C#
+      print "this would be highly suspicious\n";
+    }
+    if G != H {  // this comparison is allowed in Dafny, but requires a cast in C#
+      print "good world order\n";
+    }
+    if null == H {
+      print "given array is null\n";
+    }
+    if null != H {
+      print "given array is non-null\n";
+    }
+  }
+}
diff --git a/Test/dafny0/Compilation.dfy.expect b/Test/dafny0/Compilation.dfy.expect
index 2b76b107..0a934a63 100644
--- a/Test/dafny0/Compilation.dfy.expect
+++ b/Test/dafny0/Compilation.dfy.expect
@@ -1,5 +1,5 @@
 
-Dafny program verifier finished with 50 verified, 0 errors
+Dafny program verifier finished with 56 verified, 0 errors
 Program compiled successfully
 Running...
 
@@ -10,3 +10,7 @@ Running...
 42
 9
 9
+a is null
+a and b are equal
+good world order
+given array is non-null
-- 
cgit v1.2.3


From 854acf0f7f5aa105500c6d0ee0fcf0d4c918a81e Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Sat, 14 Nov 2015 14:50:26 -0800
Subject: Fix issue 94. Allow tuple-based assignment in statement contexts.

---
 Source/Dafny/Cloner.cs                       |   4 +
 Source/Dafny/Compiler.cs                     |   8 +
 Source/Dafny/Dafny.atg                       |  94 ++++--
 Source/Dafny/DafnyAst.cs                     |  22 ++
 Source/Dafny/Parser.cs                       | 459 +++++++++++++++------------
 Source/Dafny/Printer.cs                      |  13 +
 Source/Dafny/Resolver.cs                     |  49 ++-
 Source/Dafny/Translator.cs                   |  29 +-
 Test/dafny4/Bug94.dfy                        |  35 ++
 Test/dafny4/Bug94.dfy.expect                 |   6 +
 Test/server/simple-session.transcript.expect |   2 +-
 11 files changed, 476 insertions(+), 245 deletions(-)
 create mode 100644 Test/dafny4/Bug94.dfy
 create mode 100644 Test/dafny4/Bug94.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index 1c4275c5..1a6dfecb 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -583,6 +583,10 @@ namespace Microsoft.Dafny
         var lhss = s.Locals.ConvertAll(c => new LocalVariable(Tok(c.Tok), Tok(c.EndTok), c.Name, CloneType(c.OptionalType), c.IsGhost));
         r = new VarDeclStmt(Tok(s.Tok), Tok(s.EndTok), lhss, (ConcreteUpdateStatement)CloneStmt(s.Update));
 
+      } else if (stmt is LetStmt) {
+        var s = (LetStmt) stmt;
+        r = new LetStmt(Tok(s.Tok), Tok(s.EndTok), s.LHSs.ConvertAll(CloneCasePattern), s.RHSs.ConvertAll(CloneExpr));
+
       } else if (stmt is ModifyStmt) {
         var s = (ModifyStmt)stmt;
         var mod = CloneSpecFrameExpr(s.Mod);
diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 2786133e..82795480 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -1764,6 +1764,14 @@ namespace Microsoft.Dafny {
           wr.Write(TrStmt(s.Update, indent).ToString());
         }
 
+      } else if (stmt is LetStmt) {
+        var s = (LetStmt)stmt;
+        for (int i = 0; i < s.LHSs.Count; i++) {
+          var lhs = s.LHSs[i];
+          if (Contract.Exists(lhs.Vars, bv => !bv.IsGhost)) {
+            TrCasePatternOpt(lhs, s.RHSs[i], null, indent, wr, false);
+          }
+        }
       } else if (stmt is ModifyStmt) {
         var s = (ModifyStmt)stmt;
         if (s.Body != null) {
diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index ff3b75a3..08c22db4 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -1628,46 +1628,74 @@ VarDeclStatement<.out Statement/*!*/ s.>
      Expression suchThat = null;
      Attributes attrs = null;
      IToken endTok;
+     s = dummyStmt;
   .)
   [ "ghost"                                 (. isGhost = true;  x = t; .)
   ]
   "var"                                     (. if (!isGhost) { x = t; } .)
-  { Attribute<ref attrs> }
-  LocalIdentTypeOptional<out d, isGhost>    (. lhss.Add(d); d.Attributes = attrs; attrs = null; .)
-  { ","
-    { Attribute<ref attrs> }
-    LocalIdentTypeOptional<out d, isGhost>  (. lhss.Add(d); d.Attributes = attrs; attrs = null; .)
-  }
-  [ ":="                           (. assignTok = t; .)
-    Rhs<out r>                     (. rhss.Add(r); .)
-    { "," Rhs<out r>               (. rhss.Add(r); .)
+  ( { Attribute<ref attrs> }
+    LocalIdentTypeOptional<out d, isGhost>    (. lhss.Add(d); d.Attributes = attrs; attrs = null; .)
+    { ","
+      { Attribute<ref attrs> }
+      LocalIdentTypeOptional<out d, isGhost>  (. lhss.Add(d); d.Attributes = attrs; attrs = null; .)
     }
-  | { Attribute<ref attrs> }
-    ":|"                           (. assignTok = t; .)
-    [ IF(la.kind == _assume)       /* an Expression can also begin with an "assume", so this says to resolve it to pick up any "assume" here */
-      "assume"                     (. suchThatAssume = t; .)
+    [ ":="                           (. assignTok = t; .)
+      Rhs<out r>                     (. rhss.Add(r); .)
+      { "," Rhs<out r>               (. rhss.Add(r); .)
+      }
+    | { Attribute<ref attrs> }
+      ":|"                           (. assignTok = t; .)
+      [ IF(la.kind == _assume)       /* an Expression can also begin with an "assume", so this says to resolve it to pick up any "assume" here */
+        "assume"                     (. suchThatAssume = t; .)
+      ]
+      Expression<out suchThat, false, true>
     ]
-    Expression<out suchThat, false, true>
-  ]
-  SYNC ";"                         (. endTok = t; .)
-  (. ConcreteUpdateStatement update;
-     if (suchThat != null) {
-       var ies = new List<Expression>();
-       foreach (var lhs in lhss) {
-         ies.Add(new IdentifierExpr(lhs.Tok, lhs.Name));
-       }
-       update = new AssignSuchThatStmt(assignTok, endTok, ies, suchThat, suchThatAssume, attrs);
-     } else if (rhss.Count == 0) {
-       update = null;
-     } else {
-       var ies = new List<Expression>();
-       foreach (var lhs in lhss) {
-         ies.Add(new AutoGhostIdentifierExpr(lhs.Tok, lhs.Name));
+    SYNC ";"                         (. endTok = t; .)
+    (. ConcreteUpdateStatement update;
+       if (suchThat != null) {
+         var ies = new List<Expression>();
+         foreach (var lhs in lhss) {
+           ies.Add(new IdentifierExpr(lhs.Tok, lhs.Name));
+         }
+         update = new AssignSuchThatStmt(assignTok, endTok, ies, suchThat, suchThatAssume, attrs);
+       } else if (rhss.Count == 0) {
+         update = null;
+       } else {
+         var ies = new List<Expression>();
+         foreach (var lhs in lhss) {
+           ies.Add(new AutoGhostIdentifierExpr(lhs.Tok, lhs.Name));
+         }
+         update = new UpdateStmt(assignTok, endTok, ies, rhss);
        }
-       update = new UpdateStmt(assignTok, endTok, ies, rhss);
-     }
-     s = new VarDeclStmt(x, endTok, lhss, update);
-  .)
+       s = new VarDeclStmt(x, endTok, lhss, update);
+    .)
+  | "("                             (. var letLHSs = new List<CasePattern>();
+                                       var letRHSs = new List<Expression>();
+                                       List<CasePattern> arguments = new List<CasePattern>();
+                                       CasePattern pat;
+                                       Expression e = dummyExpr;
+                                       IToken id = t;
+                                    .)
+      [ CasePattern<out pat>            (. arguments.Add(pat); .)
+        { "," CasePattern<out pat>      (. arguments.Add(pat); .)
+        }
+      ]
+    ")"                             (. // Parse parenthesis without an identifier as a built in tuple type.
+                                       theBuiltIns.TupleType(id, arguments.Count, true); // make sure the tuple type exists
+                                       string ctor = BuiltIns.TupleTypeCtorName;  //use the TupleTypeCtors
+                                       pat = new CasePattern(id, ctor, arguments); 
+                                       if (isGhost) { pat.Vars.Iter(bv => bv.IsGhost = true); }
+                                       letLHSs.Add(pat);
+                                    .)
+    ( ":="
+    | { Attribute<ref attrs> }
+      ":|"                          (.  SemErr(pat.tok, "LHS of assign-such-that expression must be variables, not general patterns"); .)
+    )
+    Expression<out e, false, true>        (. letRHSs.Add(e); .)
+    
+    ";"
+    (. s = new LetStmt(e.tok, e.tok, letLHSs, letRHSs); .)
+  )
   .
 IfStmt<out Statement/*!*/ ifStmt>
 = (. Contract.Ensures(Contract.ValueAtReturn(out ifStmt) != null); IToken/*!*/ x;
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 9ed3b7e0..847617aa 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -4084,6 +4084,28 @@ namespace Microsoft.Dafny {
     }
   }
 
+  public class LetStmt : Statement 
+  {
+    public readonly List<CasePattern> LHSs;
+    public readonly List<Expression> RHSs;
+
+    public LetStmt(IToken tok, IToken endTok, List<CasePattern> lhss, List<Expression> rhss)
+      : base(tok, endTok) {
+      LHSs = lhss;
+      RHSs = rhss;
+    }
+
+   public IEnumerable<BoundVar> BoundVars {
+      get {
+        foreach (var lhs in LHSs) {
+          foreach (var bv in lhs.Vars) {
+           yield return bv;
+          }
+        }
+      }
+    }
+  }
+
   /// <summary>
   /// Common superclass of UpdateStmt and AssignSuchThatStmt.
   /// </summary>
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index b6a59f4e..922aad75 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -2339,6 +2339,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression suchThat = null;
 		Attributes attrs = null;
 		IToken endTok;
+		s = dummyStmt;
 		
 		if (la.kind == 73) {
 			Get();
@@ -2346,64 +2347,104 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		}
 		Expect(78);
 		if (!isGhost) { x = t; } 
-		while (la.kind == 46) {
-			Attribute(ref attrs);
-		}
-		LocalIdentTypeOptional(out d, isGhost);
-		lhss.Add(d); d.Attributes = attrs; attrs = null; 
-		while (la.kind == 22) {
-			Get();
+		if (la.kind == 1 || la.kind == 46) {
 			while (la.kind == 46) {
 				Attribute(ref attrs);
 			}
 			LocalIdentTypeOptional(out d, isGhost);
 			lhss.Add(d); d.Attributes = attrs; attrs = null; 
-		}
-		if (la.kind == 25 || la.kind == 46 || la.kind == 95) {
-			if (la.kind == 95) {
+			while (la.kind == 22) {
 				Get();
-				assignTok = t; 
-				Rhs(out r);
-				rhss.Add(r); 
-				while (la.kind == 22) {
+				while (la.kind == 46) {
+					Attribute(ref attrs);
+				}
+				LocalIdentTypeOptional(out d, isGhost);
+				lhss.Add(d); d.Attributes = attrs; attrs = null; 
+			}
+			if (la.kind == 25 || la.kind == 46 || la.kind == 95) {
+				if (la.kind == 95) {
 					Get();
+					assignTok = t; 
 					Rhs(out r);
 					rhss.Add(r); 
+					while (la.kind == 22) {
+						Get();
+						Rhs(out r);
+						rhss.Add(r); 
+					}
+				} else {
+					while (la.kind == 46) {
+						Attribute(ref attrs);
+					}
+					Expect(25);
+					assignTok = t; 
+					if (la.kind == _assume) {
+						Expect(31);
+						suchThatAssume = t; 
+					}
+					Expression(out suchThat, false, true);
 				}
+			}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(184); Get();}
+			Expect(28);
+			endTok = t; 
+			ConcreteUpdateStatement update;
+			if (suchThat != null) {
+			 var ies = new List<Expression>();
+			 foreach (var lhs in lhss) {
+			   ies.Add(new IdentifierExpr(lhs.Tok, lhs.Name));
+			 }
+			 update = new AssignSuchThatStmt(assignTok, endTok, ies, suchThat, suchThatAssume, attrs);
+			} else if (rhss.Count == 0) {
+			 update = null;
 			} else {
+			 var ies = new List<Expression>();
+			 foreach (var lhs in lhss) {
+			   ies.Add(new AutoGhostIdentifierExpr(lhs.Tok, lhs.Name));
+			 }
+			 update = new UpdateStmt(assignTok, endTok, ies, rhss);
+			}
+			s = new VarDeclStmt(x, endTok, lhss, update);
+			
+		} else if (la.kind == 50) {
+			Get();
+			var letLHSs = new List<CasePattern>();
+			var letRHSs = new List<Expression>();
+			List<CasePattern> arguments = new List<CasePattern>();
+			CasePattern pat;
+			Expression e = dummyExpr;
+			IToken id = t;
+			
+			if (la.kind == 1 || la.kind == 50) {
+				CasePattern(out pat);
+				arguments.Add(pat); 
+				while (la.kind == 22) {
+					Get();
+					CasePattern(out pat);
+					arguments.Add(pat); 
+				}
+			}
+			Expect(51);
+			theBuiltIns.TupleType(id, arguments.Count, true); // make sure the tuple type exists
+			string ctor = BuiltIns.TupleTypeCtorName;  //use the TupleTypeCtors
+			pat = new CasePattern(id, ctor, arguments); 
+			if (isGhost) { pat.Vars.Iter(bv => bv.IsGhost = true); }
+			letLHSs.Add(pat);
+			
+			if (la.kind == 95) {
+				Get();
+			} else if (la.kind == 25 || la.kind == 46) {
 				while (la.kind == 46) {
 					Attribute(ref attrs);
 				}
 				Expect(25);
-				assignTok = t; 
-				if (la.kind == _assume) {
-					Expect(31);
-					suchThatAssume = t; 
-				}
-				Expression(out suchThat, false, true);
-			}
-		}
-		while (!(la.kind == 0 || la.kind == 28)) {SynErr(184); Get();}
-		Expect(28);
-		endTok = t; 
-		ConcreteUpdateStatement update;
-		if (suchThat != null) {
-		 var ies = new List<Expression>();
-		 foreach (var lhs in lhss) {
-		   ies.Add(new IdentifierExpr(lhs.Tok, lhs.Name));
-		 }
-		 update = new AssignSuchThatStmt(assignTok, endTok, ies, suchThat, suchThatAssume, attrs);
-		} else if (rhss.Count == 0) {
-		 update = null;
-		} else {
-		 var ies = new List<Expression>();
-		 foreach (var lhs in lhss) {
-		   ies.Add(new AutoGhostIdentifierExpr(lhs.Tok, lhs.Name));
-		 }
-		 update = new UpdateStmt(assignTok, endTok, ies, rhss);
-		}
-		s = new VarDeclStmt(x, endTok, lhss, update);
-		
+				SemErr(pat.tok, "LHS of assign-such-that expression must be variables, not general patterns"); 
+			} else SynErr(185);
+			Expression(out e, false, true);
+			letRHSs.Add(e); 
+			Expect(28);
+			s = new LetStmt(e.tok, e.tok, letLHSs, letRHSs); 
+		} else SynErr(186);
 	}
 
 	void IfStmt(out Statement/*!*/ ifStmt) {
@@ -2442,7 +2483,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				} else if (la.kind == 46) {
 					BlockStmt(out bs, out bodyStart, out bodyEnd);
 					els = bs; endTok = bs.EndTok; 
-				} else SynErr(185);
+				} else SynErr(187);
 			}
 			if (guardEllipsis != null) {
 			 ifStmt = new SkeletonStatement(new IfStmt(x, endTok, isExistentialGuard, guard, thn, els), guardEllipsis, null);
@@ -2450,7 +2491,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 ifStmt = new IfStmt(x, endTok, isExistentialGuard, guard, thn, els);
 			}
 			
-		} else SynErr(186);
+		} else SynErr(188);
 	}
 
 	void WhileStmt(out Statement stmt) {
@@ -2495,7 +2536,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Expect(59);
 				bodyEllipsis = t; endTok = t; isDirtyLoop = false; 
 			} else if (StartOf(23)) {
-			} else SynErr(187);
+			} else SynErr(189);
 			if (guardEllipsis != null || bodyEllipsis != null) {
 			 if (mod != null) {
 			   SemErr(mod[0].E.tok, "'modifies' clauses are not allowed on refining loops");
@@ -2513,7 +2554,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 stmt = new WhileStmt(x, endTok, guard, invariants, new Specification<Expression>(decreases, decAttrs), new Specification<FrameExpression>(mod, modAttrs), body);
 			}
 			
-		} else SynErr(188);
+		} else SynErr(190);
 	}
 
 	void MatchStmt(out Statement/*!*/ s) {
@@ -2538,7 +2579,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				CaseStatement(out c);
 				cases.Add(c); 
 			}
-		} else SynErr(189);
+		} else SynErr(191);
 		s = new MatchStmt(x, t, e, cases, usesOptionalBrace); 
 	}
 
@@ -2563,7 +2604,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;
 			errors.Warning(t, "the 'parallel' keyword has been deprecated; the comprehension statement now uses the keyword 'forall' (and the parentheses around the bound variables are now optional)");
 			
-		} else SynErr(190);
+		} else SynErr(192);
 		if (la.kind == _openparen) {
 			Expect(50);
 			if (la.kind == 1) {
@@ -2574,7 +2615,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			if (la.kind == _ident) {
 				QuantifierDomain(out bvars, out attrs, out range);
 			}
-		} else SynErr(191);
+		} else SynErr(193);
 		if (bvars == null) { bvars = new List<BoundVar>(); }
 		if (range == null) { range = new LiteralExpr(x, true); }
 		
@@ -2664,7 +2705,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				} else if (la.kind == 32) {
 					CalcStmt(out subCalc);
 					hintEnd = subCalc.EndTok; subhints.Add(subCalc); 
-				} else SynErr(192);
+				} else SynErr(194);
 			}
 			var h = new BlockStmt(hintStart, hintEnd, subhints); // if the hint is empty, hintStart is the first token of the next line, but it doesn't matter because the block statement is just used as a container
 			hints.Add(h);
@@ -2706,14 +2747,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 59) {
 			Get();
 			ellipsisToken = t; 
-		} else SynErr(193);
+		} else SynErr(195);
 		if (la.kind == 46) {
 			BlockStmt(out body, out bodyStart, out endTok);
 		} else if (la.kind == 28) {
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(194); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(196); Get();}
 			Get();
 			endTok = t; 
-		} else SynErr(195);
+		} else SynErr(197);
 		s = new ModifyStmt(tok, endTok, mod, attrs, body);
 		if (ellipsisToken != null) {
 		 s = new SkeletonStatement(s, ellipsisToken, null);
@@ -2733,7 +2774,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 90) {
 			Get();
 			returnTok = t; isYield = true; 
-		} else SynErr(196);
+		} else SynErr(198);
 		if (StartOf(26)) {
 			Rhs(out r);
 			rhss = new List<AssignmentRhs>(); rhss.Add(r); 
@@ -2831,7 +2872,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (StartOf(7)) {
 			Expression(out e, false, true);
 			r = new ExprRhs(e); 
-		} else SynErr(197);
+		} else SynErr(199);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -2852,7 +2893,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (la.kind == 27 || la.kind == 48 || la.kind == 50) {
 				Suffix(ref e);
 			}
-		} else SynErr(198);
+		} else SynErr(200);
 	}
 
 	void Expressions(List<Expression> args) {
@@ -2866,6 +2907,56 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		}
 	}
 
+	void CasePattern(out CasePattern pat) {
+		IToken id;  List<CasePattern> arguments;
+		BoundVar bv;
+		pat = null;
+		
+		if (IsIdentParen()) {
+			Ident(out id);
+			Expect(50);
+			arguments = new List<CasePattern>(); 
+			if (la.kind == 1 || la.kind == 50) {
+				CasePattern(out pat);
+				arguments.Add(pat); 
+				while (la.kind == 22) {
+					Get();
+					CasePattern(out pat);
+					arguments.Add(pat); 
+				}
+			}
+			Expect(51);
+			pat = new CasePattern(id, id.val, arguments); 
+		} else if (la.kind == 50) {
+			Get();
+			id = t;                                                           
+			arguments = new List<CasePattern>(); 
+			
+			if (la.kind == 1 || la.kind == 50) {
+				CasePattern(out pat);
+				arguments.Add(pat); 
+				while (la.kind == 22) {
+					Get();
+					CasePattern(out pat);
+					arguments.Add(pat); 
+				}
+			}
+			Expect(51);
+			theBuiltIns.TupleType(id, arguments.Count, true); // make sure the tuple type exists
+			string ctor = BuiltIns.TupleTypeCtorName;  //use the TupleTypeCtors
+			pat = new CasePattern(id, ctor, arguments); 
+			
+		} else if (la.kind == 1) {
+			IdentTypeOptional(out bv);
+			pat = new CasePattern(bv.tok, bv);
+			
+		} else SynErr(201);
+		if (pat == null) {
+		 pat = new CasePattern(t, "_ParseError", new List<CasePattern>());
+		}
+		
+	}
+
 	void AlternativeBlock(bool allowExistentialGuards, out List<GuardedAlternative> alternatives, out IToken endTok) {
 		alternatives = new List<GuardedAlternative>();
 		IToken x;
@@ -2881,7 +2972,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				isExistentialGuard = true; 
 			} else if (StartOf(7)) {
 				Expression(out e, true, false);
-			} else SynErr(199);
+			} else SynErr(202);
 			Expect(29);
 			body = new List<Statement>(); 
 			while (StartOf(15)) {
@@ -2927,7 +3018,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (StartOf(7)) {
 			Expression(out ee, true, true);
 			e = ee; 
-		} else SynErr(200);
+		} else SynErr(203);
 	}
 
 	void LoopSpec(List<MaybeFreeExpression> invariants, List<Expression> decreases, ref List<FrameExpression> mod, ref Attributes decAttrs, ref Attributes modAttrs) {
@@ -2935,7 +3026,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		bool isFree = false; Attributes attrs = null;
 		
 		if (la.kind == 37 || la.kind == 88) {
-			while (!(la.kind == 0 || la.kind == 37 || la.kind == 88)) {SynErr(201); Get();}
+			while (!(la.kind == 0 || la.kind == 37 || la.kind == 88)) {SynErr(204); Get();}
 			if (la.kind == 88) {
 				Get();
 				isFree = true; errors.Warning(t, "the 'free' keyword is soon to be deprecated"); 
@@ -2948,7 +3039,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			invariants.Add(new MaybeFreeExpression(e, isFree, attrs)); 
 			OldSemi();
 		} else if (la.kind == 36) {
-			while (!(la.kind == 0 || la.kind == 36)) {SynErr(202); Get();}
+			while (!(la.kind == 0 || la.kind == 36)) {SynErr(205); Get();}
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref decAttrs);
@@ -2956,7 +3047,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			DecreasesList(decreases, true, true);
 			OldSemi();
 		} else if (la.kind == 43) {
-			while (!(la.kind == 0 || la.kind == 43)) {SynErr(203); Get();}
+			while (!(la.kind == 0 || la.kind == 43)) {SynErr(206); Get();}
 			Get();
 			mod = mod ?? new List<FrameExpression>(); 
 			while (IsAttribute()) {
@@ -2970,7 +3061,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				mod.Add(fe); 
 			}
 			OldSemi();
-		} else SynErr(204);
+		} else SynErr(207);
 	}
 
 	void CaseStatement(out MatchCaseStmt/*!*/ c) {
@@ -3007,66 +3098,16 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				arguments.Add(pat); 
 			}
 			Expect(51);
-		} else SynErr(205);
+		} else SynErr(208);
 		Expect(29);
-		while (!(StartOf(28))) {SynErr(206); Get();}
+		while (!(StartOf(28))) {SynErr(209); Get();}
 		while (IsNotEndOfCase()) {
 			Stmt(body);
-			while (!(StartOf(28))) {SynErr(207); Get();}
+			while (!(StartOf(28))) {SynErr(210); Get();}
 		}
 		c = new MatchCaseStmt(x, name, arguments, body); 
 	}
 
-	void CasePattern(out CasePattern pat) {
-		IToken id;  List<CasePattern> arguments;
-		BoundVar bv;
-		pat = null;
-		
-		if (IsIdentParen()) {
-			Ident(out id);
-			Expect(50);
-			arguments = new List<CasePattern>(); 
-			if (la.kind == 1 || la.kind == 50) {
-				CasePattern(out pat);
-				arguments.Add(pat); 
-				while (la.kind == 22) {
-					Get();
-					CasePattern(out pat);
-					arguments.Add(pat); 
-				}
-			}
-			Expect(51);
-			pat = new CasePattern(id, id.val, arguments); 
-		} else if (la.kind == 50) {
-			Get();
-			id = t;                                                           
-			arguments = new List<CasePattern>(); 
-			
-			if (la.kind == 1 || la.kind == 50) {
-				CasePattern(out pat);
-				arguments.Add(pat); 
-				while (la.kind == 22) {
-					Get();
-					CasePattern(out pat);
-					arguments.Add(pat); 
-				}
-			}
-			Expect(51);
-			theBuiltIns.TupleType(id, arguments.Count, true); // make sure the tuple type exists
-			string ctor = BuiltIns.TupleTypeCtorName;  //use the TupleTypeCtors
-			pat = new CasePattern(id, ctor, arguments); 
-			
-		} else if (la.kind == 1) {
-			IdentTypeOptional(out bv);
-			pat = new CasePattern(bv.tok, bv);
-			
-		} else SynErr(208);
-		if (pat == null) {
-		 pat = new CasePattern(t, "_ParseError", new List<CasePattern>());
-		}
-		
-	}
-
 	void QuantifierDomain(out List<BoundVar> bvars, out Attributes attrs, out Expression range) {
 		bvars = new List<BoundVar>();
 		BoundVar/*!*/ bv;
@@ -3161,7 +3202,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  binOp = BinaryExpr.Opcode.Exp; 
 			break;
 		}
-		default: SynErr(209); break;
+		default: SynErr(211); break;
 		}
 		if (k == null) {
 		 op = new Microsoft.Dafny.CalcStmt.BinaryCalcOp(binOp);
@@ -3176,7 +3217,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 112) {
 			Get();
-		} else SynErr(210);
+		} else SynErr(212);
 	}
 
 	void ImpliesOp() {
@@ -3184,7 +3225,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 114) {
 			Get();
-		} else SynErr(211);
+		} else SynErr(213);
 	}
 
 	void ExpliesOp() {
@@ -3192,7 +3233,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 116) {
 			Get();
-		} else SynErr(212);
+		} else SynErr(214);
 	}
 
 	void AndOp() {
@@ -3200,7 +3241,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 118) {
 			Get();
-		} else SynErr(213);
+		} else SynErr(215);
 	}
 
 	void OrOp() {
@@ -3208,7 +3249,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 120) {
 			Get();
-		} else SynErr(214);
+		} else SynErr(216);
 	}
 
 	void NegOp() {
@@ -3216,7 +3257,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 122) {
 			Get();
-		} else SynErr(215);
+		} else SynErr(217);
 	}
 
 	void Forall() {
@@ -3224,7 +3265,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 123) {
 			Get();
-		} else SynErr(216);
+		} else SynErr(218);
 	}
 
 	void Exists() {
@@ -3232,7 +3273,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 125) {
 			Get();
-		} else SynErr(217);
+		} else SynErr(219);
 	}
 
 	void QSep() {
@@ -3240,7 +3281,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 26) {
 			Get();
-		} else SynErr(218);
+		} else SynErr(220);
 	}
 
 	void EquivExpression(out Expression e0, bool allowSemi, bool allowLambda) {
@@ -3275,7 +3316,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e1, e0); 
 					
 				}
-			} else SynErr(219);
+			} else SynErr(221);
 		}
 	}
 
@@ -3305,7 +3346,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					RelationalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Or, e0, e1); 
 				}
-			} else SynErr(220);
+			} else SynErr(222);
 		}
 	}
 
@@ -3523,7 +3564,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  op = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		default: SynErr(221); break;
+		default: SynErr(223); break;
 		}
 	}
 
@@ -3545,7 +3586,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 128) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Sub; 
-		} else SynErr(222);
+		} else SynErr(224);
 	}
 
 	void UnaryExpression(out Expression e, bool allowSemi, bool allowLambda) {
@@ -3605,7 +3646,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (IsSuffix()) {
 				Suffix(ref e);
 			}
-		} else SynErr(223);
+		} else SynErr(225);
 	}
 
 	void MulOp(out IToken x, out BinaryExpr.Opcode op) {
@@ -3619,7 +3660,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 130) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Mod; 
-		} else SynErr(224);
+		} else SynErr(226);
 	}
 
 	void MapDisplayExpr(IToken/*!*/ mapToken, bool finite, out Expression e) {
@@ -3673,13 +3714,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				} else if (la.kind == 106) {
 					HashCall(id, out openParen, out typeArgs, out args);
 				} else if (StartOf(31)) {
-				} else SynErr(225);
+				} else SynErr(227);
 				e = new ExprDotName(id, e, id.val, typeArgs);
 				if (openParen != null) {
 				 e = new ApplySuffix(openParen, e, args);
 				}
 				
-			} else SynErr(226);
+			} else SynErr(228);
 		} else if (la.kind == 48) {
 			Get();
 			x = t; 
@@ -3727,7 +3768,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 						multipleIndices.Add(ee);
 						
 					}
-				} else SynErr(227);
+				} else SynErr(229);
 			} else if (la.kind == 137) {
 				Get();
 				anyDots = true; 
@@ -3735,7 +3776,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					Expression(out ee, true, true);
 					e1 = ee; 
 				}
-			} else SynErr(228);
+			} else SynErr(230);
 			if (multipleIndices != null) {
 			 e = new MultiSelectExpr(x, e, multipleIndices);
 			 // make sure an array class with this dimensionality exists
@@ -3779,7 +3820,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			Expect(51);
 			e = new ApplySuffix(openParen, e, args); 
-		} else SynErr(229);
+		} else SynErr(231);
 	}
 
 	void ISetDisplayExpr(IToken/*!*/ setToken, bool finite, out Expression e) {
@@ -3821,7 +3862,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				}
 			}
 			Expect(51);
-		} else SynErr(230);
+		} else SynErr(232);
 		while (la.kind == 44 || la.kind == 45) {
 			if (la.kind == 44) {
 				Get();
@@ -3904,7 +3945,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			NamedExpr(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(231); break;
+		default: SynErr(233); break;
 		}
 	}
 
@@ -3919,7 +3960,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 106) {
 			HashCall(id, out openParen, out typeArgs, out args);
 		} else if (StartOf(31)) {
-		} else SynErr(232);
+		} else SynErr(234);
 		e = new NameSegment(id, id.val, typeArgs);
 		if (openParen != null) {
 		 e = new ApplySuffix(openParen, e, args);
@@ -3948,7 +3989,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			e = new SeqDisplayExpr(x, elements); 
 			Expect(49);
-		} else SynErr(233);
+		} else SynErr(235);
 	}
 
 	void MultiSetExpr(out Expression e) {
@@ -3972,7 +4013,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Expression(out e, true, true);
 			e = new MultiSetFormingExpr(x, e); 
 			Expect(51);
-		} else SynErr(234);
+		} else SynErr(236);
 	}
 
 	void ConstAtomExpression(out Expression e, bool allowSemi, bool allowLambda) {
@@ -4068,7 +4109,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			ParensExpression(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(235); break;
+		default: SynErr(237); break;
 		}
 	}
 
@@ -4097,7 +4138,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 n = BigInteger.Zero;
 			}
 			
-		} else SynErr(236);
+		} else SynErr(238);
 	}
 
 	void Dec(out Basetypes.BigDec d) {
@@ -4141,7 +4182,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 30) {
 			Get();
 			oneShot = true; 
-		} else SynErr(237);
+		} else SynErr(239);
 	}
 
 	void MapLiteralExpressions(out List<ExpressionPair> elements) {
@@ -4204,7 +4245,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				CaseExpression(out c, allowSemi, allowLambda);
 				cases.Add(c); 
 			}
-		} else SynErr(238);
+		} else SynErr(240);
 		e = new MatchExpr(x, e, cases, usesOptionalBrace); 
 	}
 
@@ -4222,7 +4263,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 124 || la.kind == 125) {
 			Exists();
 			x = t; 
-		} else SynErr(239);
+		} else SynErr(241);
 		QuantifierDomain(out bvars, out attrs, out range);
 		QSep();
 		Expression(out body, allowSemi, allowLambda);
@@ -4271,7 +4312,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			AssumeStmt(out s);
 		} else if (la.kind == 32) {
 			CalcStmt(out s);
-		} else SynErr(240);
+		} else SynErr(242);
 	}
 
 	void LetExpr(out Expression e, bool allowSemi, bool allowLambda) {
@@ -4315,7 +4356,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 }
 			}
 			
-		} else SynErr(241);
+		} else SynErr(243);
 		Expression(out e, false, true);
 		letRHSs.Add(e); 
 		while (la.kind == 22) {
@@ -4375,7 +4416,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				arguments.Add(pat); 
 			}
 			Expect(51);
-		} else SynErr(242);
+		} else SynErr(244);
 		Expect(29);
 		Expression(out body, allowSemi, allowLambda);
 		c = new MatchCaseExpr(x, name, arguments, body); 
@@ -4409,7 +4450,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 2) {
 			Get();
 			id = t; 
-		} else SynErr(243);
+		} else SynErr(245);
 		Expect(95);
 		Expression(out e, true, true);
 	}
@@ -4452,7 +4493,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 44) {
 			Get();
 			x = t; 
-		} else SynErr(244);
+		} else SynErr(246);
 	}
 
 
@@ -4712,66 +4753,68 @@ public class Errors {
 			case 182: s = "invalid UpdateStmt"; break;
 			case 183: s = "invalid UpdateStmt"; break;
 			case 184: s = "this symbol not expected in VarDeclStatement"; break;
-			case 185: s = "invalid IfStmt"; break;
-			case 186: s = "invalid IfStmt"; break;
-			case 187: s = "invalid WhileStmt"; break;
-			case 188: s = "invalid WhileStmt"; break;
-			case 189: s = "invalid MatchStmt"; break;
-			case 190: s = "invalid ForallStmt"; break;
-			case 191: s = "invalid ForallStmt"; break;
-			case 192: s = "invalid CalcStmt"; break;
-			case 193: s = "invalid ModifyStmt"; break;
-			case 194: s = "this symbol not expected in ModifyStmt"; break;
+			case 185: s = "invalid VarDeclStatement"; break;
+			case 186: s = "invalid VarDeclStatement"; break;
+			case 187: s = "invalid IfStmt"; break;
+			case 188: s = "invalid IfStmt"; break;
+			case 189: s = "invalid WhileStmt"; break;
+			case 190: s = "invalid WhileStmt"; break;
+			case 191: s = "invalid MatchStmt"; break;
+			case 192: s = "invalid ForallStmt"; break;
+			case 193: s = "invalid ForallStmt"; break;
+			case 194: s = "invalid CalcStmt"; break;
 			case 195: s = "invalid ModifyStmt"; break;
-			case 196: s = "invalid ReturnStmt"; break;
-			case 197: s = "invalid Rhs"; break;
-			case 198: s = "invalid Lhs"; break;
-			case 199: s = "invalid AlternativeBlock"; break;
-			case 200: s = "invalid Guard"; break;
-			case 201: s = "this symbol not expected in LoopSpec"; break;
-			case 202: s = "this symbol not expected in LoopSpec"; break;
-			case 203: s = "this symbol not expected in LoopSpec"; break;
-			case 204: s = "invalid LoopSpec"; break;
-			case 205: s = "invalid CaseStatement"; break;
-			case 206: s = "this symbol not expected in CaseStatement"; break;
-			case 207: s = "this symbol not expected in CaseStatement"; break;
-			case 208: s = "invalid CasePattern"; break;
-			case 209: s = "invalid CalcOp"; break;
-			case 210: s = "invalid EquivOp"; break;
-			case 211: s = "invalid ImpliesOp"; break;
-			case 212: s = "invalid ExpliesOp"; break;
-			case 213: s = "invalid AndOp"; break;
-			case 214: s = "invalid OrOp"; break;
-			case 215: s = "invalid NegOp"; break;
-			case 216: s = "invalid Forall"; break;
-			case 217: s = "invalid Exists"; break;
-			case 218: s = "invalid QSep"; break;
-			case 219: s = "invalid ImpliesExpliesExpression"; break;
-			case 220: s = "invalid LogicalExpression"; break;
-			case 221: s = "invalid RelOp"; break;
-			case 222: s = "invalid AddOp"; break;
-			case 223: s = "invalid UnaryExpression"; break;
-			case 224: s = "invalid MulOp"; break;
-			case 225: s = "invalid Suffix"; break;
-			case 226: s = "invalid Suffix"; break;
+			case 196: s = "this symbol not expected in ModifyStmt"; break;
+			case 197: s = "invalid ModifyStmt"; break;
+			case 198: s = "invalid ReturnStmt"; break;
+			case 199: s = "invalid Rhs"; break;
+			case 200: s = "invalid Lhs"; break;
+			case 201: s = "invalid CasePattern"; break;
+			case 202: s = "invalid AlternativeBlock"; break;
+			case 203: s = "invalid Guard"; break;
+			case 204: s = "this symbol not expected in LoopSpec"; break;
+			case 205: s = "this symbol not expected in LoopSpec"; break;
+			case 206: s = "this symbol not expected in LoopSpec"; break;
+			case 207: s = "invalid LoopSpec"; break;
+			case 208: s = "invalid CaseStatement"; break;
+			case 209: s = "this symbol not expected in CaseStatement"; break;
+			case 210: s = "this symbol not expected in CaseStatement"; break;
+			case 211: s = "invalid CalcOp"; break;
+			case 212: s = "invalid EquivOp"; break;
+			case 213: s = "invalid ImpliesOp"; break;
+			case 214: s = "invalid ExpliesOp"; break;
+			case 215: s = "invalid AndOp"; break;
+			case 216: s = "invalid OrOp"; break;
+			case 217: s = "invalid NegOp"; break;
+			case 218: s = "invalid Forall"; break;
+			case 219: s = "invalid Exists"; break;
+			case 220: s = "invalid QSep"; break;
+			case 221: s = "invalid ImpliesExpliesExpression"; break;
+			case 222: s = "invalid LogicalExpression"; break;
+			case 223: s = "invalid RelOp"; break;
+			case 224: s = "invalid AddOp"; break;
+			case 225: s = "invalid UnaryExpression"; break;
+			case 226: s = "invalid MulOp"; break;
 			case 227: s = "invalid Suffix"; break;
 			case 228: s = "invalid Suffix"; break;
 			case 229: s = "invalid Suffix"; break;
-			case 230: s = "invalid LambdaExpression"; break;
-			case 231: s = "invalid EndlessExpression"; break;
-			case 232: s = "invalid NameSegment"; break;
-			case 233: s = "invalid DisplayExpr"; break;
-			case 234: s = "invalid MultiSetExpr"; break;
-			case 235: s = "invalid ConstAtomExpression"; break;
-			case 236: s = "invalid Nat"; break;
-			case 237: s = "invalid LambdaArrow"; break;
-			case 238: s = "invalid MatchExpression"; break;
-			case 239: s = "invalid QuantifierGuts"; break;
-			case 240: s = "invalid StmtInExpr"; break;
-			case 241: s = "invalid LetExpr"; break;
-			case 242: s = "invalid CaseExpression"; break;
-			case 243: s = "invalid MemberBindingUpdate"; break;
-			case 244: s = "invalid DotSuffix"; break;
+			case 230: s = "invalid Suffix"; break;
+			case 231: s = "invalid Suffix"; break;
+			case 232: s = "invalid LambdaExpression"; break;
+			case 233: s = "invalid EndlessExpression"; break;
+			case 234: s = "invalid NameSegment"; break;
+			case 235: s = "invalid DisplayExpr"; break;
+			case 236: s = "invalid MultiSetExpr"; break;
+			case 237: s = "invalid ConstAtomExpression"; break;
+			case 238: s = "invalid Nat"; break;
+			case 239: s = "invalid LambdaArrow"; break;
+			case 240: s = "invalid MatchExpression"; break;
+			case 241: s = "invalid QuantifierGuts"; break;
+			case 242: s = "invalid StmtInExpr"; break;
+			case 243: s = "invalid LetExpr"; break;
+			case 244: s = "invalid CaseExpression"; break;
+			case 245: s = "invalid MemberBindingUpdate"; break;
+			case 246: s = "invalid DotSuffix"; break;
 
 			default: s = "error " + n; break;
 		}
diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index 54de4905..145e82e7 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -963,6 +963,19 @@ namespace Microsoft.Dafny {
         }
         wr.Write(";");
 
+      } else if (stmt is LetStmt) {
+        var s = (LetStmt)stmt;
+        wr.Write("var");
+        string sep = "";
+        foreach (var lhs in s.LHSs) {
+          wr.Write(sep);
+          PrintCasePattern(lhs);
+          sep = ", ";
+        }
+        wr.Write(" := ");
+        PrintExpressionList(s.RHSs, true);
+        wr.WriteLine(";");
+
       } else if (stmt is SkeletonStatement) {
         var s = (SkeletonStatement)stmt;
         if (s.S == null) {
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 21476ede..315b823a 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -2221,6 +2221,10 @@ namespace Microsoft.Dafny
           foreach (var local in s.Locals) {
             CheckTypeIsDetermined(local.Tok, local.Type, "local variable");
           }
+        } else if (stmt is LetStmt) {
+          var s = (LetStmt)stmt;
+          s.BoundVars.Iter(bv => CheckTypeIsDetermined(bv.tok, bv.Type, "bound variable"));
+
         } else if (stmt is ForallStmt) {
           var s = (ForallStmt)stmt;
           s.BoundVars.Iter(bv => CheckTypeIsDetermined(bv.tok, bv.Type, "bound variable"));
@@ -2696,6 +2700,7 @@ namespace Microsoft.Dafny
         if (s.Update != null) {
           return CheckTailRecursive(s.Update, enclosingMethod, ref tailCall, reportErrors);
         }
+      } else if (stmt is LetStmt) {
       } else {
         Contract.Assert(false);  // unexpected statement type
       }
@@ -2980,6 +2985,11 @@ namespace Microsoft.Dafny
           foreach (var v in s.Locals) {
             CheckEqualityTypes_Type(v.Tok, v.Type);
           }
+        } else if (stmt is LetStmt) {
+          var s = (LetStmt)stmt;
+          foreach (var v in s.BoundVars) {
+            CheckEqualityTypes_Type(v.Tok, v.Type);
+          }
         } else if (stmt is WhileStmt) {
           var s = (WhileStmt)stmt;
           // don't recurse on the specification parts, which are ghost
@@ -3362,6 +3372,15 @@ namespace Microsoft.Dafny
             Visit(s.Update, mustBeErasable);
           }
 
+        } else if (stmt is LetStmt) {
+          var s = (LetStmt)stmt;
+          if (mustBeErasable) {
+            foreach (var bv in s.BoundVars) {
+              bv.IsGhost = true;
+            }
+          }
+          s.IsGhost = s.BoundVars.All(v => v.IsGhost);
+
         } else if (stmt is AssignStmt) {
           var s = (AssignStmt)stmt;
           var lhs = s.Lhs.Resolved;
@@ -5566,7 +5585,30 @@ namespace Microsoft.Dafny
             }
           }
         }
-
+      } else if (stmt is LetStmt) {
+        LetStmt s = (LetStmt)stmt;
+        foreach (var rhs in s.RHSs) {
+          ResolveExpression(rhs, new ResolveOpts(codeContext, true));
+        }
+        if (s.LHSs.Count != s.RHSs.Count) {
+          reporter.Error(MessageSource.Resolver, stmt, "let statement must have same number of LHSs (found {0}) as RHSs (found {1})", s.LHSs.Count, s.RHSs.Count);
+        }
+        var i = 0;
+        foreach (var lhs in s.LHSs) {
+          var rhsType = i < s.RHSs.Count ? s.RHSs[i].Type : new InferredTypeProxy();
+          ResolveCasePattern(lhs, rhsType, codeContext);
+          // Check for duplicate names now, because not until after resolving the case pattern do we know if identifiers inside it refer to bound variables or nullary constructors
+          var c = 0;
+          foreach (var bv in lhs.Vars) {
+            ScopePushAndReport(scope, bv, "local_variable");
+            c++;
+          }
+          if (c == 0) {
+            // Every identifier-looking thing in the pattern resolved to a constructor; that is, this LHS is a constant literal
+            reporter.Error(MessageSource.Resolver, lhs.tok, "LHS is a constant literal; to be legal, it must introduce at least one bound variable");
+          }
+          i++;
+        }
       } else if (stmt is AssignStmt) {
         AssignStmt s = (AssignStmt)stmt;
         int prevErrorCount = reporter.Count(ErrorLevel.Error);
@@ -6748,6 +6790,8 @@ namespace Microsoft.Dafny
         if (s.Update != null) {
           CheckForallStatementBodyRestrictions(s.Update, kind);
         }
+      } else if (stmt is LetStmt) {
+        // Are we fine?
       } else if (stmt is AssignStmt) {
         var s = (AssignStmt)stmt;
         CheckForallStatementBodyLhs(s.Tok, s.Lhs.Resolved, kind);
@@ -6903,6 +6947,8 @@ namespace Microsoft.Dafny
         if (s.Update != null) {
           CheckHintRestrictions(s.Update, localsAllowedInUpdates);
         }
+      } else if (stmt is LetStmt) {
+        // Are we fine?
       } else if (stmt is BlockStmt) {
         var s = (BlockStmt)stmt;
         var newScopeForLocals = new HashSet<LocalVariable>(localsAllowedInUpdates);
@@ -7948,7 +7994,6 @@ namespace Microsoft.Dafny
         ResolveAttributes(e.Attributes, opts);
         scope.PopMarker();
         expr.Type = e.Body.Type;
-
       } else if (expr is NamedExpr) {
         var e = (NamedExpr)expr;
         ResolveExpression(e.Body, opts);
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 47dfb96a..51b800a7 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -5214,6 +5214,7 @@ namespace Microsoft.Dafny {
           }
           CheckWellformedWithResult(Substitute(e.Body, null, substMap), options, result, resultType, locals, builder, etran);
           result = null;
+
         } else {
           // CheckWellformed(var b :| RHS(b); Body(b)) =
           //   var b where typeAntecedent;
@@ -7549,7 +7550,32 @@ namespace Microsoft.Dafny {
         if (s.Update != null) {
           TrStmt(s.Update, builder, locals, etran);
         }
-
+      } else if (stmt is LetStmt) {
+        var s = (LetStmt)stmt;
+        foreach (var bv in s.BoundVars) {
+          Bpl.LocalVariable bvar = new Bpl.LocalVariable(bv.Tok, new Bpl.TypedIdent(bv.Tok, bv.AssignUniqueName(currentDeclaration.IdGenerator), TrType(bv.Type)));
+          locals.Add(bvar);
+          var bIe = new Bpl.IdentifierExpr(bvar.tok, bvar);
+          builder.Add(new Bpl.HavocCmd(bv.Tok, new List<Bpl.IdentifierExpr> { bIe }));
+          Bpl.Expr wh = GetWhereClause(bv.Tok, bIe, bv.Type, etran);
+          if (wh != null) {
+            builder.Add(new Bpl.AssumeCmd(bv.Tok, wh));
+          }
+        }
+        Contract.Assert(s.LHSs.Count == s.RHSs.Count);  // checked by resolution
+        var varNameGen = CurrentIdGenerator.NestedFreshIdGenerator("let#");
+        for (int i = 0; i < s.LHSs.Count; i++) {
+          var pat = s.LHSs[i];
+          var rhs = s.RHSs[i];
+          var nm = varNameGen.FreshId(string.Format("#{0}#", i));
+          var r = new Bpl.LocalVariable(pat.tok, new Bpl.TypedIdent(pat.tok, nm, TrType(rhs.Type)));
+          locals.Add(r);
+          var rIe = new Bpl.IdentifierExpr(pat.tok, r);
+          TrStmt_CheckWellformed(s.RHSs[i], builder, locals, etran, false);
+          CheckWellformedWithResult(s.RHSs[i], new WFOptions(null, false, false), rIe, pat.Expr.Type, locals, builder, etran);
+          CheckCasePatternShape(pat, rIe, builder);
+          builder.Add(new Bpl.AssumeCmd(pat.tok, Bpl.Expr.Eq(etran.TrExpr(pat.Expr), rIe)));
+        }
       } else {
         Contract.Assert(false); throw new cce.UnreachableException();  // unexpected statement
       }
@@ -13700,6 +13726,7 @@ namespace Microsoft.Dafny {
             if (newCasePatterns != e.LHSs) {
               anythingChanged = true;
             }
+
             var body = Substitute(e.Body);
             // undo any changes to substMap (could be optimized to do this only if newBoundVars != e.Vars)
             foreach (var bv in e.BoundVars) {
diff --git a/Test/dafny4/Bug94.dfy b/Test/dafny4/Bug94.dfy
new file mode 100644
index 00000000..2f437785
--- /dev/null
+++ b/Test/dafny4/Bug94.dfy
@@ -0,0 +1,35 @@
+// RUN: %dafny /compile:3 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+function foo() : (int, int)
+{
+    (5, 10)
+}
+
+function bar() : int
+{
+    var (x, y) := foo();
+    x + y
+}
+
+lemma test()
+{
+    var (x, y) := foo();
+}
+
+function method foo2() : (int,int)
+{
+    (5, 10)
+}
+
+method test2()
+{
+    var (x, y) := foo2();
+}
+
+method Main()
+{
+    var (x, y) := foo2();
+    assert (x+y == 15);
+    print(x+y);
+}
diff --git a/Test/dafny4/Bug94.dfy.expect b/Test/dafny4/Bug94.dfy.expect
new file mode 100644
index 00000000..6b337d5a
--- /dev/null
+++ b/Test/dafny4/Bug94.dfy.expect
@@ -0,0 +1,6 @@
+
+Dafny program verifier finished with 9 verified, 0 errors
+Program compiled successfully
+Running...
+
+15
\ No newline at end of file
diff --git a/Test/server/simple-session.transcript.expect b/Test/server/simple-session.transcript.expect
index 91429d8e..1aadca7f 100644
--- a/Test/server/simple-session.transcript.expect
+++ b/Test/server/simple-session.transcript.expect
@@ -136,7 +136,7 @@ Retrieving cached verification result for implementation Impl$$_module.__default
   [0 proof obligations]  verified
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
-transcript(7,0): Error: ident expected
+transcript(7,0): Error: invalid VarDeclStatement
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 
-- 
cgit v1.2.3


From 0323a4f1a4d258a21be56cd65c5998ea6d0a3b19 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Mon, 16 Nov 2015 14:46:15 -0800
Subject: Updated version number to 1.9.6.21116. This version is now on
 rise4fun.

---
 Source/version.cs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'Source')

diff --git a/Source/version.cs b/Source/version.cs
index 7a6b0213..86b12fed 100644
--- a/Source/version.cs
+++ b/Source/version.cs
@@ -1,4 +1,4 @@
 using System.Reflection;
-// Version 1.9.6, year 2013+2 month 10 day 12
-[assembly: AssemblyVersion("1.9.6.21012")]
-[assembly: AssemblyFileVersion("1.9.6.21012")]
+// Version 1.9.6, year 2013+2 month 11 day 16
+[assembly: AssemblyVersion("1.9.6.21116")]
+[assembly: AssemblyFileVersion("1.9.6.21116")]
-- 
cgit v1.2.3


From 962052e98513945981e3fed49e374642d1ed4aa0 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Tue, 17 Nov 2015 11:18:13 -0800
Subject: Fix issue 100. Add an axiom for functionHandle to trigger off of the
 origial function and connect with Apply1 of the function.

---
 Source/Dafny/Translator.cs    | 27 +++++++++++++++++++++++++--
 Test/dafny4/Bug100.dfy        | 23 +++++++++++++++++++++++
 Test/dafny4/Bug100.dfy.expect |  2 ++
 3 files changed, 50 insertions(+), 2 deletions(-)
 create mode 100644 Test/dafny4/Bug100.dfy
 create mode 100644 Test/dafny4/Bug100.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 51b800a7..3417d4c3 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -5604,14 +5604,24 @@ namespace Microsoft.Dafny {
         var bvars = new List<Bpl.Variable>();
         var lhs_args = new List<Bpl.Expr>();
         var rhs_args = new List<Bpl.Expr>();
-
+        var func_vars = new List<Bpl.Variable>();
+        var func_args = new List<Bpl.Expr>();
+        var boxed_func_args = new List<Bpl.Expr>();
+        
         var idGen = f.IdGenerator.NestedFreshIdGenerator("$fh$");
         foreach (var fm in f.Formals) {
-          var fe = BplBoundVar(idGen.FreshId("x#"), predef.BoxType, bvars);
+          string fm_name = idGen.FreshId("x#");
+          // Box and its [Unbox]args
+          var fe = BplBoundVar(fm_name, predef.BoxType, bvars);
           lhs_args.Add(fe);
           var be = UnboxIfBoxed(fe, fm.Type);
           rhs_args.Add(be);
           rhs_dict[fm] = new BoogieWrapper(be, fm.Type);
+          // args and its [Box]args
+          var arg = BplBoundVar(fm_name, TrType(fm.Type), func_vars);
+          func_args.Add(arg);
+          var boxed = BoxIfUnboxed(arg, fm.Type);
+          boxed_func_args.Add(boxed);     
         }
 
         var h = BplBoundVar("$heap", predef.HeapType, vars);
@@ -5666,6 +5676,19 @@ namespace Microsoft.Dafny {
           sink.AddTopLevelDeclaration(new Axiom(f.tok,
             BplForall(Cons(bxVar, Concat(vars, bvars)), BplTrigger(lhs), Bpl.Expr.Eq(lhs, rhs))));
         }
+
+        {
+          // F(Ty1, .., TyN, Layer, Heap, self, arg1, .., argN)
+          // = [Unbox]Apply1(Ty.., F#Handle( Ty1, ..., TyN, Layer, self), Heap, [Box]arg1, ..., [Box]argN)
+
+          var fhandle = FunctionCall(f.tok, name, predef.HandleType, SnocSelf(args));
+          var lhs = FunctionCall(f.tok, f.FullSanitizedName, TrType(f.ResultType), Concat(SnocSelf(Snoc(args, h)), func_args));
+          var rhs = FunctionCall(f.tok, Apply(arity), TrType(f.ResultType), Concat(tyargs, Cons(fhandle, Cons(h, boxed_func_args))));
+          var rhs_unboxed = UnboxIfBoxed(rhs, f.ResultType);
+          
+          sink.AddTopLevelDeclaration(new Axiom(f.tok,
+            BplForall(Concat(vars, func_vars), BplTrigger(lhs), Bpl.Expr.Eq(lhs, rhs_unboxed))));
+        }
       }
       return name;
     }
diff --git a/Test/dafny4/Bug100.dfy b/Test/dafny4/Bug100.dfy
new file mode 100644
index 00000000..0c971e82
--- /dev/null
+++ b/Test/dafny4/Bug100.dfy
@@ -0,0 +1,23 @@
+// RUN: %dafny /compile:0 /autoTriggers:1 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+lemma lemma_ensures(x:int, RefineInt:int->int)
+    requires forall y :: RefineInt.requires(y);
+    ensures forall y :: RefineInt(y) + x == RefineInt(x) + y;
+
+function Identity(z:int) : int
+
+lemma test()
+{
+    var v,w:int;
+    lemma_ensures(w, Identity);
+    //var RefineInt := Identity;
+    //assert RefineInt(v) == Identity(v);
+    assert Identity(v) + w == Identity(w) + v;
+}
+
+
+
+
+
+
diff --git a/Test/dafny4/Bug100.dfy.expect b/Test/dafny4/Bug100.dfy.expect
new file mode 100644
index 00000000..73ba063c
--- /dev/null
+++ b/Test/dafny4/Bug100.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 4 verified, 0 errors
-- 
cgit v1.2.3


From 2cde0265070d65f738b9ee236f7246e765536f08 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Tue, 17 Nov 2015 13:13:40 -0800
Subject: Fix issue 107. Instead of writing out StaticReceiverExpr as null
 valued LiteralExpr, write out its type instead.

---
 Source/Dafny/Compiler.cs      |  6 ++++--
 Test/dafny4/Bug107.dfy        | 16 ++++++++++++++++
 Test/dafny4/Bug107.dfy.expect |  6 ++++++
 3 files changed, 26 insertions(+), 2 deletions(-)
 create mode 100644 Test/dafny4/Bug107.dfy
 create mode 100644 Test/dafny4/Bug107.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 82795480..8f199da4 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -2310,7 +2310,9 @@ namespace Microsoft.Dafny {
       Contract.Requires(expr != null);
       if (expr is LiteralExpr) {
         LiteralExpr e = (LiteralExpr)expr;
-        if (e.Value == null) {
+        if (e is StaticReceiverExpr) {
+          wr.Write(TypeName(e.Type, wr));
+        } else if (e.Value == null) {
           wr.Write("({0})null", TypeName(e.Type, wr));
         } else if (e.Value is bool) {
           wr.Write((bool)e.Value ? "true" : "false");
@@ -2394,7 +2396,7 @@ namespace Microsoft.Dafny {
           wr.Write(".@{0}", sf.CompiledName);
           wr.Write(sf.PostString);
         } else {
-          TrParenExpr(e.Obj, wr, inLetExprBody);
+          TrExpr(e.Obj, wr, inLetExprBody);
           wr.Write(".@{0}", e.Member.CompileName);
         }
 
diff --git a/Test/dafny4/Bug107.dfy b/Test/dafny4/Bug107.dfy
new file mode 100644
index 00000000..56965d92
--- /dev/null
+++ b/Test/dafny4/Bug107.dfy
@@ -0,0 +1,16 @@
+// RUN: %dafny /compile:3 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+method Main()
+{
+  var f := Inc;
+	print(f(4));
+}
+
+function method Inc(x: int): int
+{
+  x + 2
+}
+
+
+
diff --git a/Test/dafny4/Bug107.dfy.expect b/Test/dafny4/Bug107.dfy.expect
new file mode 100644
index 00000000..eaa3aa54
--- /dev/null
+++ b/Test/dafny4/Bug107.dfy.expect
@@ -0,0 +1,6 @@
+
+Dafny program verifier finished with 3 verified, 0 errors
+Program compiled successfully
+Running...
+
+6
\ No newline at end of file
-- 
cgit v1.2.3


From 9b2dea60e57be8ddb39b36ed8a282e3826cd4092 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Wed, 18 Nov 2015 11:05:48 -0800
Subject: Fix issue 108. Use idGenerator to create a new collection name for
 each occurrence of Set/MapComprehension when translating it to c#.

---
 Source/Dafny/Compiler.cs      | 15 +++++++++------
 Test/dafny4/Bug108.dfy        | 11 +++++++++++
 Test/dafny4/Bug108.dfy.expect |  7 +++++++
 3 files changed, 27 insertions(+), 6 deletions(-)
 create mode 100644 Test/dafny4/Bug108.dfy
 create mode 100644 Test/dafny4/Bug108.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 8f199da4..69b7a32d 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -2993,8 +2993,9 @@ namespace Microsoft.Dafny {
         // })()
         Contract.Assert(e.Bounds != null);  // the resolver would have insisted on finding bounds
         var typeName = TypeName(e.Type.AsSetType.Arg, wr);
+        var collection_name = idGenerator.FreshId("_coll");
         wr.Write("((Dafny.Helpers.ComprehensionDelegate<{0}>)delegate() {{ ", typeName);
-        wr.Write("var _coll = new System.Collections.Generic.List<{0}>(); ", typeName);
+        wr.Write("var {0} = new System.Collections.Generic.List<{1}>(); ", collection_name, typeName);
         var n = e.BoundVars.Count;
         Contract.Assert(e.Bounds.Count == n);
         for (int i = 0; i < n; i++) {
@@ -3039,13 +3040,14 @@ namespace Microsoft.Dafny {
         }
         wr.Write("if (");
         TrExpr(e.Range, wr, inLetExprBody);
-        wr.Write(") { _coll.Add(");
+        wr.Write(") {");
+        wr.Write("{0}.Add(", collection_name);
         TrExpr(e.Term, wr, inLetExprBody);
         wr.Write("); }");
         for (int i = 0; i < n; i++) {
           wr.Write("}");
         }
-        wr.Write("return Dafny.Set<{0}>.FromCollection(_coll); ", typeName);
+        wr.Write("return Dafny.Set<{0}>.FromCollection({1}); ", typeName, collection_name);
         wr.Write("})()");
 
       } else if (expr is MapComprehension) {
@@ -3069,8 +3071,9 @@ namespace Microsoft.Dafny {
         Contract.Assert(e.Bounds != null);  // the resolver would have insisted on finding bounds
         var domtypeName = TypeName(e.Type.AsMapType.Domain, wr);
         var rantypeName = TypeName(e.Type.AsMapType.Range, wr);
+        var collection_name = idGenerator.FreshId("_coll");
         wr.Write("((Dafny.Helpers.MapComprehensionDelegate<{0},{1}>)delegate() {{ ", domtypeName, rantypeName);
-        wr.Write("var _coll = new System.Collections.Generic.List<Dafny.Pair<{0},{1}>>(); ", domtypeName, rantypeName);
+        wr.Write("var {0} = new System.Collections.Generic.List<Dafny.Pair<{1},{2}>>(); ", collection_name, domtypeName, rantypeName);
         var n = e.BoundVars.Count;
         Contract.Assert(e.Bounds.Count == n && n == 1);
         var bound = e.Bounds[0];
@@ -3112,11 +3115,11 @@ namespace Microsoft.Dafny {
         wr.Write("if (");
         TrExpr(e.Range, wr, inLetExprBody);
         wr.Write(") { ");
-        wr.Write("_coll.Add(new Dafny.Pair<{0},{1}>(@{2},", domtypeName, rantypeName, bv.CompileName);
+        wr.Write("{0}.Add(new Dafny.Pair<{1},{2}>(@{3},", collection_name, domtypeName, rantypeName, bv.CompileName);
         TrExpr(e.Term, wr, inLetExprBody);
         wr.Write(")); }");
         wr.Write("}");
-        wr.Write("return Dafny.Map<{0},{1}>.FromCollection(_coll); ", domtypeName, rantypeName);
+        wr.Write("return Dafny.Map<{0},{1}>.FromCollection({2}); ", domtypeName, rantypeName, collection_name);
         wr.Write("})()");
 
       } else if (expr is LambdaExpr) {
diff --git a/Test/dafny4/Bug108.dfy b/Test/dafny4/Bug108.dfy
new file mode 100644
index 00000000..17cb9f12
--- /dev/null
+++ b/Test/dafny4/Bug108.dfy
@@ -0,0 +1,11 @@
+// RUN: %dafny /compile:3 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+method Main() {
+  var A := map[0 := 1];
+  var B := map x | x in (set y | y in A) :: A[x];
+  print A, "\n";
+  print B, "\n";
+}
+
+
diff --git a/Test/dafny4/Bug108.dfy.expect b/Test/dafny4/Bug108.dfy.expect
new file mode 100644
index 00000000..94e65ba2
--- /dev/null
+++ b/Test/dafny4/Bug108.dfy.expect
@@ -0,0 +1,7 @@
+
+Dafny program verifier finished with 2 verified, 0 errors
+Program compiled successfully
+Running...
+
+map[0 := 1]
+map[0 := 1]
-- 
cgit v1.2.3


From 7dfa02c3da9f68b10b20e6afcd81767d3c6ebf02 Mon Sep 17 00:00:00 2001
From: wuestholz <unknown>
Date: Thu, 19 Nov 2015 15:39:01 -0600
Subject: Add code that uses Z3's optimization features (currently disabled by
 default).

---
 Source/Dafny/Translator.cs | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 3417d4c3..8e8c3c19 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -94,6 +94,8 @@ namespace Microsoft.Dafny {
 
   public class Translator {
     ErrorReporter reporter;
+    // TODO(wuestholz): Enable this once Dafny's recommended Z3 version includes changeset 0592e765744497a089c42021990740f303901e67.
+    public bool UseOptimizationInZ3 { get; set; }
 
     [NotDelayed]
     public Translator(ErrorReporter reporter) {
@@ -2756,6 +2758,18 @@ namespace Microsoft.Dafny {
       List<Variable> localVariables = new List<Variable>();
       GenerateImplPrelude(m, wellformednessProc, inParams, outParams, builder, localVariables);
 
+      if (UseOptimizationInZ3 && m.Ins != null)
+      {
+        // We ask Z3 to minimize all parameters of type 'nat'.
+        foreach (var f in m.Ins)
+        {
+          if (f.Type is NatType)
+          {
+            builder.Add(optimizeExpr(true, new IdentifierExpr(f), f.Tok, etran));
+          }
+        }
+      }
+
       Bpl.StmtList stmts;
       if (!wellformednessProc) {
         var inductionVars = ApplyInduction(m.Ins, m.Attributes);
@@ -2920,6 +2934,17 @@ namespace Microsoft.Dafny {
       Reset();
     }
 
+    internal static AssumeCmd optimizeExpr(bool minimize, Expression expr, IToken tok, ExpressionTranslator etran)
+    {
+      Contract.Requires(expr != null);
+      Contract.Requires(expr.Type.IsIntegerType || expr.Type.IsRealType);
+      Contract.Requires(tok != null && etran != null);
+
+      var assumeCmd = new AssumeCmd(tok, Expr.True);
+      assumeCmd.Attributes = new QKeyValue(expr.tok, (minimize ? "minimize" : "maximize"), new List<object> { etran.TrExpr(expr) }, null);
+      return assumeCmd;
+    }
+
     private void AddFunctionOverrideCheckImpl(Function f)
     {
         Contract.Requires(f != null);
-- 
cgit v1.2.3


From b8fad094ad74180ca16670bebe602737d856b5da Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Wed, 25 Nov 2015 10:27:02 -0800
Subject: Fix issue 103. Emit the quantifiers for ForallStmt before AutoTrigger
 so that the auto-triggers can be computed for ForallStmt.

---
 Source/Dafny/Cloner.cs                        |   4 +-
 Source/Dafny/DafnyAst.cs                      |   1 +
 Source/Dafny/Printer.cs                       |  15 +-
 Source/Dafny/Resolver.cs                      |   1 +
 Source/Dafny/Rewriter.cs                      | 273 +++++++++++++++++++++
 Source/Dafny/Translator.cs                    | 340 +++++++-------------------
 Source/Dafny/Triggers/QuantifierSplitter.cs   |  12 +
 Source/Dafny/Triggers/QuantifiersCollector.cs |  13 +
 Test/dafny0/SmallTests.dfy.expect             |   1 +
 Test/dafny4/Bug103.dfy                        |  20 ++
 Test/dafny4/Bug103.dfy.expect                 |   2 +
 11 files changed, 424 insertions(+), 258 deletions(-)
 create mode 100644 Test/dafny4/Bug103.dfy
 create mode 100644 Test/dafny4/Bug103.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index 1a6dfecb..6b3b0caa 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -552,7 +552,9 @@ namespace Microsoft.Dafny
       } else if (stmt is ForallStmt) {
         var s = (ForallStmt)stmt;
         r = new ForallStmt(Tok(s.Tok), Tok(s.EndTok), s.BoundVars.ConvertAll(CloneBoundVar), null, CloneExpr(s.Range), s.Ens.ConvertAll(CloneMayBeFreeExpr), CloneStmt(s.Body));
-
+        if (s.ForallExpressions != null) {
+          ((ForallStmt)r).ForallExpressions = s.ForallExpressions.ConvertAll(CloneExpr);
+        }
       } else if (stmt is CalcStmt) {
         var s = (CalcStmt)stmt;
         // calc statements have the unusual property that the last line is duplicated.  If that is the case (which
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 847617aa..4c1e2bd7 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -4693,6 +4693,7 @@ namespace Microsoft.Dafny {
     public readonly Expression Range;
     public readonly List<MaybeFreeExpression> Ens;
     public readonly Statement Body;
+    public List<Expression> ForallExpressions;   // fill in by rewriter.
 
     public List<ComprehensionExpr.BoundedPool> Bounds;  // initialized and filled in by resolver
     // invariant: if successfully resolved, Bounds.Count == BoundVars.Count;
diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index 145e82e7..0a25b941 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -841,11 +841,22 @@ namespace Microsoft.Dafny {
         wr.Write("}");
 
       } else if (stmt is ForallStmt) {
-        var s = (ForallStmt)stmt;
+        var s = (ForallStmt)stmt;
+        Attributes attributes = s.Attributes;
+        if (attributes == null && s.ForallExpressions != null) {
+          foreach (Expression expr in s.ForallExpressions) {
+            ForallExpr e = (ForallExpr)expr;
+            while (e != null && attributes == null) {
+              attributes = e.Attributes;
+              e = (ForallExpr)e.SplitQuantifierExpression;
+            }
+            if (attributes != null) { break; }
+          }
+        }
         wr.Write("forall");
         if (s.BoundVars.Count != 0) {
           wr.Write(" ");
-          PrintQuantifierDomain(s.BoundVars, s.Attributes, s.Range);
+          PrintQuantifierDomain(s.BoundVars, attributes, s.Range);
         }
         if (s.Ens.Count == 0) {
           wr.Write(" ");
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 315b823a..eff7d97d 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -235,6 +235,7 @@ namespace Microsoft.Dafny
       rewriters.Add(new AutoReqFunctionRewriter(this.reporter, opaqueRewriter));
       rewriters.Add(opaqueRewriter);
       rewriters.Add(new TimeLimitRewriter(reporter));
+      rewriters.Add(new ForallStmtRewriter(reporter));
 
       if (DafnyOptions.O.AutoTriggers) {
         rewriters.Add(new QuantifierSplittingRewriter(reporter));
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 39c8f667..802b1918 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -72,6 +72,279 @@ namespace Microsoft.Dafny
     }
   }
 
+  // write out the quantifier for ForallStmt
+  public class ForallStmtRewriter : IRewriter
+  {
+    public ForallStmtRewriter(ErrorReporter reporter) : base(reporter) {
+      Contract.Requires(reporter != null);
+    }
+
+    internal override void PostResolve(ModuleDefinition m) {
+      var forallvisiter = new ForAllStmtVisitor();
+      foreach (var decl in ModuleDefinition.AllCallables(m.TopLevelDecls)) {
+        forallvisiter.Visit(decl, true);
+      }
+    }
+
+    internal class ForAllStmtVisitor : TopDownVisitor<bool>
+    {
+      protected override bool VisitOneStmt(Statement stmt, ref bool st) {
+        Contract.Requires(stmt != null);
+        if (stmt is ForallStmt) {
+          ForallStmt s = (ForallStmt)stmt;
+          if (s.Kind == ForallStmt.ParBodyKind.Proof) {
+            Expression term = s.Ens.Count != 0 ? s.Ens[0].E : new LiteralExpr(s.Tok, true);
+            for (int i = 1; i < s.Ens.Count; i++) {
+              term = new BinaryExpr(s.Tok, BinaryExpr.ResolvedOpcode.And, term, s.Ens[i].E);
+            }
+            List<Expression> exprList = new List<Expression>();
+            ForallExpr expr = new ForallExpr(s.Tok, s.BoundVars, s.Range, term, s.Attributes);
+            expr.Type = Type.Bool; // resolve here
+            exprList.Add(expr);
+            s.ForallExpressions = exprList;
+          } else if (s.Kind == ForallStmt.ParBodyKind.Assign) {
+            if (s.BoundVars.Count != 0) {
+              var s0 = (AssignStmt)s.S0;
+              if (s0.Rhs is ExprRhs) {
+                List<Expression> exprList = new List<Expression>();
+                Expression Fi = null;
+                Func<Expression, Expression> lhsBuilder = null;
+                var lhs = s0.Lhs.Resolved;
+                var i = s.BoundVars[0];
+                if (s.BoundVars.Count == 1) {
+                  //var lhsContext = null;
+                  // Detect the following cases:
+                  //   0: forall i | R(i) { F(i).f := E(i); }
+                  //   1: forall i | R(i) { A[F(i)] := E(i); }
+                  //   2: forall i | R(i) { F(i)[N] := E(i); }
+                  if (lhs is MemberSelectExpr) {
+                    var ll = (MemberSelectExpr)lhs;
+                    Fi = ll.Obj;
+                    lhsBuilder = e => { var l = new MemberSelectExpr(ll.tok, e, ll.MemberName); l.Member = ll.Member; l.Type = ll.Type; return l; };
+                  } else if (lhs is SeqSelectExpr) {
+                    var ll = (SeqSelectExpr)lhs;
+                    Contract.Assert(ll.SelectOne);
+                    if (!Translator.ContainsFreeVariable(ll.Seq, false, i)) {
+                      Fi = ll.E0;
+                      lhsBuilder = e => { var l = new SeqSelectExpr(ll.tok, true, ll.Seq, e, null); l.Type = ll.Type; return l; };
+                    } else if (!Translator.ContainsFreeVariable(ll.E0, false, i)) {
+                      Fi = ll.Seq;
+                      lhsBuilder = e => { var l = new SeqSelectExpr(ll.tok, true, e, ll.E0, null); l.Type = ll.Type; return l; };
+                    }
+                  }
+                }
+                var rhs = ((ExprRhs)s0.Rhs).Expr;
+                bool usedInversion = false;
+                if (Fi != null) {
+                  var j = new BoundVar(i.tok, i.Name + "#inv", Fi.Type);
+                  var jj = Expression.CreateIdentExpr(j);
+                  var jList = new List<BoundVar>() { j };
+                  var vals = InvertExpression(i, j, s.Range, Fi);
+#if DEBUG_PRINT
+          Console.WriteLine("DEBUG: Trying to invert:");
+          Console.WriteLine("DEBUG:   " + Printer.ExprToString(s.Range) + " && " + j.Name + " == " + Printer.ExprToString(Fi));
+          if (vals == null) {
+            Console.WriteLine("DEBUG: Can't");
+          } else {
+            Console.WriteLine("DEBUG: The inverse is the disjunction of the following:");
+            foreach (var val in vals) {
+              Console.WriteLine("DEBUG:   " + Printer.ExprToString(val.Range) + " && " + Printer.ExprToString(val.FInverse) + " == " + i.Name);
+            }
+          }
+#endif
+                  if (vals != null) {
+                    foreach (var val in vals) {
+                      lhs = lhsBuilder(jj);
+                      Attributes attributes = new Attributes("trigger", new List<Expression>() { lhs }, s.Attributes);
+                      var expr = new ForallExpr(s.Tok, jList, val.Range, new BinaryExpr(s.Tok, BinaryExpr.ResolvedOpcode.EqCommon, lhs, Substitute(rhs, i, val.FInverse)), attributes);
+                      expr.Type = Type.Bool; //resolve here
+                      exprList.Add(expr);
+                    }
+                    usedInversion = true;
+                  }
+                }
+                if (!usedInversion) {
+                  var expr = new ForallExpr(s.Tok, s.BoundVars, s.Range, new BinaryExpr(s.Tok, BinaryExpr.ResolvedOpcode.EqCommon, lhs, rhs), s.Attributes);
+                  expr.Type = Type.Bool; // resolve here
+                  exprList.Add(expr);
+                }
+                s.ForallExpressions = exprList;
+              }
+            }
+          } else if (s.Kind == ForallStmt.ParBodyKind.Call) {
+            var s0 = (CallStmt)s.S0;
+            Expression term = s0.Method.Ens.Count != 0 ? s0.Method.Ens[0].E : new LiteralExpr(s.Tok, true);
+            for (int i = 1; i < s0.Method.Ens.Count; i++) {
+              term = new BinaryExpr(s.Tok, BinaryExpr.ResolvedOpcode.And, term, s0.Method.Ens[i].E);
+            }
+            List<Expression> exprList = new List<Expression>();
+            ForallExpr expr = new ForallExpr(s.Tok, s.BoundVars, s.Range, term, s.Attributes);
+            expr.Type = Type.Bool; // resolve here
+            exprList.Add(expr);
+          } else {
+            Contract.Assert(false);  // unexpected kind
+          }
+        }
+        return true;  //visit the sub-parts with the same "st"    
+      }
+
+      internal class ForallStmtTranslationValues
+      {
+        public readonly Expression Range;
+        public readonly Expression FInverse;
+        public ForallStmtTranslationValues(Expression range, Expression fInverse) {
+          Contract.Requires(range != null);
+          Contract.Requires(fInverse != null);
+          Range = range;
+          FInverse = fInverse;
+        }
+        public ForallStmtTranslationValues Subst(IVariable j, Expression e) {
+          Contract.Requires(j != null);
+          Contract.Requires(e != null);
+          Dictionary<TypeParameter, Type> typeMap = new Dictionary<TypeParameter, Type>();
+          var substMap = new Dictionary<IVariable, Expression>();
+          substMap.Add(j, e);
+          Translator.Substituter sub = new Translator.Substituter(null, substMap, typeMap, null);
+          var v = new ForallStmtTranslationValues(sub.Substitute(Range), sub.Substitute(FInverse));
+          return v;
+        }
+      }
+
+      /// <summary>
+      /// Find piecewise inverse of F under R.  More precisely, find lists of expressions P and F-1
+      /// such that
+      ///     R(i) && j == F(i)
+      /// holds iff the disjunction of the following predicates holds:
+      ///     P_0(j) && F-1_0(j) == i
+      ///     ...
+      ///     P_{n-1}(j) && F-1_{n-1}(j) == i
+      /// If no such disjunction is found, return null.
+      /// If such a disjunction is found, return for each disjunct:
+      ///     * The predicate P_k(j), which is an expression that may have free occurrences of j (but no free occurrences of i)
+      ///     * The expression F-1_k(j), which also may have free occurrences of j but not of i
+      /// </summary>
+      private List<ForallStmtTranslationValues> InvertExpression(BoundVar i, BoundVar j, Expression R, Expression F) {
+        Contract.Requires(i != null);
+        Contract.Requires(j != null);
+        Contract.Requires(R != null);
+        Contract.Requires(F != null);
+        var vals = new List<ForallStmtTranslationValues>(InvertExpressionIter(i, j, R, F));
+        if (vals.Count == 0) {
+          return null;
+        } else {
+          return vals;
+        }
+      }
+      /// <summary>
+      /// See InvertExpression.
+      /// </summary>
+      private IEnumerable<ForallStmtTranslationValues> InvertExpressionIter(BoundVar i, BoundVar j, Expression R, Expression F) {
+        Contract.Requires(i != null);
+        Contract.Requires(j != null);
+        Contract.Requires(R != null);
+        Contract.Requires(F != null);
+        F = F.Resolved;
+        if (!Translator.ContainsFreeVariable(F, false, i)) {
+          // We're looking at R(i) && j == K.
+          // We cannot invert j == K, but if we're lucky, R(i) contains a conjunct i==G.
+          Expression r = Expression.CreateBoolLiteral(R.tok, true);
+          Expression G = null;
+          foreach (var c in Expression.Conjuncts(R)) {
+            if (G == null && c is BinaryExpr) {
+              var bin = (BinaryExpr)c;
+              if (BinaryExpr.IsEqualityOp(bin.ResolvedOp)) {
+                var id = bin.E0.Resolved as IdentifierExpr;
+                if (id != null && id.Var == i) {
+                  G = bin.E1;
+                  continue;
+                }
+                id = bin.E1.Resolved as IdentifierExpr;
+                if (id != null && id.Var == i) {
+                  G = bin.E0;
+                  continue;
+                }
+              }
+            }
+            r = Expression.CreateAnd(r, c);
+          }
+          if (G != null) {
+            var jIsK = Expression.CreateEq(Expression.CreateIdentExpr(j), F, j.Type);
+            var rr = Substitute(r, i, G);
+            yield return new ForallStmtTranslationValues(Expression.CreateAnd(rr, jIsK), G);
+          }
+        } else if (F is IdentifierExpr) {
+          var e = (IdentifierExpr)F;
+          if (e.Var == i) {
+            // We're looking at R(i) && j == i, which is particularly easy to invert:  R(j) && j == i
+            var jj = Expression.CreateIdentExpr(j);
+            yield return new ForallStmtTranslationValues(Substitute(R, i, jj), jj);
+          }
+        } else if (F is BinaryExpr) {
+          var bin = (BinaryExpr)F;
+          if (bin.ResolvedOp == BinaryExpr.ResolvedOpcode.Add && (bin.E0.Type.IsIntegerType || bin.E0.Type.IsRealType)) {
+            if (!Translator.ContainsFreeVariable(bin.E1, false, i)) {
+              // We're looking at:  R(i) && j == f(i) + K.
+              // By a recursive call, we'll ask to invert:  R(i) && j' == f(i).
+              // For each P_0(j') && f-1_0(j') == i we get back, we yield:
+              // P_0(j - K) && f-1_0(j - K) == i
+              var jMinusK = Expression.CreateSubtract(Expression.CreateIdentExpr(j), bin.E1);
+              foreach (var val in InvertExpression(i, j, R, bin.E0)) {
+                yield return val.Subst(j, jMinusK);
+              }
+            } else if (!Translator.ContainsFreeVariable(bin.E0, false, i)) {
+              // We're looking at:  R(i) && j == K + f(i)
+              // Do as in previous case, but with operands reversed.
+              var jMinusK = Expression.CreateSubtract(Expression.CreateIdentExpr(j), bin.E0);
+              foreach (var val in InvertExpression(i, j, R, bin.E1)) {
+                yield return val.Subst(j, jMinusK);
+              }
+            }
+          } else if (bin.ResolvedOp == BinaryExpr.ResolvedOpcode.Sub && (bin.E0.Type.IsIntegerType || bin.E0.Type.IsRealType)) {
+            if (!Translator.ContainsFreeVariable(bin.E1, false, i)) {
+              // We're looking at:  R(i) && j == f(i) - K
+              // Recurse on f(i) and then replace j := j + K
+              var jPlusK = Expression.CreateAdd(Expression.CreateIdentExpr(j), bin.E1);
+              foreach (var val in InvertExpression(i, j, R, bin.E0)) {
+                yield return val.Subst(j, jPlusK);
+              }
+            } else if (!Translator.ContainsFreeVariable(bin.E0, false, i)) {
+              // We're looking at:  R(i) && j == K - f(i)
+              // Recurse on f(i) and then replace j := K - j
+              var kMinusJ = Expression.CreateAdd(Expression.CreateIdentExpr(j), bin.E0);
+              foreach (var val in InvertExpression(i, j, R, bin.E1)) {
+                yield return val.Subst(j, kMinusJ);
+              }
+            }
+          }
+        } else if (F is ITEExpr) {
+          var ife = (ITEExpr)F;
+          // We're looking at R(i) && j == if A(i) then B(i) else C(i), which is equivalent to the disjunction of:
+          //   R(i) && A(i) && j == B(i)
+          //   R(i) && !A(i) && j == C(i)
+          // We recurse on each one, yielding the results
+          var r = Expression.CreateAnd(R, ife.Test);
+          var valsThen = InvertExpression(i, j, r, ife.Thn);
+          if (valsThen != null) {
+            r = Expression.CreateAnd(R, Expression.CreateNot(ife.tok, ife.Test));
+            var valsElse = InvertExpression(i, j, r, ife.Els);
+            if (valsElse != null) {
+              foreach (var val in valsThen) { yield return val; }
+              foreach (var val in valsElse) { yield return val; }
+            }
+          }
+        }
+      }
+
+      Expression Substitute(Expression expr, IVariable v, Expression e) {
+        Dictionary<IVariable, Expression/*!*/> substMap = new Dictionary<IVariable, Expression>();
+        Dictionary<TypeParameter, Type> typeMap = new Dictionary<TypeParameter, Type>();
+        substMap.Add(v, e);
+        Translator.Substituter sub = new Translator.Substituter(null, substMap, typeMap, null);
+        return sub.Substitute(expr);
+      }
+    }
+  }
+
   /// <summary>
   /// AutoContracts is an experimental feature that will fill much of the dynamic-frames boilerplate
   /// into a class.  From the user's perspective, what needs to be done is simply:
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 8e8c3c19..37408aa1 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -2860,11 +2860,11 @@ namespace Microsoft.Dafny {
 #if VERIFY_CORRECTNESS_OF_TRANSLATION_FORALL_STATEMENT_RANGE
           var definedness = new Bpl.StmtListBuilder();
           var exporter = new Bpl.StmtListBuilder();
-          TrForallStmtCall(m.tok, parBoundVars, parRange, decrCheck, recursiveCall, definedness, exporter, localVariables, etran);
+          TrForallStmtCall(m.tok, parBoundVars, parRange, decrCheck, null, recursiveCall, definedness, exporter, localVariables, etran);
           // All done, so put the two pieces together
           builder.Add(new Bpl.IfCmd(m.tok, null, definedness.Collect(m.tok), null, exporter.Collect(m.tok)));
 #else
-          TrForallStmtCall(m.tok, parBoundVars, parRange, decrCheck, recursiveCall, null, builder, localVariables, etran);
+          TrForallStmtCall(m.tok, parBoundVars, parRange, decrCheck, null, recursiveCall, null, builder, localVariables, etran);
 #endif
         }
         // translate the body of the method
@@ -7413,7 +7413,7 @@ namespace Microsoft.Dafny {
             var s0 = (CallStmt)s.S0;
             var definedness = new Bpl.StmtListBuilder();
             var exporter = new Bpl.StmtListBuilder();
-            TrForallStmtCall(s.Tok, s.BoundVars, s.Range, null, s0, definedness, exporter, locals, etran);
+            TrForallStmtCall(s.Tok, s.BoundVars, s.Range, null, s.ForallExpressions, s0, definedness, exporter, locals, etran);
             // All done, so put the two pieces together
             builder.Add(new Bpl.IfCmd(s.Tok, null, definedness.Collect(s.Tok), null, exporter.Collect(s.Tok)));
             builder.Add(CaptureState(stmt));
@@ -8038,65 +8038,16 @@ namespace Microsoft.Dafny {
       Bpl.Expr qq = new Bpl.ForallExpr(s.Tok, new List<TypeVariable> { alpha }, new List<Variable> { oVar, fVar }, null, tr, body);
       updater.Add(new Bpl.AssumeCmd(s.Tok, qq));
 
-      if (s0.Rhs is ExprRhs) {
-        Expression Fi = null;
-        Func<Expression,Expression> lhsBuilder = null;
-        lhs = s0.Lhs.Resolved;
-        var i = s.BoundVars[0];
-        if (s.BoundVars.Count == 1) {
-          //var lhsContext = null;
-          // Detect the following cases:
-          //   0: forall i | R(i) { F(i).f := E(i); }
-          //   1: forall i | R(i) { A[F(i)] := E(i); }
-          //   2: forall i | R(i) { F(i)[N] := E(i); }
-          if (lhs is MemberSelectExpr) {
-            var ll = (MemberSelectExpr)lhs;
-            Fi = ll.Obj;
-            lhsBuilder = e => { var l = new MemberSelectExpr(ll.tok, e, ll.MemberName); l.Member = ll.Member; l.Type = ll.Type; return l; };
-          } else if (lhs is SeqSelectExpr) {
-            var ll = (SeqSelectExpr)lhs;
-            Contract.Assert(ll.SelectOne);
-            if (!ContainsFreeVariable(ll.Seq, false, i)) {
-              Fi = ll.E0;
-              lhsBuilder = e => { var l = new SeqSelectExpr(ll.tok, true, ll.Seq, e, null); l.Type = ll.Type; return l; };
-            } else if (!ContainsFreeVariable(ll.E0, false, i)) {
-              Fi = ll.Seq;
-              lhsBuilder = e => { var l = new SeqSelectExpr(ll.tok, true, e, ll.E0, null); l.Type = ll.Type; return l; };
-            }
-          }
-        }
-        var rhs = ((ExprRhs)s0.Rhs).Expr;
-        bool usedInversion = false;
-        if (Fi != null) {
-          var j = new BoundVar(i.tok, i.Name + "#inv", Fi.Type);
-          var jj = Expression.CreateIdentExpr(j);
-          var jList = new List<BoundVar>() { j };
-          var vals = InvertExpression(i, j, s.Range, Fi);
-#if DEBUG_PRINT
-          Console.WriteLine("DEBUG: Trying to invert:");
-          Console.WriteLine("DEBUG:   " + Printer.ExprToString(s.Range) + " && " + j.Name + " == " + Printer.ExprToString(Fi));
-          if (vals == null) {
-            Console.WriteLine("DEBUG: Can't");
-          } else {
-            Console.WriteLine("DEBUG: The inverse is the disjunction of the following:");
-            foreach (var val in vals) {
-              Console.WriteLine("DEBUG:   " + Printer.ExprToString(val.Range) + " && " + Printer.ExprToString(val.FInverse) + " == " + i.Name);
-            }
-          }
-#endif
-          if (vals != null) {
-            foreach (var val in vals) {
-              qq = TrForall_NewValueAssumption(s.Tok, jList, val.Range, lhsBuilder(jj), Substitute(rhs, i, val.FInverse), true, etran, prevEtran);
-              updater.Add(new Bpl.AssumeCmd(s.Tok, qq));
-            }
-            usedInversion = true;
-          }
-        }
-        if (!usedInversion) {
-          qq = TrForall_NewValueAssumption(s.Tok, s.BoundVars, s.Range, lhs, rhs, false, etran, prevEtran);
+      if (s.ForallExpressions != null) {
+        foreach (ForallExpr expr in s.ForallExpressions) {
+          BinaryExpr term = (BinaryExpr)expr.Term;
+          Contract.Assert(term != null);
+          var e0 = Substitute(((BinaryExpr)term).E0.Resolved, null, substMap);
+          var e1 = Substitute(((BinaryExpr)term).E1, null, substMap);
+          qq = TrForall_NewValueAssumption(expr.tok, expr.BoundVars, expr.Range, e0, e1, expr.Attributes, etran, prevEtran);
           updater.Add(new Bpl.AssumeCmd(s.Tok, qq));
         }
-      }
+      } 
     }
 
     /// <summary>
@@ -8110,7 +8061,7 @@ namespace Microsoft.Dafny {
     ///   G             is rhs
     /// If lhsAsTrigger is true, then use the LHS of the equality above as the trigger; otherwise, don't specify any trigger.
     /// </summary>
-    private Bpl.Expr TrForall_NewValueAssumption(IToken tok, List<BoundVar> boundVars, Expression range, Expression lhs, Expression rhs, bool lhsAsTrigger, ExpressionTranslator etran, ExpressionTranslator prevEtran) {
+    private Bpl.Expr TrForall_NewValueAssumption(IToken tok, List<BoundVar> boundVars, Expression range, Expression lhs, Expression rhs, Attributes attributes, ExpressionTranslator etran, ExpressionTranslator prevEtran) {
       Contract.Requires(tok != null);
       Contract.Requires(boundVars != null);
       Contract.Requires(range != null);
@@ -8130,159 +8081,27 @@ namespace Microsoft.Dafny {
       Type lhsType = lhs is MemberSelectExpr ? ((MemberSelectExpr)lhs).Type : null;
       g = CondApplyBox(rhs.tok, g, rhs.Type, lhsType);
 
-      Trigger tr = lhsAsTrigger ? new Trigger(tok, true, new List<Bpl.Expr>() { xHeapOF }) : null;
-      return new Bpl.ForallExpr(tok, xBvars, tr, Bpl.Expr.Imp(xAnte, Bpl.Expr.Eq(xHeapOF, g)));
-    }
-
-    class ForallStmtTranslationValues
-    {
-      public readonly Expression Range;
-      public readonly Expression FInverse;
-      public ForallStmtTranslationValues(Expression range, Expression fInverse) {
-        Contract.Requires(range != null);
-        Contract.Requires(fInverse != null);
-        Range = range;
-        FInverse = fInverse;
-      }
-      public ForallStmtTranslationValues Subst(IVariable j, Expression e, Translator translator) {
-        Contract.Requires(j != null);
-        Contract.Requires(e != null);
-        Contract.Requires(translator != null);
-        var substMap = new Dictionary<IVariable, Expression>();
-        substMap.Add(j, e);
-        var v = new ForallStmtTranslationValues(translator.Substitute(Range, null, substMap), translator.Substitute(FInverse, null, substMap));
-        return v;
-      }
-    }
-
-    /// <summary>
-    /// Find piecewise inverse of F under R.  More precisely, find lists of expressions P and F-1
-    /// such that
-    ///     R(i) && j == F(i)
-    /// holds iff the disjunction of the following predicates holds:
-    ///     P_0(j) && F-1_0(j) == i
-    ///     ...
-    ///     P_{n-1}(j) && F-1_{n-1}(j) == i
-    /// If no such disjunction is found, return null.
-    /// If such a disjunction is found, return for each disjunct:
-    ///     * The predicate P_k(j), which is an expression that may have free occurrences of j (but no free occurrences of i)
-    ///     * The expression F-1_k(j), which also may have free occurrences of j but not of i
-    /// </summary>
-    private List<ForallStmtTranslationValues> InvertExpression(BoundVar i, BoundVar j, Expression R, Expression F) {
-      Contract.Requires(i != null);
-      Contract.Requires(j != null);
-      Contract.Requires(R != null);
-      Contract.Requires(F != null);
-      var vals = new List<ForallStmtTranslationValues>(InvertExpressionIter(i, j, R, F));
-      if (vals.Count == 0) {
-        return null;
-      } else {
-        return vals;
-      }
-    }
-    /// <summary>
-    /// See InvertExpression.
-    /// </summary>
-    private IEnumerable<ForallStmtTranslationValues> InvertExpressionIter(BoundVar i, BoundVar j, Expression R, Expression F) {
-      Contract.Requires(i != null);
-      Contract.Requires(j != null);
-      Contract.Requires(R != null);
-      Contract.Requires(F != null);
-      F = F.Resolved;
-      if (!ContainsFreeVariable(F, false, i)) {
-        // We're looking at R(i) && j == K.
-        // We cannot invert j == K, but if we're lucky, R(i) contains a conjunct i==G.
-        Expression r = Expression.CreateBoolLiteral(R.tok, true);
-        Expression G = null;
-        foreach (var c in Expression.Conjuncts(R)) {
-          if (G == null && c is BinaryExpr) {
-            var bin = (BinaryExpr)c;
-            if (BinaryExpr.IsEqualityOp(bin.ResolvedOp)) {
-              var id = bin.E0.Resolved as IdentifierExpr;
-              if (id != null && id.Var == i) {
-                G = bin.E1;
-                continue;
-              }
-              id = bin.E1.Resolved as IdentifierExpr;
-              if (id != null && id.Var == i) {
-                G = bin.E0;
-                continue;
-              }
+      Bpl.Trigger tr = null;
+      var argsEtran = etran.WithNoLits();
+      foreach (var aa in attributes.AsEnumerable()) {
+        if (aa.Name == "trigger") {
+          List<Bpl.Expr> tt = new List<Bpl.Expr>();
+          foreach (var arg in aa.Args) {
+            if (arg == lhs) {
+              tt.Add(xHeapOF);
+            } else {
+              tt.Add(argsEtran.TrExpr(arg));
             }
           }
-          r = Expression.CreateAnd(r, c);
-        }
-        if (G != null) {
-          var jIsK = Expression.CreateEq(Expression.CreateIdentExpr(j), F, j.Type);
-          var rr = Substitute(r, i, G);
-          yield return new ForallStmtTranslationValues(Expression.CreateAnd(rr, jIsK), G);
-        }
-      } else if (F is IdentifierExpr) {
-        var e = (IdentifierExpr)F;
-        if (e.Var == i) {
-          // We're looking at R(i) && j == i, which is particularly easy to invert:  R(j) && j == i
-          var jj = Expression.CreateIdentExpr(j);
-          yield return new ForallStmtTranslationValues(Substitute(R, i, jj), jj);
-        }
-      } else if (F is BinaryExpr) {
-        var bin = (BinaryExpr)F;
-        if (bin.ResolvedOp == BinaryExpr.ResolvedOpcode.Add && (bin.E0.Type.IsIntegerType || bin.E0.Type.IsRealType)) {
-          if (!ContainsFreeVariable(bin.E1, false, i)) {
-            // We're looking at:  R(i) && j == f(i) + K.
-            // By a recursive call, we'll ask to invert:  R(i) && j' == f(i).
-            // For each P_0(j') && f-1_0(j') == i we get back, we yield:
-            // P_0(j - K) && f-1_0(j - K) == i
-            var jMinusK = Expression.CreateSubtract(Expression.CreateIdentExpr(j), bin.E1);
-            foreach (var val in InvertExpression(i, j, R, bin.E0)) {
-              yield return val.Subst(j, jMinusK, this);
-            }
-          } else if (!ContainsFreeVariable(bin.E0, false, i)) {
-            // We're looking at:  R(i) && j == K + f(i)
-            // Do as in previous case, but with operands reversed.
-            var jMinusK = Expression.CreateSubtract(Expression.CreateIdentExpr(j), bin.E0);
-            foreach (var val in InvertExpression(i, j, R, bin.E1)) {
-              yield return val.Subst(j, jMinusK, this);
-            }
-          }
-        } else if (bin.ResolvedOp == BinaryExpr.ResolvedOpcode.Sub && (bin.E0.Type.IsIntegerType || bin.E0.Type.IsRealType)) {
-          if (!ContainsFreeVariable(bin.E1, false, i)) {
-            // We're looking at:  R(i) && j == f(i) - K
-            // Recurse on f(i) and then replace j := j + K
-            var jPlusK = Expression.CreateAdd(Expression.CreateIdentExpr(j), bin.E1);
-            foreach (var val in InvertExpression(i, j, R, bin.E0)) {
-              yield return val.Subst(j, jPlusK, this);
-            }
-          } else if (!ContainsFreeVariable(bin.E0, false, i)) {
-            // We're looking at:  R(i) && j == K - f(i)
-            // Recurse on f(i) and then replace j := K - j
-            var kMinusJ = Expression.CreateAdd(Expression.CreateIdentExpr(j), bin.E0);
-            foreach (var val in InvertExpression(i, j, R, bin.E1)) {
-              yield return val.Subst(j, kMinusJ, this);
-            }
-          }
-        }
-      } else if (F is ITEExpr) {
-        var ife = (ITEExpr)F;
-        // We're looking at R(i) && j == if A(i) then B(i) else C(i), which is equivalent to the disjunction of:
-        //   R(i) && A(i) && j == B(i)
-        //   R(i) && !A(i) && j == C(i)
-        // We recurse on each one, yielding the results
-        var r = Expression.CreateAnd(R, ife.Test);
-        var valsThen = InvertExpression(i, j, r, ife.Thn);
-        if (valsThen != null) {
-          r = Expression.CreateAnd(R, Expression.CreateNot(ife.tok, ife.Test));
-          var valsElse = InvertExpression(i, j, r, ife.Els);
-          if (valsElse != null) {
-            foreach (var val in valsThen) { yield return val; }
-            foreach (var val in valsElse) { yield return val; }
-          }
+          tr = new Bpl.Trigger(tok, true, tt, tr);
         }
       }
+      return new Bpl.ForallExpr(tok, xBvars, tr, Bpl.Expr.Imp(xAnte, Bpl.Expr.Eq(xHeapOF, g)));
     }
 
     delegate Bpl.Expr ExpressionConverter(Dictionary<IVariable, Expression> substMap, ExpressionTranslator etran);
 
-    void TrForallStmtCall(IToken tok, List<BoundVar> boundVars, Expression range, ExpressionConverter additionalRange, CallStmt s0,
+    void TrForallStmtCall(IToken tok, List<BoundVar> boundVars, Expression range, ExpressionConverter additionalRange, List<Expression> forallExpressions, CallStmt s0,
       Bpl.StmtListBuilder definedness, Bpl.StmtListBuilder exporter, List<Variable> locals, ExpressionTranslator etran) {
       Contract.Requires(tok != null);
       Contract.Requires(boundVars != null);
@@ -8365,38 +8184,56 @@ namespace Microsoft.Dafny {
           RecordNewObjectsIn_New(tok, iter, initHeap, heapIdExpr, exporter, locals, etran);
         }
 
-        var bvars = new List<Variable>();
-        Dictionary<IVariable, Expression> substMap;
-        var ante = initEtran.TrBoundVariablesRename(boundVars, bvars, out substMap);
-        ante = BplAnd(ante, initEtran.TrExpr(Substitute(range, null, substMap)));
-        if (additionalRange != null) {
-          ante = BplAnd(ante, additionalRange(substMap, initEtran));
-        }
-
         // Note, in the following, we need to do a bit of a song and dance.  The actual arguments of the
         // call should be translated using "initEtran", whereas the method postcondition should be translated
         // using "callEtran".  To accomplish this, we translate the argument and then tuck the resulting
         // Boogie expressions into BoogieExprWrappers that are used in the DafnyExpr-to-DafnyExpr substitution.
-        // TODO
-        var argsSubstMap = new Dictionary<IVariable, Expression>();  // maps formal arguments to actuals
-        Contract.Assert(s0.Method.Ins.Count == s0.Args.Count);
-        for (int i = 0; i < s0.Method.Ins.Count; i++) {
-          var arg = Substitute(s0.Args[i], null, substMap, s0.MethodSelect.TypeArgumentSubstitutions());  // substitute the renamed bound variables for the declared ones
-          argsSubstMap.Add(s0.Method.Ins[i], new BoogieWrapper(initEtran.TrExpr(arg), s0.Args[i].Type));
-        }
-        var receiver = new BoogieWrapper(initEtran.TrExpr(Substitute(s0.Receiver, null, substMap, s0.MethodSelect.TypeArgumentSubstitutions())), s0.Receiver.Type);
-        var callEtran = new ExpressionTranslator(this, predef, etran.HeapExpr, initHeap);
-        Bpl.Expr post = Bpl.Expr.True;
-        foreach (var ens in s0.Method.Ens) {
-          var p = Substitute(ens.E, receiver, argsSubstMap, s0.MethodSelect.TypeArgumentSubstitutions());  // substitute the call's actuals for the method's formals
-          post = BplAnd(post, callEtran.TrExpr(p));
-        }
-
-        // TRIG (forall $ih#s0#0: Seq Box :: $Is($ih#s0#0, TSeq(TChar)) && $IsAlloc($ih#s0#0, TSeq(TChar), $initHeapForallStmt#0) && Seq#Length($ih#s0#0) != 0 && Seq#Rank($ih#s0#0) < Seq#Rank(s#0) ==> (forall i#2: int :: true ==> LitInt(0) <= i#2 && i#2 < Seq#Length($ih#s0#0) ==> char#ToInt(_module.CharChar.MinChar($LS($LZ), $Heap, this, $ih#s0#0)) <= char#ToInt($Unbox(Seq#Index($ih#s0#0, i#2)): char)))
-        // TRIG (forall $ih#pat0#0: Seq Box, $ih#a0#0: Seq Box :: $Is($ih#pat0#0, TSeq(_module._default.Same0$T)) && $IsAlloc($ih#pat0#0, TSeq(_module._default.Same0$T), $initHeapForallStmt#0) && $Is($ih#a0#0, TSeq(_module._default.Same0$T)) && $IsAlloc($ih#a0#0, TSeq(_module._default.Same0$T), $initHeapForallStmt#0) && Seq#Length($ih#pat0#0) <= Seq#Length($ih#a0#0) && Seq#SameUntil($ih#pat0#0, $ih#a0#0, Seq#Length($ih#pat0#0)) && (Seq#Rank($ih#pat0#0) < Seq#Rank(pat#0) || (Seq#Rank($ih#pat0#0) == Seq#Rank(pat#0) && Seq#Rank($ih#a0#0) < Seq#Rank(a#0))) ==> _module.__default.IsRelaxedPrefixAux(_module._default.Same0$T, $LS($LZ), $Heap, $ih#pat0#0, $ih#a0#0, LitInt(1)))'
-        // TRIG (forall $ih#m0#0: DatatypeType, $ih#n0#0: DatatypeType :: $Is($ih#m0#0, Tclass._module.Nat()) && $IsAlloc($ih#m0#0, Tclass._module.Nat(), $initHeapForallStmt#0) && $Is($ih#n0#0, Tclass._module.Nat()) && $IsAlloc($ih#n0#0, Tclass._module.Nat(), $initHeapForallStmt#0) && Lit(true) && (DtRank($ih#m0#0) < DtRank(m#0) || (DtRank($ih#m0#0) == DtRank(m#0) && DtRank($ih#n0#0) < DtRank(n#0))) ==> _module.__default.mult($LS($LZ), $Heap, $ih#m0#0, _module.__default.plus($LS($LZ), $Heap, $ih#n0#0, $ih#n0#0)) == _module.__default.mult($LS($LZ), $Heap, _module.__default.plus($LS($LZ), $Heap, $ih#m0#0, $ih#m0#0), $ih#n0#0))
-        Bpl.Expr qq = new Bpl.ForallExpr(tok, bvars, Bpl.Expr.Imp(ante, post));  // SMART_TRIGGER
-        exporter.Add(new Bpl.AssumeCmd(tok, qq));
+        // TODO     
+        Bpl.Expr qq;
+        if (forallExpressions != null) {
+          var callEtran = new ExpressionTranslator(this, predef, etran.HeapExpr, initHeap);
+          foreach (Expression expr in forallExpressions) {
+            Dictionary<IVariable, Expression> substMap = new Dictionary<IVariable, Expression>();
+            var e = Substitute(expr, null, substMap, null);
+            var argsSubstMap = new Dictionary<IVariable, Expression>();
+            Contract.Assert(s0.Method.Ins.Count == s0.Args.Count);
+            for (int i = 0; i < s0.Method.Ins.Count; i++) {
+              var arg = Substitute(s0.Args[i], null, substMap, s0.MethodSelect.TypeArgumentSubstitutions());  // substitute the renamed bound variables for the declared ones
+              argsSubstMap.Add(s0.Method.Ins[i], new BoogieWrapper(initEtran.TrExpr(arg), s0.Args[i].Type));
+            }
+            var receiver = new BoogieWrapper(initEtran.TrExpr(Substitute(s0.Receiver, null, substMap, s0.MethodSelect.TypeArgumentSubstitutions())), s0.Receiver.Type);
+            var p = Substitute(e, receiver, argsSubstMap, s0.MethodSelect.TypeArgumentSubstitutions());  // substitute the call's actuals for the method's formals
+            qq = callEtran.TrExpr(p, initEtran);
+            exporter.Add(new Bpl.AssumeCmd(tok, qq));
+          }
+        } else {
+          var bvars = new List<Variable>();
+          Dictionary<IVariable, Expression> substMap;
+          var ante = initEtran.TrBoundVariablesRename(boundVars, bvars, out substMap);
+          var argsSubstMap = new Dictionary<IVariable, Expression>();  // maps formal arguments to actuals
+          Contract.Assert(s0.Method.Ins.Count == s0.Args.Count);
+          for (int i = 0; i < s0.Method.Ins.Count; i++) {
+            var arg = Substitute(s0.Args[i], null, substMap, s0.MethodSelect.TypeArgumentSubstitutions());  // substitute the renamed bound variables for the declared ones
+            argsSubstMap.Add(s0.Method.Ins[i], new BoogieWrapper(initEtran.TrExpr(arg), s0.Args[i].Type));
+          }
+          var callEtran = new ExpressionTranslator(this, predef, etran.HeapExpr, initHeap);
+          ante = BplAnd(ante, initEtran.TrExpr(Substitute(range, null, substMap)));
+          if (additionalRange != null) {
+            ante = BplAnd(ante, additionalRange(substMap, initEtran));
+          } 
+          var receiver = new BoogieWrapper(initEtran.TrExpr(Substitute(s0.Receiver, null, substMap, s0.MethodSelect.TypeArgumentSubstitutions())), s0.Receiver.Type);
+          Bpl.Expr post = Bpl.Expr.True;
+          foreach (var ens in s0.Method.Ens) {
+            var p = Substitute(ens.E, receiver, argsSubstMap, s0.MethodSelect.TypeArgumentSubstitutions());  // substitute the call's actuals for the method's formals
+            post = BplAnd(post, callEtran.TrExpr(p));
+          }
+
+          // TRIG (forall $ih#s0#0: Seq Box :: $Is($ih#s0#0, TSeq(TChar)) && $IsAlloc($ih#s0#0, TSeq(TChar), $initHeapForallStmt#0) && Seq#Length($ih#s0#0) != 0 && Seq#Rank($ih#s0#0) < Seq#Rank(s#0) ==> (forall i#2: int :: true ==> LitInt(0) <= i#2 && i#2 < Seq#Length($ih#s0#0) ==> char#ToInt(_module.CharChar.MinChar($LS($LZ), $Heap, this, $ih#s0#0)) <= char#ToInt($Unbox(Seq#Index($ih#s0#0, i#2)): char)))
+          // TRIG (forall $ih#pat0#0: Seq Box, $ih#a0#0: Seq Box :: $Is($ih#pat0#0, TSeq(_module._default.Same0$T)) && $IsAlloc($ih#pat0#0, TSeq(_module._default.Same0$T), $initHeapForallStmt#0) && $Is($ih#a0#0, TSeq(_module._default.Same0$T)) && $IsAlloc($ih#a0#0, TSeq(_module._default.Same0$T), $initHeapForallStmt#0) && Seq#Length($ih#pat0#0) <= Seq#Length($ih#a0#0) && Seq#SameUntil($ih#pat0#0, $ih#a0#0, Seq#Length($ih#pat0#0)) && (Seq#Rank($ih#pat0#0) < Seq#Rank(pat#0) || (Seq#Rank($ih#pat0#0) == Seq#Rank(pat#0) && Seq#Rank($ih#a0#0) < Seq#Rank(a#0))) ==> _module.__default.IsRelaxedPrefixAux(_module._default.Same0$T, $LS($LZ), $Heap, $ih#pat0#0, $ih#a0#0, LitInt(1)))'
+          // TRIG (forall $ih#m0#0: DatatypeType, $ih#n0#0: DatatypeType :: $Is($ih#m0#0, Tclass._module.Nat()) && $IsAlloc($ih#m0#0, Tclass._module.Nat(), $initHeapForallStmt#0) && $Is($ih#n0#0, Tclass._module.Nat()) && $IsAlloc($ih#n0#0, Tclass._module.Nat(), $initHeapForallStmt#0) && Lit(true) && (DtRank($ih#m0#0) < DtRank(m#0) || (DtRank($ih#m0#0) == DtRank(m#0) && DtRank($ih#n0#0) < DtRank(n#0))) ==> _module.__default.mult($LS($LZ), $Heap, $ih#m0#0, _module.__default.plus($LS($LZ), $Heap, $ih#n0#0, $ih#n0#0)) == _module.__default.mult($LS($LZ), $Heap, _module.__default.plus($LS($LZ), $Heap, $ih#m0#0, $ih#m0#0), $ih#n0#0))
+          qq = new Bpl.ForallExpr(tok, bvars, Bpl.Expr.Imp(ante, post));  // SMART_TRIGGER
+          exporter.Add(new Bpl.AssumeCmd(tok, qq));
+        }       
       }
     }
 
@@ -8501,24 +8338,14 @@ namespace Microsoft.Dafny {
         }
       }
 
-      var bvars = new List<Variable>();
-      Dictionary<IVariable, Expression> substMap;
-      var ante = initEtran.TrBoundVariablesRename(s.BoundVars, bvars, out substMap);
-      var range = Substitute(s.Range, null, substMap);
-      ante = BplAnd(ante, initEtran.TrExpr(range));
-
-      Bpl.Expr post = Bpl.Expr.True;
-      foreach (var ens in s.Ens) {
-        var p = Substitute(ens.E, null, substMap);
-        post = BplAnd(post, etran.TrExpr(p));
-      }
-
-      Bpl.Expr qq = Bpl.Expr.Imp(ante, post);
-      if (bvars.Count != 0) {
-        var triggers = TrTrigger(etran, s.Attributes, s.Tok, substMap);
-        qq = new Bpl.ForallExpr(s.Tok, bvars, triggers, qq);
+      Dictionary<IVariable, Expression> substMap = new Dictionary<IVariable, Expression>();
+      var p = Substitute(s.ForallExpressions[0], null, substMap);
+      Bpl.Expr qq = etran.TrExpr(p, initEtran);
+      if (s.BoundVars.Count != 0) {
+        exporter.Add(new Bpl.AssumeCmd(s.Tok, qq));
+      } else {
+        exporter.Add(new Bpl.AssumeCmd(s.Tok, ((Bpl.ForallExpr)qq).Body));
       }
-      exporter.Add(new Bpl.AssumeCmd(s.Tok, qq));
     }
 
     private string GetObjFieldDetails(Expression lhs, ExpressionTranslator etran, out Bpl.Expr obj, out Bpl.Expr F) {
@@ -10868,7 +10695,10 @@ namespace Microsoft.Dafny {
       /// filled in, but it is really necessary for anything that may show up in a Boogie assert, since that location may
       /// then show up in an error message).
       /// </summary>
-      public Bpl.Expr TrExpr(Expression expr)
+      public Bpl.Expr TrExpr(Expression expr) {
+        return TrExpr(expr, null);
+      }
+      public Bpl.Expr TrExpr(Expression expr, ExpressionTranslator etran)
       {
         Contract.Requires(expr != null);
         Contract.Requires(predef != null);
@@ -11683,7 +11513,7 @@ namespace Microsoft.Dafny {
             List<Variable> tyvars = translator.MkTyParamBinders(e.TypeArgs);
             List<Variable> bvars = new List<Variable>();
 
-            var initEtran = this;
+            var initEtran = (etran == null) ? this : etran;
             var bodyEtran = this;
             bool _scratch = true;
 
@@ -11704,7 +11534,7 @@ namespace Microsoft.Dafny {
             });
             }
 
-            antecedent = BplAnd(antecedent, bodyEtran.TrBoundVariables(e.BoundVars, bvars));
+            antecedent = BplAnd(antecedent, initEtran.TrBoundVariables(e.BoundVars, bvars));
 
             Bpl.QKeyValue kv = TrAttributes(e.Attributes, "trigger");
             Bpl.Trigger tr = null;
@@ -11719,7 +11549,7 @@ namespace Microsoft.Dafny {
               }
             }
             if (e.Range != null) {
-              antecedent = BplAnd(antecedent, bodyEtran.TrExpr(e.Range));
+              antecedent = BplAnd(antecedent, initEtran.TrExpr(e.Range));
             }
             Bpl.Expr body = bodyEtran.TrExpr(e.Term);
 
diff --git a/Source/Dafny/Triggers/QuantifierSplitter.cs b/Source/Dafny/Triggers/QuantifierSplitter.cs
index 865aa33e..e46b64fb 100644
--- a/Source/Dafny/Triggers/QuantifierSplitter.cs
+++ b/Source/Dafny/Triggers/QuantifierSplitter.cs
@@ -114,6 +114,18 @@ namespace Microsoft.Dafny.Triggers {
       }
     }
 
+    protected override void VisitOneStmt(Statement stmt) {
+      Contract.Requires(stmt != null);
+      if (stmt is ForallStmt) {
+        ForallStmt s = (ForallStmt)stmt;
+        if (s.ForallExpressions != null) {
+          foreach (Expression expr in s.ForallExpressions) {
+            VisitOneExpr(expr);
+          }
+        }
+      }
+    }
+
     /// <summary>
     /// See comments above definition of splits for reason why this method exists
     /// </summary>
diff --git a/Source/Dafny/Triggers/QuantifiersCollector.cs b/Source/Dafny/Triggers/QuantifiersCollector.cs
index 1f37dcfa..789e7614 100644
--- a/Source/Dafny/Triggers/QuantifiersCollector.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollector.cs
@@ -40,5 +40,18 @@ namespace Microsoft.Dafny.Triggers {
 
       return true;
     }
+
+    protected override bool VisitOneStmt(Statement stmt, ref bool st) {
+      Contract.Requires(stmt != null);
+      if (stmt is ForallStmt) {
+        ForallStmt s = (ForallStmt)stmt;
+        if (s.ForallExpressions != null) {
+          foreach (Expression expr in s.ForallExpressions) {
+            VisitOneExpr(expr, ref st);
+          }
+        }
+      }
+      return true;
+    }
   }
 }
diff --git a/Test/dafny0/SmallTests.dfy.expect b/Test/dafny0/SmallTests.dfy.expect
index 4bd12096..6161c3dd 100644
--- a/Test/dafny0/SmallTests.dfy.expect
+++ b/Test/dafny0/SmallTests.dfy.expect
@@ -1,3 +1,4 @@
+SmallTests.dfy(507,4): Warning: /!\ No trigger covering all quantified variables found.
 SmallTests.dfy(34,10): Error: index out of range
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny4/Bug103.dfy b/Test/dafny4/Bug103.dfy
new file mode 100644
index 00000000..559a361c
--- /dev/null
+++ b/Test/dafny4/Bug103.dfy
@@ -0,0 +1,20 @@
+// RUN: %dafny /compile:0 /autoTriggers:1 /print:"%t.print" "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+predicate IsLessThanSuccesor(i:int) 
+{
+  i < i + 1
+} 
+
+lemma LemmaWithoutTriggerOnForallStatement() 
+{
+  forall i
+    ensures IsLessThanSuccesor(i);
+  {
+  }
+}
+
+
+
+
+
diff --git a/Test/dafny4/Bug103.dfy.expect b/Test/dafny4/Bug103.dfy.expect
new file mode 100644
index 00000000..52595bf9
--- /dev/null
+++ b/Test/dafny4/Bug103.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 3 verified, 0 errors
-- 
cgit v1.2.3


From 22e353122e53fbf396f24977eee99cb5991f5455 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Fri, 27 Nov 2015 17:37:48 -0800
Subject: autocontracts: Don't add modifies clause to ghost methods

---
 Source/Dafny/Rewriter.cs | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 39c8f667..d9db03c7 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -81,10 +81,10 @@ namespace Microsoft.Dafny
   /// AutoContracts will then:
   ///
   /// Declare:
-  ///    ghost var Repr: set(object);
+  ///    ghost var Repr: set(object)
   ///
   /// For function/predicate Valid(), insert:
-  ///    reads this, Repr;
+  ///    reads this, Repr
   /// Into body of Valid(), insert (at the beginning of the body):
   ///    this in Repr && null !in Repr
   /// and also insert, for every array-valued field A declared in the class:
@@ -96,19 +96,23 @@ namespace Microsoft.Dafny
   ///
   /// For every constructor, add:
   ///    modifies this;
-  ///    ensures Valid() && fresh(Repr - {this});
+  ///    ensures Valid() && fresh(Repr - {this})
   /// At the end of the body of the constructor, add:
   ///    Repr := {this};
   ///    if (A != null) { Repr := Repr + {A}; }
   ///    if (F != null) { Repr := Repr + {F} + F.Repr; }
   ///
-  /// For every method, add:
-  ///    requires Valid();
-  ///    modifies Repr;
-  ///    ensures Valid() && fresh(Repr - old(Repr));
+  /// For every non-static non-ghost method that is not a "simple query method",
+  /// add:
+  ///    requires Valid()
+  ///    modifies Repr
+  ///    ensures Valid() && fresh(Repr - old(Repr))
   /// At the end of the body of the method, add:
   ///    if (A != null) { Repr := Repr + {A}; }
   ///    if (F != null) { Repr := Repr + {F} + F.Repr; }
+  /// For every non-static method that is either ghost or is a "simple query method",
+  /// add:
+  ///    requires Valid()
   /// </summary>
   public class AutoContractsRewriter : IRewriter
   {
@@ -293,7 +297,7 @@ namespace Microsoft.Dafny
             AddSubobjectReprs(tok, subobjects, bodyStatements, self, implicitSelf, cNull, Repr);
           }
 
-        } else if (member is Method && !member.IsStatic) {
+        } else if (member is Method && !member.IsStatic && !member.IsGhost) {
           var m = (Method)member;
           if (Valid != null && !IsSimpleQueryMethod(m)) {
             if (member.RefinementBase == null) {
-- 
cgit v1.2.3


From 351bce8912c2ae2159abb0ebe2b1e1ad1a4b4290 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Fri, 27 Nov 2015 17:57:47 -0800
Subject: Make cached results dependent on if a function is ghost or not

---
 Source/Dafny/Translator.cs | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 8e8c3c19..e3915e6d 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -3510,10 +3510,13 @@ namespace Microsoft.Dafny {
 
     private void InsertChecksum(Function f, Bpl.Declaration decl, bool specificationOnly = false)
     {
+      Contract.Requires(f != null);
+      Contract.Requires(decl != null);
       byte[] data;
       using (var writer = new System.IO.StringWriter())
       {
         var printer = new Printer(writer);
+        writer.Write(f.IsGhost ? "function" : "function method");
         printer.PrintAttributes(f.Attributes);
         printer.PrintFormals(f.Formals);
         writer.Write(": ");
@@ -3534,6 +3537,8 @@ namespace Microsoft.Dafny {
 
     private void InsertChecksum(Bpl.Declaration decl, byte[] data)
     {
+      Contract.Requires(decl != null);
+      Contract.Requires(data != null);
       var md5 = System.Security.Cryptography.MD5.Create();
       var hashedData = md5.ComputeHash(data);
       var checksum = BitConverter.ToString(hashedData);
-- 
cgit v1.2.3


From 8131e68401d9f97d1216be32f3d0e23db83da744 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Sat, 28 Nov 2015 22:22:52 -0800
Subject: Made an adjustment in the printing of resolved forall expressions
 (previous code introduced with bug fix 103 and tripped over with the /rprint
 and /autoTriggers:1 flags used in the new dafny4/UnionFind.dfy test).

---
 Source/Dafny/Printer.cs | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index 0a25b941..6010e2f0 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -846,10 +846,7 @@ namespace Microsoft.Dafny {
         if (attributes == null && s.ForallExpressions != null) {
           foreach (Expression expr in s.ForallExpressions) {
             ForallExpr e = (ForallExpr)expr;
-            while (e != null && attributes == null) {
-              attributes = e.Attributes;
-              e = (ForallExpr)e.SplitQuantifierExpression;
-            }
+            attributes = GetSomeAttributes(e);
             if (attributes != null) { break; }
           }
         }
@@ -1010,6 +1007,20 @@ namespace Microsoft.Dafny {
       } else {
         Contract.Assert(false); throw new cce.UnreachableException();  // unexpected statement
       }
+    }
+
+    private static Attributes GetSomeAttributes(Expression expr) {
+      if (expr is ForallExpr) {
+        var e = (ForallExpr)expr;
+        if (e.Attributes != null) {
+          return e.Attributes;
+        }
+        return GetSomeAttributes(e.SplitQuantifierExpression);
+      } else if (expr is BinaryExpr) {
+        var e = (BinaryExpr)expr;
+        return GetSomeAttributes(e.E0) ?? GetSomeAttributes(e.E1);
+      }
+      return null;
     }
 
     private void PrintModifyStmt(int indent, ModifyStmt s, bool omitFrame) {
-- 
cgit v1.2.3


From f011e32f5a4a62b241c0c1301ab8010878b1bc7b Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Mon, 30 Nov 2015 13:03:21 -0800
Subject: Fix issue 111. Create a new BoundVar for each CasePattern of
 MatchCaseExpr when trying to substitute the nested CasePattern with the
 BoundVar.

---
 Source/Dafny/Resolver.cs      | 33 ++++++++++++++++-----------------
 Source/Dafny/Rewriter.cs      | 22 +++++++++++++---------
 Test/dafny4/Bug111.dfy        | 18 ++++++++++++++++++
 Test/dafny4/Bug111.dfy.expect |  2 ++
 4 files changed, 49 insertions(+), 26 deletions(-)
 create mode 100644 Test/dafny4/Bug111.dfy
 create mode 100644 Test/dafny4/Bug111.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index eff7d97d..52845c3f 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -5950,13 +5950,9 @@ namespace Microsoft.Dafny
       }
 
       // convert CasePattern in MatchCaseExpr to BoundVar and flatten the MatchCaseExpr.
-      Type type = new InferredTypeProxy();
-      string name = FreshTempVarName("_mc#", codeContext);
-      MatchCaseToken mcToken = new MatchCaseToken(s.Tok);
-      BoundVar bv = new BoundVar(mcToken, name, type);
-      List<CasePattern> patternSubst = new List<CasePattern>();
+      List<Tuple<CasePattern, BoundVar>> patternSubst = new List<Tuple<CasePattern, BoundVar>>(); 
       if (dtd != null) {
-        DesugarMatchCaseStmt(s, dtd, bv, patternSubst, codeContext);
+        DesugarMatchCaseStmt(s, dtd, patternSubst, codeContext);
       }
 
       ISet<string> memberNamesUsed = new HashSet<string>();
@@ -6008,7 +6004,7 @@ namespace Microsoft.Dafny
         // substitute body to replace the case pat with v. This needs to happen
         // after the body is resolved so we can scope the bv correctly.
         if (patternSubst.Count > 0) {
-          MatchCaseExprSubstituteCloner cloner = new MatchCaseExprSubstituteCloner(patternSubst, bv);
+          MatchCaseExprSubstituteCloner cloner = new MatchCaseExprSubstituteCloner(patternSubst);
           List<Statement> list = new List<Statement>();
           foreach (Statement ss in mc.Body) {
             Statement clone = cloner.CloneStmt(ss);
@@ -6125,7 +6121,7 @@ namespace Microsoft.Dafny
      *       case Nil => y
      *       case Cons(z, zs) => last(ys)
      */
-    void DesugarMatchCaseStmt(MatchStmt s, DatatypeDecl dtd, BoundVar sourceVar, List<CasePattern> patterns, ICodeContext codeContext) {
+    void DesugarMatchCaseStmt(MatchStmt s, DatatypeDecl dtd, List<Tuple<CasePattern, BoundVar>> patterns, ICodeContext codeContext) {
       Contract.Assert(dtd != null);
       Dictionary<string, DatatypeCtor> ctors = datatypeCtors[dtd];
       if (ctors == null) {
@@ -6133,6 +6129,8 @@ namespace Microsoft.Dafny
         return;
       }
 
+      Type type = new InferredTypeProxy();
+      string name = FreshTempVarName("_mc#", codeContext);
       foreach (MatchCaseStmt mc in s.Cases) {
         if (mc.Arguments != null) {
           // already desugared. This happens during the second pass resolver after cloning.
@@ -6140,6 +6138,7 @@ namespace Microsoft.Dafny
           return;
         }
 
+        BoundVar sourceVar = new BoundVar(new MatchCaseToken(s.Tok), name, type);
         Contract.Assert(mc.Arguments == null);
         Contract.Assert(mc.CasePatterns != null);
         Contract.Assert(ctors != null);
@@ -6157,7 +6156,7 @@ namespace Microsoft.Dafny
               arguments.Add(v);
             } else {
               DesugarMatchCasePattern(mc, pat, sourceVar);
-              patterns.Add(pat);
+              patterns.Add(new Tuple<CasePattern, BoundVar>(pat, sourceVar));
               arguments.Add(sourceVar);
             }
           }
@@ -8249,12 +8248,9 @@ namespace Microsoft.Dafny
       }
 
       // convert CasePattern in MatchCaseExpr to BoundVar and flatten the MatchCaseExpr.
-      Type type = new InferredTypeProxy();
-      string name = FreshTempVarName("_mc#", opts.codeContext);
-      BoundVar bv = new BoundVar(new MatchCaseToken(me.tok), name, type);
-      List<CasePattern> patternSubst = new List<CasePattern>();
+      List<Tuple<CasePattern, BoundVar>> patternSubst = new List<Tuple<CasePattern, BoundVar>>(); 
       if (dtd != null) {
-        DesugarMatchCaseExpr(me, dtd, bv, patternSubst, opts.codeContext);
+        DesugarMatchCaseExpr(me, dtd, patternSubst, opts.codeContext);
       }
 
       ISet<string> memberNamesUsed = new HashSet<string>();
@@ -8306,7 +8302,7 @@ namespace Microsoft.Dafny
         // substitute body to replace the case pat with v. This needs to happen
         // after the body is resolved so we can scope the bv correctly.
         if (patternSubst.Count > 0) {
-          MatchCaseExprSubstituteCloner cloner = new MatchCaseExprSubstituteCloner(patternSubst, bv);
+          MatchCaseExprSubstituteCloner cloner = new MatchCaseExprSubstituteCloner(patternSubst);
           mc.UpdateBody(cloner.CloneExpr(mc.Body));
           // resolve it again since we just cloned it.
           ResolveExpression(mc.Body, opts);
@@ -8408,7 +8404,7 @@ namespace Microsoft.Dafny
      *       case Nil => y
      *       case Cons(z, zs) => last(ys)
      * */
-    void DesugarMatchCaseExpr(MatchExpr me, DatatypeDecl dtd, BoundVar sourceVar, List<CasePattern> patterns, ICodeContext codeContext) {
+    void DesugarMatchCaseExpr(MatchExpr me, DatatypeDecl dtd, List<Tuple<CasePattern, BoundVar>> patterns, ICodeContext codeContext) {
       Contract.Assert(dtd != null);
       Dictionary<string, DatatypeCtor> ctors = datatypeCtors[dtd];
       if (ctors == null) {
@@ -8416,6 +8412,8 @@ namespace Microsoft.Dafny
         return;
       }
 
+      Type type = new InferredTypeProxy();
+      string name = FreshTempVarName("_mc#", codeContext);
       foreach (MatchCaseExpr mc in me.Cases) {
         if (mc.Arguments != null) {
           // already desugared. This happens during the second pass resolver after cloning.
@@ -8423,6 +8421,7 @@ namespace Microsoft.Dafny
           return;
         }
 
+        BoundVar sourceVar = new BoundVar(new MatchCaseToken(me.tok), name, type);
         Contract.Assert(mc.Arguments == null);
         Contract.Assert(mc.CasePatterns != null);
         Contract.Assert(ctors != null);
@@ -8439,7 +8438,7 @@ namespace Microsoft.Dafny
               arguments.Add(v);
             } else {
               DesugarMatchCasePattern(mc, pat, sourceVar);
-              patterns.Add(pat);
+              patterns.Add(new Tuple<CasePattern, BoundVar>(pat, sourceVar));
               arguments.Add(sourceVar);
             }
           }
diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 9a898cbe..13b16066 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -1429,16 +1429,16 @@ namespace Microsoft.Dafny
 
   class MatchCaseExprSubstituteCloner : Cloner
   {
-    private List<CasePattern> patternSubst;
+    private List<Tuple<CasePattern, BoundVar>> patternSubst;
     private BoundVar oldvar;
     private BoundVar var;
 
     // the cloner is called after resolving the body of matchexpr, trying
     // to replace casepattern in the body that has been replaced by bv
-    public MatchCaseExprSubstituteCloner(List<CasePattern> subst, BoundVar var) {
+    public MatchCaseExprSubstituteCloner(List<Tuple<CasePattern, BoundVar>> subst) {
       this.patternSubst = subst;
       this.oldvar = null;
-      this.var = var;
+      this.var = null;
     }
 
     public MatchCaseExprSubstituteCloner(BoundVar oldvar, BoundVar var) {
@@ -1471,21 +1471,23 @@ namespace Microsoft.Dafny
     public override Expression CloneApplySuffix(ApplySuffix e) {
       // if the ApplySuffix matches the CasePattern, then replace it with the BoundVar.
       CasePattern cp = null;
-      if (FindMatchingPattern(e, out cp)) {
-        if (this.var.tok is MatchCaseToken) {
+      BoundVar bv = null;
+      if (FindMatchingPattern(e, out cp, out bv)) {
+        if (bv.tok is MatchCaseToken) {
           Contract.Assert(e.Args.Count == cp.Arguments.Count);
           for (int i = 0; i < e.Args.Count; i++) {
-            ((MatchCaseToken)this.var.tok).AddVar(e.Args[i].tok, cp.Arguments[i].Var, false);
+            ((MatchCaseToken)bv.tok).AddVar(e.Args[i].tok, cp.Arguments[i].Var, false);
           }
         }
-        return new NameSegment(new AutoGeneratedToken(e.tok), this.var.Name, null);
+        return new NameSegment(new AutoGeneratedToken(e.tok), bv.Name, null);
       } else {
         return new ApplySuffix(Tok(e.tok), CloneExpr(e.Lhs), e.Args.ConvertAll(CloneExpr));
       }
     }
 
-    private bool FindMatchingPattern(ApplySuffix e, out CasePattern pattern) {
+    private bool FindMatchingPattern(ApplySuffix e, out CasePattern pattern, out BoundVar bv) {
       pattern = null;
+      bv = null;
       if (patternSubst == null) {
         return false;
       }
@@ -1494,7 +1496,8 @@ namespace Microsoft.Dafny
         return false;
       }
       string applyName = ((NameSegment)lhs).Name;
-      foreach (CasePattern cp in patternSubst) {
+      foreach (Tuple<CasePattern, BoundVar> pair in patternSubst) {
+        CasePattern cp = pair.Item1;
         string ctorName = cp.Id;
         if (!(applyName.Equals(ctorName)) || (e.Args.Count != cp.Arguments.Count)) {
           continue;
@@ -1514,6 +1517,7 @@ namespace Microsoft.Dafny
         }
         if (found) {
           pattern = cp;
+          bv = pair.Item2;
           return true;
         }
       }
diff --git a/Test/dafny4/Bug111.dfy b/Test/dafny4/Bug111.dfy
new file mode 100644
index 00000000..730d44d3
--- /dev/null
+++ b/Test/dafny4/Bug111.dfy
@@ -0,0 +1,18 @@
+// RUN: %dafny /compile:0  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+datatype A = A(i:int)
+datatype B = B1(a1:A) | B2(a2:A)
+
+function f(b:B):int
+{
+  match b
+  {
+    case B1(A(i)) => i
+    case B2(A(j)) => j
+  }
+}
+
+
+
+
diff --git a/Test/dafny4/Bug111.dfy.expect b/Test/dafny4/Bug111.dfy.expect
new file mode 100644
index 00000000..c0c48e2b
--- /dev/null
+++ b/Test/dafny4/Bug111.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 1 verified, 0 errors
-- 
cgit v1.2.3


From f7ab307779e4d21d706be13acad670d63d0e6537 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Wed, 2 Dec 2015 12:35:54 -0800
Subject: Fix issue 110. Set useImport to true when trying to
 registerTopLevelDecls in MakeAbstractSignature.

---
 Source/Dafny/Resolver.cs      |  2 +-
 Test/dafny4/Bug110.dfy        | 31 +++++++++++++++++++++++++++++++
 Test/dafny4/Bug110.dfy.expect |  2 ++
 3 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 Test/dafny4/Bug110.dfy
 create mode 100644 Test/dafny4/Bug110.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 52845c3f..9dc0f829 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -1269,7 +1269,7 @@ namespace Microsoft.Dafny
       foreach (var kv in p.TopLevels) {
         mod.TopLevelDecls.Add(CloneDeclaration(kv.Value, mod, mods, Name));
       }
-      var sig = RegisterTopLevelDecls(mod, false);
+      var sig = RegisterTopLevelDecls(mod, true);
       sig.Refines = p.Refines;
       sig.CompileSignature = p;
       sig.IsAbstract = p.IsAbstract;
diff --git a/Test/dafny4/Bug110.dfy b/Test/dafny4/Bug110.dfy
new file mode 100644
index 00000000..239f18d3
--- /dev/null
+++ b/Test/dafny4/Bug110.dfy
@@ -0,0 +1,31 @@
+// RUN: %dafny /compile:0  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+module Io {
+  predicate AdvanceTime(oldTime:int) { oldTime > 2 }
+  class Time
+  {
+    static method GetTime()
+        ensures AdvanceTime(1);        
+  }
+
+  function MaxPacketSize() : int { 65507 }
+
+  class UdpClient
+  {
+    method Receive()        
+        ensures AdvanceTime(3);       
+
+    method Send() returns(ok:bool)
+        requires 0 <= MaxPacketSize();       
+  }
+}
+
+abstract module Host {
+    import opened Io // Doesn't work.   
+    //import Io          // Works
+}
+
+abstract module Main {
+    import H as Host
+}
diff --git a/Test/dafny4/Bug110.dfy.expect b/Test/dafny4/Bug110.dfy.expect
new file mode 100644
index 00000000..42fd56a5
--- /dev/null
+++ b/Test/dafny4/Bug110.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 8 verified, 0 errors
-- 
cgit v1.2.3


From e2bab8d4be0805bf22f7295be2014a39d1e18535 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Thu, 3 Dec 2015 11:14:28 -0800
Subject: Fix issue 113. Make sure the tempVar name used in ToString() method
 doesn't collide with the names of its formals.

---
 Source/Dafny/Compiler.cs      | 32 ++++++++++++++++++++++++++------
 Test/dafny4/Bug113.dfy        | 10 ++++++++++
 Test/dafny4/Bug113.dfy.expect |  6 ++++++
 3 files changed, 42 insertions(+), 6 deletions(-)
 create mode 100644 Test/dafny4/Bug113.dfy
 create mode 100644 Test/dafny4/Bug113.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 69b7a32d..264ecf9b 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -473,22 +473,23 @@ namespace Microsoft.Dafny {
           } else {
             nm = (dt.Module.IsDefaultModule ? "" : dt.Module.CompileName + ".") + dt.CompileName + "." + ctor.CompileName;
           }
-          Indent(ind + IndentAmount, wr); wr.WriteLine("string s = \"{0}\";", nm);
+          var tempVar = GenVarName("s", ctor.Formals);
+          Indent(ind + IndentAmount, wr); wr.WriteLine("string {0} = \"{1}\";", tempVar, nm);
           if (ctor.Formals.Count != 0) {
-            Indent(ind + IndentAmount, wr); wr.WriteLine("s += \"(\";");
+            Indent(ind + IndentAmount, wr); wr.WriteLine("{0} += \"(\";", tempVar);
             i = 0;
             foreach (var arg in ctor.Formals) {
               if (!arg.IsGhost) {
                 if (i != 0) {
-                  Indent(ind + IndentAmount, wr); wr.WriteLine("s += \", \";");
+                  Indent(ind + IndentAmount, wr); wr.WriteLine("{0} += \", \";", tempVar);
                 }
-                Indent(ind + IndentAmount, wr); wr.WriteLine("s += @{0}.ToString();", FormalName(arg, i));
+                Indent(ind + IndentAmount, wr); wr.WriteLine("{0} += @{1}.ToString();", tempVar,FormalName(arg, i));
                 i++;
               }
             }
-            Indent(ind + IndentAmount, wr); wr.WriteLine("s += \")\";");
+            Indent(ind + IndentAmount, wr); wr.WriteLine("{0} += \")\";", tempVar);
           }
-          Indent(ind + IndentAmount, wr); wr.WriteLine("return s;");
+          Indent(ind + IndentAmount, wr); wr.WriteLine("return {0};", tempVar);
           Indent(ind, wr); wr.WriteLine("}");
         }
 
@@ -497,6 +498,25 @@ namespace Microsoft.Dafny {
       constructorIndex++;
     }
 
+    // create a varName that is not a duplicate of formals' name
+    string GenVarName(string root, List<Formal> formals) {
+      bool finished = false;
+      while (!finished) {
+        finished = true;
+        int i = 0;
+        foreach (var arg in formals) {
+          if (!arg.IsGhost) {
+            if (root.Equals(FormalName(arg, i))) {
+              root += root;
+              finished = false;
+            }
+            i++;
+          }
+        }
+      }
+      return root;
+    }
+
     void CompileDatatypeStruct(DatatypeDecl dt, int indent, TextWriter wr) {
       Contract.Requires(dt != null);
 
diff --git a/Test/dafny4/Bug113.dfy b/Test/dafny4/Bug113.dfy
new file mode 100644
index 00000000..8f5ddf9f
--- /dev/null
+++ b/Test/dafny4/Bug113.dfy
@@ -0,0 +1,10 @@
+// RUN: %dafny /compile:3  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+datatype D = D(q:int, r:int, s:int, t:int)
+
+method Main()
+{
+    print D(10, 20, 30, 40);
+    print "\n";
+}
\ No newline at end of file
diff --git a/Test/dafny4/Bug113.dfy.expect b/Test/dafny4/Bug113.dfy.expect
new file mode 100644
index 00000000..c4be010e
--- /dev/null
+++ b/Test/dafny4/Bug113.dfy.expect
@@ -0,0 +1,6 @@
+
+Dafny program verifier finished with 2 verified, 0 errors
+Program compiled successfully
+Running...
+
+D.D(10, 20, 30, 40)
-- 
cgit v1.2.3


From 8248d9f5548c2635f3eded76b63ef551b24a9b80 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Fri, 4 Dec 2015 08:52:13 -0800
Subject: Fix printing for ForallStmt. Previously we traverse the resolved
 forall expressions to get the attributes for the forallstmt, which is flawed
 since the forallexpr could have been splitted into different subquantifiers
 each with different triggers.  PrintExpression already knows how to print out
 splitted forall expressions, so we use it to print the resolved forall
 expressions instead.

---
 Source/Dafny/Printer.cs | 174 +++++++++++++++++++++++-------------------------
 1 file changed, 82 insertions(+), 92 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index 6010e2f0..accdb9d3 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -842,25 +842,23 @@ namespace Microsoft.Dafny {
 
       } else if (stmt is ForallStmt) {
         var s = (ForallStmt)stmt;
-        Attributes attributes = s.Attributes;
-        if (attributes == null && s.ForallExpressions != null) {
-          foreach (Expression expr in s.ForallExpressions) {
-            ForallExpr e = (ForallExpr)expr;
-            attributes = GetSomeAttributes(e);
-            if (attributes != null) { break; }
+        if (s.ForallExpressions != null) {
+          foreach (var expr in s.ForallExpressions) {
+            PrintExpression(expr, false, " ensures ");
+          }
+        } else {
+          wr.Write("forall");
+          if (s.BoundVars.Count != 0) {
+            wr.Write(" ");
+            PrintQuantifierDomain(s.BoundVars, s.Attributes, s.Range);
+          }
+          if (s.Ens.Count == 0) {
+            wr.Write(" ");
+          } else {
+            wr.WriteLine();
+            PrintSpec("ensures", s.Ens, indent + IndentAmount, s.Body != null);
+            Indent(indent);
           }
-        }
-        wr.Write("forall");
-        if (s.BoundVars.Count != 0) {
-          wr.Write(" ");
-          PrintQuantifierDomain(s.BoundVars, attributes, s.Range);
-        }
-        if (s.Ens.Count == 0) {
-          wr.Write(" ");
-        } else {
-          wr.WriteLine();
-          PrintSpec("ensures", s.Ens, indent + IndentAmount, s.Body != null);
-          Indent(indent);
         }
         if (s.Body != null) {
           PrintStatement(s.Body, indent);
@@ -1007,20 +1005,6 @@ namespace Microsoft.Dafny {
       } else {
         Contract.Assert(false); throw new cce.UnreachableException();  // unexpected statement
       }
-    }
-
-    private static Attributes GetSomeAttributes(Expression expr) {
-      if (expr is ForallExpr) {
-        var e = (ForallExpr)expr;
-        if (e.Attributes != null) {
-          return e.Attributes;
-        }
-        return GetSomeAttributes(e.SplitQuantifierExpression);
-      } else if (expr is BinaryExpr) {
-        var e = (BinaryExpr)expr;
-        return GetSomeAttributes(e.E0) ?? GetSomeAttributes(e.E1);
-      }
-      return null;
     }
 
     private void PrintModifyStmt(int indent, ModifyStmt s, bool omitFrame) {
@@ -1328,6 +1312,11 @@ namespace Microsoft.Dafny {
     public void PrintExpression(Expression expr, bool isFollowedBySemicolon, int indent) {
       Contract.Requires(expr != null);
       PrintExpr(expr, 0, false, true, isFollowedBySemicolon, indent);
+    }
+
+    public void PrintExpression(Expression expr, bool isFollowedBySemicolon, string keyword) {
+      Contract.Requires(expr != null);
+      PrintExpr(expr, 0, false, true, isFollowedBySemicolon, -1, keyword);
     }
 
     private bool ParensNeeded(int opBindingStrength, int contextBindingStrength, bool fragileContext) {
@@ -1338,7 +1327,7 @@ namespace Microsoft.Dafny {
     /// <summary>
     /// An indent of -1 means print the entire expression on one line.
     /// </summary>
-    void PrintExpr(Expression expr, int contextBindingStrength, bool fragileContext, bool isRightmost, bool isFollowedBySemicolon, int indent, int resolv_count = 2)
+    void PrintExpr(Expression expr, int contextBindingStrength, bool fragileContext, bool isRightmost, bool isFollowedBySemicolon, int indent, string keyword = null, int resolv_count = 2 )
     {
       Contract.Requires(-1 <= indent);
       Contract.Requires(expr != null);
@@ -1439,8 +1428,8 @@ namespace Microsoft.Dafny {
           ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
         if (parensNeeded) { wr.Write("("); }
-        if (!e.Lhs.IsImplicit) {
-          PrintExpr(e.Lhs, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
+        if (!e.Lhs.IsImplicit) {
+          PrintExpr(e.Lhs, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1, keyword);
           wr.Write(".");
         }
         wr.Write(e.SuffixName);
@@ -1459,8 +1448,8 @@ namespace Microsoft.Dafny {
           wr.Write("(");
           PrintExpression(e.Lhs, false);
           wr.Write(")");
-        } else {
-          PrintExpr(e.Lhs, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
+        } else {
+          PrintExpr(e.Lhs, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1, keyword);
         }
         wr.Write("(");
         PrintExpressionList(e.Args, false);
@@ -1475,8 +1464,8 @@ namespace Microsoft.Dafny {
           ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
         if (parensNeeded) { wr.Write("("); }
-        if (!(e.Obj.IsImplicit)) {
-          PrintExpr(e.Obj, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
+        if (!(e.Obj.IsImplicit)) {
+          PrintExpr(e.Obj, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1, keyword);
           wr.Write(".");
         }
         wr.Write(e.MemberName);
@@ -1488,8 +1477,8 @@ namespace Microsoft.Dafny {
         int opBindingStrength = 0x70;
         bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
-        if (parensNeeded) { wr.Write("("); }
-        PrintExpr(e.Seq, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent);
+        if (parensNeeded) { wr.Write("("); }
+        PrintExpr(e.Seq, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent, keyword);
         wr.Write("[");
         if (e.SelectOne) {
           Contract.Assert( e.E0 != null);
@@ -1512,8 +1501,8 @@ namespace Microsoft.Dafny {
         int opBindingStrength = 0x70;
         bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
-        if (parensNeeded) { wr.Write("("); }
-        PrintExpr(e.Array, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent);
+        if (parensNeeded) { wr.Write("("); }
+        PrintExpr(e.Array, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent, keyword);
         string prefix = "[";
         foreach (Expression idx in e.Indices) {
           Contract.Assert(idx != null);
@@ -1527,8 +1516,8 @@ namespace Microsoft.Dafny {
       } else if (expr is SeqUpdateExpr) {
         SeqUpdateExpr e = (SeqUpdateExpr)expr;
         if (e.ResolvedUpdateExpr != null)
-        {
-          PrintExpr(e.ResolvedUpdateExpr, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent);
+        {
+          PrintExpr(e.ResolvedUpdateExpr, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent, keyword);
         }
         else
         {
@@ -1536,8 +1525,8 @@ namespace Microsoft.Dafny {
           int opBindingStrength = 0x70;
           bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
-          if (parensNeeded) { wr.Write("("); }
-          PrintExpr(e.Seq, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent);
+          if (parensNeeded) { wr.Write("("); }
+          PrintExpr(e.Seq, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent, keyword);
           wr.Write("[");
           PrintExpression(e.Index, false);
           wr.Write(" := ");
@@ -1553,7 +1542,7 @@ namespace Microsoft.Dafny {
         bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
         if (parensNeeded) { wr.Write("("); }
-        PrintExpr(e.Root, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent);
+        PrintExpr(e.Root, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, indent, keyword);
         wr.Write(".(");
         var sep = "";
         foreach (var update in e.Updates) {
@@ -1570,9 +1559,9 @@ namespace Microsoft.Dafny {
         int opBindingStrength = 0x70;
         bool parensNeeded = ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
-        if (parensNeeded) { wr.Write("("); }
-
-        PrintExpr(e.Function, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
+        if (parensNeeded) { wr.Write("("); }
+
+        PrintExpr(e.Function, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1, keyword);
         wr.Write("(");
         PrintExpressionList(e.Args, false);
         wr.Write(")");
@@ -1587,8 +1576,8 @@ namespace Microsoft.Dafny {
           ParensNeeded(opBindingStrength, contextBindingStrength, fragileContext);
 
         if (parensNeeded) { wr.Write("("); }
-        if (!e.Receiver.IsImplicit) {
-          PrintExpr(e.Receiver, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1);
+        if (!e.Receiver.IsImplicit) {
+          PrintExpr(e.Receiver, opBindingStrength, false, false, !parensNeeded && isFollowedBySemicolon, -1, keyword);
           wr.Write(".");
         }
         wr.Write(e.Name);
@@ -1643,8 +1632,8 @@ namespace Microsoft.Dafny {
                                 ((UnaryOpExpr)((ParensExpression)e.E).E).Op == UnaryOpExpr.Opcode.Not;
 
           if (parensNeeded) { wr.Write("("); }
-          wr.Write(op);
-          PrintExpr(e.E, opBindingStrength, containsNestedNot, parensNeeded || isRightmost, !parensNeeded && isFollowedBySemicolon, -1);
+          wr.Write(op);
+          PrintExpr(e.E, opBindingStrength, containsNestedNot, parensNeeded || isRightmost, !parensNeeded && isFollowedBySemicolon, -1, keyword);
           if (parensNeeded) { wr.Write(")"); }
         }
 
@@ -1703,31 +1692,31 @@ namespace Microsoft.Dafny {
         string op = BinaryExpr.OpcodeString(e.Op);
         if (parensNeeded) { wr.Write("("); }
         var sem = !parensNeeded && isFollowedBySemicolon;
-        if (0 <= indent && e.Op == BinaryExpr.Opcode.And) {
-          PrintExpr(e.E0, opBindingStrength, fragileLeftContext, false, sem, indent);
+        if (0 <= indent && e.Op == BinaryExpr.Opcode.And) {
+          PrintExpr(e.E0, opBindingStrength, fragileLeftContext, false, sem, indent, keyword);
           wr.WriteLine(" {0}", op);
-          Indent(indent);
-          PrintExpr(e.E1, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, indent);
-        } else if (0 <= indent && e.Op == BinaryExpr.Opcode.Imp) {
-          PrintExpr(e.E0, opBindingStrength, fragileLeftContext, false, sem, indent);
+          Indent(indent);
+          PrintExpr(e.E1, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, indent, keyword);
+        } else if (0 <= indent && e.Op == BinaryExpr.Opcode.Imp) {
+          PrintExpr(e.E0, opBindingStrength, fragileLeftContext, false, sem, indent, keyword);
           wr.WriteLine(" {0}", op);
           int ind = indent + IndentAmount;
-          Indent(ind);
-          PrintExpr(e.E1, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, ind);
-        } else if (0 <= indent && e.Op == BinaryExpr.Opcode.Exp) {
-          PrintExpr(e.E1, opBindingStrength, fragileLeftContext, false, sem, indent);
+          Indent(ind);
+          PrintExpr(e.E1, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, ind, keyword);
+        } else if (0 <= indent && e.Op == BinaryExpr.Opcode.Exp) {
+          PrintExpr(e.E1, opBindingStrength, fragileLeftContext, false, sem, indent, keyword);
           wr.WriteLine(" {0}", op);
           int ind = indent + IndentAmount;
-          Indent(ind);
-          PrintExpr(e.E0, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, ind);
+          Indent(ind);
+          PrintExpr(e.E0, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, ind, keyword);
         } else if (e.Op == BinaryExpr.Opcode.Exp) {
-          PrintExpr(e.E1, opBindingStrength, fragileLeftContext, false, sem, -1);
-          wr.Write(" {0} ", op);
-          PrintExpr(e.E0, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, -1);
-        } else {
-          PrintExpr(e.E0, opBindingStrength, fragileLeftContext, false, sem, -1);
-          wr.Write(" {0} ", op);
-          PrintExpr(e.E1, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, -1);
+          PrintExpr(e.E1, opBindingStrength, fragileLeftContext, false, sem, -1, keyword);
+          wr.Write(" {0} ", op);
+          PrintExpr(e.E0, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, -1, keyword);
+        } else {
+          PrintExpr(e.E0, opBindingStrength, fragileLeftContext, false, sem, -1, keyword);
+          wr.Write(" {0} ", op);
+          PrintExpr(e.E1, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, -1, keyword);
         }
         if (parensNeeded) { wr.Write(")"); }
 
@@ -1746,12 +1735,12 @@ namespace Microsoft.Dafny {
               (opBS == ctxtBS && (opBindingStrength != contextBindingStrength || fragileContext));
 
             if (parensNeeded) { wr.Write("("); }
-            var sem = !parensNeeded && isFollowedBySemicolon;
-            PrintExpr(e.E1, opBindingStrength, fragileLeftContext, false, sem, -1);
+            var sem = !parensNeeded && isFollowedBySemicolon;
+            PrintExpr(e.E1, opBindingStrength, fragileLeftContext, false, sem, -1, keyword);
             wr.Write(" {0}#[", e.Op == TernaryExpr.Opcode.PrefixEqOp ? "==" : "!=");
             PrintExpression(e.E0, false);
-            wr.Write("] ");
-            PrintExpr(e.E2, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, -1);
+            wr.Write("] ");
+            PrintExpr(e.E2, opBindingStrength, fragileRightContext, parensNeeded || isRightmost, sem, -1, keyword);
             if (parensNeeded) { wr.Write(")"); }
             break;
           default:
@@ -1769,8 +1758,8 @@ namespace Microsoft.Dafny {
           (opBS == ctxtBS && (opBindingStrength != contextBindingStrength || fragileContext));
 
         if (parensNeeded) { wr.Write("("); }
-        var sem = !parensNeeded && isFollowedBySemicolon;
-        PrintExpr(e.Operands[0], opBindingStrength, true, false, sem, -1);
+        var sem = !parensNeeded && isFollowedBySemicolon;
+        PrintExpr(e.Operands[0], opBindingStrength, true, false, sem, -1, keyword);
         for (int i = 0; i < e.Operators.Count; i++) {
           string op = BinaryExpr.OpcodeString(e.Operators[i]);
           if (e.PrefixLimits[i] == null) {
@@ -1779,8 +1768,8 @@ namespace Microsoft.Dafny {
             wr.Write(" {0}#[", op);
             PrintExpression(e.PrefixLimits[i], false);
             wr.Write("] ");
-          }
-          PrintExpr(e.Operands[i+1], opBindingStrength, true, i == e.Operators.Count - 1 && (parensNeeded || isRightmost), sem, -1);
+          }
+          PrintExpr(e.Operands[i + 1], opBindingStrength, true, i == e.Operators.Count - 1 && (parensNeeded || isRightmost), sem, -1, keyword);
         }
         if (parensNeeded) { wr.Write(")"); }
 
@@ -1808,8 +1797,8 @@ namespace Microsoft.Dafny {
       } else if (expr is QuantifierExpr) {
         QuantifierExpr e = (QuantifierExpr)expr;
 
-        if (DafnyOptions.O.DafnyPrintResolvedFile != null && e.SplitQuantifier != null) {
-          PrintExpr(e.SplitQuantifierExpression, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent, resolv_count);
+        if (DafnyOptions.O.DafnyPrintResolvedFile != null && e.SplitQuantifier != null) {
+          PrintExpr(e.SplitQuantifierExpression, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent, keyword, resolv_count);
           return;
         }
 
@@ -1818,8 +1807,9 @@ namespace Microsoft.Dafny {
         wr.Write(e is ForallExpr ? "forall" : "exists");
         PrintTypeParams(e.TypeArgs); // new!
         wr.Write(" ");
-        PrintQuantifierDomain(e.BoundVars, e.Attributes, e.Range);
-        wr.Write(" :: ");
+        PrintQuantifierDomain(e.BoundVars, e.Attributes, e.Range);
+        string s = keyword ?? " :: ";
+        wr.Write("{0}", s);
         if (0 <= indent) {
           int ind = indent + IndentAmount;
           wr.WriteLine();
@@ -1925,8 +1915,8 @@ namespace Microsoft.Dafny {
 
       } else if (expr is ParensExpression) {
         var e = (ParensExpression)expr;
-        // printing of parentheses is done optimally, not according to the parentheses in the given program
-        PrintExpr(e.E, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent);
+        // printing of parentheses is done optimally, not according to the parentheses in the given program
+        PrintExpr(e.E, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent, keyword);
 
       } else if (expr is NegationExpression) {
         var e = (NegationExpression)expr;
@@ -1937,8 +1927,8 @@ namespace Microsoft.Dafny {
         bool containsNestedNegation = e.E is ParensExpression && ((ParensExpression)e.E).E is NegationExpression;
 
         if (parensNeeded) { wr.Write("("); }
-        wr.Write(op);
-        PrintExpr(e.E, opBindingStrength, containsNestedNegation, parensNeeded || isRightmost, !parensNeeded && isFollowedBySemicolon, -1);
+        wr.Write(op);
+        PrintExpr(e.E, opBindingStrength, containsNestedNegation, parensNeeded || isRightmost, !parensNeeded && isFollowedBySemicolon, -1, keyword);
         if (parensNeeded) { wr.Write(")"); }
 
       } else if (expr is MatchExpr) {
@@ -1962,8 +1952,8 @@ namespace Microsoft.Dafny {
 
       } else if (expr is BoxingCastExpr) {
         // this is not expected for a parsed program, but we may be called for /trace purposes in the translator
-        var e = (BoxingCastExpr)expr;
-        PrintExpr(e.E, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent);
+        var e = (BoxingCastExpr)expr;
+        PrintExpr(e.E, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent, keyword);
       } else if (expr is Translator.BoogieWrapper) {
         wr.Write("[BoogieWrapper]");  // this is somewhat unexpected, but we can get here if the /trace switch is used, so it seems best to cover this case here
       } else {
-- 
cgit v1.2.3


From 18a231edf04437a0748d542d3114ed79899aa363 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Tue, 8 Dec 2015 15:15:21 -0800
Subject: Fix issue 114. Do not export private terms for ComprehensionExpr in
 trigger collectors.

---
 Source/Dafny/Triggers/TriggersCollector.cs |  7 +++++++
 Test/dafny4/Bug114.dfy                     | 10 ++++++++++
 Test/dafny4/Bug114.dfy.expect              |  7 +++++++
 3 files changed, 24 insertions(+)
 create mode 100644 Test/dafny4/Bug114.dfy
 create mode 100644 Test/dafny4/Bug114.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index 698ea3b5..f96d3e4c 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -209,6 +209,8 @@ namespace Microsoft.Dafny.Triggers {
         annotation = AnnotateIdentifier((IdentifierExpr)expr);
       } else if (expr is ApplySuffix) {
         annotation = AnnotateApplySuffix((ApplySuffix)expr);
+      } else if (expr is ComprehensionExpr) {
+        annotation = AnnotateComprehensionExpr((ComprehensionExpr)expr);
       } else if (expr is ConcreteSyntaxExpression ||
                  expr is LiteralExpr ||
                  expr is OldExpr ||
@@ -272,6 +274,11 @@ namespace Microsoft.Dafny.Triggers {
       return new TriggerAnnotation(false, Enumerable.Repeat(expr.Var, 1), null);
     }
 
+    private TriggerAnnotation AnnotateComprehensionExpr(ComprehensionExpr expr) {
+      var terms = CollectExportedCandidates(expr);
+      return new TriggerAnnotation(true, CollectVariables(expr), terms,  OnlyPrivateCandidates(terms, expr.BoundVars));
+    }
+
     private TriggerAnnotation AnnotateOther(Expression expr, bool isTriggerKiller) {
       return new TriggerAnnotation(isTriggerKiller || CollectIsKiller(expr), CollectVariables(expr), CollectExportedCandidates(expr));
     }
diff --git a/Test/dafny4/Bug114.dfy b/Test/dafny4/Bug114.dfy
new file mode 100644
index 00000000..1c0f0109
--- /dev/null
+++ b/Test/dafny4/Bug114.dfy
@@ -0,0 +1,10 @@
+// RUN: %dafny /compile:0  /autoTriggers:1 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+function f1(d:int):map<int,int>
+function f2(y:int, d:int):int
+
+method M(m:map<int,int>, d:int, x2:int)
+{
+  assert forall d :: f1(d) == (map x | x in m ::  f2(x, d));
+}
\ No newline at end of file
diff --git a/Test/dafny4/Bug114.dfy.expect b/Test/dafny4/Bug114.dfy.expect
new file mode 100644
index 00000000..8e671f90
--- /dev/null
+++ b/Test/dafny4/Bug114.dfy.expect
@@ -0,0 +1,7 @@
+Bug114.dfy(9,9): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+    (0,0): anon3_Then
+    (0,0): anon2
+
+Dafny program verifier finished with 3 verified, 1 error
-- 
cgit v1.2.3


From bfd722fb0f5654fac4c3510625e5eec0a09cdfd1 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Tue, 5 Jan 2016 10:14:00 -0800
Subject: Fix issue 116. Add the missing @ for the generated c# code.

---
 Source/Dafny/Compiler.cs      |  3 +--
 Test/dafny4/Bug116.dfy        | 15 +++++++++++++++
 Test/dafny4/Bug116.dfy.expect |  3 +++
 3 files changed, 19 insertions(+), 2 deletions(-)
 create mode 100644 Test/dafny4/Bug116.dfy
 create mode 100644 Test/dafny4/Bug116.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 264ecf9b..1a99a8af 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -2507,8 +2507,7 @@ namespace Microsoft.Dafny {
         DatatypeValue dtv = (DatatypeValue)expr;
         Contract.Assert(dtv.Ctor != null);  // since dtv has been successfully resolved
         var typeParams = dtv.InferredTypeArgs.Count == 0 ? "" : string.Format("<{0}>", TypeNames(dtv.InferredTypeArgs, wr));
-
-        wr.Write("new {0}{1}(", DtName(dtv.Ctor.EnclosingDatatype), typeParams);
+        wr.Write("new @{0}{1}(", DtName(dtv.Ctor.EnclosingDatatype), typeParams);
         if (!dtv.IsCoCall) {
           // For an ordinary constructor (that is, one that does not guard any co-recursive calls), generate:
           //   new Dt_Cons<T>( args )
diff --git a/Test/dafny4/Bug116.dfy b/Test/dafny4/Bug116.dfy
new file mode 100644
index 00000000..9fd30597
--- /dev/null
+++ b/Test/dafny4/Bug116.dfy
@@ -0,0 +1,15 @@
+// RUN: %dafny "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+datatype struct = S  // this is ok
+
+method Main()
+{
+  var s := S;  // this line generates illegal C# code
+  print s;
+}
+
+
+
+
+
diff --git a/Test/dafny4/Bug116.dfy.expect b/Test/dafny4/Bug116.dfy.expect
new file mode 100644
index 00000000..b0cf7300
--- /dev/null
+++ b/Test/dafny4/Bug116.dfy.expect
@@ -0,0 +1,3 @@
+
+Dafny program verifier finished with 2 verified, 0 errors
+Compiled assembly into Bug116.exe
-- 
cgit v1.2.3


From 817d28da901dc8d285c8e7f86f25496093fd6af2 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Wed, 6 Jan 2016 11:49:34 -0800
Subject: Fix some VS IDE performance issues. - cache scan results so it can be
 shared between different instances of   DafnyTokenTagger - Instead of
 rescanning the whole text buffer upon a text change, only rescan   the text
 span that the text change is in. - set the timer to half a second to match
 the comment at the beginnig of   the file. The event change are only passed
 along to Dafny when the user stop   typing for half a second. - Change
 framework dependence so the project can work with version 4.5 and   higher.

---
 Source/DafnyExtension/BufferIdleEventUtil.cs       |   2 +-
 Source/DafnyExtension/TokenTagger.cs               | 214 ++++++++++++++++-----
 .../DafnyExtension/source.extension.vsixmanifest   |   2 +-
 3 files changed, 168 insertions(+), 50 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyExtension/BufferIdleEventUtil.cs b/Source/DafnyExtension/BufferIdleEventUtil.cs
index 5ab9df09..8a1ad0ed 100644
--- a/Source/DafnyExtension/BufferIdleEventUtil.cs
+++ b/Source/DafnyExtension/BufferIdleEventUtil.cs
@@ -120,7 +120,7 @@ namespace DafnyLanguage
             {
                 timer = new DispatcherTimer(DispatcherPriority.ApplicationIdle)
                 {
-                    Interval = TimeSpan.FromMilliseconds(50)
+                    Interval = TimeSpan.FromMilliseconds(500)
                 };
 
                 timer.Tick += (s, e) =>
diff --git a/Source/DafnyExtension/TokenTagger.cs b/Source/DafnyExtension/TokenTagger.cs
index 8377b3a2..f1c4860c 100644
--- a/Source/DafnyExtension/TokenTagger.cs
+++ b/Source/DafnyExtension/TokenTagger.cs
@@ -70,17 +70,37 @@ namespace DafnyLanguage
     }
   }
 
+
   internal sealed class DafnyTokenTagger : ITagger<DafnyTokenTag>, IDisposable
   {
+    internal sealed class ScanResult
+    {
+      internal ITextSnapshot _oldSnapshot; 
+      internal ITextSnapshot _newSnapshot; 
+      internal List<TokenRegion> _regions; // the regions computed for the _newSnapshot
+      internal NormalizedSnapshotSpanCollection _difference; // the difference between _oldSnapshot and _newSnapshot
+
+      internal ScanResult(ITextSnapshot oldSnapshot, ITextSnapshot newSnapshot, List<TokenRegion> regions, NormalizedSnapshotSpanCollection diffs) {
+        _oldSnapshot = oldSnapshot;
+        _newSnapshot = newSnapshot;
+        _regions = regions;
+        _difference = diffs;
+      }
+    }
+
     ITextBuffer _buffer;
     ITextSnapshot _snapshot;
     List<TokenRegion> _regions;
+    // TODO: instead of storing the scan result in the static field and shared by the different
+    // instances of DafnyTokenTagger, could it be associated to the TextBuffer using 
+    // ITextBuffer.Properties.GetOrCreateSingletonProperty?
+    static ScanResult _scanResult = null;
     bool _disposed;
 
     internal DafnyTokenTagger(ITextBuffer buffer) {
       _buffer = buffer;
       _snapshot = buffer.CurrentSnapshot;
-      _regions = Rescan(_snapshot);
+      _regions = Scan(_snapshot);
 
       _buffer.Changed += new EventHandler<TextContentChangedEventArgs>(ReparseFile);
     }
@@ -92,6 +112,7 @@ namespace DafnyLanguage
           _buffer = null;
           _snapshot = null;
           _regions = null;
+          _scanResult = null;
           _disposed = true;
         }
       }
@@ -127,24 +148,92 @@ namespace DafnyLanguage
       ITextSnapshot snapshot = _buffer.CurrentSnapshot;
       if (snapshot == _snapshot)
         return;  // we've already computed the regions for this snapshot
+      
+      NormalizedSnapshotSpanCollection difference = new NormalizedSnapshotSpanCollection();
+      if (DafnyTokenTagger._scanResult != null &&
+        DafnyTokenTagger._scanResult._oldSnapshot == _snapshot &&
+        DafnyTokenTagger._scanResult._newSnapshot == snapshot) {
+        difference = DafnyTokenTagger._scanResult._difference;
+        // save the new baseline
+        _regions = DafnyTokenTagger._scanResult._regions;
+        _snapshot = snapshot;
+      } else {
+        List<TokenRegion>  regions = new List<TokenRegion>();
+        List<SnapshotSpan> rescannedRegions = new List<SnapshotSpan>();
+
+        // loop through the changes and check for changes in comments first. If 
+        // the change is in a comments, we need to rescan starting from the 
+        // beginning of the comments (which in multi-lined comments, it can
+        // be a line that the changes are not on), otherwise, we can just rescan the lines
+        // that the changes are on.
+        bool done;
+        SnapshotPoint start, end;
+        for (int i = 0; i < args.Changes.Count; i++) {
+          done = false;
+          // get the span of the lines that the change is on.
+          int cStart = args.Changes[i].NewSpan.Start;
+          int cEnd = args.Changes[i].NewSpan.End;
+          start = snapshot.GetLineFromPosition(cStart).Start;
+          end = snapshot.GetLineFromPosition(cEnd).End;
+          SnapshotSpan newSpan = new SnapshotSpan(start, end);
+          foreach (TokenRegion r in _regions) {
+            if (r.Kind == DafnyTokenKind.Comment) {
+              // if the change is in the comments, we want to start scanning from the
+              // the beginning of the comments instead.
+              SnapshotSpan span = r.Span.TranslateTo(snapshot, SpanTrackingMode.EdgeExclusive);
+              if (span.IntersectsWith(newSpan)) {
+                start = span.Start.Position < newSpan.Start.Position ? span.Start : newSpan.Start;
+                end = span.End.Position > newSpan.End.Position ? span.End : newSpan.End;
+                end = Scan(snapshot.GetText(new SnapshotSpan(start, end)), start, regions, snapshot);
+                // record the regions that we rescanned.
+                rescannedRegions.Add(new SnapshotSpan(start, end));
+                done = true;
+                break;
+              }
+            }
+          }
+          if (!done) {
+            // scan the lines that the change is on to generate the new regions.
+            end = Scan(snapshot.GetText(new SnapshotSpan(start, end)), start, regions, snapshot);
+            // record the span that we rescanned.
+            rescannedRegions.Add(new SnapshotSpan(start, end));
+          }
+        }
 
-      // get all of the outline regions in the snapshot
-      List<TokenRegion> newRegions = Rescan(snapshot);
-
-      // determine the changed span, and send a changed event with the new spans
-      List<SnapshotSpan> oldSpans = new List<SnapshotSpan>(_regions.Select(r =>
-        r.Span.TranslateTo(snapshot, SpanTrackingMode.EdgeExclusive)));
-
-      List<SnapshotSpan> newSpans = new List<SnapshotSpan>(newRegions.Select(r => r.Span));
-
-      NormalizedSnapshotSpanCollection oldSpanCollection = new NormalizedSnapshotSpanCollection(oldSpans);
-      NormalizedSnapshotSpanCollection newSpanCollection = new NormalizedSnapshotSpanCollection(newSpans);
-
-      NormalizedSnapshotSpanCollection difference = SymmetricDifference(oldSpanCollection, newSpanCollection);
-
-      // save the new baseline
-      _snapshot = snapshot;
-      _regions = newRegions;
+        List<SnapshotSpan> oldSpans = new List<SnapshotSpan>();
+        List<SnapshotSpan> newSpans = new List<SnapshotSpan>();
+        // record the newly created spans.
+        foreach (TokenRegion r in regions) {
+          newSpans.Add(r.Span);
+        }
+        // loop through the old scan results and remove the ones that 
+        // are in the regions that are rescanned.
+        foreach (TokenRegion r in _regions) {
+          SnapshotSpan origSpan = r.Span.TranslateTo(snapshot, SpanTrackingMode.EdgeExclusive);
+          bool obsolete = false;
+          foreach (SnapshotSpan span in rescannedRegions) {
+            if (origSpan.IntersectsWith(span)) {
+              oldSpans.Add(span);
+              obsolete = true;
+              break;
+            }
+          }
+          if (!obsolete) {
+            TokenRegion region = new TokenRegion(origSpan.Start, origSpan.End, r.Kind);
+            regions.Add(region);
+          }
+        }
+        
+        NormalizedSnapshotSpanCollection oldSpanCollection = new NormalizedSnapshotSpanCollection(oldSpans);
+        NormalizedSnapshotSpanCollection newSpanCollection = new NormalizedSnapshotSpanCollection(newSpans);
+        difference = SymmetricDifference(oldSpanCollection, newSpanCollection);
+
+        // save the scan result
+        DafnyTokenTagger._scanResult = new ScanResult(_snapshot, snapshot, regions, difference);
+        // save the new baseline
+        _snapshot = snapshot;
+        _regions = regions;
+      }
 
       var chng = TagsChanged;
       if (chng != null) {
@@ -160,38 +249,35 @@ namespace DafnyLanguage
           NormalizedSnapshotSpanCollection.Difference(second, first));
     }
 
-    private static List<TokenRegion> Rescan(ITextSnapshot newSnapshot) {
-      List<TokenRegion> newRegions = new List<TokenRegion>();
-
+    private static SnapshotPoint Scan(string txt, SnapshotPoint start, List<TokenRegion> newRegions, ITextSnapshot newSnapshot) {
       int longCommentDepth = 0;
-      SnapshotPoint commentStart = new SnapshotPoint();  // used only when longCommentDepth != 0
+      SnapshotPoint commentStart = new SnapshotPoint();
       SnapshotPoint commentEndAsWeKnowIt = new SnapshotPoint();  // used only when longCommentDepth != 0
-      foreach (ITextSnapshotLine line in newSnapshot.Lines) {
-        string txt = line.GetText();  // the current line (without linebreak characters)
-        int N = txt.Length;  // length of the current line
-        int cur = 0;  // offset into the current line
-
+      int N = txt.Length;
+      bool done = false;
+      while (!done) {
+        N = txt.Length;  // length of the current buffer
+        int cur = 0;  // offset into the current buffer
         if (longCommentDepth != 0) {
           ScanForEndOfComment(txt, ref longCommentDepth, ref cur);
           if (longCommentDepth == 0) {
             // we just finished parsing a long comment
-            newRegions.Add(new TokenRegion(commentStart, new SnapshotPoint(newSnapshot, line.Start + cur), DafnyTokenKind.Comment));
+            newRegions.Add(new TokenRegion(commentStart, new SnapshotPoint(newSnapshot, start + cur), DafnyTokenKind.Comment));
           } else {
             // we're still parsing the long comment
             Contract.Assert(cur == txt.Length);
-            commentEndAsWeKnowIt = new SnapshotPoint(newSnapshot, line.Start + cur);
+            commentEndAsWeKnowIt = new SnapshotPoint(newSnapshot, start + cur);
             goto OUTER_CONTINUE;
           }
         }
-
-        // repeatedly get the remaining tokens from this line
-        int end;  // offset into the current line
+        // repeatedly get the remaining tokens from this buffer
+        int end;  // offset into the current buffer
         for (; ; cur = end) {
           // advance to the first character of a keyword or token
           DafnyTokenKind ty = DafnyTokenKind.Keyword;
           for (; ; cur++) {
             if (N <= cur) {
-              // we've looked at everything in this line
+              // we've looked at everything in this buffer
               goto OUTER_CONTINUE;
             }
             char ch = txt[cur];
@@ -204,7 +290,7 @@ namespace DafnyLanguage
           }
 
           // advance to the end of the token
-          end = cur + 1;  // offset into the current line
+          end = cur + 1;  // offset into the current buffer
           if (ty == DafnyTokenKind.Number) {
             // scan the rest of this number
             for (; end < N; end++) {
@@ -213,7 +299,7 @@ namespace DafnyLanguage
               } else break;
             }
           } else if (ty == DafnyTokenKind.String) {
-            // scan the rest of this string, but not past the end-of-line
+            // scan the rest of this string, but not past the end-of-buffer
             for (; end < N; end++) {
               char ch = txt[end];
               if (ch == '"') {
@@ -233,20 +319,20 @@ namespace DafnyLanguage
             if (end == N) continue;  // this was not the start of a comment; it was just a single "/" and we don't care to color it
             char ch = txt[end];
             if (ch == '/') {
-              // a short comment
-              end = N;
+              // a short comment, to the end of the line.
+              end = newSnapshot.GetLineFromPosition(start + end).End.Position - start;
             } else if (ch == '*') {
               // a long comment; find the matching "*/"
               end++;
-              commentStart = new SnapshotPoint(newSnapshot, line.Start + cur);
+              commentStart = new SnapshotPoint(newSnapshot, start + cur);
               Contract.Assert(longCommentDepth == 0);
               longCommentDepth = 1;
               ScanForEndOfComment(txt, ref longCommentDepth, ref end);
               if (longCommentDepth == 0) {
                 // we finished scanning a long comment, and "end" is set to right after it
-                newRegions.Add(new TokenRegion(commentStart, new SnapshotPoint(newSnapshot, line.Start + end), DafnyTokenKind.Comment));
+                newRegions.Add(new TokenRegion(commentStart, new SnapshotPoint(newSnapshot, start + end), DafnyTokenKind.Comment));
               } else {
-                commentEndAsWeKnowIt = new SnapshotPoint(newSnapshot, line.Start + end);
+                commentEndAsWeKnowIt = new SnapshotPoint(newSnapshot, start + end);
               }
               continue;
             } else {
@@ -358,21 +444,53 @@ namespace DafnyLanguage
               }
             }
           }
-
-          newRegions.Add(new TokenRegion(new SnapshotPoint(newSnapshot, line.Start + cur), new SnapshotPoint(newSnapshot, line.Start + end), ty));
+          newRegions.Add(new TokenRegion(new SnapshotPoint(newSnapshot, start + cur), new SnapshotPoint(newSnapshot, start + end), ty));
+        }
+      OUTER_CONTINUE:
+        done = true;
+        if (longCommentDepth != 0) {
+          // we need to look into the next line
+          ITextSnapshotLine currLine = newSnapshot.GetLineFromPosition(start + N);
+          if ((currLine.LineNumber + 1) < newSnapshot.LineCount) {
+            ITextSnapshotLine nextLine = newSnapshot.GetLineFromLineNumber(currLine.LineNumber + 1);
+            txt = nextLine.GetText();
+            start = nextLine.Start;
+            // we are done scanning the current buffer, but not the whole file yet.
+            // we need to continue to find the enclosing "*/", or until the end of the file.
+            done = false;
+          } else {
+            // This was a malformed comment, running to the end of the buffer.  Above, we let "commentEndAsWeKnowIt" be the end of the
+            // last line, so we can use it here.
+            newRegions.Add(new TokenRegion(commentStart, commentEndAsWeKnowIt, DafnyTokenKind.Comment));
+          }
         }
-      OUTER_CONTINUE: ;
       }
+      return new SnapshotPoint(newSnapshot, start + N);
+    }
 
-      if (longCommentDepth != 0) {
-        // This was a malformed comment, running to the end of the buffer.  Above, we let "commentEndAsWeKnowIt" be the end of the
-        // last line, so we can use it here.
-        newRegions.Add(new TokenRegion(commentStart, commentEndAsWeKnowIt, DafnyTokenKind.Comment));
+    private static List<TokenRegion> Scan(ITextSnapshot newSnapshot) {
+      List<TokenRegion> newRegions; 
+      if (DafnyTokenTagger._scanResult != null &&
+        DafnyTokenTagger._scanResult._newSnapshot == newSnapshot) {
+        newRegions = DafnyTokenTagger._scanResult._regions;
+      } else {
+        newRegions = new List<TokenRegion>();
+        int nextLineNumber = -1;
+        foreach (ITextSnapshotLine line in newSnapshot.Lines) {
+          if (line.LineNumber <= nextLineNumber) {
+            // the line is already processed.
+            continue;
+          }
+          string txt = line.GetText();  // the current line (without linebreak characters)
+          SnapshotPoint end = Scan(txt, line.Start, newRegions, newSnapshot);
+          nextLineNumber = newSnapshot.GetLineFromPosition(end).LineNumber;
+        }
+        DafnyTokenTagger._scanResult = new ScanResult(null, newSnapshot, newRegions, null);
       }
-
       return newRegions;
     }
 
+    
     /// <summary>
     /// Scans "txt" beginning with depth "depth", which is assumed to be non-0.  Any occurrences of "/*" or "*/"
     /// increment or decrement "depth".  If "depth" ever reaches 0, then "end" returns as the number of characters
diff --git a/Source/DafnyExtension/source.extension.vsixmanifest b/Source/DafnyExtension/source.extension.vsixmanifest
index 66e4deda..a3987456 100644
--- a/Source/DafnyExtension/source.extension.vsixmanifest
+++ b/Source/DafnyExtension/source.extension.vsixmanifest
@@ -11,7 +11,7 @@
     <InstallationTarget Version="[14.0,15.0)" Id="Microsoft.VisualStudio.Community" />
   </Installation>
   <Dependencies>
-    <Dependency Id="Microsoft.Framework.NDP" DisplayName="Microsoft .NET Framework" d:Source="Manual" Version="4.5" />
+    <Dependency Id="Microsoft.Framework.NDP" DisplayName="Microsoft .NET Framework" d:Source="Manual" Version="[4.5,]" />
     <Dependency Id="Microsoft.VisualStudio.MPF.11.0" DisplayName="Visual Studio MPF 11.0" d:Source="Installed" Version="11.0" />
   </Dependencies>
   <Assets>
-- 
cgit v1.2.3


From 4c81e90e18b1d142c50453470fe9647693ef8de4 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Wed, 6 Jan 2016 19:00:18 -0800
Subject: Removed Contract.Requires from method overrides (preconditions of
 overrides are inherited from the overridden method and Code Contracts will
 copy those preconditions to make sure the right run-time checking happens;
 when Code Contracts finds preconditions on overrides, it emits warnings).

---
 Source/Dafny/Rewriter.cs                      | 1 -
 Source/Dafny/Triggers/QuantifierSplitter.cs   | 1 -
 Source/Dafny/Triggers/QuantifiersCollector.cs | 1 -
 3 files changed, 3 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Rewriter.cs b/Source/Dafny/Rewriter.cs
index 13b16066..2e18c4e6 100644
--- a/Source/Dafny/Rewriter.cs
+++ b/Source/Dafny/Rewriter.cs
@@ -89,7 +89,6 @@ namespace Microsoft.Dafny
     internal class ForAllStmtVisitor : TopDownVisitor<bool>
     {
       protected override bool VisitOneStmt(Statement stmt, ref bool st) {
-        Contract.Requires(stmt != null);
         if (stmt is ForallStmt) {
           ForallStmt s = (ForallStmt)stmt;
           if (s.Kind == ForallStmt.ParBodyKind.Proof) {
diff --git a/Source/Dafny/Triggers/QuantifierSplitter.cs b/Source/Dafny/Triggers/QuantifierSplitter.cs
index e46b64fb..d0b2b430 100644
--- a/Source/Dafny/Triggers/QuantifierSplitter.cs
+++ b/Source/Dafny/Triggers/QuantifierSplitter.cs
@@ -115,7 +115,6 @@ namespace Microsoft.Dafny.Triggers {
     }
 
     protected override void VisitOneStmt(Statement stmt) {
-      Contract.Requires(stmt != null);
       if (stmt is ForallStmt) {
         ForallStmt s = (ForallStmt)stmt;
         if (s.ForallExpressions != null) {
diff --git a/Source/Dafny/Triggers/QuantifiersCollector.cs b/Source/Dafny/Triggers/QuantifiersCollector.cs
index 789e7614..b887435b 100644
--- a/Source/Dafny/Triggers/QuantifiersCollector.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollector.cs
@@ -42,7 +42,6 @@ namespace Microsoft.Dafny.Triggers {
     }
 
     protected override bool VisitOneStmt(Statement stmt, ref bool st) {
-      Contract.Requires(stmt != null);
       if (stmt is ForallStmt) {
         ForallStmt s = (ForallStmt)stmt;
         if (s.ForallExpressions != null) {
-- 
cgit v1.2.3


From 4c4647bbd61883edee6f55d5dc37c9649d23af2e Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Thu, 7 Jan 2016 16:43:53 -0800
Subject: Fix issue 118. When iteratively computing bounds, treat
 RefBoundedPool typed bound as undetermined so that iteration will continue.

---
 Source/Dafny/Resolver.cs      |  5 ++++-
 Test/dafny4/Bug118.dfy        | 12 ++++++++++++
 Test/dafny4/Bug118.dfy.expect |  2 ++
 3 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 Test/dafny4/Bug118.dfy
 create mode 100644 Test/dafny4/Bug118.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 9dc0f829..79f1e7e1 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -9771,11 +9771,14 @@ namespace Microsoft.Dafny
         bests = all.ConvertAll(tup => ComprehensionExpr.BoundedPool.GetBest(tup.Item2, onlyFiniteBounds));
         // check to see if we found new bounds in this iteration
         int count = 0;
+        // figure out how many bounds are not determined yet.
         for (int i = 0; i < bests.Count; i++) {
-          if (bests[i] == null) {
+          if (bests[i] == null || (bests[i] is ComprehensionExpr.RefBoundedPool)) {
             count++;
           }
         }
+        // if there are bounds that are not determined yet and the number of undetermined bounds
+        // changed, we will need to do another iteration.
         if (count >0 && count != orgCount) {
           changed = true;
           knownBounds = bests;
diff --git a/Test/dafny4/Bug118.dfy b/Test/dafny4/Bug118.dfy
new file mode 100644
index 00000000..1e2dddeb
--- /dev/null
+++ b/Test/dafny4/Bug118.dfy
@@ -0,0 +1,12 @@
+// RUN: %dafny /compile:0 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+class Foo {
+  ghost var Repr: set<object>
+}
+
+function SeqRepr(s:seq<Foo>) : set<object>
+  reads set b | b in s 
+{
+  set o,b | b in s && b != null && o in b.Repr :: o     // Works if you say "set b,o | ..."
+}
\ No newline at end of file
diff --git a/Test/dafny4/Bug118.dfy.expect b/Test/dafny4/Bug118.dfy.expect
new file mode 100644
index 00000000..c0c48e2b
--- /dev/null
+++ b/Test/dafny4/Bug118.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 1 verified, 0 errors
-- 
cgit v1.2.3


From 44b30341ed42c5348e860bb52c1940891068002b Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Fri, 8 Jan 2016 11:08:12 -0800
Subject: Fix issue 117. Generate an error when the "opened" of an import
 doesn't match between a module and its refinement base.

---
 Source/Dafny/RefinementTransformer.cs | 21 ++++++++++++++++++++
 Test/dafny4/Bug117.dfy                | 37 +++++++++++++++++++++++++++++++++++
 Test/dafny4/Bug117.dfy.expect         |  3 +++
 3 files changed, 61 insertions(+)
 create mode 100644 Test/dafny4/Bug117.dfy
 create mode 100644 Test/dafny4/Bug117.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/RefinementTransformer.cs b/Source/Dafny/RefinementTransformer.cs
index 82ddddf1..6281417d 100644
--- a/Source/Dafny/RefinementTransformer.cs
+++ b/Source/Dafny/RefinementTransformer.cs
@@ -88,6 +88,27 @@ namespace Microsoft.Dafny
                     "no more than one exclusive refinement may exist for a given module.");
               }
             }
+            // check that the openess in the imports between refinement and its base matches
+            List<TopLevelDecl> declarations = m.TopLevelDecls;
+            List<TopLevelDecl> baseDeclarations = m.RefinementBase.TopLevelDecls;
+            foreach (var im in declarations) {
+              if (im is ModuleDecl) {
+                ModuleDecl mdecl = (ModuleDecl)im;
+                //find the matching import from the base
+                foreach (var bim in baseDeclarations) {
+                  if (bim is ModuleDecl && ((ModuleDecl)bim).Name.Equals(mdecl.Name)) {
+                    if (mdecl.Opened != ((ModuleDecl)bim).Opened) {
+                      string message = mdecl.Opened ? 
+                        "{0} in {1} cannot be imported with \"opened\" because it does not match the corresponding import in the refinement base {2} " :
+                        "{0} in {1} must be imported with \"opened\"  to match the corresponding import in its refinement base {2}.";
+                        reporter.Error(MessageSource.RefinementTransformer,m.tok, message, im.Name, m.Name, m.RefinementBase.Name);
+                    }
+                    break;
+                  }
+                }
+              }
+            }
+            
             PreResolveWorker(m);
           } else {
             reporter.Error(MessageSource.RefinementTransformer, m.RefinementBaseName[0], "module ({0}) named as refinement base is not a literal module or simple reference to a literal module", Util.Comma(".", m.RefinementBaseName, x => x.val));
diff --git a/Test/dafny4/Bug117.dfy b/Test/dafny4/Bug117.dfy
new file mode 100644
index 00000000..2ae4bc70
--- /dev/null
+++ b/Test/dafny4/Bug117.dfy
@@ -0,0 +1,37 @@
+// RUN: %dafny /compile:0  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+abstract module AbstractModule1 
+{
+	type AbstractType1
+} 
+
+abstract module AbstractModule2 
+{
+	import opened AM1 as AbstractModule1
+	
+	datatype AbstractType2 = AbstractType2(x:AbstractType1)
+} 
+
+abstract module AbstractModule3 
+{
+	import AM1 as AbstractModule1
+	
+	datatype AbstractType2 = AbstractType2(x:AM1.AbstractType1)
+} 
+
+module ConcreteModule1
+{
+	type AbstractType1 = int
+} 
+
+module ConcreteModule2 refines AbstractModule2 
+{
+	import AM1 = ConcreteModule1 // error: must be declared "opened" to match AbstratctModule2 
+} 
+
+module ConcreteModule3 refines AbstractModule3 
+{
+	import opened AM1 = ConcreteModule1 // error: can't be declared "opened" to match AbstractModule3
+} 
+
diff --git a/Test/dafny4/Bug117.dfy.expect b/Test/dafny4/Bug117.dfy.expect
new file mode 100644
index 00000000..0c5a5445
--- /dev/null
+++ b/Test/dafny4/Bug117.dfy.expect
@@ -0,0 +1,3 @@
+Bug117.dfy(28,7): Error: AM1 in ConcreteModule2 must be imported with "opened"  to match the corresponding import in its refinement base AbstractModule2.
+Bug117.dfy(33,7): Error: AM1 in ConcreteModule3 cannot be imported with "opened" because it does not match the corresponding import in the refinement base AbstractModule3 
+2 resolution/type errors detected in Bug117.dfy
-- 
cgit v1.2.3


From b1b2e4973487cd9fed17ab3b0add8852fd708ad9 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Wed, 20 Jan 2016 10:36:58 -0800
Subject: Mark temps that are generated in the resolver as auto-generated
 identifiers so that they don't show up in the VS IDE

---
 Source/Dafny/Resolver.cs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 79f1e7e1..4d900a1b 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -8194,8 +8194,8 @@ namespace Microsoft.Dafny
 
         // Create a unique name for d', the variable we introduce in the let expression
         var tmpName = FreshTempVarName("dt_update_tmp#", opts.codeContext);
-        var tmpVarIdExpr = new IdentifierExpr(tok, tmpName);
-        var tmpVarBv = new BoundVar(tok, tmpName, root.Type);
+        var tmpVarIdExpr = new IdentifierExpr(new AutoGeneratedToken(tok), tmpName);
+        var tmpVarBv = new BoundVar(new AutoGeneratedToken(tok), tmpName, root.Type);
 
         // Build the arguments to the datatype constructor, using the updated value in the appropriate slot
         var ctor_args = new List<Expression>();
-- 
cgit v1.2.3


From 8f244896640bae196070aa8b2bfe0b2f0be24e2a Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Wed, 20 Jan 2016 16:25:46 -0800
Subject: VS IDE performance - invoke dafny parser when the buffer hasn't
 changed for half a second, but delay calling Dafny resolver until the text
 buffer hasn't been changed for 5 seconds. Also save the parsing result from
 TokenTagger in ITextBuffer's property instead of in a static field.

---
 Source/DafnyExtension/DafnyDriver.cs    | 49 +++++++++++++++++++++++----------
 Source/DafnyExtension/ResolverTagger.cs | 37 +++++++++++++++++++++----
 Source/DafnyExtension/TokenTagger.cs    | 31 ++++++++++-----------
 3 files changed, 82 insertions(+), 35 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyExtension/DafnyDriver.cs b/Source/DafnyExtension/DafnyDriver.cs
index 27471d56..037d0cd3 100644
--- a/Source/DafnyExtension/DafnyDriver.cs
+++ b/Source/DafnyExtension/DafnyDriver.cs
@@ -18,13 +18,16 @@ namespace DafnyLanguage
   {
     readonly string _filename;
     readonly ITextSnapshot _snapshot;
+    readonly ITextBuffer _buffer;
     Dafny.Program _program;
+    static object bufferDafnyKey = new object();
 
     List<DafnyError> _errors = new List<DafnyError>();
     public List<DafnyError> Errors { get { return _errors; } }
 
-    public DafnyDriver(ITextSnapshot snapshot, string filename) {
-      _snapshot = snapshot;
+    public DafnyDriver(ITextBuffer buffer, string filename) {
+      _buffer = buffer;
+      _snapshot = buffer.CurrentSnapshot;
       _filename = filename;
     }
 
@@ -107,25 +110,42 @@ namespace DafnyLanguage
 
     #region Parsing and type checking
 
-    internal Dafny.Program ProcessResolution() {
-      if (!ParseAndTypeCheck()) {
+    internal Dafny.Program ProcessResolution(bool runResolver) {
+      if (!ParseAndTypeCheck(runResolver)) {
         return null;
       }
       return _program;
     }
 
-    bool ParseAndTypeCheck() {
-      Dafny.ModuleDecl module = new Dafny.LiteralModuleDecl(new Dafny.DefaultModuleDecl(), null);
-      Dafny.BuiltIns builtIns = new Dafny.BuiltIns();
-
+    bool ParseAndTypeCheck(bool runResolver) {
+      Tuple<ITextSnapshot, Dafny.Program, List<DafnyError>> parseResult;
+      Dafny.Program program;
       var errorReporter = new VSErrorReporter(this);
-      var parseErrors = new Dafny.Errors(errorReporter);
-
-      int errorCount = Dafny.Parser.Parse(_snapshot.GetText(), _filename, _filename, module, builtIns, parseErrors);
-      string errString = Dafny.Main.ParseIncludes(module, builtIns, new List<string>(), parseErrors);
-      if (errorCount != 0 || errString != null)
+      if (_buffer.Properties.TryGetProperty(bufferDafnyKey, out parseResult) &&
+         (parseResult.Item1 == _snapshot)) {
+        // already parsed;
+        program = parseResult.Item2;
+        _errors = parseResult.Item3;
+        if (program == null)
+          runResolver = false;
+      } else {
+        Dafny.ModuleDecl module = new Dafny.LiteralModuleDecl(new Dafny.DefaultModuleDecl(), null);
+        Dafny.BuiltIns builtIns = new Dafny.BuiltIns();
+        var parseErrors = new Dafny.Errors(errorReporter);
+        int errorCount = Dafny.Parser.Parse(_snapshot.GetText(), _filename, _filename, module, builtIns, parseErrors);
+        string errString = Dafny.Main.ParseIncludes(module, builtIns, new List<string>(), parseErrors);
+
+        if (errorCount != 0 || errString != null) {
+          runResolver = false;
+          program = null;
+        } else {
+          program = new Dafny.Program(_filename, module, builtIns, errorReporter);
+        }
+        _buffer.Properties[bufferDafnyKey] = new Tuple<ITextSnapshot, Dafny.Program, List<DafnyError>>(_snapshot, program, _errors);
+      }
+      if (!runResolver) {
         return false;
-      Dafny.Program program = new Dafny.Program(_filename, module, builtIns, errorReporter);
+      }
 
       var r = new Resolver(program);
       r.ResolveProgram(program);
@@ -136,6 +156,7 @@ namespace DafnyLanguage
       return true;  // success
     }
 
+
     void RecordError(string filename, int line, int col, ErrorCategory cat, string msg, bool isRecycled = false)
     {
       _errors.Add(new DafnyError(filename, line - 1, col - 1, cat, msg, _snapshot, isRecycled, null, System.IO.Path.GetFullPath(this._filename) == filename));
diff --git a/Source/DafnyExtension/ResolverTagger.cs b/Source/DafnyExtension/ResolverTagger.cs
index 58a46196..b711c276 100644
--- a/Source/DafnyExtension/ResolverTagger.cs
+++ b/Source/DafnyExtension/ResolverTagger.cs
@@ -15,6 +15,7 @@ using System.Linq;
 using System.Text.RegularExpressions;
 using System.Windows.Shapes;
 using Microsoft.VisualStudio;
+using System.Windows.Threading;
 using Microsoft.VisualStudio.Shell;
 using Microsoft.VisualStudio.Shell.Interop;
 using Microsoft.VisualStudio.Text;
@@ -129,6 +130,8 @@ namespace DafnyLanguage
     ErrorListProvider _errorProvider;
     private bool m_disposed;
 
+    readonly DispatcherTimer timer;
+
     // The 'Snapshot' and 'Program' fields should be updated and read together, so they are protected by "this"
     public ITextSnapshot Snapshot;  // may be null
     public Dafny.Program Program;  // non-null only if the snapshot contains a Dafny program that type checks
@@ -227,7 +230,13 @@ namespace DafnyLanguage
       Snapshot = null;  // this makes sure the next snapshot will look different
       _errorProvider = new ErrorListProvider(serviceProvider);
 
-      BufferIdleEventUtil.AddBufferIdleEventListener(_buffer, ResolveBuffer);
+      BufferIdleEventUtil.AddBufferIdleEventListener(_buffer, UponIdle);
+
+      // keep track idle time after BufferIdleEvent has been handled.
+      timer = new DispatcherTimer(DispatcherPriority.ApplicationIdle);
+      timer.Interval = TimeSpan.FromMilliseconds(5000);
+      timer.Tick += new EventHandler(ResolveBuffer);
+      buffer.Changed += BufferChanged;
     }
 
     public void Dispose()
@@ -257,7 +266,9 @@ namespace DafnyLanguage
               _errorProvider.Dispose();
               _errorProvider = null;
             }
-            BufferIdleEventUtil.RemoveBufferIdleEventListener(_buffer, ResolveBuffer);
+            BufferIdleEventUtil.RemoveBufferIdleEventListener(_buffer, UponIdle);
+            timer.Tick -= ResolveBuffer;
+            _buffer.Changed -= BufferChanged;
             if (_document != null && _document.TextBuffer != null)
             {
               ResolverTaggers.Remove(_document.TextBuffer);
@@ -319,17 +330,28 @@ namespace DafnyLanguage
     /// </summary>
     void ResolveBuffer(object sender, EventArgs args)
     {
+      timer.Stop();
+      ParseAndResolveBuffer(sender, args, true);
+    }
+
+    void UponIdle(object sender, EventArgs args) {
+      timer.Stop();
+      ParseAndResolveBuffer(sender, args, false);
+      timer.Start();
+    }
+
+    void ParseAndResolveBuffer(object sender, EventArgs args, bool runResolver) {
       ITextSnapshot snapshot = _buffer.CurrentSnapshot;
-      if (snapshot == Snapshot)
+      if (snapshot == Snapshot && !runResolver)
         return;  // we've already done this snapshot
 
       string filename = _document != null ? _document.FilePath : "<program>";
-      var driver = new DafnyDriver(snapshot, filename);
+      var driver = new DafnyDriver(_buffer, filename);
       List<DafnyError> newErrors;
       Dafny.Program program;
       try
       {
-        program = driver.ProcessResolution();
+        program = driver.ProcessResolution(runResolver);
         newErrors = driver.Errors;
       }
       catch (Exception e)
@@ -358,6 +380,11 @@ namespace DafnyLanguage
       UpdateErrorList(snapshot);
     }
 
+    void BufferChanged(object sender, TextContentChangedEventArgs e) {
+      timer.Stop();
+      timer.Start();
+    }
+
     public void UpdateErrorList(ITextSnapshot snapshot)
     {
       if (_errorProvider != null && !m_disposed)
diff --git a/Source/DafnyExtension/TokenTagger.cs b/Source/DafnyExtension/TokenTagger.cs
index f1c4860c..7a5eb572 100644
--- a/Source/DafnyExtension/TokenTagger.cs
+++ b/Source/DafnyExtension/TokenTagger.cs
@@ -91,10 +91,7 @@ namespace DafnyLanguage
     ITextBuffer _buffer;
     ITextSnapshot _snapshot;
     List<TokenRegion> _regions;
-    // TODO: instead of storing the scan result in the static field and shared by the different
-    // instances of DafnyTokenTagger, could it be associated to the TextBuffer using 
-    // ITextBuffer.Properties.GetOrCreateSingletonProperty?
-    static ScanResult _scanResult = null;
+    static object bufferTokenTaggerKey = new object();
     bool _disposed;
 
     internal DafnyTokenTagger(ITextBuffer buffer) {
@@ -109,10 +106,10 @@ namespace DafnyLanguage
       lock (this) {
         if (!_disposed) {
           _buffer.Changed -= ReparseFile;
+          _buffer.Properties.RemoveProperty(bufferTokenTaggerKey);
           _buffer = null;
           _snapshot = null;
           _regions = null;
-          _scanResult = null;
           _disposed = true;
         }
       }
@@ -150,12 +147,13 @@ namespace DafnyLanguage
         return;  // we've already computed the regions for this snapshot
       
       NormalizedSnapshotSpanCollection difference = new NormalizedSnapshotSpanCollection();
-      if (DafnyTokenTagger._scanResult != null &&
-        DafnyTokenTagger._scanResult._oldSnapshot == _snapshot &&
-        DafnyTokenTagger._scanResult._newSnapshot == snapshot) {
-        difference = DafnyTokenTagger._scanResult._difference;
+      ScanResult result;
+      if (_buffer.Properties.TryGetProperty(bufferTokenTaggerKey, out result) &&
+          (result._oldSnapshot == _snapshot) &&
+          (result._newSnapshot == snapshot)) {
+        difference = result._difference;
         // save the new baseline
-        _regions = DafnyTokenTagger._scanResult._regions;
+        _regions = result._regions;
         _snapshot = snapshot;
       } else {
         List<TokenRegion>  regions = new List<TokenRegion>();
@@ -229,7 +227,7 @@ namespace DafnyLanguage
         difference = SymmetricDifference(oldSpanCollection, newSpanCollection);
 
         // save the scan result
-        DafnyTokenTagger._scanResult = new ScanResult(_snapshot, snapshot, regions, difference);
+        _buffer.Properties[bufferTokenTaggerKey] = new ScanResult(_snapshot, snapshot, regions, difference);
         // save the new baseline
         _snapshot = snapshot;
         _regions = regions;
@@ -468,11 +466,12 @@ namespace DafnyLanguage
       return new SnapshotPoint(newSnapshot, start + N);
     }
 
-    private static List<TokenRegion> Scan(ITextSnapshot newSnapshot) {
+    private List<TokenRegion> Scan(ITextSnapshot newSnapshot) {      
       List<TokenRegion> newRegions; 
-      if (DafnyTokenTagger._scanResult != null &&
-        DafnyTokenTagger._scanResult._newSnapshot == newSnapshot) {
-        newRegions = DafnyTokenTagger._scanResult._regions;
+      ScanResult result;
+      if (_buffer.Properties.TryGetProperty(bufferTokenTaggerKey, out result) &&         
+        result._newSnapshot == newSnapshot) {
+        newRegions = result._regions;
       } else {
         newRegions = new List<TokenRegion>();
         int nextLineNumber = -1;
@@ -485,7 +484,7 @@ namespace DafnyLanguage
           SnapshotPoint end = Scan(txt, line.Start, newRegions, newSnapshot);
           nextLineNumber = newSnapshot.GetLineFromPosition(end).LineNumber;
         }
-        DafnyTokenTagger._scanResult = new ScanResult(null, newSnapshot, newRegions, null);
+        _buffer.Properties[bufferTokenTaggerKey] = new ScanResult(null, newSnapshot, newRegions, null);
       }
       return newRegions;
     }
-- 
cgit v1.2.3


From 9cf02f9daaba01d48621a932c4984753337fbbc5 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Mon, 25 Jan 2016 11:27:26 -0800
Subject: Fix issue 122. Only generate autoTriggers for QuantifierExpr that are
 not empty.

---
 Source/Dafny/Triggers/QuantifiersCollector.cs |  3 ++-
 Test/dafny4/Bug122.dfy                        | 17 +++++++++++++++++
 Test/dafny4/Bug122.dfy.expect                 |  2 ++
 3 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 Test/dafny4/Bug122.dfy
 create mode 100644 Test/dafny4/Bug122.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifiersCollector.cs b/Source/Dafny/Triggers/QuantifiersCollector.cs
index b887435b..cb2d5c6d 100644
--- a/Source/Dafny/Triggers/QuantifiersCollector.cs
+++ b/Source/Dafny/Triggers/QuantifiersCollector.cs
@@ -21,7 +21,8 @@ namespace Microsoft.Dafny.Triggers {
     protected override bool VisitOneExpr(Expression expr, ref bool inOldContext) {
       var quantifier = expr as QuantifierExpr;
 
-      if (quantifier != null && !quantifiers.Contains(quantifier)) {
+      // only consider quantifiers that are not empty (Bound.Vars.Count > 0)
+      if (quantifier != null && (quantifier.BoundVars.Count > 0) && !quantifiers.Contains(quantifier)) {
         quantifiers.Add(quantifier);
         if (quantifier.SplitQuantifier != null) {
           var collection = quantifier.SplitQuantifier.Select(q => q as QuantifierExpr).Where(q => q != null);
diff --git a/Test/dafny4/Bug122.dfy b/Test/dafny4/Bug122.dfy
new file mode 100644
index 00000000..adbee30d
--- /dev/null
+++ b/Test/dafny4/Bug122.dfy
@@ -0,0 +1,17 @@
+// RUN: %dafny /compile:0 /autoTriggers:1 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+method Try (a:int) 
+{
+	forall
+    ensures a == a;
+	{
+	}
+} 
+
+
+
+
+
+
+
diff --git a/Test/dafny4/Bug122.dfy.expect b/Test/dafny4/Bug122.dfy.expect
new file mode 100644
index 00000000..069e7767
--- /dev/null
+++ b/Test/dafny4/Bug122.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 2 verified, 0 errors
-- 
cgit v1.2.3


From 436966ef61a3e4330bbe705d0d0319fcde5f3099 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Mon, 25 Jan 2016 11:30:02 -0800
Subject: Fix issue 121. Don't split QuantifierExpr that are empty.

---
 Source/Dafny/Triggers/QuantifierSplitter.cs |  5 +++--
 Test/dafny4/Bug121.dfy                      | 18 ++++++++++++++++++
 Test/dafny4/Bug121.dfy.expect               |  2 ++
 3 files changed, 23 insertions(+), 2 deletions(-)
 create mode 100644 Test/dafny4/Bug121.dfy
 create mode 100644 Test/dafny4/Bug121.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/QuantifierSplitter.cs b/Source/Dafny/Triggers/QuantifierSplitter.cs
index d0b2b430..b039a402 100644
--- a/Source/Dafny/Triggers/QuantifierSplitter.cs
+++ b/Source/Dafny/Triggers/QuantifierSplitter.cs
@@ -100,8 +100,9 @@ namespace Microsoft.Dafny.Triggers {
     }
     
     private static bool AllowsSplitting(QuantifierExpr quantifier) {
-      bool splitAttr = true;
-      return !Attributes.ContainsBool(quantifier.Attributes, "split", ref splitAttr) || splitAttr;
+      // allow split if attributes doesn't contains "split" or it is "split: true" and it is not an empty QuantifierExpr (boundvar.count>0)
+      bool splitAttr = true; 
+      return (!Attributes.ContainsBool(quantifier.Attributes, "split", ref splitAttr) || splitAttr) && (quantifier.BoundVars.Count > 0);
     }
 
     protected override void VisitOneExpr(Expression expr) {
diff --git a/Test/dafny4/Bug121.dfy b/Test/dafny4/Bug121.dfy
new file mode 100644
index 00000000..13798fa8
--- /dev/null
+++ b/Test/dafny4/Bug121.dfy
@@ -0,0 +1,18 @@
+// RUN: %dafny /compile:0 /autoTriggers:1 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+method Try (a:int, b:int, c:int) 
+{
+	forall
+    ensures a * c == a * c;
+    ensures b * c == b * c;
+	{
+	}
+} 
+
+
+
+
+
+
+
diff --git a/Test/dafny4/Bug121.dfy.expect b/Test/dafny4/Bug121.dfy.expect
new file mode 100644
index 00000000..069e7767
--- /dev/null
+++ b/Test/dafny4/Bug121.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 2 verified, 0 errors
-- 
cgit v1.2.3


From 17405efd598d2a8a2dac304ee9a7f7d9bd30a558 Mon Sep 17 00:00:00 2001
From: "Richard L. Ford" <richford@microsoft.com>
Date: Wed, 27 Jan 2016 14:09:16 -0800
Subject: Implement 'extern' declaration modifier.

The 'extern' declaration modifier provides a more convenient
way of interfacing Dafny code with C# source files and
.Net DLLs.

We support an 'extern' keyword on a module, class, function method,
or method (cannot extern ghost). We check the CompileNames of
all modules to make sure there are no duplicate names.

Every Dafny-generated C# class is marked partial, so it can
potentially be extended.

The extern keyword could be accompanied by an optional string naming
the corresponding C# method/class to connect to. If not given
the name of the method/class is used.

An 'extern' keyword implies an {:axiom} attribute for functions
and methods, so their ensures clauses are assumed to be true
without proof.

In addition to the .dfy files, the user may supply
C# files (.cs) and dynamic linked libraries (.dll) on
command line. These will be passed onto the C# compiler,
the .cs files as sources, and the .dll files as references.

As part of this change the grammar was refactored some.
New productions are

- TopDecls - a list of top-level declarations.
- TopDecl - a single top-level declaration
- DeclModifiers - a list of declaration modifiers which are
  either 'abstract', 'ghost', 'static', 'protected', or 'extern'.
  They can be in any order and we diagnose duplicates.
  In addition, since they are not all allowed in all contexts,
  we check and give diagnostics if an DeclModifier appears
  where it is not allowed.
---
 Source/Dafny/Compiler.cs              |    2 +-
 Source/Dafny/Dafny.atg                |  356 +++++---
 Source/Dafny/DafnyAst.cs              |   31 +-
 Source/Dafny/Makefile                 |    4 +-
 Source/Dafny/Parser.cs                | 1534 ++++++++++++++++++---------------
 Source/Dafny/Resolver.cs              |   29 +
 Source/Dafny/Scanner.cs               |  169 ++--
 Source/DafnyDriver/DafnyDriver.cs     |  121 ++-
 Source/DafnyExtension/DafnyDriver.cs  |    6 +-
 Test/dafny0/Extern.dfy                |   27 +
 Test/dafny0/Extern.dfy.expect         |    4 +
 Test/dafny0/Extern2.cs                |   14 +
 Test/dafny0/ExternHelloLibrary.cs     |   15 +
 Test/dafny0/ExternHelloLibrary.dll    |  Bin 0 -> 3072 bytes
 Test/dafny0/ExternNegative.dfy        |   26 +
 Test/dafny0/ExternNegative.dfy.expect |    3 +
 Test/dafny0/ExternNegative2.dfy       |   26 +
 17 files changed, 1407 insertions(+), 960 deletions(-)
 create mode 100644 Test/dafny0/Extern.dfy
 create mode 100644 Test/dafny0/Extern.dfy.expect
 create mode 100644 Test/dafny0/Extern2.cs
 create mode 100644 Test/dafny0/ExternHelloLibrary.cs
 create mode 100644 Test/dafny0/ExternHelloLibrary.dll
 create mode 100644 Test/dafny0/ExternNegative.dfy
 create mode 100644 Test/dafny0/ExternNegative.dfy.expect
 create mode 100644 Test/dafny0/ExternNegative2.dfy

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 1a99a8af..f5f95bd2 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -254,7 +254,7 @@ namespace Microsoft.Dafny {
           else if (d is ClassDecl) {
             var cl = (ClassDecl)d;
             Indent(indent, wr);
-            wr.Write("public class @{0}", cl.CompileName);
+            wr.Write("public partial class @{0}", cl.CompileName);
             if (cl.TypeArgs.Count != 0) {
               wr.Write("<{0}>", TypeParameters(cl.TypeArgs));
             }
diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index 08c22db4..87e75541 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -23,10 +23,113 @@ readonly BuiltIns theBuiltIns;
 readonly bool theVerifyThisFile;
 int anonymousIds = 0;
 
-struct MemberModifiers {
+/// <summary>
+/// Holds the modifiers given for a declaration
+///
+/// Not all modifiers are applicable to all kinds of declarations.
+/// Errors are given when a modify does not apply.
+/// We also record the tokens for the specified modifiers so that
+/// they can be used in error messages.
+/// </summary>
+struct DeclModifierData {
+  public bool IsAbstract;
+  public IToken AbstractToken;
   public bool IsGhost;
+  public IToken GhostToken;
   public bool IsStatic;
+  public IToken StaticToken;
   public bool IsProtected;
+  public IToken ProtectedToken;
+  public bool IsExtern;
+  public IToken ExternToken;
+  public StringLiteralExpr ExternName;
+
+}
+
+// Check that token has not been set, then set it.
+public void CheckAndSetToken(ref IToken token)
+{
+    if (token != null) {
+      SemErr(t, "Duplicate declaration modifier: " + t.val);
+    }
+    token = t;
+}
+
+/// <summary>
+// A flags type used to tell what declaration modifiers are allowed for a declaration.
+/// </summary>
+[Flags]
+enum AllowedDeclModifiers {
+  None = 0,
+  Abstract = 1,
+  Ghost = 2,
+
+  // Means ghost not allowed because already implicitly ghost.
+  AlreadyGhost = 4,
+  Static = 8,
+  Protected = 16, 
+  Extern = 32
+};
+
+/// <summary>
+/// Check the declaration modifiers against those that are allowed.
+///
+/// The 'allowed' parameter specifies which declaratio modifiers are allowed.
+/// The 'declCaption' parameter should be a string describing the kind of declaration. 
+/// It is used in error messages.
+/// Any declaration modifiers that are present but not allowed are cleared.
+///</summary>
+void CheckDeclModifiers(DeclModifierData dmod, string declCaption, AllowedDeclModifiers allowed)
+{
+  if (dmod.IsAbstract && ((allowed & AllowedDeclModifiers.Abstract) == 0)) {
+    SemErr(dmod.AbstractToken, declCaption + " cannot be declared 'abstract'.");
+    dmod.IsAbstract = false;
+  }
+  if (dmod.IsGhost) {
+    if ((allowed & AllowedDeclModifiers.AlreadyGhost) != 0) {
+      SemErr(dmod.GhostToken, declCaption + " cannot be declared ghost (they are 'ghost' by default).");
+      dmod.IsGhost = false;
+    } else if ((allowed & AllowedDeclModifiers.Ghost) == 0) {
+      SemErr(dmod.GhostToken, declCaption + " cannot be declared 'ghost'.");
+      dmod.IsGhost = false;
+    }
+  }
+  if (dmod.IsStatic && ((allowed & AllowedDeclModifiers.Static) == 0)) {
+    SemErr(dmod.StaticToken, declCaption + " cannot be declared 'static'.");
+    dmod.IsStatic = false;
+  }
+  if (dmod.IsProtected && ((allowed & AllowedDeclModifiers.Protected) == 0)) {
+    SemErr(dmod.ProtectedToken, declCaption + " cannot be declared 'protected'.");
+    dmod.IsProtected = false;
+  }
+  if (dmod.IsExtern && ((allowed & AllowedDeclModifiers.Extern) == 0)) {
+    SemErr(dmod.ExternToken, declCaption + " cannot be declared 'extern'.");
+    dmod.IsExtern = false;
+  }
+}
+
+/// <summary>
+/// Encode an 'extern' declaration modifier as an {:extern name} attribute.
+///
+/// We also include an {:axiom} attribute since the specification of an
+/// external entity is assumed to hold, but only for methods or functions.
+///</summary>
+static void EncodeExternAsAttribute(DeclModifierData dmod, ref Attributes attrs, IToken/*!*/ id, bool needAxiom) {
+  if (dmod.IsExtern) {
+    StringLiteralExpr name = dmod.ExternName;
+    if (name == null) {
+      bool isVerbatimString = false;
+      name = new StringLiteralExpr(id, id.val, isVerbatimString);
+    }
+    var args = new List<Expression>();
+    args.Add(name);
+    attrs = new Attributes("extern", args, attrs);
+
+    // Also 'extern' implies 'axiom' for methods or functions.
+    if (needAxiom) {
+      attrs = new Attributes("axiom", new List<Expression>(), attrs);
+    }
+  }
 }
 
 ///<summary>
@@ -516,13 +619,10 @@ IGNORE cr + lf + tab
 /*------------------------------------------------------------------------*/
 PRODUCTIONS
 Dafny
-= (. ClassDecl/*!*/ c; DatatypeDecl/*!*/ dt; TopLevelDecl td; IteratorDecl iter;
-     List<MemberDecl/*!*/> membersDefaultClass = new List<MemberDecl/*!*/>();
-     ModuleDecl submodule;
+= (. List<MemberDecl/*!*/> membersDefaultClass = new List<MemberDecl/*!*/>();
      // to support multiple files, create a default module only if theModule is null
      DefaultModuleDecl defaultModule = (DefaultModuleDecl)((LiteralModuleDecl)theModule).ModuleDef;
      // theModule should be a DefaultModuleDecl (actually, the singular DefaultModuleDecl)
-	 TraitDecl/*!*/ trait;
      Contract.Assert(defaultModule != null);
   .)
   { "include" stringToken               (. {
@@ -540,15 +640,7 @@ Dafny
                                            }
                                         .)
   }
-  { SubModuleDecl<defaultModule, out submodule> (. defaultModule.TopLevelDecls.Add(submodule); .)
-  | ClassDecl<defaultModule, out c>             (. defaultModule.TopLevelDecls.Add(c); .)
-  | DatatypeDecl<defaultModule, out dt>         (. defaultModule.TopLevelDecls.Add(dt); .)
-  | NewtypeDecl<defaultModule, out td>          (. defaultModule.TopLevelDecls.Add(td); .)
-  | OtherTypeDecl<defaultModule, out td>        (. defaultModule.TopLevelDecls.Add(td); .)
-  | IteratorDecl<defaultModule, out iter>       (. defaultModule.TopLevelDecls.Add(iter); .)
-  | TraitDecl<defaultModule, out trait>    (. defaultModule.TopLevelDecls.Add(trait); .)
-  | ClassMemberDecl<membersDefaultClass, false, !DafnyOptions.O.AllowGlobals, false>
-  }
+  TopDecls<defaultModule, membersDefaultClass, /* isTopLevel */ true, /* isAbstract */ false>
   (. // find the default class in the default module, then append membersDefaultClass to its member list
      DefaultClassDecl defaultClass = null;
      foreach (TopLevelDecl topleveldecl in defaultModule.TopLevelDecls) {
@@ -564,43 +656,71 @@ Dafny
      } .)
   EOF
   .
-SubModuleDecl<ModuleDefinition parent, out ModuleDecl submodule>
-= (. ClassDecl/*!*/ c; DatatypeDecl/*!*/ dt; TopLevelDecl td; IteratorDecl iter;
-     Attributes attrs = null;  IToken/*!*/ id;
-     TraitDecl/*!*/ trait;
-	 List<MemberDecl/*!*/> namedModuleDefaultClassMembers = new List<MemberDecl>();;
+
+TopDecls<. ModuleDefinition module, List<MemberDecl/*!*/> membersDefaultClass, bool isTopLevel, bool isAbstract .>
+= { TopDecl<module, membersDefaultClass, isTopLevel, isAbstract> }
+  .
+
+DeclModifiers<out DeclModifierData dmod>
+= (. dmod = new DeclModifierData(); .)
+  { "abstract"                             (. dmod.IsAbstract = true;  CheckAndSetToken(ref dmod.AbstractToken); .)
+  | "ghost"                                (. dmod.IsGhost = true;  CheckAndSetToken(ref dmod.GhostToken); .)
+  | "static"                               (. dmod.IsStatic = true; CheckAndSetToken(ref dmod.StaticToken); .)
+  | "protected"                            (. dmod.IsProtected = true; CheckAndSetToken(ref dmod.ProtectedToken); .)
+  | "extern"                               (. dmod.IsExtern = true; CheckAndSetToken(ref dmod.ExternToken); .)
+    [ stringToken                          (. bool isVerbatimString;
+                                              string s = Util.RemoveParsedStringQuotes(t.val, out isVerbatimString);
+                                              dmod.ExternName = new StringLiteralExpr(t, s, isVerbatimString);
+                                           .)
+    ]
+  }
+  .
+
+TopDecl<. ModuleDefinition module, List<MemberDecl/*!*/> membersDefaultClass, bool isTopLevel, bool isAbstract .>
+= (. DeclModifierData dmod; ModuleDecl submodule;
+     ClassDecl/*!*/ c; DatatypeDecl/*!*/ dt; TopLevelDecl td; IteratorDecl iter;
+  	 TraitDecl/*!*/ trait;
+  .)
+  DeclModifiers<out dmod>
+  ( SubModuleDecl<dmod, module, out submodule> (. module.TopLevelDecls.Add(submodule); .)
+  | ClassDecl<dmod, module, out c>             (. module.TopLevelDecls.Add(c); .)
+  | DatatypeDecl<dmod, module, out dt>         (. module.TopLevelDecls.Add(dt); .)
+  | NewtypeDecl<dmod, module, out td>          (. module.TopLevelDecls.Add(td); .)
+  | OtherTypeDecl<dmod, module, out td>        (. module.TopLevelDecls.Add(td); .)
+  | IteratorDecl<dmod, module, out iter>       (. module.TopLevelDecls.Add(iter); .)
+  | TraitDecl<dmod, module, out trait>         (. module.TopLevelDecls.Add(trait); .)
+  | ClassMemberDecl<dmod, membersDefaultClass, false, !DafnyOptions.O.AllowGlobals, 
+                    !isTopLevel && DafnyOptions.O.IronDafny && isAbstract>
+  ) .
+
+SubModuleDecl<DeclModifierData dmod, ModuleDefinition parent, out ModuleDecl submodule>
+= (. Attributes attrs = null;  IToken/*!*/ id;
+	   List<MemberDecl/*!*/> namedModuleDefaultClassMembers = new List<MemberDecl>();;
      List<IToken> idRefined = null, idPath = null, idAssignment = null;
      ModuleDefinition module;
-     ModuleDecl sm;
      submodule = null; // appease compiler
-     bool isAbstract = false;
+     bool isAbstract = dmod.IsAbstract;
      bool isExclusively = false;
      bool opened = false;
+     CheckDeclModifiers(dmod, "Modules", AllowedDeclModifiers.Abstract | AllowedDeclModifiers.Extern);
   .)
-  ( [ "abstract"  (. isAbstract = true; .) ]
-    "module"
+  ( "module"
     { Attribute<ref attrs> }
     NoUSIdent<out id>
+    (. EncodeExternAsAttribute(dmod, ref attrs, id, /* needAxiom */ false); .)
 
       [ "exclusively" "refines" QualifiedModuleName<out idRefined> (. isExclusively = true; .)  
       | "refines" QualifiedModuleName<out idRefined> (. isExclusively = false; .) ] 
             (. module = new ModuleDefinition(id, id.val, isAbstract, false, isExclusively, idRefined == null ? null : idRefined, parent, attrs, false, this); .)  
        "{"                                             (. module.BodyStartTok = t; .)
-        { SubModuleDecl<module, out sm>                (. module.TopLevelDecls.Add(sm); .)
-        | ClassDecl<module, out c>                     (. module.TopLevelDecls.Add(c); .)
-        | TraitDecl<module, out trait>                 (. module.TopLevelDecls.Add(trait); .)
-		| DatatypeDecl<module, out dt>                 (. module.TopLevelDecls.Add(dt); .)
-        | NewtypeDecl<module, out td>                  (. module.TopLevelDecls.Add(td); .)
-        | OtherTypeDecl<module, out td>                (. module.TopLevelDecls.Add(td); .)
-        | IteratorDecl<module, out iter>               (. module.TopLevelDecls.Add(iter); .)
-        | ClassMemberDecl<namedModuleDefaultClassMembers, false, !DafnyOptions.O.AllowGlobals, DafnyOptions.O.IronDafny && isAbstract>
-        }
-      "}"                                  (. module.BodyEndTok = t;
+            TopDecls<module, namedModuleDefaultClassMembers, /* isTopLevel */ false, isAbstract>
+       "}"                                 (. module.BodyEndTok = t;
                                               module.TopLevelDecls.Add(new DefaultClassDecl(module, namedModuleDefaultClassMembers));
                                               submodule = new LiteralModuleDecl(module, parent); .)
   |
     "import" ["opened" (.opened = true;.)]
     NoUSIdent<out id>
+    (. EncodeExternAsAttribute(dmod, ref attrs, id, /* needAxiom */ false); .)
     [ "=" QualifiedModuleName<out idPath>
       (. submodule = new AliasModuleDecl(idPath, id, parent, opened); .)
     | "as" QualifiedModuleName<out idPath>  ["default" QualifiedModuleName<out idAssignment> ]
@@ -629,7 +749,7 @@ QualifiedModuleName<.out List<IToken> ids.>
   }
   .
 
-ClassDecl<ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c>
+ClassDecl<DeclModifierData dmodClass, ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c>
 = (. Contract.Requires(module != null);
      Contract.Ensures(Contract.ValueAtReturn(out c) != null);
      IToken/*!*/ id;
@@ -639,18 +759,21 @@ ClassDecl<ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c>
      List<TypeParameter/*!*/> typeArgs = new List<TypeParameter/*!*/>();
      List<MemberDecl/*!*/> members = new List<MemberDecl/*!*/>();
      IToken bodyStart;
+     CheckDeclModifiers(dmodClass, "Classes", AllowedDeclModifiers.Extern);
+     DeclModifierData dmod; 
   .)
   SYNC
   "class"
   { Attribute<ref attrs> }
   NoUSIdent<out id>
+  (. EncodeExternAsAttribute(dmodClass, ref attrs, id, /* needAxiom */ false); .)
   [ GenericParameters<typeArgs> ]
   ["extends" 
   Type<out trait>		(. traits.Add(trait); .) 
   {"," Type<out trait>  (. traits.Add(trait); .) }
   ]         
   "{"                                            (. bodyStart = t;  .)
-  { ClassMemberDecl<members, true, false, false>
+  { DeclModifiers<out dmod> ClassMemberDecl<dmod, members, true, false, false>
   }
   "}"
   (. c = new ClassDecl(id, id.val, module, typeArgs, members, attrs, traits);
@@ -659,14 +782,16 @@ ClassDecl<ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c>
   .)
   .
 
-    TraitDecl<ModuleDefinition/*!*/ module, out TraitDecl/*!*/ trait>
-  = (. Contract.Requires(module != null);
+TraitDecl<DeclModifierData dmodIn, ModuleDefinition/*!*/ module, out TraitDecl/*!*/ trait>
+  = (. Contract.Requires(module != null);     
+     CheckDeclModifiers(dmodIn, "Traits", AllowedDeclModifiers.None);
 	   Contract.Ensures(Contract.ValueAtReturn(out trait) != null);
 	   IToken/*!*/ id;
 	   Attributes attrs = null;
 	   List<TypeParameter/*!*/> typeArgs = new List<TypeParameter/*!*/>(); //traits should not support type parameters at the moment
 	   List<MemberDecl/*!*/> members = new List<MemberDecl/*!*/>();
 	   IToken bodyStart;
+     DeclModifierData dmod; 
     .)
 	SYNC
 	"trait"
@@ -674,7 +799,7 @@ ClassDecl<ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c>
 	NoUSIdent<out id>
 	[ GenericParameters<typeArgs> ]
 	"{"                                            (. bodyStart = t; .)
-    { ClassMemberDecl<members, true, false, false>
+    { DeclModifiers<out dmod> ClassMemberDecl<dmod, members, true, false, false>
     }
     "}"
 	(. trait = new TraitDecl(id, id.val, module, typeArgs, members, attrs);
@@ -683,44 +808,33 @@ ClassDecl<ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c>
     .)
 	.
 
-ClassMemberDecl<.List<MemberDecl> mm, bool allowConstructors, bool moduleLevelDecl, bool isWithinAbstractModule.>
+ClassMemberDecl<. DeclModifierData dmod, List<MemberDecl> mm, bool allowConstructors, bool moduleLevelDecl, bool isWithinAbstractModule.>
 = (. Contract.Requires(cce.NonNullElements(mm));
      Method/*!*/ m;
      Function/*!*/ f;
-     MemberModifiers mmod = new MemberModifiers();
-     IToken staticToken = null, protectedToken = null;
   .)
-  { "ghost"                                (. mmod.IsGhost = true; .)
-  | "static"                               (. mmod.IsStatic = true; staticToken = t; .)
-  | "protected"                            (. mmod.IsProtected = true; protectedToken = t; .)
-  }
   ( (. if (moduleLevelDecl) {
          SemErr(la, "fields are not allowed to be declared at the module level; instead, wrap the field in a 'class' declaration");
-         mmod.IsStatic = false;
-         mmod.IsProtected = false;
+         dmod.IsStatic = false;
        }
     .)
-    FieldDecl<mmod, mm>
+    FieldDecl<dmod, mm>
   | IF(IsFunctionDecl())
-    (. if (moduleLevelDecl && staticToken != null) {
-         errors.Warning(staticToken, "module-level functions are always non-instance, so the 'static' keyword is not allowed here");
-         mmod.IsStatic = false;
+    (. if (moduleLevelDecl && dmod.StaticToken != null) {
+         errors.Warning(dmod.StaticToken, "module-level functions are always non-instance, so the 'static' keyword is not allowed here");
+         dmod.IsStatic = false;
        }
     .)
-    FunctionDecl<mmod, isWithinAbstractModule, out f>                   (. mm.Add(f); .)
-  | (. if (moduleLevelDecl && staticToken != null) {
-         errors.Warning(staticToken, "module-level methods are always non-instance, so the 'static' keyword is not allowed here");
-         mmod.IsStatic = false;
-       }
-       if (protectedToken != null) {
-         SemErr(protectedToken, "only functions, not methods, can be declared 'protected'");
-         mmod.IsProtected = false;
+    FunctionDecl<dmod, isWithinAbstractModule, out f>                   (. mm.Add(f); .)
+  | (. if (moduleLevelDecl && dmod.StaticToken != null) {
+         errors.Warning(dmod.StaticToken, "module-level methods are always non-instance, so the 'static' keyword is not allowed here");
+         dmod.IsStatic = false;
        }
     .)
-    MethodDecl<mmod, allowConstructors, isWithinAbstractModule, out m>  (. mm.Add(m); .)
+    MethodDecl<dmod, allowConstructors, isWithinAbstractModule, out m>  (. mm.Add(m); .)
   )
   .
-DatatypeDecl<ModuleDefinition/*!*/ module, out DatatypeDecl/*!*/ dt>
+DatatypeDecl<DeclModifierData dmod, ModuleDefinition/*!*/ module, out DatatypeDecl/*!*/ dt>
 = (. Contract.Requires(module != null);
      Contract.Ensures(Contract.ValueAtReturn(out dt)!=null);
      IToken/*!*/ id;
@@ -729,6 +843,7 @@ DatatypeDecl<ModuleDefinition/*!*/ module, out DatatypeDecl/*!*/ dt>
      List<DatatypeCtor/*!*/> ctors = new List<DatatypeCtor/*!*/>();
      IToken bodyStart = Token.NoToken;  // dummy assignment
      bool co = false;
+     CheckDeclModifiers(dmod, "Datatypes or codatatypes", AllowedDeclModifiers.None);
   .)
   SYNC
   ( "datatype"
@@ -766,27 +881,27 @@ DatatypeMemberDecl<.List<DatatypeCtor/*!*/>/*!*/ ctors.>
   [ FormalsOptionalIds<formals> ]
   (. ctors.Add(new DatatypeCtor(id, id.val, formals, attrs)); .)
   .
-FieldDecl<.MemberModifiers mmod, List<MemberDecl/*!*/>/*!*/ mm.>
+FieldDecl<.DeclModifierData dmod, List<MemberDecl/*!*/>/*!*/ mm.>
 = (. Contract.Requires(cce.NonNullElements(mm));
      Attributes attrs = null;
      IToken/*!*/ id;  Type/*!*/ ty;
+     CheckDeclModifiers(dmod, "Fields", AllowedDeclModifiers.Ghost);
   .)
   SYNC
   "var"
-  (. if (mmod.IsStatic) { SemErr(t, "fields cannot be declared 'static'"); }
-  .)
   { Attribute<ref attrs> }
-  FIdentType<out id, out ty>                        (. mm.Add(new Field(id, id.val, mmod.IsGhost, ty, attrs)); .)
-  { "," FIdentType<out id, out ty>                  (. mm.Add(new Field(id, id.val, mmod.IsGhost, ty, attrs)); .)
+  FIdentType<out id, out ty>                        (. mm.Add(new Field(id, id.val, dmod.IsGhost, ty, attrs)); .)
+  { "," FIdentType<out id, out ty>                  (. mm.Add(new Field(id, id.val, dmod.IsGhost, ty, attrs)); .)
   }
   OldSemi
   .
-NewtypeDecl<ModuleDefinition module, out TopLevelDecl td>
+NewtypeDecl<DeclModifierData dmod, ModuleDefinition module, out TopLevelDecl td>
 = (. IToken id, bvId;
      Attributes attrs = null;
      td = null;
      Type baseType = null;
      Expression wh;
+     CheckDeclModifiers(dmod, "Newtypes", AllowedDeclModifiers.None);
   .)
   "newtype"
   { Attribute<ref attrs> }
@@ -800,13 +915,14 @@ NewtypeDecl<ModuleDefinition module, out TopLevelDecl td>
   | Type<out baseType>               (. td = new NewtypeDecl(theVerifyThisFile ? id : new IncludeToken(id), id.val, module, baseType, attrs); .)
   )
   .
-OtherTypeDecl<ModuleDefinition module, out TopLevelDecl td>
+OtherTypeDecl<DeclModifierData dmod, ModuleDefinition module, out TopLevelDecl td>
 = (. IToken id;
      Attributes attrs = null;
      var eqSupport = TypeParameter.EqualitySupportValue.Unspecified;
      var typeArgs = new List<TypeParameter>();
      td = null;
      Type ty;
+     CheckDeclModifiers(dmod, "Type aliases", AllowedDeclModifiers.None);
   .)
   "type"
   { Attribute<ref attrs> }
@@ -902,7 +1018,7 @@ TypeIdentOptional<out IToken/*!*/ id, out string/*!*/ identName, out Type/*!*/ t
   .)
   .
 /*------------------------------------------------------------------------*/
-IteratorDecl<ModuleDefinition module, out IteratorDecl/*!*/ iter>
+IteratorDecl<DeclModifierData dmod, ModuleDefinition module, out IteratorDecl/*!*/ iter>
 = (. Contract.Ensures(Contract.ValueAtReturn(out iter) != null);
      IToken/*!*/ id;
      Attributes attrs = null;
@@ -924,6 +1040,7 @@ IteratorDecl<ModuleDefinition module, out IteratorDecl/*!*/ iter>
      IToken signatureEllipsis = null;
      IToken bodyStart = Token.NoToken;
      IToken bodyEnd = Token.NoToken;
+     CheckDeclModifiers(dmod, "Iterators", AllowedDeclModifiers.None);
   .)
   SYNC
   "iterator"
@@ -969,7 +1086,7 @@ GenericParameters<.List<TypeParameter/*!*/>/*!*/ typeArgs.>
   ">"
   .
 /*------------------------------------------------------------------------*/
-MethodDecl<MemberModifiers mmod, bool allowConstructor, bool isWithinAbstractModule, out Method/*!*/ m>
+MethodDecl<DeclModifierData dmod, bool allowConstructor, bool isWithinAbstractModule, out Method/*!*/ m>
 = (. Contract.Ensures(Contract.ValueAtReturn(out m) !=null);
      IToken/*!*/ id = Token.NoToken;
      bool hasName = false;  IToken keywordToken;
@@ -991,43 +1108,36 @@ MethodDecl<MemberModifiers mmod, bool allowConstructor, bool isWithinAbstractMod
      IToken signatureEllipsis = null;
      IToken bodyStart = Token.NoToken;
      IToken bodyEnd = Token.NoToken;
+     AllowedDeclModifiers allowed = AllowedDeclModifiers.None;
+     string caption = "";
   .)
   SYNC
-  ( "method"
-  | "lemma"                         (. isLemma = true; .)
-  | "colemma"                       (. isCoLemma = true; .)
-  | "comethod"                      (. isCoLemma = true;
+  ( "method"                        (. caption = "Methods";
+                                       allowed = AllowedDeclModifiers.Ghost | AllowedDeclModifiers.Static 
+                                         | AllowedDeclModifiers.Extern; .)
+  | "lemma"                         (. isLemma = true; caption = "Lemmas";
+                                       allowed = AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static 
+                                         | AllowedDeclModifiers.Protected; .)
+  | "colemma"                       (. isCoLemma = true; caption = "Colemmas";
+                                       allowed = AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static 
+                                         | AllowedDeclModifiers.Protected; .)
+  | "comethod"                      (. isCoLemma = true; caption = "Comethods";
+                                       allowed = AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static 
+                                         | AllowedDeclModifiers.Protected;
                                        errors.Warning(t, "the 'comethod' keyword has been deprecated; it has been renamed to 'colemma'");
                                     .)
-  | "inductive" "lemma"             (. isIndLemma = true; .)
+  | "inductive" "lemma"             (. isIndLemma = true;  caption = "Inductive lemmas";
+                                       allowed = AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static;.)
   | "constructor"                   (. if (allowConstructor) {
                                          isConstructor = true;
                                        } else {
                                          SemErr(t, "constructors are allowed only in classes");
-                                       }
+                                       } 
+                                       caption = "Constructors";
+                                       allowed = AllowedDeclModifiers.None;
                                     .)
-  )                                 (. keywordToken = t; .)
-  (. if (isLemma) {
-       if (mmod.IsGhost) {
-         SemErr(t, "lemmas cannot be declared 'ghost' (they are automatically 'ghost')");
-       }
-     } else if (isConstructor) {
-       if (mmod.IsGhost) {
-         SemErr(t, "constructors cannot be declared 'ghost'");
-       }
-       if (mmod.IsStatic) {
-         SemErr(t, "constructors cannot be declared 'static'");
-       }
-     } else if (isIndLemma) {
-       if (mmod.IsGhost) {
-         SemErr(t, "inductive lemmas cannot be declared 'ghost' (they are automatically 'ghost')");
-       }
-     } else if (isCoLemma) {
-       if (mmod.IsGhost) {
-         SemErr(t, "colemmas cannot be declared 'ghost' (they are automatically 'ghost')");
-       }
-     }
-  .)
+  )                                 (. keywordToken = t; 
+                                       CheckDeclModifiers(dmod, caption, allowed); .)
   { Attribute<ref attrs> }
   [ NoUSIdent<out id>               (. hasName = true; .)
   ]
@@ -1037,12 +1147,13 @@ MethodDecl<MemberModifiers mmod, bool allowConstructor, bool isWithinAbstractMod
          SemErr(la, "a method must be given a name (expecting identifier)");
        }
      }
+     EncodeExternAsAttribute(dmod, ref attrs, id, /* needAxiom */ true);
   .)
   (
     [ GenericParameters<typeArgs> ]
-    Formals<true, !mmod.IsGhost, ins>
+    Formals<true, !dmod.IsGhost, ins>
     [ "returns"                                 (. if (isConstructor) { SemErr(t, "constructors cannot have out-parameters"); } .)
-      Formals<false, !mmod.IsGhost, outs>
+      Formals<false, !dmod.IsGhost, outs>
     ]
   | "..."                                       (. signatureEllipsis = t; .)
   )
@@ -1059,16 +1170,16 @@ MethodDecl<MemberModifiers mmod, bool allowConstructor, bool isWithinAbstractMod
        m = new Constructor(tok, hasName ? id.val : "_ctor", typeArgs, ins,
                            req, new Specification<FrameExpression>(mod, modAttrs), ens, new Specification<Expression>(dec, decAttrs), body, attrs, signatureEllipsis);
      } else if (isIndLemma) {
-       m = new InductiveLemma(tok, id.val, mmod.IsStatic, typeArgs, ins, outs,
+       m = new InductiveLemma(tok, id.val, dmod.IsStatic, typeArgs, ins, outs,
                               req, new Specification<FrameExpression>(mod, modAttrs), ens, new Specification<Expression>(dec, decAttrs), body, attrs, signatureEllipsis);
      } else if (isCoLemma) {
-       m = new CoLemma(tok, id.val, mmod.IsStatic, typeArgs, ins, outs,
+       m = new CoLemma(tok, id.val, dmod.IsStatic, typeArgs, ins, outs,
                        req, new Specification<FrameExpression>(mod, modAttrs), ens, new Specification<Expression>(dec, decAttrs), body, attrs, signatureEllipsis);
      } else if (isLemma) {
-       m = new Lemma(tok, id.val, mmod.IsStatic, typeArgs, ins, outs,
+       m = new Lemma(tok, id.val, dmod.IsStatic, typeArgs, ins, outs,
                      req, new Specification<FrameExpression>(mod, modAttrs), ens, new Specification<Expression>(dec, decAttrs), body, attrs, signatureEllipsis);
      } else {
-       m = new Method(tok, id.val, mmod.IsStatic, mmod.IsGhost, typeArgs, ins, outs,
+       m = new Method(tok, id.val, dmod.IsStatic, dmod.IsGhost, typeArgs, ins, outs,
                       req, new Specification<FrameExpression>(mod, modAttrs), ens, new Specification<Expression>(dec, decAttrs), body, attrs, signatureEllipsis);
      }
      m.BodyStartTok = bodyStart;
@@ -1273,7 +1384,7 @@ GenericInstantiation<.List<Type/*!*/>/*!*/ gt.>
   ">"
   .
 /*------------------------------------------------------------------------*/
-FunctionDecl<MemberModifiers mmod, bool isWithinAbstractModule, out Function/*!*/ f>
+FunctionDecl<DeclModifierData dmod, bool isWithinAbstractModule, out Function/*!*/ f>
 = (. Contract.Ensures(Contract.ValueAtReturn(out f)!=null);
      Attributes attrs = null;
      IToken/*!*/ id = Token.NoToken;  // to please compiler
@@ -1296,7 +1407,13 @@ FunctionDecl<MemberModifiers mmod, bool isWithinAbstractModule, out Function/*!*
   ( "function"
     [ "method"                 (. isFunctionMethod = true; .)
     ]
-    (. if (mmod.IsGhost) { SemErr(t, "functions cannot be declared 'ghost' (they are ghost by default)"); }
+    (. AllowedDeclModifiers allowed = AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static | AllowedDeclModifiers.Protected;
+       string caption = "Functions";
+       if (isFunctionMethod) { 
+         allowed |= AllowedDeclModifiers.Extern; 
+         caption = "Function methods";
+       }
+       CheckDeclModifiers(dmod, caption, allowed);
     .)
     { Attribute<ref attrs> }
     NoUSIdent<out id>
@@ -1312,7 +1429,13 @@ FunctionDecl<MemberModifiers mmod, bool isWithinAbstractModule, out Function/*!*
   | "predicate"                (. isPredicate = true; .)
     [ "method"                 (. isFunctionMethod = true; .)
     ]
-    (. if (mmod.IsGhost) { SemErr(t, "predicates cannot be declared 'ghost' (they are ghost by default)"); }
+    (. AllowedDeclModifiers allowed = AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static | AllowedDeclModifiers.Protected;
+       string caption = "Predicates";
+       if (isFunctionMethod) { 
+         allowed |= AllowedDeclModifiers.Extern; 
+         caption = "Predicate methods";
+       }
+       CheckDeclModifiers(dmod, caption, allowed);
     .)
     { Attribute<ref attrs> }
     NoUSIdent<out id>
@@ -1327,7 +1450,8 @@ FunctionDecl<MemberModifiers mmod, bool isWithinAbstractModule, out Function/*!*
 
   /* ----- inductive predicate ----- */
   | "inductive" "predicate"    (. isIndPredicate = true; .)
-    (. if (mmod.IsGhost) { SemErr(t, "inductive predicates cannot be declared 'ghost' (they are ghost by default)"); }
+    (. CheckDeclModifiers(dmod, "Inductive predicates",
+         AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static | AllowedDeclModifiers.Protected);
     .)
     { Attribute<ref attrs> }
     NoUSIdent<out id>
@@ -1341,7 +1465,8 @@ FunctionDecl<MemberModifiers mmod, bool isWithinAbstractModule, out Function/*!*
 
   /* ----- copredicate ----- */
   | "copredicate"              (. isCoPredicate = true; .)
-    (. if (mmod.IsGhost) { SemErr(t, "copredicates cannot be declared 'ghost' (they are ghost by default)"); }
+    (. CheckDeclModifiers(dmod, "Copredicates",
+         AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static | AllowedDeclModifiers.Protected);
     .)
     { Attribute<ref attrs> }
     NoUSIdent<out id>
@@ -1358,22 +1483,23 @@ FunctionDecl<MemberModifiers mmod, bool isWithinAbstractModule, out Function/*!*
   { FunctionSpec<reqs, reads, ens, decreases> }
   [ FunctionBody<out body, out bodyStart, out bodyEnd>
   ]
-  (. if (!isWithinAbstractModule && DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported")) {
+  (. if (!isWithinAbstractModule && DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 &&
+         !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported")) {
         SemErr(t, "a function with an ensures clause must have a body, unless given the :axiom attribute");
      }
-
+     EncodeExternAsAttribute(dmod, ref attrs, id, /* needAxiom */ true);
      IToken tok = theVerifyThisFile ? id : new IncludeToken(id);
      if (isPredicate) {
-        f = new Predicate(tok, id.val, mmod.IsStatic, mmod.IsProtected, !isFunctionMethod, typeArgs, formals,
+        f = new Predicate(tok, id.val, dmod.IsStatic, dmod.IsProtected, !isFunctionMethod, typeArgs, formals,
                           reqs, reads, ens, new Specification<Expression>(decreases, null), body, Predicate.BodyOriginKind.OriginalOrInherited, attrs, signatureEllipsis);
      } else if (isIndPredicate) {
-        f = new InductivePredicate(tok, id.val, mmod.IsStatic, mmod.IsProtected, typeArgs, formals,
+        f = new InductivePredicate(tok, id.val, dmod.IsStatic, dmod.IsProtected, typeArgs, formals,
                                    reqs, reads, ens, body, attrs, signatureEllipsis);
      } else if (isCoPredicate) {
-        f = new CoPredicate(tok, id.val, mmod.IsStatic, mmod.IsProtected, typeArgs, formals,
+        f = new CoPredicate(tok, id.val, dmod.IsStatic, dmod.IsProtected, typeArgs, formals,
                             reqs, reads, ens, body, attrs, signatureEllipsis);
      } else {
-        f = new Function(tok, id.val, mmod.IsStatic, mmod.IsProtected, !isFunctionMethod, typeArgs, formals, returnType,
+        f = new Function(tok, id.val, dmod.IsStatic, dmod.IsProtected, !isFunctionMethod, typeArgs, formals, returnType,
                          reqs, reads, ens, new Specification<Expression>(decreases, null), body, attrs, signatureEllipsis);
      }
      f.BodyStartTok = bodyStart;
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 4c1e2bd7..a51e30de 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -1059,7 +1059,7 @@ namespace Microsoft.Dafny {
     public virtual string FullCompileName {
       get {
         if (ResolvedClass != null && !ResolvedClass.Module.IsDefaultModule) {
-          return ResolvedClass.Module.CompileName + ".@" + CompileName;
+          return ResolvedClass.Module.CompileName + ".@" + ResolvedClass.CompileName;
         } else {
           return CompileName;
         }
@@ -1536,7 +1536,17 @@ namespace Microsoft.Dafny {
     public virtual string CompileName {
       get {
         if (compileName == null) {
-          compileName = NonglobalVariable.CompilerizeName(Name);
+          object externValue = "";
+          string errorMessage = "";
+          bool isExternal = Attributes.ContainsMatchingValue(this.Attributes, "extern", ref externValue,
+            new Attributes.MatchingValueOption[] { Attributes.MatchingValueOption.String },
+            err => errorMessage = err);
+          if (isExternal) {
+            compileName = (string)externValue;
+          }
+          else {
+            compileName = NonglobalVariable.CompilerizeName(Name);
+          }
         }
         return compileName;
       }
@@ -1835,10 +1845,19 @@ namespace Microsoft.Dafny {
     public string CompileName {
       get {
         if (compileName == null) {
-          if (IsBuiltinName)
-            compileName = Name;
-          else
-            compileName = "_" + Height.ToString() + "_" + NonglobalVariable.CompilerizeName(Name);
+          object externValue = "";
+          string errorMessage = "";
+          bool isExternal = Attributes.ContainsMatchingValue(this.Attributes, "extern", ref externValue,
+            new Attributes.MatchingValueOption[] { Attributes.MatchingValueOption.String },
+            err => errorMessage = err);
+          if (isExternal) {
+            compileName = (string)externValue;
+          } else {
+            if (IsBuiltinName)
+              compileName = Name;
+            else
+              compileName = "_" + Height.ToString() + "_" + NonglobalVariable.CompilerizeName(Name);
+          }
         }
         return compileName;
       }
diff --git a/Source/Dafny/Makefile b/Source/Dafny/Makefile
index 68ab7a2d..a61539b0 100644
--- a/Source/Dafny/Makefile
+++ b/Source/Dafny/Makefile
@@ -4,8 +4,8 @@
 # from http://boogiepartners.codeplex.com/. Update the FRAME_DIR variable to
 # point to whatever directory you install that into.
 # ###############################################################################
-COCO_EXE_DIR = ..\..\..\boogie-partners\CocoR\bin
-FRAME_DIR = ..\..\..\boogie-partners\CocoR\Modified
+COCO_EXE_DIR = ..\..\..\coco
+FRAME_DIR = ..\..\..\boogiepartners\CocoR\Modified
 COCO = $(COCO_EXE_DIR)\Coco.exe
 
 # "all" depends on 2 files, really (Parser.cs and Scanner.cs), but they
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index 922aad75..dc661fc5 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -73,7 +73,7 @@ public class Parser {
 	public const int _star = 57;
 	public const int _notIn = 58;
 	public const int _ellipsis = 59;
-	public const int maxT = 138;
+	public const int maxT = 139;
 
 	const bool _T = true;
 	const bool _x = false;
@@ -95,10 +95,113 @@ readonly BuiltIns theBuiltIns;
 readonly bool theVerifyThisFile;
 int anonymousIds = 0;
 
-struct MemberModifiers {
+/// <summary>
+/// Holds the modifiers given for a declaration
+///
+/// Not all modifiers are applicable to all kinds of declarations.
+/// Errors are given when a modify does not apply.
+/// We also record the tokens for the specified modifiers so that
+/// they can be used in error messages.
+/// </summary>
+struct DeclModifierData {
+  public bool IsAbstract;
+  public IToken AbstractToken;
   public bool IsGhost;
+  public IToken GhostToken;
   public bool IsStatic;
+  public IToken StaticToken;
   public bool IsProtected;
+  public IToken ProtectedToken;
+  public bool IsExtern;
+  public IToken ExternToken;
+  public StringLiteralExpr ExternName;
+
+}
+
+// Check that token has not been set, then set it.
+public void CheckAndSetToken(ref IToken token)
+{
+    if (token != null) {
+      SemErr(t, "Duplicate declaration modifier: " + t.val);
+    }
+    token = t;
+}
+
+/// <summary>
+// A flags type used to tell what declaration modifiers are allowed for a declaration.
+/// </summary>
+[Flags]
+enum AllowedDeclModifiers {
+  None = 0,
+  Abstract = 1,
+  Ghost = 2,
+
+  // Means ghost not allowed because already implicitly ghost.
+  AlreadyGhost = 4,
+  Static = 8,
+  Protected = 16, 
+  Extern = 32
+};
+
+/// <summary>
+/// Check the declaration modifiers against those that are allowed.
+///
+/// The 'allowed' parameter specifies which declaratio modifiers are allowed.
+/// The 'declCaption' parameter should be a string describing the kind of declaration. 
+/// It is used in error messages.
+/// Any declaration modifiers that are present but not allowed are cleared.
+///</summary>
+void CheckDeclModifiers(DeclModifierData dmod, string declCaption, AllowedDeclModifiers allowed)
+{
+  if (dmod.IsAbstract && ((allowed & AllowedDeclModifiers.Abstract) == 0)) {
+    SemErr(dmod.AbstractToken, declCaption + " cannot be declared 'abstract'.");
+    dmod.IsAbstract = false;
+  }
+  if (dmod.IsGhost) {
+    if ((allowed & AllowedDeclModifiers.AlreadyGhost) != 0) {
+      SemErr(dmod.GhostToken, declCaption + " cannot be declared ghost (they are 'ghost' by default).");
+      dmod.IsGhost = false;
+    } else if ((allowed & AllowedDeclModifiers.Ghost) == 0) {
+      SemErr(dmod.GhostToken, declCaption + " cannot be declared 'ghost'.");
+      dmod.IsGhost = false;
+    }
+  }
+  if (dmod.IsStatic && ((allowed & AllowedDeclModifiers.Static) == 0)) {
+    SemErr(dmod.StaticToken, declCaption + " cannot be declared 'static'.");
+    dmod.IsStatic = false;
+  }
+  if (dmod.IsProtected && ((allowed & AllowedDeclModifiers.Protected) == 0)) {
+    SemErr(dmod.ProtectedToken, declCaption + " cannot be declared 'protected'.");
+    dmod.IsProtected = false;
+  }
+  if (dmod.IsExtern && ((allowed & AllowedDeclModifiers.Extern) == 0)) {
+    SemErr(dmod.ExternToken, declCaption + " cannot be declared 'extern'.");
+    dmod.IsExtern = false;
+  }
+}
+
+/// <summary>
+/// Encode an 'extern' declaration modifier as an {:extern name} attribute.
+///
+/// We also include an {:axiom} attribute since the specification of an
+/// external entity is assumed to hold, but only for methods or functions.
+///</summary>
+static void EncodeExternAsAttribute(DeclModifierData dmod, ref Attributes attrs, IToken/*!*/ id, bool needAxiom) {
+  if (dmod.IsExtern) {
+    StringLiteralExpr name = dmod.ExternName;
+    if (name == null) {
+      bool isVerbatimString = false;
+      name = new StringLiteralExpr(id, id.val, isVerbatimString);
+    }
+    var args = new List<Expression>();
+    args.Add(name);
+    attrs = new Attributes("extern", args, attrs);
+
+    // Also 'extern' implies 'axiom' for methods or functions.
+    if (needAxiom) {
+      attrs = new Attributes("axiom", new List<Expression>(), attrs);
+    }
+  }
 }
 
 ///<summary>
@@ -543,13 +646,10 @@ bool IsType(ref IToken pt) {
 
 
 	void Dafny() {
-		ClassDecl/*!*/ c; DatatypeDecl/*!*/ dt; TopLevelDecl td; IteratorDecl iter;
 		List<MemberDecl/*!*/> membersDefaultClass = new List<MemberDecl/*!*/>();
-		ModuleDecl submodule;
 		// to support multiple files, create a default module only if theModule is null
 		DefaultModuleDecl defaultModule = (DefaultModuleDecl)((LiteralModuleDecl)theModule).ModuleDef;
 		// theModule should be a DefaultModuleDecl (actually, the singular DefaultModuleDecl)
-		TraitDecl/*!*/ trait;
 		Contract.Assert(defaultModule != null);
 		
 		while (la.kind == 60) {
@@ -570,49 +670,7 @@ bool IsType(ref IToken pt) {
 			}
 			
 		}
-		while (StartOf(1)) {
-			switch (la.kind) {
-			case 61: case 62: case 65: {
-				SubModuleDecl(defaultModule, out submodule);
-				defaultModule.TopLevelDecls.Add(submodule); 
-				break;
-			}
-			case 70: {
-				ClassDecl(defaultModule, out c);
-				defaultModule.TopLevelDecls.Add(c); 
-				break;
-			}
-			case 76: case 77: {
-				DatatypeDecl(defaultModule, out dt);
-				defaultModule.TopLevelDecls.Add(dt); 
-				break;
-			}
-			case 79: {
-				NewtypeDecl(defaultModule, out td);
-				defaultModule.TopLevelDecls.Add(td); 
-				break;
-			}
-			case 80: {
-				OtherTypeDecl(defaultModule, out td);
-				defaultModule.TopLevelDecls.Add(td); 
-				break;
-			}
-			case 81: {
-				IteratorDecl(defaultModule, out iter);
-				defaultModule.TopLevelDecls.Add(iter); 
-				break;
-			}
-			case 72: {
-				TraitDecl(defaultModule, out trait);
-				defaultModule.TopLevelDecls.Add(trait); 
-				break;
-			}
-			case 38: case 39: case 40: case 41: case 42: case 73: case 74: case 75: case 78: case 84: case 85: case 86: case 87: {
-				ClassMemberDecl(membersDefaultClass, false, !DafnyOptions.O.AllowGlobals, false);
-				break;
-			}
-			}
-		}
+		TopDecls(defaultModule, membersDefaultClass, /* isTopLevel */ true, /* isAbstract */ false);
 		DefaultClassDecl defaultClass = null;
 		foreach (TopLevelDecl topleveldecl in defaultModule.TopLevelDecls) {
 		 defaultClass = topleveldecl as DefaultClassDecl;
@@ -628,33 +686,114 @@ bool IsType(ref IToken pt) {
 		Expect(0);
 	}
 
-	void SubModuleDecl(ModuleDefinition parent, out ModuleDecl submodule) {
+	void TopDecls(ModuleDefinition module, List<MemberDecl/*!*/> membersDefaultClass, bool isTopLevel, bool isAbstract ) {
+		while (StartOf(1)) {
+			TopDecl(module, membersDefaultClass, isTopLevel, isAbstract);
+		}
+	}
+
+	void TopDecl(ModuleDefinition module, List<MemberDecl/*!*/> membersDefaultClass, bool isTopLevel, bool isAbstract ) {
+		DeclModifierData dmod; ModuleDecl submodule;
 		ClassDecl/*!*/ c; DatatypeDecl/*!*/ dt; TopLevelDecl td; IteratorDecl iter;
-		Attributes attrs = null;  IToken/*!*/ id;
 		TraitDecl/*!*/ trait;
+		
+		DeclModifiers(out dmod);
+		switch (la.kind) {
+		case 66: case 69: {
+			SubModuleDecl(dmod, module, out submodule);
+			module.TopLevelDecls.Add(submodule); 
+			break;
+		}
+		case 74: {
+			ClassDecl(dmod, module, out c);
+			module.TopLevelDecls.Add(c); 
+			break;
+		}
+		case 77: case 78: {
+			DatatypeDecl(dmod, module, out dt);
+			module.TopLevelDecls.Add(dt); 
+			break;
+		}
+		case 80: {
+			NewtypeDecl(dmod, module, out td);
+			module.TopLevelDecls.Add(td); 
+			break;
+		}
+		case 81: {
+			OtherTypeDecl(dmod, module, out td);
+			module.TopLevelDecls.Add(td); 
+			break;
+		}
+		case 82: {
+			IteratorDecl(dmod, module, out iter);
+			module.TopLevelDecls.Add(iter); 
+			break;
+		}
+		case 76: {
+			TraitDecl(dmod, module, out trait);
+			module.TopLevelDecls.Add(trait); 
+			break;
+		}
+		case 38: case 39: case 40: case 41: case 42: case 79: case 85: case 86: case 87: case 88: {
+			ClassMemberDecl(dmod, membersDefaultClass, false, !DafnyOptions.O.AllowGlobals, 
+!isTopLevel && DafnyOptions.O.IronDafny && isAbstract);
+			break;
+		}
+		default: SynErr(140); break;
+		}
+	}
+
+	void DeclModifiers(out DeclModifierData dmod) {
+		dmod = new DeclModifierData(); 
+		while (StartOf(2)) {
+			if (la.kind == 61) {
+				Get();
+				dmod.IsAbstract = true;  CheckAndSetToken(ref dmod.AbstractToken); 
+			} else if (la.kind == 62) {
+				Get();
+				dmod.IsGhost = true;  CheckAndSetToken(ref dmod.GhostToken); 
+			} else if (la.kind == 63) {
+				Get();
+				dmod.IsStatic = true; CheckAndSetToken(ref dmod.StaticToken); 
+			} else if (la.kind == 64) {
+				Get();
+				dmod.IsProtected = true; CheckAndSetToken(ref dmod.ProtectedToken); 
+			} else {
+				Get();
+				dmod.IsExtern = true; CheckAndSetToken(ref dmod.ExternToken); 
+				if (la.kind == 20) {
+					Get();
+					bool isVerbatimString;
+					string s = Util.RemoveParsedStringQuotes(t.val, out isVerbatimString);
+					dmod.ExternName = new StringLiteralExpr(t, s, isVerbatimString);
+					
+				}
+			}
+		}
+	}
+
+	void SubModuleDecl(DeclModifierData dmod, ModuleDefinition parent, out ModuleDecl submodule) {
+		Attributes attrs = null;  IToken/*!*/ id;
 		List<MemberDecl/*!*/> namedModuleDefaultClassMembers = new List<MemberDecl>();;
 		List<IToken> idRefined = null, idPath = null, idAssignment = null;
 		ModuleDefinition module;
-		ModuleDecl sm;
 		submodule = null; // appease compiler
-		bool isAbstract = false;
+		bool isAbstract = dmod.IsAbstract;
 		bool isExclusively = false;
 		bool opened = false;
+		CheckDeclModifiers(dmod, "Modules", AllowedDeclModifiers.Abstract | AllowedDeclModifiers.Extern);
 		
-		if (la.kind == 61 || la.kind == 62) {
-			if (la.kind == 61) {
-				Get();
-				isAbstract = true; 
-			}
-			Expect(62);
+		if (la.kind == 66) {
+			Get();
 			while (la.kind == 46) {
 				Attribute(ref attrs);
 			}
 			NoUSIdent(out id);
-			if (la.kind == 63 || la.kind == 64) {
-				if (la.kind == 63) {
+			EncodeExternAsAttribute(dmod, ref attrs, id, /* needAxiom */ false); 
+			if (la.kind == 67 || la.kind == 68) {
+				if (la.kind == 67) {
 					Get();
-					Expect(64);
+					Expect(68);
 					QualifiedModuleName(out idRefined);
 					isExclusively = true; 
 				} else {
@@ -666,69 +805,28 @@ bool IsType(ref IToken pt) {
 			module = new ModuleDefinition(id, id.val, isAbstract, false, isExclusively, idRefined == null ? null : idRefined, parent, attrs, false, this); 
 			Expect(46);
 			module.BodyStartTok = t; 
-			while (StartOf(1)) {
-				switch (la.kind) {
-				case 61: case 62: case 65: {
-					SubModuleDecl(module, out sm);
-					module.TopLevelDecls.Add(sm); 
-					break;
-				}
-				case 70: {
-					ClassDecl(module, out c);
-					module.TopLevelDecls.Add(c); 
-					break;
-				}
-				case 72: {
-					TraitDecl(module, out trait);
-					module.TopLevelDecls.Add(trait); 
-					break;
-				}
-				case 76: case 77: {
-					DatatypeDecl(module, out dt);
-					module.TopLevelDecls.Add(dt); 
-					break;
-				}
-				case 79: {
-					NewtypeDecl(module, out td);
-					module.TopLevelDecls.Add(td); 
-					break;
-				}
-				case 80: {
-					OtherTypeDecl(module, out td);
-					module.TopLevelDecls.Add(td); 
-					break;
-				}
-				case 81: {
-					IteratorDecl(module, out iter);
-					module.TopLevelDecls.Add(iter); 
-					break;
-				}
-				case 38: case 39: case 40: case 41: case 42: case 73: case 74: case 75: case 78: case 84: case 85: case 86: case 87: {
-					ClassMemberDecl(namedModuleDefaultClassMembers, false, !DafnyOptions.O.AllowGlobals, DafnyOptions.O.IronDafny && isAbstract);
-					break;
-				}
-				}
-			}
+			TopDecls(module, namedModuleDefaultClassMembers, /* isTopLevel */ false, isAbstract);
 			Expect(47);
 			module.BodyEndTok = t;
 			module.TopLevelDecls.Add(new DefaultClassDecl(module, namedModuleDefaultClassMembers));
 			submodule = new LiteralModuleDecl(module, parent); 
-		} else if (la.kind == 65) {
+		} else if (la.kind == 69) {
 			Get();
-			if (la.kind == 66) {
+			if (la.kind == 70) {
 				Get();
 				opened = true;
 			}
 			NoUSIdent(out id);
-			if (la.kind == 67 || la.kind == 68) {
-				if (la.kind == 67) {
+			EncodeExternAsAttribute(dmod, ref attrs, id, /* needAxiom */ false); 
+			if (la.kind == 71 || la.kind == 72) {
+				if (la.kind == 71) {
 					Get();
 					QualifiedModuleName(out idPath);
 					submodule = new AliasModuleDecl(idPath, id, parent, opened); 
 				} else {
 					Get();
 					QualifiedModuleName(out idPath);
-					if (la.kind == 69) {
+					if (la.kind == 73) {
 						Get();
 						QualifiedModuleName(out idAssignment);
 					}
@@ -736,7 +834,7 @@ bool IsType(ref IToken pt) {
 				}
 			}
 			if (la.kind == 28) {
-				while (!(la.kind == 0 || la.kind == 28)) {SynErr(139); Get();}
+				while (!(la.kind == 0 || la.kind == 28)) {SynErr(141); Get();}
 				Get();
 				errors.Warning(t, "the semi-colon that used to terminate a sub-module declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 			}
@@ -746,10 +844,10 @@ bool IsType(ref IToken pt) {
 			 submodule = new AliasModuleDecl(idPath, id, parent, opened);
 			}
 			
-		} else SynErr(140);
+		} else SynErr(142);
 	}
 
-	void ClassDecl(ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c) {
+	void ClassDecl(DeclModifierData dmodClass, ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c) {
 		Contract.Requires(module != null);
 		Contract.Ensures(Contract.ValueAtReturn(out c) != null);
 		IToken/*!*/ id;
@@ -759,17 +857,20 @@ bool IsType(ref IToken pt) {
 		List<TypeParameter/*!*/> typeArgs = new List<TypeParameter/*!*/>();
 		List<MemberDecl/*!*/> members = new List<MemberDecl/*!*/>();
 		IToken bodyStart;
+		CheckDeclModifiers(dmodClass, "Classes", AllowedDeclModifiers.Extern);
+		DeclModifierData dmod; 
 		
-		while (!(la.kind == 0 || la.kind == 70)) {SynErr(141); Get();}
-		Expect(70);
+		while (!(la.kind == 0 || la.kind == 74)) {SynErr(143); Get();}
+		Expect(74);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
+		EncodeExternAsAttribute(dmodClass, ref attrs, id, /* needAxiom */ false); 
 		if (la.kind == 52) {
 			GenericParameters(typeArgs);
 		}
-		if (la.kind == 71) {
+		if (la.kind == 75) {
 			Get();
 			Type(out trait);
 			traits.Add(trait); 
@@ -781,8 +882,9 @@ bool IsType(ref IToken pt) {
 		}
 		Expect(46);
 		bodyStart = t;  
-		while (StartOf(2)) {
-			ClassMemberDecl(members, true, false, false);
+		while (StartOf(3)) {
+			DeclModifiers(out dmod);
+			ClassMemberDecl(dmod, members, true, false, false);
 		}
 		Expect(47);
 		c = new ClassDecl(id, id.val, module, typeArgs, members, attrs, traits);
@@ -791,7 +893,7 @@ bool IsType(ref IToken pt) {
 		
 	}
 
-	void DatatypeDecl(ModuleDefinition/*!*/ module, out DatatypeDecl/*!*/ dt) {
+	void DatatypeDecl(DeclModifierData dmod, ModuleDefinition/*!*/ module, out DatatypeDecl/*!*/ dt) {
 		Contract.Requires(module != null);
 		Contract.Ensures(Contract.ValueAtReturn(out dt)!=null);
 		IToken/*!*/ id;
@@ -800,14 +902,15 @@ bool IsType(ref IToken pt) {
 		List<DatatypeCtor/*!*/> ctors = new List<DatatypeCtor/*!*/>();
 		IToken bodyStart = Token.NoToken;  // dummy assignment
 		bool co = false;
+		CheckDeclModifiers(dmod, "Datatypes or codatatypes", AllowedDeclModifiers.None);
 		
-		while (!(la.kind == 0 || la.kind == 76 || la.kind == 77)) {SynErr(142); Get();}
-		if (la.kind == 76) {
+		while (!(la.kind == 0 || la.kind == 77 || la.kind == 78)) {SynErr(144); Get();}
+		if (la.kind == 77) {
 			Get();
-		} else if (la.kind == 77) {
+		} else if (la.kind == 78) {
 			Get();
 			co = true; 
-		} else SynErr(143);
+		} else SynErr(145);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -815,7 +918,7 @@ bool IsType(ref IToken pt) {
 		if (la.kind == 52) {
 			GenericParameters(typeArgs);
 		}
-		Expect(67);
+		Expect(71);
 		bodyStart = t; 
 		DatatypeMemberDecl(ctors);
 		while (la.kind == 23) {
@@ -823,7 +926,7 @@ bool IsType(ref IToken pt) {
 			DatatypeMemberDecl(ctors);
 		}
 		if (la.kind == 28) {
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(144); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(146); Get();}
 			Get();
 			errors.Warning(t, "the semi-colon that used to terminate a (co)datatype declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 		}
@@ -837,19 +940,20 @@ bool IsType(ref IToken pt) {
 		
 	}
 
-	void NewtypeDecl(ModuleDefinition module, out TopLevelDecl td) {
+	void NewtypeDecl(DeclModifierData dmod, ModuleDefinition module, out TopLevelDecl td) {
 		IToken id, bvId;
 		Attributes attrs = null;
 		td = null;
 		Type baseType = null;
 		Expression wh;
+		CheckDeclModifiers(dmod, "Newtypes", AllowedDeclModifiers.None);
 		
-		Expect(79);
+		Expect(80);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		NoUSIdent(out id);
-		Expect(67);
+		Expect(71);
 		if (IsIdentColonOrBar()) {
 			NoUSIdent(out bvId);
 			if (la.kind == 21) {
@@ -860,21 +964,22 @@ bool IsType(ref IToken pt) {
 			Expect(23);
 			Expression(out wh, false, true);
 			td = new NewtypeDecl(theVerifyThisFile ? id : new IncludeToken(id), id.val, module, new BoundVar(bvId, bvId.val, baseType), wh, attrs); 
-		} else if (StartOf(3)) {
+		} else if (StartOf(4)) {
 			Type(out baseType);
 			td = new NewtypeDecl(theVerifyThisFile ? id : new IncludeToken(id), id.val, module, baseType, attrs); 
-		} else SynErr(145);
+		} else SynErr(147);
 	}
 
-	void OtherTypeDecl(ModuleDefinition module, out TopLevelDecl td) {
+	void OtherTypeDecl(DeclModifierData dmod, ModuleDefinition module, out TopLevelDecl td) {
 		IToken id;
 		Attributes attrs = null;
 		var eqSupport = TypeParameter.EqualitySupportValue.Unspecified;
 		var typeArgs = new List<TypeParameter>();
 		td = null;
 		Type ty;
+		CheckDeclModifiers(dmod, "Type aliases", AllowedDeclModifiers.None);
 		
-		Expect(80);
+		Expect(81);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -887,28 +992,28 @@ bool IsType(ref IToken pt) {
 			if (la.kind == 52) {
 				GenericParameters(typeArgs);
 			}
-		} else if (StartOf(4)) {
+		} else if (StartOf(5)) {
 			if (la.kind == 52) {
 				GenericParameters(typeArgs);
 			}
-			if (la.kind == 67) {
+			if (la.kind == 71) {
 				Get();
 				Type(out ty);
 				td = new TypeSynonymDecl(id, id.val, typeArgs, module, ty, attrs); 
 			}
-		} else SynErr(146);
+		} else SynErr(148);
 		if (td == null) {
 		 td = new OpaqueTypeDecl(id, id.val, module, eqSupport, typeArgs, attrs);
 		}
 		
 		if (la.kind == 28) {
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(147); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(149); Get();}
 			Get();
 			errors.Warning(t, "the semi-colon that used to terminate an opaque-type declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 		}
 	}
 
-	void IteratorDecl(ModuleDefinition module, out IteratorDecl/*!*/ iter) {
+	void IteratorDecl(DeclModifierData dmod, ModuleDefinition module, out IteratorDecl/*!*/ iter) {
 		Contract.Ensures(Contract.ValueAtReturn(out iter) != null);
 		IToken/*!*/ id;
 		Attributes attrs = null;
@@ -930,9 +1035,10 @@ bool IsType(ref IToken pt) {
 		IToken signatureEllipsis = null;
 		IToken bodyStart = Token.NoToken;
 		IToken bodyEnd = Token.NoToken;
+		CheckDeclModifiers(dmod, "Iterators", AllowedDeclModifiers.None);
 		
-		while (!(la.kind == 0 || la.kind == 81)) {SynErr(148); Get();}
-		Expect(81);
+		while (!(la.kind == 0 || la.kind == 82)) {SynErr(150); Get();}
+		Expect(82);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -942,8 +1048,8 @@ bool IsType(ref IToken pt) {
 				GenericParameters(typeArgs);
 			}
 			Formals(true, true, ins);
-			if (la.kind == 82 || la.kind == 83) {
-				if (la.kind == 82) {
+			if (la.kind == 83 || la.kind == 84) {
+				if (la.kind == 83) {
 					Get();
 				} else {
 					Get();
@@ -954,8 +1060,8 @@ bool IsType(ref IToken pt) {
 		} else if (la.kind == 59) {
 			Get();
 			signatureEllipsis = t; 
-		} else SynErr(149);
-		while (StartOf(5)) {
+		} else SynErr(151);
+		while (StartOf(6)) {
 			IteratorSpec(reads, mod, decreases, req, ens, yieldReq, yieldEns, ref readsAttrs, ref modAttrs, ref decrAttrs);
 		}
 		if (la.kind == 46) {
@@ -972,17 +1078,19 @@ bool IsType(ref IToken pt) {
 		
 	}
 
-	void TraitDecl(ModuleDefinition/*!*/ module, out TraitDecl/*!*/ trait) {
-		Contract.Requires(module != null);
+	void TraitDecl(DeclModifierData dmodIn, ModuleDefinition/*!*/ module, out TraitDecl/*!*/ trait) {
+		Contract.Requires(module != null);     
+		CheckDeclModifiers(dmodIn, "Traits", AllowedDeclModifiers.None);
 		Contract.Ensures(Contract.ValueAtReturn(out trait) != null);
 		IToken/*!*/ id;
 		Attributes attrs = null;
 		List<TypeParameter/*!*/> typeArgs = new List<TypeParameter/*!*/>(); //traits should not support type parameters at the moment
 		List<MemberDecl/*!*/> members = new List<MemberDecl/*!*/>();
 		IToken bodyStart;
+		DeclModifierData dmod; 
 		
-		while (!(la.kind == 0 || la.kind == 72)) {SynErr(150); Get();}
-		Expect(72);
+		while (!(la.kind == 0 || la.kind == 76)) {SynErr(152); Get();}
+		Expect(76);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -992,8 +1100,9 @@ bool IsType(ref IToken pt) {
 		}
 		Expect(46);
 		bodyStart = t; 
-		while (StartOf(2)) {
-			ClassMemberDecl(members, true, false, false);
+		while (StartOf(3)) {
+			DeclModifiers(out dmod);
+			ClassMemberDecl(dmod, members, true, false, false);
 		}
 		Expect(47);
 		trait = new TraitDecl(id, id.val, module, typeArgs, members, attrs);
@@ -1002,54 +1111,35 @@ bool IsType(ref IToken pt) {
 		
 	}
 
-	void ClassMemberDecl(List<MemberDecl> mm, bool allowConstructors, bool moduleLevelDecl, bool isWithinAbstractModule) {
+	void ClassMemberDecl(DeclModifierData dmod, List<MemberDecl> mm, bool allowConstructors, bool moduleLevelDecl, bool isWithinAbstractModule) {
 		Contract.Requires(cce.NonNullElements(mm));
 		Method/*!*/ m;
 		Function/*!*/ f;
-		MemberModifiers mmod = new MemberModifiers();
-		IToken staticToken = null, protectedToken = null;
 		
-		while (la.kind == 73 || la.kind == 74 || la.kind == 75) {
-			if (la.kind == 73) {
-				Get();
-				mmod.IsGhost = true; 
-			} else if (la.kind == 74) {
-				Get();
-				mmod.IsStatic = true; staticToken = t; 
-			} else {
-				Get();
-				mmod.IsProtected = true; protectedToken = t; 
-			}
-		}
-		if (la.kind == 78) {
+		if (la.kind == 79) {
 			if (moduleLevelDecl) {
 			 SemErr(la, "fields are not allowed to be declared at the module level; instead, wrap the field in a 'class' declaration");
-			 mmod.IsStatic = false;
-			 mmod.IsProtected = false;
+			 dmod.IsStatic = false;
 			}
 			
-			FieldDecl(mmod, mm);
+			FieldDecl(dmod, mm);
 		} else if (IsFunctionDecl()) {
-			if (moduleLevelDecl && staticToken != null) {
-			 errors.Warning(staticToken, "module-level functions are always non-instance, so the 'static' keyword is not allowed here");
-			 mmod.IsStatic = false;
+			if (moduleLevelDecl && dmod.StaticToken != null) {
+			 errors.Warning(dmod.StaticToken, "module-level functions are always non-instance, so the 'static' keyword is not allowed here");
+			 dmod.IsStatic = false;
 			}
 			
-			FunctionDecl(mmod, isWithinAbstractModule, out f);
+			FunctionDecl(dmod, isWithinAbstractModule, out f);
 			mm.Add(f); 
-		} else if (StartOf(6)) {
-			if (moduleLevelDecl && staticToken != null) {
-			 errors.Warning(staticToken, "module-level methods are always non-instance, so the 'static' keyword is not allowed here");
-			 mmod.IsStatic = false;
-			}
-			if (protectedToken != null) {
-			 SemErr(protectedToken, "only functions, not methods, can be declared 'protected'");
-			 mmod.IsProtected = false;
+		} else if (StartOf(7)) {
+			if (moduleLevelDecl && dmod.StaticToken != null) {
+			 errors.Warning(dmod.StaticToken, "module-level methods are always non-instance, so the 'static' keyword is not allowed here");
+			 dmod.IsStatic = false;
 			}
 			
-			MethodDecl(mmod, allowConstructors, isWithinAbstractModule, out m);
+			MethodDecl(dmod, allowConstructors, isWithinAbstractModule, out m);
 			mm.Add(m); 
-		} else SynErr(151);
+		} else SynErr(153);
 	}
 
 	void Attribute(ref Attributes attrs) {
@@ -1060,7 +1150,7 @@ bool IsType(ref IToken pt) {
 		Expect(21);
 		NoUSIdent(out x);
 		name = x.val; 
-		if (StartOf(7)) {
+		if (StartOf(8)) {
 			Expressions(args);
 		}
 		Expect(47);
@@ -1129,29 +1219,28 @@ bool IsType(ref IToken pt) {
 		TypeAndToken(out tok, out ty);
 	}
 
-	void FieldDecl(MemberModifiers mmod, List<MemberDecl/*!*/>/*!*/ mm) {
+	void FieldDecl(DeclModifierData dmod, List<MemberDecl/*!*/>/*!*/ mm) {
 		Contract.Requires(cce.NonNullElements(mm));
 		Attributes attrs = null;
 		IToken/*!*/ id;  Type/*!*/ ty;
+		CheckDeclModifiers(dmod, "Fields", AllowedDeclModifiers.Ghost);
 		
-		while (!(la.kind == 0 || la.kind == 78)) {SynErr(152); Get();}
-		Expect(78);
-		if (mmod.IsStatic) { SemErr(t, "fields cannot be declared 'static'"); }
-		
+		while (!(la.kind == 0 || la.kind == 79)) {SynErr(154); Get();}
+		Expect(79);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
 		FIdentType(out id, out ty);
-		mm.Add(new Field(id, id.val, mmod.IsGhost, ty, attrs)); 
+		mm.Add(new Field(id, id.val, dmod.IsGhost, ty, attrs)); 
 		while (la.kind == 22) {
 			Get();
 			FIdentType(out id, out ty);
-			mm.Add(new Field(id, id.val, mmod.IsGhost, ty, attrs)); 
+			mm.Add(new Field(id, id.val, dmod.IsGhost, ty, attrs)); 
 		}
 		OldSemi();
 	}
 
-	void FunctionDecl(MemberModifiers mmod, bool isWithinAbstractModule, out Function/*!*/ f) {
+	void FunctionDecl(DeclModifierData dmod, bool isWithinAbstractModule, out Function/*!*/ f) {
 		Contract.Ensures(Contract.ValueAtReturn(out f)!=null);
 		Attributes attrs = null;
 		IToken/*!*/ id = Token.NoToken;  // to please compiler
@@ -1172,11 +1261,17 @@ bool IsType(ref IToken pt) {
 		
 		if (la.kind == 38) {
 			Get();
-			if (la.kind == 84) {
+			if (la.kind == 85) {
 				Get();
 				isFunctionMethod = true; 
 			}
-			if (mmod.IsGhost) { SemErr(t, "functions cannot be declared 'ghost' (they are ghost by default)"); }
+			AllowedDeclModifiers allowed = AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static | AllowedDeclModifiers.Protected;
+			string caption = "Functions";
+			if (isFunctionMethod) { 
+			 allowed |= AllowedDeclModifiers.Extern; 
+			 caption = "Function methods";
+			}
+			CheckDeclModifiers(dmod, caption, allowed);
 			
 			while (la.kind == 46) {
 				Attribute(ref attrs);
@@ -1192,21 +1287,27 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(153);
+			} else SynErr(155);
 		} else if (la.kind == 39) {
 			Get();
 			isPredicate = true; 
-			if (la.kind == 84) {
+			if (la.kind == 85) {
 				Get();
 				isFunctionMethod = true; 
 			}
-			if (mmod.IsGhost) { SemErr(t, "predicates cannot be declared 'ghost' (they are ghost by default)"); }
+			AllowedDeclModifiers allowed = AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static | AllowedDeclModifiers.Protected;
+			string caption = "Predicates";
+			if (isFunctionMethod) { 
+			 allowed |= AllowedDeclModifiers.Extern; 
+			 caption = "Predicate methods";
+			}
+			CheckDeclModifiers(dmod, caption, allowed);
 			
 			while (la.kind == 46) {
 				Attribute(ref attrs);
 			}
 			NoUSIdent(out id);
-			if (StartOf(8)) {
+			if (StartOf(9)) {
 				if (la.kind == 52) {
 					GenericParameters(typeArgs);
 				}
@@ -1223,12 +1324,13 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(154);
+			} else SynErr(156);
 		} else if (la.kind == 40) {
 			Get();
 			Expect(39);
 			isIndPredicate = true; 
-			if (mmod.IsGhost) { SemErr(t, "inductive predicates cannot be declared 'ghost' (they are ghost by default)"); }
+			CheckDeclModifiers(dmod, "Inductive predicates",
+			 AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static | AllowedDeclModifiers.Protected);
 			
 			while (la.kind == 46) {
 				Attribute(ref attrs);
@@ -1246,11 +1348,12 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(155);
+			} else SynErr(157);
 		} else if (la.kind == 42) {
 			Get();
 			isCoPredicate = true; 
-			if (mmod.IsGhost) { SemErr(t, "copredicates cannot be declared 'ghost' (they are ghost by default)"); }
+			CheckDeclModifiers(dmod, "Copredicates",
+			 AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static | AllowedDeclModifiers.Protected);
 			
 			while (la.kind == 46) {
 				Attribute(ref attrs);
@@ -1268,31 +1371,32 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(156);
-		} else SynErr(157);
+			} else SynErr(158);
+		} else SynErr(159);
 		decreases = isIndPredicate || isCoPredicate ? null : new List<Expression/*!*/>(); 
-		while (StartOf(9)) {
+		while (StartOf(10)) {
 			FunctionSpec(reqs, reads, ens, decreases);
 		}
 		if (la.kind == 46) {
 			FunctionBody(out body, out bodyStart, out bodyEnd);
 		}
-		if (!isWithinAbstractModule && DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 && !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported")) {
+		if (!isWithinAbstractModule && DafnyOptions.O.DisallowSoundnessCheating && body == null && ens.Count > 0 &&
+		   !Attributes.Contains(attrs, "axiom") && !Attributes.Contains(attrs, "imported")) {
 		  SemErr(t, "a function with an ensures clause must have a body, unless given the :axiom attribute");
 		}
-		
+		EncodeExternAsAttribute(dmod, ref attrs, id, /* needAxiom */ true);
 		IToken tok = theVerifyThisFile ? id : new IncludeToken(id);
 		if (isPredicate) {
-		  f = new Predicate(tok, id.val, mmod.IsStatic, mmod.IsProtected, !isFunctionMethod, typeArgs, formals,
+		  f = new Predicate(tok, id.val, dmod.IsStatic, dmod.IsProtected, !isFunctionMethod, typeArgs, formals,
 		                    reqs, reads, ens, new Specification<Expression>(decreases, null), body, Predicate.BodyOriginKind.OriginalOrInherited, attrs, signatureEllipsis);
 		} else if (isIndPredicate) {
-		  f = new InductivePredicate(tok, id.val, mmod.IsStatic, mmod.IsProtected, typeArgs, formals,
+		  f = new InductivePredicate(tok, id.val, dmod.IsStatic, dmod.IsProtected, typeArgs, formals,
 		                             reqs, reads, ens, body, attrs, signatureEllipsis);
 		} else if (isCoPredicate) {
-		  f = new CoPredicate(tok, id.val, mmod.IsStatic, mmod.IsProtected, typeArgs, formals,
+		  f = new CoPredicate(tok, id.val, dmod.IsStatic, dmod.IsProtected, typeArgs, formals,
 		                      reqs, reads, ens, body, attrs, signatureEllipsis);
 		} else {
-		  f = new Function(tok, id.val, mmod.IsStatic, mmod.IsProtected, !isFunctionMethod, typeArgs, formals, returnType,
+		  f = new Function(tok, id.val, dmod.IsStatic, dmod.IsProtected, !isFunctionMethod, typeArgs, formals, returnType,
 		                   reqs, reads, ens, new Specification<Expression>(decreases, null), body, attrs, signatureEllipsis);
 		}
 		f.BodyStartTok = bodyStart;
@@ -1305,7 +1409,7 @@ bool IsType(ref IToken pt) {
 		
 	}
 
-	void MethodDecl(MemberModifiers mmod, bool allowConstructor, bool isWithinAbstractModule, out Method/*!*/ m) {
+	void MethodDecl(DeclModifierData dmod, bool allowConstructor, bool isWithinAbstractModule, out Method/*!*/ m) {
 		Contract.Ensures(Contract.ValueAtReturn(out m) !=null);
 		IToken/*!*/ id = Token.NoToken;
 		bool hasName = false;  IToken keywordToken;
@@ -1327,26 +1431,37 @@ bool IsType(ref IToken pt) {
 		IToken signatureEllipsis = null;
 		IToken bodyStart = Token.NoToken;
 		IToken bodyEnd = Token.NoToken;
+		AllowedDeclModifiers allowed = AllowedDeclModifiers.None;
+		string caption = "";
 		
-		while (!(StartOf(10))) {SynErr(158); Get();}
+		while (!(StartOf(11))) {SynErr(160); Get();}
 		switch (la.kind) {
-		case 84: {
+		case 85: {
 			Get();
+			caption = "Methods";
+			allowed = AllowedDeclModifiers.Ghost | AllowedDeclModifiers.Static 
+			 | AllowedDeclModifiers.Extern; 
 			break;
 		}
 		case 41: {
 			Get();
-			isLemma = true; 
+			isLemma = true; caption = "Lemmas";
+			allowed = AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static 
+			 | AllowedDeclModifiers.Protected; 
 			break;
 		}
-		case 85: {
+		case 86: {
 			Get();
-			isCoLemma = true; 
+			isCoLemma = true; caption = "Colemmas";
+			allowed = AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static 
+			 | AllowedDeclModifiers.Protected; 
 			break;
 		}
-		case 86: {
+		case 87: {
 			Get();
-			isCoLemma = true;
+			isCoLemma = true; caption = "Comethods";
+			allowed = AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static 
+			 | AllowedDeclModifiers.Protected;
 			errors.Warning(t, "the 'comethod' keyword has been deprecated; it has been renamed to 'colemma'");
 			
 			break;
@@ -1354,43 +1469,26 @@ bool IsType(ref IToken pt) {
 		case 40: {
 			Get();
 			Expect(41);
-			isIndLemma = true; 
+			isIndLemma = true;  caption = "Inductive lemmas";
+			allowed = AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static;
 			break;
 		}
-		case 87: {
+		case 88: {
 			Get();
 			if (allowConstructor) {
 			 isConstructor = true;
 			} else {
 			 SemErr(t, "constructors are allowed only in classes");
-			}
+			} 
+			caption = "Constructors";
+			allowed = AllowedDeclModifiers.None;
 			
 			break;
 		}
-		default: SynErr(159); break;
+		default: SynErr(161); break;
 		}
 		keywordToken = t; 
-		if (isLemma) {
-		 if (mmod.IsGhost) {
-		   SemErr(t, "lemmas cannot be declared 'ghost' (they are automatically 'ghost')");
-		 }
-		} else if (isConstructor) {
-		 if (mmod.IsGhost) {
-		   SemErr(t, "constructors cannot be declared 'ghost'");
-		 }
-		 if (mmod.IsStatic) {
-		   SemErr(t, "constructors cannot be declared 'static'");
-		 }
-		} else if (isIndLemma) {
-		 if (mmod.IsGhost) {
-		   SemErr(t, "inductive lemmas cannot be declared 'ghost' (they are automatically 'ghost')");
-		 }
-		} else if (isCoLemma) {
-		 if (mmod.IsGhost) {
-		   SemErr(t, "colemmas cannot be declared 'ghost' (they are automatically 'ghost')");
-		 }
-		}
-		
+		CheckDeclModifiers(dmod, caption, allowed); 
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -1404,22 +1502,23 @@ bool IsType(ref IToken pt) {
 		   SemErr(la, "a method must be given a name (expecting identifier)");
 		 }
 		}
+		EncodeExternAsAttribute(dmod, ref attrs, id, /* needAxiom */ true);
 		
 		if (la.kind == 50 || la.kind == 52) {
 			if (la.kind == 52) {
 				GenericParameters(typeArgs);
 			}
-			Formals(true, !mmod.IsGhost, ins);
-			if (la.kind == 83) {
+			Formals(true, !dmod.IsGhost, ins);
+			if (la.kind == 84) {
 				Get();
 				if (isConstructor) { SemErr(t, "constructors cannot have out-parameters"); } 
-				Formals(false, !mmod.IsGhost, outs);
+				Formals(false, !dmod.IsGhost, outs);
 			}
 		} else if (la.kind == 59) {
 			Get();
 			signatureEllipsis = t; 
-		} else SynErr(160);
-		while (StartOf(11)) {
+		} else SynErr(162);
+		while (StartOf(12)) {
 			MethodSpec(req, mod, ens, dec, ref decAttrs, ref modAttrs);
 		}
 		if (la.kind == 46) {
@@ -1434,16 +1533,16 @@ bool IsType(ref IToken pt) {
 		 m = new Constructor(tok, hasName ? id.val : "_ctor", typeArgs, ins,
 		                     req, new Specification<FrameExpression>(mod, modAttrs), ens, new Specification<Expression>(dec, decAttrs), body, attrs, signatureEllipsis);
 		} else if (isIndLemma) {
-		 m = new InductiveLemma(tok, id.val, mmod.IsStatic, typeArgs, ins, outs,
+		 m = new InductiveLemma(tok, id.val, dmod.IsStatic, typeArgs, ins, outs,
 		                        req, new Specification<FrameExpression>(mod, modAttrs), ens, new Specification<Expression>(dec, decAttrs), body, attrs, signatureEllipsis);
 		} else if (isCoLemma) {
-		 m = new CoLemma(tok, id.val, mmod.IsStatic, typeArgs, ins, outs,
+		 m = new CoLemma(tok, id.val, dmod.IsStatic, typeArgs, ins, outs,
 		                 req, new Specification<FrameExpression>(mod, modAttrs), ens, new Specification<Expression>(dec, decAttrs), body, attrs, signatureEllipsis);
 		} else if (isLemma) {
-		 m = new Lemma(tok, id.val, mmod.IsStatic, typeArgs, ins, outs,
+		 m = new Lemma(tok, id.val, dmod.IsStatic, typeArgs, ins, outs,
 		               req, new Specification<FrameExpression>(mod, modAttrs), ens, new Specification<Expression>(dec, decAttrs), body, attrs, signatureEllipsis);
 		} else {
-		 m = new Method(tok, id.val, mmod.IsStatic, mmod.IsGhost, typeArgs, ins, outs,
+		 m = new Method(tok, id.val, dmod.IsStatic, dmod.IsGhost, typeArgs, ins, outs,
 		                req, new Specification<FrameExpression>(mod, modAttrs), ens, new Specification<Expression>(dec, decAttrs), body, attrs, signatureEllipsis);
 		}
 		m.BodyStartTok = bodyStart;
@@ -1470,7 +1569,7 @@ bool IsType(ref IToken pt) {
 	void FormalsOptionalIds(List<Formal/*!*/>/*!*/ formals) {
 		Contract.Requires(cce.NonNullElements(formals)); IToken/*!*/ id;  Type/*!*/ ty;  string/*!*/ name;  bool isGhost; 
 		Expect(50);
-		if (StartOf(12)) {
+		if (StartOf(13)) {
 			TypeIdentOptional(out id, out name, out ty, out isGhost);
 			formals.Add(new Formal(id, name, ty, true, isGhost)); 
 			while (la.kind == 22) {
@@ -1491,14 +1590,14 @@ bool IsType(ref IToken pt) {
 		} else if (la.kind == 2) {
 			Get();
 			id = t; 
-		} else SynErr(161);
+		} else SynErr(163);
 		Expect(21);
 		Type(out ty);
 	}
 
 	void OldSemi() {
 		if (la.kind == 28) {
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(162); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(164); Get();}
 			Get();
 		}
 	}
@@ -1521,7 +1620,7 @@ bool IsType(ref IToken pt) {
 		Contract.Ensures(Contract.ValueAtReturn(out id)!=null);
 		Contract.Ensures(Contract.ValueAtReturn(out ty)!=null);
 		isGhost = false; 
-		if (la.kind == 73) {
+		if (la.kind == 62) {
 			Get();
 			if (allowGhostKeyword) { isGhost = true; } else { SemErr(t, "formal cannot be declared 'ghost' in this context"); } 
 		}
@@ -1573,11 +1672,11 @@ bool IsType(ref IToken pt) {
 		Contract.Ensures(Contract.ValueAtReturn(out ty)!=null);
 		Contract.Ensures(Contract.ValueAtReturn(out identName)!=null);
 		string name = null; id = Token.NoToken; ty = new BoolType()/*dummy*/; isGhost = false; 
-		if (la.kind == 73) {
+		if (la.kind == 62) {
 			Get();
 			isGhost = true; 
 		}
-		if (StartOf(3)) {
+		if (StartOf(4)) {
 			TypeAndToken(out id, out ty);
 			if (la.kind == 21) {
 				Get();
@@ -1595,7 +1694,7 @@ bool IsType(ref IToken pt) {
 			id = t; name = id.val;
 			Expect(21);
 			Type(out ty);
-		} else SynErr(163);
+		} else SynErr(165);
 		if (name != null) {
 		 identName = name;
 		} else {
@@ -1746,7 +1845,7 @@ bool IsType(ref IToken pt) {
 		case 50: {
 			Get();
 			tok = t; tupleArgTypes = new List<Type>(); 
-			if (StartOf(3)) {
+			if (StartOf(4)) {
 				Type(out ty);
 				tupleArgTypes.Add(ty); 
 				while (la.kind == 22) {
@@ -1783,7 +1882,7 @@ bool IsType(ref IToken pt) {
 			ty = new UserDefinedType(e.tok, e); 
 			break;
 		}
-		default: SynErr(164); break;
+		default: SynErr(166); break;
 		}
 		if (la.kind == 30) {
 			Type t2; 
@@ -1804,7 +1903,7 @@ bool IsType(ref IToken pt) {
 	void Formals(bool incoming, bool allowGhostKeyword, List<Formal> formals) {
 		Contract.Requires(cce.NonNullElements(formals)); IToken id;  Type ty;  bool isGhost; 
 		Expect(50);
-		if (la.kind == 1 || la.kind == 73) {
+		if (la.kind == 1 || la.kind == 62) {
 			GIdentType(allowGhostKeyword, out id, out ty, out isGhost);
 			formals.Add(new Formal(id, id.val, ty, incoming, isGhost)); 
 			while (la.kind == 22) {
@@ -1822,7 +1921,7 @@ List<MaybeFreeExpression/*!*/>/*!*/ yieldReq, List<MaybeFreeExpression/*!*/>/*!*
 ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 		Expression/*!*/ e; FrameExpression/*!*/ fe; bool isFree = false; bool isYield = false; Attributes ensAttrs = null;
 		
-		while (!(StartOf(13))) {SynErr(165); Get();}
+		while (!(StartOf(14))) {SynErr(167); Get();}
 		if (la.kind == 44) {
 			Get();
 			while (IsAttribute()) {
@@ -1849,14 +1948,14 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 				mod.Add(fe); 
 			}
 			OldSemi();
-		} else if (StartOf(14)) {
-			if (la.kind == 88) {
+		} else if (StartOf(15)) {
+			if (la.kind == 89) {
 				Get();
 				isFree = true;
 				errors.Warning(t, "the 'free' keyword is soon to be deprecated");
 				
 			}
-			if (la.kind == 90) {
+			if (la.kind == 91) {
 				Get();
 				isYield = true; 
 			}
@@ -1870,7 +1969,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 				 req.Add(new MaybeFreeExpression(e, isFree));
 				}
 				
-			} else if (la.kind == 89) {
+			} else if (la.kind == 90) {
 				Get();
 				while (IsAttribute()) {
 					Attribute(ref ensAttrs);
@@ -1883,7 +1982,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 				 ens.Add(new MaybeFreeExpression(e, isFree, ensAttrs));
 				}
 				
-			} else SynErr(166);
+			} else SynErr(168);
 		} else if (la.kind == 36) {
 			Get();
 			while (IsAttribute()) {
@@ -1891,7 +1990,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 			}
 			DecreasesList(decreases, false, false);
 			OldSemi();
-		} else SynErr(167);
+		} else SynErr(169);
 	}
 
 	void BlockStmt(out BlockStmt/*!*/ block, out IToken bodyStart, out IToken bodyEnd) {
@@ -1900,7 +1999,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 		
 		Expect(46);
 		bodyStart = t; 
-		while (StartOf(15)) {
+		while (StartOf(16)) {
 			Stmt(body);
 		}
 		Expect(47);
@@ -1913,7 +2012,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Requires(cce.NonNullElements(req)); Contract.Requires(cce.NonNullElements(mod)); Contract.Requires(cce.NonNullElements(ens)); Contract.Requires(cce.NonNullElements(decreases));
 		Expression/*!*/ e;  FrameExpression/*!*/ fe;  bool isFree = false; Attributes ensAttrs = null;
 		
-		while (!(StartOf(16))) {SynErr(168); Get();}
+		while (!(StartOf(17))) {SynErr(170); Get();}
 		if (la.kind == 43) {
 			Get();
 			while (IsAttribute()) {
@@ -1927,8 +2026,8 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				mod.Add(fe); 
 			}
 			OldSemi();
-		} else if (la.kind == 45 || la.kind == 88 || la.kind == 89) {
-			if (la.kind == 88) {
+		} else if (la.kind == 45 || la.kind == 89 || la.kind == 90) {
+			if (la.kind == 89) {
 				Get();
 				isFree = true;
 				errors.Warning(t, "the 'free' keyword is soon to be deprecated");
@@ -1939,7 +2038,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Expression(out e, false, false);
 				OldSemi();
 				req.Add(new MaybeFreeExpression(e, isFree)); 
-			} else if (la.kind == 89) {
+			} else if (la.kind == 90) {
 				Get();
 				while (IsAttribute()) {
 					Attribute(ref ensAttrs);
@@ -1947,7 +2046,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Expression(out e, false, false);
 				OldSemi();
 				ens.Add(new MaybeFreeExpression(e, isFree, ensAttrs)); 
-			} else SynErr(169);
+			} else SynErr(171);
 		} else if (la.kind == 36) {
 			Get();
 			while (IsAttribute()) {
@@ -1955,7 +2054,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			DecreasesList(decreases, true, false);
 			OldSemi();
-		} else SynErr(170);
+		} else SynErr(172);
 	}
 
 	void FrameExpression(out FrameExpression fe, bool allowSemi, bool allowLambda) {
@@ -1965,21 +2064,21 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		string fieldName = null;  IToken feTok = null;
 		fe = null;
 		
-		if (StartOf(7)) {
+		if (StartOf(8)) {
 			Expression(out e, allowSemi, allowLambda);
 			feTok = e.tok; 
-			if (la.kind == 91) {
+			if (la.kind == 92) {
 				Get();
 				Ident(out id);
 				fieldName = id.val;  feTok = id; 
 			}
 			fe = new FrameExpression(feTok, e, fieldName); 
-		} else if (la.kind == 91) {
+		} else if (la.kind == 92) {
 			Get();
 			Ident(out id);
 			fieldName = id.val; 
 			fe = new FrameExpression(id, new ImplicitThisExpr(id), fieldName); 
-		} else SynErr(171);
+		} else SynErr(173);
 	}
 
 	void DecreasesList(List<Expression> decreases, bool allowWildcard, bool allowLambda) {
@@ -2034,7 +2133,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Requires(cce.NonNullElements(reads));
 		Contract.Requires(decreases == null || cce.NonNullElements(decreases));
 		Expression/*!*/ e;  FrameExpression/*!*/ fe; 
-		while (!(StartOf(17))) {SynErr(172); Get();}
+		while (!(StartOf(18))) {SynErr(174); Get();}
 		if (la.kind == 45) {
 			Get();
 			Expression(out e, false, false);
@@ -2050,7 +2149,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				reads.Add(fe); 
 			}
 			OldSemi();
-		} else if (la.kind == 89) {
+		} else if (la.kind == 90) {
 			Get();
 			Expression(out e, false, false);
 			OldSemi();
@@ -2064,7 +2163,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			
 			DecreasesList(decreases, false, false);
 			OldSemi();
-		} else SynErr(173);
+		} else SynErr(175);
 	}
 
 	void FunctionBody(out Expression/*!*/ e, out IToken bodyStart, out IToken bodyEnd) {
@@ -2081,9 +2180,9 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (la.kind == 57) {
 			Get();
 			fe = new FrameExpression(t, new WildcardExpr(t), null); 
-		} else if (StartOf(18)) {
+		} else if (StartOf(19)) {
 			FrameExpression(out fe, allowSemi, false);
-		} else SynErr(174);
+		} else SynErr(176);
 	}
 
 	void PossiblyWildExpression(out Expression e, bool allowLambda) {
@@ -2092,9 +2191,9 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (la.kind == 57) {
 			Get();
 			e = new WildcardExpr(t); 
-		} else if (StartOf(7)) {
+		} else if (StartOf(8)) {
 			Expression(out e, false, allowLambda);
-		} else SynErr(175);
+		} else SynErr(177);
 	}
 
 	void Stmt(List<Statement/*!*/>/*!*/ ss) {
@@ -2111,14 +2210,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken bodyStart, bodyEnd;
 		int breakCount;
 		
-		while (!(StartOf(19))) {SynErr(176); Get();}
+		while (!(StartOf(20))) {SynErr(178); Get();}
 		switch (la.kind) {
 		case 46: {
 			BlockStmt(out bs, out bodyStart, out bodyEnd);
 			s = bs; 
 			break;
 		}
-		case 101: {
+		case 102: {
 			AssertStmt(out s);
 			break;
 		}
@@ -2126,31 +2225,31 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			AssumeStmt(out s);
 			break;
 		}
-		case 102: {
+		case 103: {
 			PrintStmt(out s);
 			break;
 		}
-		case 1: case 2: case 3: case 4: case 8: case 10: case 19: case 20: case 23: case 50: case 131: case 132: case 133: case 134: case 135: case 136: {
+		case 1: case 2: case 3: case 4: case 8: case 10: case 19: case 20: case 23: case 50: case 132: case 133: case 134: case 135: case 136: case 137: {
 			UpdateStmt(out s);
 			break;
 		}
-		case 73: case 78: {
+		case 62: case 79: {
 			VarDeclStatement(out s);
 			break;
 		}
-		case 98: {
+		case 99: {
 			IfStmt(out s);
 			break;
 		}
-		case 99: {
+		case 100: {
 			WhileStmt(out s);
 			break;
 		}
-		case 100: {
+		case 101: {
 			MatchStmt(out s);
 			break;
 		}
-		case 103: case 104: {
+		case 104: case 105: {
 			ForallStmt(out s);
 			break;
 		}
@@ -2158,11 +2257,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			CalcStmt(out s);
 			break;
 		}
-		case 105: {
+		case 106: {
 			ModifyStmt(out s);
 			break;
 		}
-		case 92: {
+		case 93: {
 			Get();
 			x = t; 
 			NoUSIdent(out id);
@@ -2171,24 +2270,24 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			s.Labels = new LList<Label>(new Label(x, id.val), s.Labels); 
 			break;
 		}
-		case 93: {
+		case 94: {
 			Get();
 			x = t; breakCount = 1; label = null; 
 			if (la.kind == 1) {
 				NoUSIdent(out id);
 				label = id.val; 
-			} else if (la.kind == 28 || la.kind == 93) {
-				while (la.kind == 93) {
+			} else if (la.kind == 28 || la.kind == 94) {
+				while (la.kind == 94) {
 					Get();
 					breakCount++; 
 				}
-			} else SynErr(177);
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(178); Get();}
+			} else SynErr(179);
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(180); Get();}
 			Expect(28);
 			s = label != null ? new BreakStmt(x, t, label) : new BreakStmt(x, t, breakCount); 
 			break;
 		}
-		case 90: case 96: {
+		case 91: case 97: {
 			ReturnStmt(out s);
 			break;
 		}
@@ -2196,7 +2295,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			SkeletonStmt(out s);
 			break;
 		}
-		default: SynErr(179); break;
+		default: SynErr(181); break;
 		}
 	}
 
@@ -2205,17 +2304,17 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression e = dummyExpr; Attributes attrs = null;
 		IToken dotdotdot = null;
 		
-		Expect(101);
+		Expect(102);
 		x = t; 
 		while (IsAttribute()) {
 			Attribute(ref attrs);
 		}
-		if (StartOf(7)) {
+		if (StartOf(8)) {
 			Expression(out e, false, true);
 		} else if (la.kind == 59) {
 			Get();
 			dotdotdot = t; 
-		} else SynErr(180);
+		} else SynErr(182);
 		Expect(28);
 		if (dotdotdot != null) {
 		 s = new SkeletonStatement(new AssertStmt(x, t, new LiteralExpr(x, true), attrs), dotdotdot, null);
@@ -2235,12 +2334,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		while (IsAttribute()) {
 			Attribute(ref attrs);
 		}
-		if (StartOf(7)) {
+		if (StartOf(8)) {
 			Expression(out e, false, true);
 		} else if (la.kind == 59) {
 			Get();
 			dotdotdot = t; 
-		} else SynErr(181);
+		} else SynErr(183);
 		Expect(28);
 		if (dotdotdot != null) {
 		 s = new SkeletonStatement(new AssumeStmt(x, t, new LiteralExpr(x, true), attrs), dotdotdot, null);
@@ -2255,7 +2354,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken x;  Expression e;
 		var args = new List<Expression>();
 		
-		Expect(102);
+		Expect(103);
 		x = t; 
 		Expression(out e, false, true);
 		args.Add(e); 
@@ -2285,14 +2384,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			Expect(28);
 			endTok = t; rhss.Add(new ExprRhs(e, attrs)); 
-		} else if (la.kind == 22 || la.kind == 25 || la.kind == 95) {
+		} else if (la.kind == 22 || la.kind == 25 || la.kind == 96) {
 			lhss.Add(e); 
 			while (la.kind == 22) {
 				Get();
 				Lhs(out e);
 				lhss.Add(e); 
 			}
-			if (la.kind == 95) {
+			if (la.kind == 96) {
 				Get();
 				x = t; 
 				Rhs(out r);
@@ -2310,13 +2409,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					suchThatAssume = t; 
 				}
 				Expression(out suchThat, false, true);
-			} else SynErr(182);
+			} else SynErr(184);
 			Expect(28);
 			endTok = t; 
 		} else if (la.kind == 21) {
 			Get();
 			SemErr(t, "invalid statement (did you forget the 'label' keyword?)"); 
-		} else SynErr(183);
+		} else SynErr(185);
 		if (suchThat != null) {
 		 s = new AssignSuchThatStmt(x, endTok, lhss, suchThat, suchThatAssume, null);
 		} else {
@@ -2341,11 +2440,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken endTok;
 		s = dummyStmt;
 		
-		if (la.kind == 73) {
+		if (la.kind == 62) {
 			Get();
 			isGhost = true;  x = t; 
 		}
-		Expect(78);
+		Expect(79);
 		if (!isGhost) { x = t; } 
 		if (la.kind == 1 || la.kind == 46) {
 			while (la.kind == 46) {
@@ -2361,8 +2460,8 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				LocalIdentTypeOptional(out d, isGhost);
 				lhss.Add(d); d.Attributes = attrs; attrs = null; 
 			}
-			if (la.kind == 25 || la.kind == 46 || la.kind == 95) {
-				if (la.kind == 95) {
+			if (la.kind == 25 || la.kind == 46 || la.kind == 96) {
+				if (la.kind == 96) {
 					Get();
 					assignTok = t; 
 					Rhs(out r);
@@ -2385,7 +2484,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					Expression(out suchThat, false, true);
 				}
 			}
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(184); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(186); Get();}
 			Expect(28);
 			endTok = t; 
 			ConcreteUpdateStatement update;
@@ -2431,7 +2530,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			if (isGhost) { pat.Vars.Iter(bv => bv.IsGhost = true); }
 			letLHSs.Add(pat);
 			
-			if (la.kind == 95) {
+			if (la.kind == 96) {
 				Get();
 			} else if (la.kind == 25 || la.kind == 46) {
 				while (la.kind == 46) {
@@ -2439,12 +2538,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				}
 				Expect(25);
 				SemErr(pat.tok, "LHS of assign-such-that expression must be variables, not general patterns"); 
-			} else SynErr(185);
+			} else SynErr(187);
 			Expression(out e, false, true);
 			letRHSs.Add(e); 
 			Expect(28);
 			s = new LetStmt(e.tok, e.tok, letLHSs, letRHSs); 
-		} else SynErr(186);
+		} else SynErr(188);
 	}
 
 	void IfStmt(out Statement/*!*/ ifStmt) {
@@ -2458,16 +2557,16 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<GuardedAlternative> alternatives;
 		ifStmt = dummyStmt;  // to please the compiler
 		
-		Expect(98);
+		Expect(99);
 		x = t; 
 		if (IsAlternative()) {
 			AlternativeBlock(true, out alternatives, out endTok);
 			ifStmt = new AlternativeStmt(x, endTok, alternatives); 
-		} else if (StartOf(20)) {
+		} else if (StartOf(21)) {
 			if (IsExistentialGuard()) {
 				ExistentialGuard(out guard, true);
 				isExistentialGuard = true; 
-			} else if (StartOf(21)) {
+			} else if (StartOf(22)) {
 				Guard(out guard);
 			} else {
 				Get();
@@ -2477,13 +2576,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			endTok = thn.EndTok; 
 			if (la.kind == 35) {
 				Get();
-				if (la.kind == 98) {
+				if (la.kind == 99) {
 					IfStmt(out s);
 					els = s; endTok = s.EndTok; 
 				} else if (la.kind == 46) {
 					BlockStmt(out bs, out bodyStart, out bodyEnd);
 					els = bs; endTok = bs.EndTok; 
-				} else SynErr(187);
+				} else SynErr(189);
 			}
 			if (guardEllipsis != null) {
 			 ifStmt = new SkeletonStatement(new IfStmt(x, endTok, isExistentialGuard, guard, thn, els), guardEllipsis, null);
@@ -2491,7 +2590,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 ifStmt = new IfStmt(x, endTok, isExistentialGuard, guard, thn, els);
 			}
 			
-		} else SynErr(188);
+		} else SynErr(190);
 	}
 
 	void WhileStmt(out Statement stmt) {
@@ -2510,23 +2609,23 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		stmt = dummyStmt;  // to please the compiler
 		bool isDirtyLoop = true;
 		
-		Expect(99);
+		Expect(100);
 		x = t; 
 		if (IsLoopSpec() || IsAlternative()) {
-			while (StartOf(22)) {
+			while (StartOf(23)) {
 				LoopSpec(invariants, decreases, ref mod, ref decAttrs, ref modAttrs);
 			}
 			AlternativeBlock(false, out alternatives, out endTok);
 			stmt = new AlternativeLoopStmt(x, endTok, invariants, new Specification<Expression>(decreases, decAttrs), new Specification<FrameExpression>(mod, modAttrs), alternatives); 
-		} else if (StartOf(20)) {
-			if (StartOf(21)) {
+		} else if (StartOf(21)) {
+			if (StartOf(22)) {
 				Guard(out guard);
 				Contract.Assume(guard == null || cce.Owner.None(guard)); 
 			} else {
 				Get();
 				guardEllipsis = t; 
 			}
-			while (StartOf(22)) {
+			while (StartOf(23)) {
 				LoopSpec(invariants, decreases, ref mod, ref decAttrs, ref modAttrs);
 			}
 			if (la.kind == _lbrace) {
@@ -2535,8 +2634,8 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			} else if (la.kind == _ellipsis) {
 				Expect(59);
 				bodyEllipsis = t; endTok = t; isDirtyLoop = false; 
-			} else if (StartOf(23)) {
-			} else SynErr(189);
+			} else if (StartOf(24)) {
+			} else SynErr(191);
 			if (guardEllipsis != null || bodyEllipsis != null) {
 			 if (mod != null) {
 			   SemErr(mod[0].E.tok, "'modifies' clauses are not allowed on refining loops");
@@ -2554,7 +2653,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 stmt = new WhileStmt(x, endTok, guard, invariants, new Specification<Expression>(decreases, decAttrs), new Specification<FrameExpression>(mod, modAttrs), body);
 			}
 			
-		} else SynErr(190);
+		} else SynErr(192);
 	}
 
 	void MatchStmt(out Statement/*!*/ s) {
@@ -2563,7 +2662,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<MatchCaseStmt/*!*/> cases = new List<MatchCaseStmt/*!*/>();
 		bool usesOptionalBrace = false;
 		
-		Expect(100);
+		Expect(101);
 		x = t; 
 		Expression(out e, true, true);
 		if (la.kind == _lbrace) {
@@ -2574,12 +2673,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				cases.Add(c); 
 			}
 			Expect(47);
-		} else if (StartOf(23)) {
+		} else if (StartOf(24)) {
 			while (la.kind == _case) {
 				CaseStatement(out c);
 				cases.Add(c); 
 			}
-		} else SynErr(191);
+		} else SynErr(193);
 		s = new MatchStmt(x, t, e, cases, usesOptionalBrace); 
 	}
 
@@ -2596,38 +2695,38 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken bodyStart, bodyEnd;
 		IToken tok = Token.NoToken;
 		
-		if (la.kind == 103) {
+		if (la.kind == 104) {
 			Get();
 			x = t; tok = x; 
-		} else if (la.kind == 104) {
+		} else if (la.kind == 105) {
 			Get();
 			x = t;
 			errors.Warning(t, "the 'parallel' keyword has been deprecated; the comprehension statement now uses the keyword 'forall' (and the parentheses around the bound variables are now optional)");
 			
-		} else SynErr(192);
+		} else SynErr(194);
 		if (la.kind == _openparen) {
 			Expect(50);
 			if (la.kind == 1) {
 				QuantifierDomain(out bvars, out attrs, out range);
 			}
 			Expect(51);
-		} else if (StartOf(24)) {
+		} else if (StartOf(25)) {
 			if (la.kind == _ident) {
 				QuantifierDomain(out bvars, out attrs, out range);
 			}
-		} else SynErr(193);
+		} else SynErr(195);
 		if (bvars == null) { bvars = new List<BoundVar>(); }
 		if (range == null) { range = new LiteralExpr(x, true); }
 		
-		while (la.kind == 88 || la.kind == 89) {
+		while (la.kind == 89 || la.kind == 90) {
 			isFree = false; 
-			if (la.kind == 88) {
+			if (la.kind == 89) {
 				Get();
 				isFree = true;
 				errors.Warning(t, "the 'free' keyword is soon to be deprecated");
 				
 			}
-			Expect(89);
+			Expect(90);
 			Expression(out e, false, true);
 			ens.Add(new MaybeFreeExpression(e, isFree)); 
 			OldSemi();
@@ -2666,7 +2765,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		while (IsAttribute()) {
 			Attribute(ref attrs);
 		}
-		if (StartOf(25)) {
+		if (StartOf(26)) {
 			CalcOp(out opTok, out calcOp);
 			maybeOp = calcOp.ResultOp(calcOp); // guard against non-transitive calcOp (like !=)
 			if (maybeOp == null) {
@@ -2676,11 +2775,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			
 		}
 		Expect(46);
-		while (StartOf(7)) {
+		while (StartOf(8)) {
 			Expression(out e, false, true);
 			lines.Add(e); stepOp = calcOp; danglingOperator = null; 
 			Expect(28);
-			if (StartOf(25)) {
+			if (StartOf(26)) {
 				CalcOp(out opTok, out op);
 				maybeOp = resOp.ResultOp(op);
 				if (maybeOp == null) {
@@ -2705,7 +2804,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				} else if (la.kind == 32) {
 					CalcStmt(out subCalc);
 					hintEnd = subCalc.EndTok; subhints.Add(subCalc); 
-				} else SynErr(194);
+				} else SynErr(196);
 			}
 			var h = new BlockStmt(hintStart, hintEnd, subhints); // if the hint is empty, hintStart is the first token of the next line, but it doesn't matter because the block statement is just used as a container
 			hints.Add(h);
@@ -2731,12 +2830,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		BlockStmt body = null;  IToken bodyStart;
 		IToken ellipsisToken = null;
 		
-		Expect(105);
+		Expect(106);
 		tok = t; 
 		while (IsAttribute()) {
 			Attribute(ref attrs);
 		}
-		if (StartOf(18)) {
+		if (StartOf(19)) {
 			FrameExpression(out fe, false, true);
 			mod.Add(fe); 
 			while (la.kind == 22) {
@@ -2747,14 +2846,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 59) {
 			Get();
 			ellipsisToken = t; 
-		} else SynErr(195);
+		} else SynErr(197);
 		if (la.kind == 46) {
 			BlockStmt(out body, out bodyStart, out endTok);
 		} else if (la.kind == 28) {
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(196); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(198); Get();}
 			Get();
 			endTok = t; 
-		} else SynErr(197);
+		} else SynErr(199);
 		s = new ModifyStmt(tok, endTok, mod, attrs, body);
 		if (ellipsisToken != null) {
 		 s = new SkeletonStatement(s, ellipsisToken, null);
@@ -2768,14 +2867,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		AssignmentRhs r;
 		bool isYield = false;
 		
-		if (la.kind == 96) {
+		if (la.kind == 97) {
 			Get();
 			returnTok = t; 
-		} else if (la.kind == 90) {
+		} else if (la.kind == 91) {
 			Get();
 			returnTok = t; isYield = true; 
-		} else SynErr(198);
-		if (StartOf(26)) {
+		} else SynErr(200);
+		if (StartOf(27)) {
 			Rhs(out r);
 			rhss = new List<AssignmentRhs>(); rhss.Add(r); 
 			while (la.kind == 22) {
@@ -2800,7 +2899,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression e; 
 		Expect(59);
 		dotdotdot = t; 
-		if (la.kind == 94) {
+		if (la.kind == 95) {
 			Get();
 			names = new List<IToken>(); exprs = new List<Expression>(); whereTok = t;
 			Ident(out tok);
@@ -2810,7 +2909,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Ident(out tok);
 				names.Add(tok); 
 			}
-			Expect(95);
+			Expect(96);
 			Expression(out e, false, true);
 			exprs.Add(e); 
 			while (la.kind == 22) {
@@ -2837,7 +2936,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		r = dummyRhs;  // to please compiler
 		Attributes attrs = null;
 		
-		if (la.kind == 97) {
+		if (la.kind == 98) {
 			Get();
 			newToken = t; 
 			TypeAndToken(out x, out ty);
@@ -2852,7 +2951,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				} else {
 					x = null; args = new List<Expression/*!*/>(); 
 					Get();
-					if (StartOf(7)) {
+					if (StartOf(8)) {
 						Expressions(args);
 					}
 					Expect(51);
@@ -2869,10 +2968,10 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 57) {
 			Get();
 			r = new HavocRhs(t); 
-		} else if (StartOf(7)) {
+		} else if (StartOf(8)) {
 			Expression(out e, false, true);
 			r = new ExprRhs(e); 
-		} else SynErr(199);
+		} else SynErr(201);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -2887,13 +2986,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (la.kind == 27 || la.kind == 48 || la.kind == 50) {
 				Suffix(ref e);
 			}
-		} else if (StartOf(27)) {
+		} else if (StartOf(28)) {
 			ConstAtomExpression(out e, false, false);
 			Suffix(ref e);
 			while (la.kind == 27 || la.kind == 48 || la.kind == 50) {
 				Suffix(ref e);
 			}
-		} else SynErr(200);
+		} else SynErr(202);
 	}
 
 	void Expressions(List<Expression> args) {
@@ -2950,7 +3049,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			IdentTypeOptional(out bv);
 			pat = new CasePattern(bv.tok, bv);
 			
-		} else SynErr(201);
+		} else SynErr(203);
 		if (pat == null) {
 		 pat = new CasePattern(t, "_ParseError", new List<CasePattern>());
 		}
@@ -2970,12 +3069,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			if (allowExistentialGuards && IsExistentialGuard()) {
 				ExistentialGuard(out e, false );
 				isExistentialGuard = true; 
-			} else if (StartOf(7)) {
+			} else if (StartOf(8)) {
 				Expression(out e, true, false);
-			} else SynErr(202);
+			} else SynErr(204);
 			Expect(29);
 			body = new List<Statement>(); 
-			while (StartOf(15)) {
+			while (StartOf(16)) {
 				Stmt(body);
 			}
 			alternatives.Add(new GuardedAlternative(x, isExistentialGuard, e, body)); 
@@ -3015,19 +3114,19 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Expect(57);
 			Expect(51);
 			e = null; 
-		} else if (StartOf(7)) {
+		} else if (StartOf(8)) {
 			Expression(out ee, true, true);
 			e = ee; 
-		} else SynErr(203);
+		} else SynErr(205);
 	}
 
 	void LoopSpec(List<MaybeFreeExpression> invariants, List<Expression> decreases, ref List<FrameExpression> mod, ref Attributes decAttrs, ref Attributes modAttrs) {
 		Expression e; FrameExpression fe;
 		bool isFree = false; Attributes attrs = null;
 		
-		if (la.kind == 37 || la.kind == 88) {
-			while (!(la.kind == 0 || la.kind == 37 || la.kind == 88)) {SynErr(204); Get();}
-			if (la.kind == 88) {
+		if (la.kind == 37 || la.kind == 89) {
+			while (!(la.kind == 0 || la.kind == 37 || la.kind == 89)) {SynErr(206); Get();}
+			if (la.kind == 89) {
 				Get();
 				isFree = true; errors.Warning(t, "the 'free' keyword is soon to be deprecated"); 
 			}
@@ -3039,7 +3138,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			invariants.Add(new MaybeFreeExpression(e, isFree, attrs)); 
 			OldSemi();
 		} else if (la.kind == 36) {
-			while (!(la.kind == 0 || la.kind == 36)) {SynErr(205); Get();}
+			while (!(la.kind == 0 || la.kind == 36)) {SynErr(207); Get();}
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref decAttrs);
@@ -3047,7 +3146,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			DecreasesList(decreases, true, true);
 			OldSemi();
 		} else if (la.kind == 43) {
-			while (!(la.kind == 0 || la.kind == 43)) {SynErr(206); Get();}
+			while (!(la.kind == 0 || la.kind == 43)) {SynErr(208); Get();}
 			Get();
 			mod = mod ?? new List<FrameExpression>(); 
 			while (IsAttribute()) {
@@ -3061,7 +3160,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				mod.Add(fe); 
 			}
 			OldSemi();
-		} else SynErr(207);
+		} else SynErr(209);
 	}
 
 	void CaseStatement(out MatchCaseStmt/*!*/ c) {
@@ -3098,12 +3197,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				arguments.Add(pat); 
 			}
 			Expect(51);
-		} else SynErr(208);
+		} else SynErr(210);
 		Expect(29);
-		while (!(StartOf(28))) {SynErr(209); Get();}
+		while (!(StartOf(29))) {SynErr(211); Get();}
 		while (IsNotEndOfCase()) {
 			Stmt(body);
-			while (!(StartOf(28))) {SynErr(210); Get();}
+			while (!(StartOf(29))) {SynErr(212); Get();}
 		}
 		c = new MatchCaseStmt(x, name, arguments, body); 
 	}
@@ -3139,7 +3238,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		case 54: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Eq; 
-			if (la.kind == 106) {
+			if (la.kind == 107) {
 				Get();
 				Expect(48);
 				Expression(out k, true, true);
@@ -3157,12 +3256,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  binOp = BinaryExpr.Opcode.Gt; 
 			break;
 		}
-		case 107: {
+		case 108: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 108: {
+		case 109: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Ge; 
 			break;
@@ -3177,32 +3276,32 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  binOp = BinaryExpr.Opcode.Neq; 
 			break;
 		}
-		case 109: {
+		case 110: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 110: {
+		case 111: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		case 111: case 112: {
+		case 112: case 113: {
 			EquivOp();
 			x = t;  binOp = BinaryExpr.Opcode.Iff; 
 			break;
 		}
-		case 113: case 114: {
+		case 114: case 115: {
 			ImpliesOp();
 			x = t;  binOp = BinaryExpr.Opcode.Imp; 
 			break;
 		}
-		case 115: case 116: {
+		case 116: case 117: {
 			ExpliesOp();
 			x = t;  binOp = BinaryExpr.Opcode.Exp; 
 			break;
 		}
-		default: SynErr(211); break;
+		default: SynErr(213); break;
 		}
 		if (k == null) {
 		 op = new Microsoft.Dafny.CalcStmt.BinaryCalcOp(binOp);
@@ -3213,67 +3312,67 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 	}
 
 	void EquivOp() {
-		if (la.kind == 111) {
+		if (la.kind == 112) {
 			Get();
-		} else if (la.kind == 112) {
+		} else if (la.kind == 113) {
 			Get();
-		} else SynErr(212);
+		} else SynErr(214);
 	}
 
 	void ImpliesOp() {
-		if (la.kind == 113) {
+		if (la.kind == 114) {
 			Get();
-		} else if (la.kind == 114) {
+		} else if (la.kind == 115) {
 			Get();
-		} else SynErr(213);
+		} else SynErr(215);
 	}
 
 	void ExpliesOp() {
-		if (la.kind == 115) {
+		if (la.kind == 116) {
 			Get();
-		} else if (la.kind == 116) {
+		} else if (la.kind == 117) {
 			Get();
-		} else SynErr(214);
+		} else SynErr(216);
 	}
 
 	void AndOp() {
-		if (la.kind == 117) {
+		if (la.kind == 118) {
 			Get();
-		} else if (la.kind == 118) {
+		} else if (la.kind == 119) {
 			Get();
-		} else SynErr(215);
+		} else SynErr(217);
 	}
 
 	void OrOp() {
-		if (la.kind == 119) {
+		if (la.kind == 120) {
 			Get();
-		} else if (la.kind == 120) {
+		} else if (la.kind == 121) {
 			Get();
-		} else SynErr(216);
+		} else SynErr(218);
 	}
 
 	void NegOp() {
-		if (la.kind == 121) {
+		if (la.kind == 122) {
 			Get();
-		} else if (la.kind == 122) {
+		} else if (la.kind == 123) {
 			Get();
-		} else SynErr(217);
+		} else SynErr(219);
 	}
 
 	void Forall() {
-		if (la.kind == 103) {
+		if (la.kind == 104) {
 			Get();
-		} else if (la.kind == 123) {
+		} else if (la.kind == 124) {
 			Get();
-		} else SynErr(218);
+		} else SynErr(220);
 	}
 
 	void Exists() {
-		if (la.kind == 124) {
+		if (la.kind == 125) {
 			Get();
-		} else if (la.kind == 125) {
+		} else if (la.kind == 126) {
 			Get();
-		} else SynErr(219);
+		} else SynErr(221);
 	}
 
 	void QSep() {
@@ -3281,7 +3380,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 26) {
 			Get();
-		} else SynErr(220);
+		} else SynErr(222);
 	}
 
 	void EquivExpression(out Expression e0, bool allowSemi, bool allowLambda) {
@@ -3299,12 +3398,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Ensures(Contract.ValueAtReturn(out e0) != null); IToken/*!*/ x;  Expression/*!*/ e1; 
 		LogicalExpression(out e0, allowSemi, allowLambda);
 		if (IsImpliesOp() || IsExpliesOp()) {
-			if (la.kind == 113 || la.kind == 114) {
+			if (la.kind == 114 || la.kind == 115) {
 				ImpliesOp();
 				x = t; 
 				ImpliesExpression(out e1, allowSemi, allowLambda);
 				e0 = new BinaryExpr(x, BinaryExpr.Opcode.Imp, e0, e1); 
-			} else if (la.kind == 115 || la.kind == 116) {
+			} else if (la.kind == 116 || la.kind == 117) {
 				ExpliesOp();
 				x = t; 
 				LogicalExpression(out e1, allowSemi, allowLambda);
@@ -3316,7 +3415,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e1, e0); 
 					
 				}
-			} else SynErr(221);
+			} else SynErr(223);
 		}
 	}
 
@@ -3324,7 +3423,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Ensures(Contract.ValueAtReturn(out e0) != null); IToken/*!*/ x;  Expression/*!*/ e1; 
 		RelationalExpression(out e0, allowSemi, allowLambda);
 		if (IsAndOp() || IsOrOp()) {
-			if (la.kind == 117 || la.kind == 118) {
+			if (la.kind == 118 || la.kind == 119) {
 				AndOp();
 				x = t; 
 				RelationalExpression(out e1, allowSemi, allowLambda);
@@ -3335,7 +3434,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					RelationalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.And, e0, e1); 
 				}
-			} else if (la.kind == 119 || la.kind == 120) {
+			} else if (la.kind == 120 || la.kind == 121) {
 				OrOp();
 				x = t; 
 				RelationalExpression(out e1, allowSemi, allowLambda);
@@ -3346,7 +3445,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					RelationalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Or, e0, e1); 
 				}
-			} else SynErr(222);
+			} else SynErr(224);
 		}
 	}
 
@@ -3482,7 +3581,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		case 54: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Eq; 
-			if (la.kind == 106) {
+			if (la.kind == 107) {
 				Get();
 				Expect(48);
 				Expression(out k, true, true);
@@ -3500,12 +3599,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  op = BinaryExpr.Opcode.Gt; 
 			break;
 		}
-		case 107: {
+		case 108: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 108: {
+		case 109: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Ge; 
 			break;
@@ -3513,7 +3612,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		case 55: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Neq; 
-			if (la.kind == 106) {
+			if (la.kind == 107) {
 				Get();
 				Expect(48);
 				Expression(out k, true, true);
@@ -3521,7 +3620,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			break;
 		}
-		case 126: {
+		case 127: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.In; 
 			break;
@@ -3531,11 +3630,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  op = BinaryExpr.Opcode.NotIn; 
 			break;
 		}
-		case 121: {
+		case 122: {
 			Get();
 			x = t;  y = Token.NoToken; 
 			if (la.val == "!") {
-				Expect(121);
+				Expect(122);
 				y = t; 
 			}
 			if (y == Token.NoToken) {
@@ -3554,17 +3653,17 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  op = BinaryExpr.Opcode.Neq; 
 			break;
 		}
-		case 109: {
+		case 110: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 110: {
+		case 111: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		default: SynErr(223); break;
+		default: SynErr(225); break;
 		}
 	}
 
@@ -3580,23 +3679,23 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void AddOp(out IToken x, out BinaryExpr.Opcode op) {
 		Contract.Ensures(Contract.ValueAtReturn(out x) != null); x = Token.NoToken;  op=BinaryExpr.Opcode.Add/*(dummy)*/; 
-		if (la.kind == 127) {
+		if (la.kind == 128) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Add; 
-		} else if (la.kind == 128) {
+		} else if (la.kind == 129) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Sub; 
-		} else SynErr(224);
+		} else SynErr(226);
 	}
 
 	void UnaryExpression(out Expression e, bool allowSemi, bool allowLambda) {
 		Contract.Ensures(Contract.ValueAtReturn(out e) != null); IToken/*!*/ x;  e = dummyExpr; 
-		if (la.kind == 128) {
+		if (la.kind == 129) {
 			Get();
 			x = t; 
 			UnaryExpression(out e, allowSemi, allowLambda);
 			e = new NegationExpression(x, e); 
-		} else if (la.kind == 121 || la.kind == 122) {
+		} else if (la.kind == 122 || la.kind == 123) {
 			NegOp();
 			x = t; 
 			UnaryExpression(out e, allowSemi, allowLambda);
@@ -3624,7 +3723,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 		} else if (IsLambda(allowLambda)) {
 			LambdaExpression(out e, allowSemi);
-		} else if (StartOf(29)) {
+		} else if (StartOf(30)) {
 			EndlessExpression(out e, allowSemi, allowLambda);
 		} else if (la.kind == 1) {
 			NameSegment(out e);
@@ -3641,12 +3740,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (IsSuffix()) {
 				Suffix(ref e);
 			}
-		} else if (StartOf(27)) {
+		} else if (StartOf(28)) {
 			ConstAtomExpression(out e, allowSemi, allowLambda);
 			while (IsSuffix()) {
 				Suffix(ref e);
 			}
-		} else SynErr(225);
+		} else SynErr(227);
 	}
 
 	void MulOp(out IToken x, out BinaryExpr.Opcode op) {
@@ -3654,13 +3753,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (la.kind == 57) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Mul; 
-		} else if (la.kind == 129) {
+		} else if (la.kind == 130) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Div; 
-		} else if (la.kind == 130) {
+		} else if (la.kind == 131) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Mod; 
-		} else SynErr(226);
+		} else SynErr(228);
 	}
 
 	void MapDisplayExpr(IToken/*!*/ mapToken, bool finite, out Expression e) {
@@ -3669,7 +3768,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;
 		
 		Expect(48);
-		if (StartOf(7)) {
+		if (StartOf(8)) {
 			MapLiteralExpressions(out elements);
 		}
 		e = new MapDisplayExpr(mapToken, finite, elements);
@@ -3699,7 +3798,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				}
 				Expect(51);
 				e = new DatatypeUpdateExpr(x, e, updates); 
-			} else if (StartOf(30)) {
+			} else if (StartOf(31)) {
 				DotSuffix(out id, out x);
 				if (x != null) {
 				 // process id as a Suffix in its own right
@@ -3711,30 +3810,30 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				if (IsGenericInstantiation()) {
 					typeArgs = new List<Type>(); 
 					GenericInstantiation(typeArgs);
-				} else if (la.kind == 106) {
+				} else if (la.kind == 107) {
 					HashCall(id, out openParen, out typeArgs, out args);
-				} else if (StartOf(31)) {
-				} else SynErr(227);
+				} else if (StartOf(32)) {
+				} else SynErr(229);
 				e = new ExprDotName(id, e, id.val, typeArgs);
 				if (openParen != null) {
 				 e = new ApplySuffix(openParen, e, args);
 				}
 				
-			} else SynErr(228);
+			} else SynErr(230);
 		} else if (la.kind == 48) {
 			Get();
 			x = t; 
-			if (StartOf(7)) {
+			if (StartOf(8)) {
 				Expression(out ee, true, true);
 				e0 = ee; 
-				if (la.kind == 137) {
+				if (la.kind == 138) {
 					Get();
 					anyDots = true; 
-					if (StartOf(7)) {
+					if (StartOf(8)) {
 						Expression(out ee, true, true);
 						e1 = ee; 
 					}
-				} else if (la.kind == 95) {
+				} else if (la.kind == 96) {
 					Get();
 					Expression(out ee, true, true);
 					e1 = ee; 
@@ -3744,7 +3843,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					multipleLengths.Add(e0);  // account for the Expression read before the colon
 					takeRest = true;
 					
-					if (StartOf(7)) {
+					if (StartOf(8)) {
 						Expression(out ee, true, true);
 						multipleLengths.Add(ee); takeRest = false; 
 						while (IsNonFinalColon()) {
@@ -3768,15 +3867,15 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 						multipleIndices.Add(ee);
 						
 					}
-				} else SynErr(229);
-			} else if (la.kind == 137) {
+				} else SynErr(231);
+			} else if (la.kind == 138) {
 				Get();
 				anyDots = true; 
-				if (StartOf(7)) {
+				if (StartOf(8)) {
 					Expression(out ee, true, true);
 					e1 = ee; 
 				}
-			} else SynErr(230);
+			} else SynErr(232);
 			if (multipleIndices != null) {
 			 e = new MultiSelectExpr(x, e, multipleIndices);
 			 // make sure an array class with this dimensionality exists
@@ -3815,12 +3914,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 50) {
 			Get();
 			IToken openParen = t; var args = new List<Expression>(); 
-			if (StartOf(7)) {
+			if (StartOf(8)) {
 				Expressions(args);
 			}
 			Expect(51);
 			e = new ApplySuffix(openParen, e, args); 
-		} else SynErr(231);
+		} else SynErr(233);
 	}
 
 	void ISetDisplayExpr(IToken/*!*/ setToken, bool finite, out Expression e) {
@@ -3829,7 +3928,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;
 		
 		Expect(46);
-		if (StartOf(7)) {
+		if (StartOf(8)) {
 			Expressions(elements);
 		}
 		e = new SetDisplayExpr(setToken, finite, elements);
@@ -3862,7 +3961,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				}
 			}
 			Expect(51);
-		} else SynErr(232);
+		} else SynErr(234);
 		while (la.kind == 44 || la.kind == 45) {
 			if (la.kind == 44) {
 				Get();
@@ -3888,7 +3987,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;
 		
 		switch (la.kind) {
-		case 98: {
+		case 99: {
 			Get();
 			x = t; 
 			Expression(out e, true, true);
@@ -3899,11 +3998,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			e = new ITEExpr(x, e, e0, e1); 
 			break;
 		}
-		case 100: {
+		case 101: {
 			MatchExpression(out e, allowSemi, allowLambda);
 			break;
 		}
-		case 103: case 123: case 124: case 125: {
+		case 104: case 124: case 125: case 126: {
 			QuantifierGuts(out e, allowSemi, allowLambda);
 			break;
 		}
@@ -3919,13 +4018,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			SetComprehensionExpr(x, false, out e, allowSemi, allowLambda);
 			break;
 		}
-		case 31: case 32: case 101: {
+		case 31: case 32: case 102: {
 			StmtInExpr(out s);
 			Expression(out e, allowSemi, allowLambda);
 			e = new StmtExpr(s.Tok, s, e); 
 			break;
 		}
-		case 73: case 78: {
+		case 62: case 79: {
 			LetExpr(out e, allowSemi, allowLambda);
 			break;
 		}
@@ -3941,11 +4040,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			MapComprehensionExpr(x, false, out e, allowSemi, allowLambda);
 			break;
 		}
-		case 92: {
+		case 93: {
 			NamedExpr(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(233); break;
+		default: SynErr(235); break;
 		}
 	}
 
@@ -3957,10 +4056,10 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (IsGenericInstantiation()) {
 			typeArgs = new List<Type>(); 
 			GenericInstantiation(typeArgs);
-		} else if (la.kind == 106) {
+		} else if (la.kind == 107) {
 			HashCall(id, out openParen, out typeArgs, out args);
-		} else if (StartOf(31)) {
-		} else SynErr(234);
+		} else if (StartOf(32)) {
+		} else SynErr(236);
 		e = new NameSegment(id, id.val, typeArgs);
 		if (openParen != null) {
 		 e = new ApplySuffix(openParen, e, args);
@@ -3976,7 +4075,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (la.kind == 46) {
 			Get();
 			x = t;  elements = new List<Expression/*!*/>(); 
-			if (StartOf(7)) {
+			if (StartOf(8)) {
 				Expressions(elements);
 			}
 			e = new SetDisplayExpr(x, true, elements);
@@ -3984,12 +4083,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 48) {
 			Get();
 			x = t;  elements = new List<Expression/*!*/>(); 
-			if (StartOf(7)) {
+			if (StartOf(8)) {
 				Expressions(elements);
 			}
 			e = new SeqDisplayExpr(x, elements); 
 			Expect(49);
-		} else SynErr(235);
+		} else SynErr(237);
 	}
 
 	void MultiSetExpr(out Expression e) {
@@ -4002,7 +4101,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (la.kind == 46) {
 			Get();
 			elements = new List<Expression/*!*/>(); 
-			if (StartOf(7)) {
+			if (StartOf(8)) {
 				Expressions(elements);
 			}
 			e = new MultiSetDisplayExpr(x, elements);
@@ -4013,7 +4112,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Expression(out e, true, true);
 			e = new MultiSetFormingExpr(x, e); 
 			Expect(51);
-		} else SynErr(236);
+		} else SynErr(238);
 	}
 
 	void ConstAtomExpression(out Expression e, bool allowSemi, bool allowLambda) {
@@ -4022,17 +4121,17 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;  Type toType = null;
 		
 		switch (la.kind) {
-		case 131: {
+		case 132: {
 			Get();
 			e = new LiteralExpr(t, false); 
 			break;
 		}
-		case 132: {
+		case 133: {
 			Get();
 			e = new LiteralExpr(t, true); 
 			break;
 		}
-		case 133: {
+		case 134: {
 			Get();
 			e = new LiteralExpr(t); 
 			break;
@@ -4060,12 +4159,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			
 			break;
 		}
-		case 134: {
+		case 135: {
 			Get();
 			e = new ThisExpr(t); 
 			break;
 		}
-		case 135: {
+		case 136: {
 			Get();
 			x = t; 
 			Expect(50);
@@ -4074,7 +4173,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			e = new UnaryOpExpr(x, UnaryOpExpr.Opcode.Fresh, e); 
 			break;
 		}
-		case 136: {
+		case 137: {
 			Get();
 			x = t; 
 			Expect(50);
@@ -4109,7 +4208,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			ParensExpression(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(237); break;
+		default: SynErr(239); break;
 		}
 	}
 
@@ -4138,7 +4237,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 n = BigInteger.Zero;
 			}
 			
-		} else SynErr(238);
+		} else SynErr(240);
 	}
 
 	void Dec(out Basetypes.BigDec d) {
@@ -4160,7 +4259,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		
 		Expect(50);
 		x = t; 
-		if (StartOf(7)) {
+		if (StartOf(8)) {
 			Expressions(args);
 		}
 		Expect(51);
@@ -4182,20 +4281,20 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 30) {
 			Get();
 			oneShot = true; 
-		} else SynErr(239);
+		} else SynErr(241);
 	}
 
 	void MapLiteralExpressions(out List<ExpressionPair> elements) {
 		Expression/*!*/ d, r;
 		elements = new List<ExpressionPair/*!*/>(); 
 		Expression(out d, true, true);
-		Expect(95);
+		Expect(96);
 		Expression(out r, true, true);
 		elements.Add(new ExpressionPair(d,r)); 
 		while (la.kind == 22) {
 			Get();
 			Expression(out d, true, true);
-			Expect(95);
+			Expect(96);
 			Expression(out r, true, true);
 			elements.Add(new ExpressionPair(d,r)); 
 		}
@@ -4229,7 +4328,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<MatchCaseExpr/*!*/> cases = new List<MatchCaseExpr/*!*/>();
 		bool usesOptionalBrace = false;
 		
-		Expect(100);
+		Expect(101);
 		x = t; 
 		Expression(out e, allowSemi, allowLambda);
 		if (la.kind == _lbrace) {
@@ -4240,12 +4339,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				cases.Add(c); 
 			}
 			Expect(47);
-		} else if (StartOf(32)) {
+		} else if (StartOf(33)) {
 			while (la.kind == _case) {
 				CaseExpression(out c, allowSemi, allowLambda);
 				cases.Add(c); 
 			}
-		} else SynErr(240);
+		} else SynErr(242);
 		e = new MatchExpr(x, e, cases, usesOptionalBrace); 
 	}
 
@@ -4257,13 +4356,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression range;
 		Expression/*!*/ body;
 		
-		if (la.kind == 103 || la.kind == 123) {
+		if (la.kind == 104 || la.kind == 124) {
 			Forall();
 			x = t;  univ = true; 
-		} else if (la.kind == 124 || la.kind == 125) {
+		} else if (la.kind == 125 || la.kind == 126) {
 			Exists();
 			x = t; 
-		} else SynErr(241);
+		} else SynErr(243);
 		QuantifierDomain(out bvars, out attrs, out range);
 		QSep();
 		Expression(out body, allowSemi, allowLambda);
@@ -4306,13 +4405,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void StmtInExpr(out Statement s) {
 		s = dummyStmt; 
-		if (la.kind == 101) {
+		if (la.kind == 102) {
 			AssertStmt(out s);
 		} else if (la.kind == 31) {
 			AssumeStmt(out s);
 		} else if (la.kind == 32) {
 			CalcStmt(out s);
-		} else SynErr(242);
+		} else SynErr(244);
 	}
 
 	void LetExpr(out Expression e, bool allowSemi, bool allowLambda) {
@@ -4325,11 +4424,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Attributes attrs = null;
 		e = dummyExpr;
 		
-		if (la.kind == 73) {
+		if (la.kind == 62) {
 			Get();
 			isGhost = true;  x = t; 
 		}
-		Expect(78);
+		Expect(79);
 		if (!isGhost) { x = t; } 
 		CasePattern(out pat);
 		if (isGhost) { pat.Vars.Iter(bv => bv.IsGhost = true); }
@@ -4342,7 +4441,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			letLHSs.Add(pat);
 			
 		}
-		if (la.kind == 95) {
+		if (la.kind == 96) {
 			Get();
 		} else if (la.kind == 25 || la.kind == 46) {
 			while (la.kind == 46) {
@@ -4356,7 +4455,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 }
 			}
 			
-		} else SynErr(243);
+		} else SynErr(245);
 		Expression(out e, false, true);
 		letRHSs.Add(e); 
 		while (la.kind == 22) {
@@ -4374,7 +4473,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;
 		Expression expr;
 		
-		Expect(92);
+		Expect(93);
 		x = t; 
 		NoUSIdent(out d);
 		Expect(21);
@@ -4416,7 +4515,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				arguments.Add(pat); 
 			}
 			Expect(51);
-		} else SynErr(244);
+		} else SynErr(246);
 		Expect(29);
 		Expression(out body, allowSemi, allowLambda);
 		c = new MatchCaseExpr(x, name, arguments, body); 
@@ -4424,7 +4523,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void HashCall(IToken id, out IToken openParen, out List<Type> typeArgs, out List<Expression> args) {
 		Expression k; args = new List<Expression>(); typeArgs = null; 
-		Expect(106);
+		Expect(107);
 		id.val = id.val + "#"; 
 		if (la.kind == 52) {
 			typeArgs = new List<Type>(); 
@@ -4436,7 +4535,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		args.Add(k); 
 		Expect(50);
 		openParen = t; 
-		if (StartOf(7)) {
+		if (StartOf(8)) {
 			Expressions(args);
 		}
 		Expect(51);
@@ -4450,8 +4549,8 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 2) {
 			Get();
 			id = t; 
-		} else SynErr(245);
-		Expect(95);
+		} else SynErr(247);
+		Expect(96);
 		Expression(out e, true, true);
 	}
 
@@ -4493,7 +4592,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 44) {
 			Get();
 			x = t; 
-		} else SynErr(246);
+		} else SynErr(248);
 	}
 
 
@@ -4508,39 +4607,40 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 	}
 
 	static readonly bool[,] set = {
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_T, _T,_T,_x,_x, _T,_T,_x,_x, _T,_T,_x,_T, _T,_T,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_x, _T,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_T, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _T,_T,_T,_x, _T,_T,_T,_T, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _T,_T,_T,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_x, _T,_T,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_T,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_x,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_x, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_x,_x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_T,_x, _T,_T,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x}
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_T, _T,_T,_x,_x, _T,_T,_x,_x, _T,_T,_x,_T, _T,_T,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_x, _x,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_x,_T,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_T,_x,_T, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_x, _x,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _T,_T,_T,_x, _T,_T,_T,_T, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_x, _x,_T,_T,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_T,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_T, _x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
+		{_x,_x,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x}
 
 	};
 } // end Parser
@@ -4630,191 +4730,193 @@ public class Errors {
 			case 59: s = "ellipsis expected"; break;
 			case 60: s = "\"include\" expected"; break;
 			case 61: s = "\"abstract\" expected"; break;
-			case 62: s = "\"module\" expected"; break;
-			case 63: s = "\"exclusively\" expected"; break;
-			case 64: s = "\"refines\" expected"; break;
-			case 65: s = "\"import\" expected"; break;
-			case 66: s = "\"opened\" expected"; break;
-			case 67: s = "\"=\" expected"; break;
-			case 68: s = "\"as\" expected"; break;
-			case 69: s = "\"default\" expected"; break;
-			case 70: s = "\"class\" expected"; break;
-			case 71: s = "\"extends\" expected"; break;
-			case 72: s = "\"trait\" expected"; break;
-			case 73: s = "\"ghost\" expected"; break;
-			case 74: s = "\"static\" expected"; break;
-			case 75: s = "\"protected\" expected"; break;
-			case 76: s = "\"datatype\" expected"; break;
-			case 77: s = "\"codatatype\" expected"; break;
-			case 78: s = "\"var\" expected"; break;
-			case 79: s = "\"newtype\" expected"; break;
-			case 80: s = "\"type\" expected"; break;
-			case 81: s = "\"iterator\" expected"; break;
-			case 82: s = "\"yields\" expected"; break;
-			case 83: s = "\"returns\" expected"; break;
-			case 84: s = "\"method\" expected"; break;
-			case 85: s = "\"colemma\" expected"; break;
-			case 86: s = "\"comethod\" expected"; break;
-			case 87: s = "\"constructor\" expected"; break;
-			case 88: s = "\"free\" expected"; break;
-			case 89: s = "\"ensures\" expected"; break;
-			case 90: s = "\"yield\" expected"; break;
-			case 91: s = "\"`\" expected"; break;
-			case 92: s = "\"label\" expected"; break;
-			case 93: s = "\"break\" expected"; break;
-			case 94: s = "\"where\" expected"; break;
-			case 95: s = "\":=\" expected"; break;
-			case 96: s = "\"return\" expected"; break;
-			case 97: s = "\"new\" expected"; break;
-			case 98: s = "\"if\" expected"; break;
-			case 99: s = "\"while\" expected"; break;
-			case 100: s = "\"match\" expected"; break;
-			case 101: s = "\"assert\" expected"; break;
-			case 102: s = "\"print\" expected"; break;
-			case 103: s = "\"forall\" expected"; break;
-			case 104: s = "\"parallel\" expected"; break;
-			case 105: s = "\"modify\" expected"; break;
-			case 106: s = "\"#\" expected"; break;
-			case 107: s = "\"<=\" expected"; break;
-			case 108: s = "\">=\" expected"; break;
-			case 109: s = "\"\\u2264\" expected"; break;
-			case 110: s = "\"\\u2265\" expected"; break;
-			case 111: s = "\"<==>\" expected"; break;
-			case 112: s = "\"\\u21d4\" expected"; break;
-			case 113: s = "\"==>\" expected"; break;
-			case 114: s = "\"\\u21d2\" expected"; break;
-			case 115: s = "\"<==\" expected"; break;
-			case 116: s = "\"\\u21d0\" expected"; break;
-			case 117: s = "\"&&\" expected"; break;
-			case 118: s = "\"\\u2227\" expected"; break;
-			case 119: s = "\"||\" expected"; break;
-			case 120: s = "\"\\u2228\" expected"; break;
-			case 121: s = "\"!\" expected"; break;
-			case 122: s = "\"\\u00ac\" expected"; break;
-			case 123: s = "\"\\u2200\" expected"; break;
-			case 124: s = "\"exists\" expected"; break;
-			case 125: s = "\"\\u2203\" expected"; break;
-			case 126: s = "\"in\" expected"; break;
-			case 127: s = "\"+\" expected"; break;
-			case 128: s = "\"-\" expected"; break;
-			case 129: s = "\"/\" expected"; break;
-			case 130: s = "\"%\" expected"; break;
-			case 131: s = "\"false\" expected"; break;
-			case 132: s = "\"true\" expected"; break;
-			case 133: s = "\"null\" expected"; break;
-			case 134: s = "\"this\" expected"; break;
-			case 135: s = "\"fresh\" expected"; break;
-			case 136: s = "\"old\" expected"; break;
-			case 137: s = "\"..\" expected"; break;
-			case 138: s = "??? expected"; break;
-			case 139: s = "this symbol not expected in SubModuleDecl"; break;
-			case 140: s = "invalid SubModuleDecl"; break;
-			case 141: s = "this symbol not expected in ClassDecl"; break;
-			case 142: s = "this symbol not expected in DatatypeDecl"; break;
-			case 143: s = "invalid DatatypeDecl"; break;
+			case 62: s = "\"ghost\" expected"; break;
+			case 63: s = "\"static\" expected"; break;
+			case 64: s = "\"protected\" expected"; break;
+			case 65: s = "\"extern\" expected"; break;
+			case 66: s = "\"module\" expected"; break;
+			case 67: s = "\"exclusively\" expected"; break;
+			case 68: s = "\"refines\" expected"; break;
+			case 69: s = "\"import\" expected"; break;
+			case 70: s = "\"opened\" expected"; break;
+			case 71: s = "\"=\" expected"; break;
+			case 72: s = "\"as\" expected"; break;
+			case 73: s = "\"default\" expected"; break;
+			case 74: s = "\"class\" expected"; break;
+			case 75: s = "\"extends\" expected"; break;
+			case 76: s = "\"trait\" expected"; break;
+			case 77: s = "\"datatype\" expected"; break;
+			case 78: s = "\"codatatype\" expected"; break;
+			case 79: s = "\"var\" expected"; break;
+			case 80: s = "\"newtype\" expected"; break;
+			case 81: s = "\"type\" expected"; break;
+			case 82: s = "\"iterator\" expected"; break;
+			case 83: s = "\"yields\" expected"; break;
+			case 84: s = "\"returns\" expected"; break;
+			case 85: s = "\"method\" expected"; break;
+			case 86: s = "\"colemma\" expected"; break;
+			case 87: s = "\"comethod\" expected"; break;
+			case 88: s = "\"constructor\" expected"; break;
+			case 89: s = "\"free\" expected"; break;
+			case 90: s = "\"ensures\" expected"; break;
+			case 91: s = "\"yield\" expected"; break;
+			case 92: s = "\"`\" expected"; break;
+			case 93: s = "\"label\" expected"; break;
+			case 94: s = "\"break\" expected"; break;
+			case 95: s = "\"where\" expected"; break;
+			case 96: s = "\":=\" expected"; break;
+			case 97: s = "\"return\" expected"; break;
+			case 98: s = "\"new\" expected"; break;
+			case 99: s = "\"if\" expected"; break;
+			case 100: s = "\"while\" expected"; break;
+			case 101: s = "\"match\" expected"; break;
+			case 102: s = "\"assert\" expected"; break;
+			case 103: s = "\"print\" expected"; break;
+			case 104: s = "\"forall\" expected"; break;
+			case 105: s = "\"parallel\" expected"; break;
+			case 106: s = "\"modify\" expected"; break;
+			case 107: s = "\"#\" expected"; break;
+			case 108: s = "\"<=\" expected"; break;
+			case 109: s = "\">=\" expected"; break;
+			case 110: s = "\"\\u2264\" expected"; break;
+			case 111: s = "\"\\u2265\" expected"; break;
+			case 112: s = "\"<==>\" expected"; break;
+			case 113: s = "\"\\u21d4\" expected"; break;
+			case 114: s = "\"==>\" expected"; break;
+			case 115: s = "\"\\u21d2\" expected"; break;
+			case 116: s = "\"<==\" expected"; break;
+			case 117: s = "\"\\u21d0\" expected"; break;
+			case 118: s = "\"&&\" expected"; break;
+			case 119: s = "\"\\u2227\" expected"; break;
+			case 120: s = "\"||\" expected"; break;
+			case 121: s = "\"\\u2228\" expected"; break;
+			case 122: s = "\"!\" expected"; break;
+			case 123: s = "\"\\u00ac\" expected"; break;
+			case 124: s = "\"\\u2200\" expected"; break;
+			case 125: s = "\"exists\" expected"; break;
+			case 126: s = "\"\\u2203\" expected"; break;
+			case 127: s = "\"in\" expected"; break;
+			case 128: s = "\"+\" expected"; break;
+			case 129: s = "\"-\" expected"; break;
+			case 130: s = "\"/\" expected"; break;
+			case 131: s = "\"%\" expected"; break;
+			case 132: s = "\"false\" expected"; break;
+			case 133: s = "\"true\" expected"; break;
+			case 134: s = "\"null\" expected"; break;
+			case 135: s = "\"this\" expected"; break;
+			case 136: s = "\"fresh\" expected"; break;
+			case 137: s = "\"old\" expected"; break;
+			case 138: s = "\"..\" expected"; break;
+			case 139: s = "??? expected"; break;
+			case 140: s = "invalid TopDecl"; break;
+			case 141: s = "this symbol not expected in SubModuleDecl"; break;
+			case 142: s = "invalid SubModuleDecl"; break;
+			case 143: s = "this symbol not expected in ClassDecl"; break;
 			case 144: s = "this symbol not expected in DatatypeDecl"; break;
-			case 145: s = "invalid NewtypeDecl"; break;
-			case 146: s = "invalid OtherTypeDecl"; break;
-			case 147: s = "this symbol not expected in OtherTypeDecl"; break;
-			case 148: s = "this symbol not expected in IteratorDecl"; break;
-			case 149: s = "invalid IteratorDecl"; break;
-			case 150: s = "this symbol not expected in TraitDecl"; break;
-			case 151: s = "invalid ClassMemberDecl"; break;
-			case 152: s = "this symbol not expected in FieldDecl"; break;
-			case 153: s = "invalid FunctionDecl"; break;
-			case 154: s = "invalid FunctionDecl"; break;
+			case 145: s = "invalid DatatypeDecl"; break;
+			case 146: s = "this symbol not expected in DatatypeDecl"; break;
+			case 147: s = "invalid NewtypeDecl"; break;
+			case 148: s = "invalid OtherTypeDecl"; break;
+			case 149: s = "this symbol not expected in OtherTypeDecl"; break;
+			case 150: s = "this symbol not expected in IteratorDecl"; break;
+			case 151: s = "invalid IteratorDecl"; break;
+			case 152: s = "this symbol not expected in TraitDecl"; break;
+			case 153: s = "invalid ClassMemberDecl"; break;
+			case 154: s = "this symbol not expected in FieldDecl"; break;
 			case 155: s = "invalid FunctionDecl"; break;
 			case 156: s = "invalid FunctionDecl"; break;
 			case 157: s = "invalid FunctionDecl"; break;
-			case 158: s = "this symbol not expected in MethodDecl"; break;
-			case 159: s = "invalid MethodDecl"; break;
-			case 160: s = "invalid MethodDecl"; break;
-			case 161: s = "invalid FIdentType"; break;
-			case 162: s = "this symbol not expected in OldSemi"; break;
-			case 163: s = "invalid TypeIdentOptional"; break;
-			case 164: s = "invalid TypeAndToken"; break;
-			case 165: s = "this symbol not expected in IteratorSpec"; break;
-			case 166: s = "invalid IteratorSpec"; break;
-			case 167: s = "invalid IteratorSpec"; break;
-			case 168: s = "this symbol not expected in MethodSpec"; break;
-			case 169: s = "invalid MethodSpec"; break;
-			case 170: s = "invalid MethodSpec"; break;
-			case 171: s = "invalid FrameExpression"; break;
-			case 172: s = "this symbol not expected in FunctionSpec"; break;
-			case 173: s = "invalid FunctionSpec"; break;
-			case 174: s = "invalid PossiblyWildFrameExpression"; break;
-			case 175: s = "invalid PossiblyWildExpression"; break;
-			case 176: s = "this symbol not expected in OneStmt"; break;
-			case 177: s = "invalid OneStmt"; break;
+			case 158: s = "invalid FunctionDecl"; break;
+			case 159: s = "invalid FunctionDecl"; break;
+			case 160: s = "this symbol not expected in MethodDecl"; break;
+			case 161: s = "invalid MethodDecl"; break;
+			case 162: s = "invalid MethodDecl"; break;
+			case 163: s = "invalid FIdentType"; break;
+			case 164: s = "this symbol not expected in OldSemi"; break;
+			case 165: s = "invalid TypeIdentOptional"; break;
+			case 166: s = "invalid TypeAndToken"; break;
+			case 167: s = "this symbol not expected in IteratorSpec"; break;
+			case 168: s = "invalid IteratorSpec"; break;
+			case 169: s = "invalid IteratorSpec"; break;
+			case 170: s = "this symbol not expected in MethodSpec"; break;
+			case 171: s = "invalid MethodSpec"; break;
+			case 172: s = "invalid MethodSpec"; break;
+			case 173: s = "invalid FrameExpression"; break;
+			case 174: s = "this symbol not expected in FunctionSpec"; break;
+			case 175: s = "invalid FunctionSpec"; break;
+			case 176: s = "invalid PossiblyWildFrameExpression"; break;
+			case 177: s = "invalid PossiblyWildExpression"; break;
 			case 178: s = "this symbol not expected in OneStmt"; break;
 			case 179: s = "invalid OneStmt"; break;
-			case 180: s = "invalid AssertStmt"; break;
-			case 181: s = "invalid AssumeStmt"; break;
-			case 182: s = "invalid UpdateStmt"; break;
-			case 183: s = "invalid UpdateStmt"; break;
-			case 184: s = "this symbol not expected in VarDeclStatement"; break;
-			case 185: s = "invalid VarDeclStatement"; break;
-			case 186: s = "invalid VarDeclStatement"; break;
-			case 187: s = "invalid IfStmt"; break;
-			case 188: s = "invalid IfStmt"; break;
-			case 189: s = "invalid WhileStmt"; break;
-			case 190: s = "invalid WhileStmt"; break;
-			case 191: s = "invalid MatchStmt"; break;
-			case 192: s = "invalid ForallStmt"; break;
-			case 193: s = "invalid ForallStmt"; break;
-			case 194: s = "invalid CalcStmt"; break;
-			case 195: s = "invalid ModifyStmt"; break;
-			case 196: s = "this symbol not expected in ModifyStmt"; break;
+			case 180: s = "this symbol not expected in OneStmt"; break;
+			case 181: s = "invalid OneStmt"; break;
+			case 182: s = "invalid AssertStmt"; break;
+			case 183: s = "invalid AssumeStmt"; break;
+			case 184: s = "invalid UpdateStmt"; break;
+			case 185: s = "invalid UpdateStmt"; break;
+			case 186: s = "this symbol not expected in VarDeclStatement"; break;
+			case 187: s = "invalid VarDeclStatement"; break;
+			case 188: s = "invalid VarDeclStatement"; break;
+			case 189: s = "invalid IfStmt"; break;
+			case 190: s = "invalid IfStmt"; break;
+			case 191: s = "invalid WhileStmt"; break;
+			case 192: s = "invalid WhileStmt"; break;
+			case 193: s = "invalid MatchStmt"; break;
+			case 194: s = "invalid ForallStmt"; break;
+			case 195: s = "invalid ForallStmt"; break;
+			case 196: s = "invalid CalcStmt"; break;
 			case 197: s = "invalid ModifyStmt"; break;
-			case 198: s = "invalid ReturnStmt"; break;
-			case 199: s = "invalid Rhs"; break;
-			case 200: s = "invalid Lhs"; break;
-			case 201: s = "invalid CasePattern"; break;
-			case 202: s = "invalid AlternativeBlock"; break;
-			case 203: s = "invalid Guard"; break;
-			case 204: s = "this symbol not expected in LoopSpec"; break;
-			case 205: s = "this symbol not expected in LoopSpec"; break;
+			case 198: s = "this symbol not expected in ModifyStmt"; break;
+			case 199: s = "invalid ModifyStmt"; break;
+			case 200: s = "invalid ReturnStmt"; break;
+			case 201: s = "invalid Rhs"; break;
+			case 202: s = "invalid Lhs"; break;
+			case 203: s = "invalid CasePattern"; break;
+			case 204: s = "invalid AlternativeBlock"; break;
+			case 205: s = "invalid Guard"; break;
 			case 206: s = "this symbol not expected in LoopSpec"; break;
-			case 207: s = "invalid LoopSpec"; break;
-			case 208: s = "invalid CaseStatement"; break;
-			case 209: s = "this symbol not expected in CaseStatement"; break;
-			case 210: s = "this symbol not expected in CaseStatement"; break;
-			case 211: s = "invalid CalcOp"; break;
-			case 212: s = "invalid EquivOp"; break;
-			case 213: s = "invalid ImpliesOp"; break;
-			case 214: s = "invalid ExpliesOp"; break;
-			case 215: s = "invalid AndOp"; break;
-			case 216: s = "invalid OrOp"; break;
-			case 217: s = "invalid NegOp"; break;
-			case 218: s = "invalid Forall"; break;
-			case 219: s = "invalid Exists"; break;
-			case 220: s = "invalid QSep"; break;
-			case 221: s = "invalid ImpliesExpliesExpression"; break;
-			case 222: s = "invalid LogicalExpression"; break;
-			case 223: s = "invalid RelOp"; break;
-			case 224: s = "invalid AddOp"; break;
-			case 225: s = "invalid UnaryExpression"; break;
-			case 226: s = "invalid MulOp"; break;
-			case 227: s = "invalid Suffix"; break;
-			case 228: s = "invalid Suffix"; break;
+			case 207: s = "this symbol not expected in LoopSpec"; break;
+			case 208: s = "this symbol not expected in LoopSpec"; break;
+			case 209: s = "invalid LoopSpec"; break;
+			case 210: s = "invalid CaseStatement"; break;
+			case 211: s = "this symbol not expected in CaseStatement"; break;
+			case 212: s = "this symbol not expected in CaseStatement"; break;
+			case 213: s = "invalid CalcOp"; break;
+			case 214: s = "invalid EquivOp"; break;
+			case 215: s = "invalid ImpliesOp"; break;
+			case 216: s = "invalid ExpliesOp"; break;
+			case 217: s = "invalid AndOp"; break;
+			case 218: s = "invalid OrOp"; break;
+			case 219: s = "invalid NegOp"; break;
+			case 220: s = "invalid Forall"; break;
+			case 221: s = "invalid Exists"; break;
+			case 222: s = "invalid QSep"; break;
+			case 223: s = "invalid ImpliesExpliesExpression"; break;
+			case 224: s = "invalid LogicalExpression"; break;
+			case 225: s = "invalid RelOp"; break;
+			case 226: s = "invalid AddOp"; break;
+			case 227: s = "invalid UnaryExpression"; break;
+			case 228: s = "invalid MulOp"; break;
 			case 229: s = "invalid Suffix"; break;
 			case 230: s = "invalid Suffix"; break;
 			case 231: s = "invalid Suffix"; break;
-			case 232: s = "invalid LambdaExpression"; break;
-			case 233: s = "invalid EndlessExpression"; break;
-			case 234: s = "invalid NameSegment"; break;
-			case 235: s = "invalid DisplayExpr"; break;
-			case 236: s = "invalid MultiSetExpr"; break;
-			case 237: s = "invalid ConstAtomExpression"; break;
-			case 238: s = "invalid Nat"; break;
-			case 239: s = "invalid LambdaArrow"; break;
-			case 240: s = "invalid MatchExpression"; break;
-			case 241: s = "invalid QuantifierGuts"; break;
-			case 242: s = "invalid StmtInExpr"; break;
-			case 243: s = "invalid LetExpr"; break;
-			case 244: s = "invalid CaseExpression"; break;
-			case 245: s = "invalid MemberBindingUpdate"; break;
-			case 246: s = "invalid DotSuffix"; break;
+			case 232: s = "invalid Suffix"; break;
+			case 233: s = "invalid Suffix"; break;
+			case 234: s = "invalid LambdaExpression"; break;
+			case 235: s = "invalid EndlessExpression"; break;
+			case 236: s = "invalid NameSegment"; break;
+			case 237: s = "invalid DisplayExpr"; break;
+			case 238: s = "invalid MultiSetExpr"; break;
+			case 239: s = "invalid ConstAtomExpression"; break;
+			case 240: s = "invalid Nat"; break;
+			case 241: s = "invalid LambdaArrow"; break;
+			case 242: s = "invalid MatchExpression"; break;
+			case 243: s = "invalid QuantifierGuts"; break;
+			case 244: s = "invalid StmtInExpr"; break;
+			case 245: s = "invalid LetExpr"; break;
+			case 246: s = "invalid CaseExpression"; break;
+			case 247: s = "invalid MemberBindingUpdate"; break;
+			case 248: s = "invalid DotSuffix"; break;
 
 			default: s = "error " + n; break;
 		}
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 4d900a1b..eb82df72 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -197,6 +197,33 @@ namespace Microsoft.Dafny
       Contract.Invariant(cce.NonNullDictionaryAndValues(datatypeCtors) && Contract.ForAll(datatypeCtors.Values, v => cce.NonNullDictionaryAndValues(v)));
     }
 
+    /// <summary>
+    /// Check that now two modules that are being compiled have the same CompileName.
+    /// 
+    /// This could happen if they are given the same name using the 'extern' declaration modifier.
+    /// </summary>
+    /// <param name="prog">The Dafny program being compiled.</param>
+    void CheckDupModuleNames(Program prog)
+    {
+      // Check that none of the modules have the same CompileName.
+      Dictionary<string, ModuleDefinition> compileNameMap = new Dictionary<string, ModuleDefinition>();
+      foreach (ModuleDefinition m in prog.CompileModules) {
+        if (m.IsAbstract) {
+          // the purpose of an abstract module is to skip compilation
+          continue;
+        }
+        string compileName = m.CompileName;
+        ModuleDefinition priorModDef;
+        if (compileNameMap.TryGetValue(compileName, out priorModDef)) {
+          reporter.Error(MessageSource.Resolver, m.tok, 
+            "Modules '{0}' and '{1}' both have CompileName '{2}'.",
+            priorModDef.tok.val, m.tok.val, compileName);
+        }
+        else {
+          compileNameMap.Add(compileName, m);
+        }
+      }
+    }
     public void ResolveProgram(Program prog) {
       Contract.Requires(prog != null);
       var origErrorCount = reporter.Count(ErrorLevel.Error); //TODO: This is used further below, but not in the >0 comparisons in the next few lines. Is that right?
@@ -459,6 +486,8 @@ namespace Microsoft.Dafny
           }
         }
       }
+
+      CheckDupModuleNames(prog);
     }
 
     void FillInDefaultDecreasesClauses(Program prog)
diff --git a/Source/Dafny/Scanner.cs b/Source/Dafny/Scanner.cs
index 6e2107c3..784f9cd5 100644
--- a/Source/Dafny/Scanner.cs
+++ b/Source/Dafny/Scanner.cs
@@ -211,8 +211,8 @@ public class UTF8Buffer: Buffer {
 public class Scanner {
 	const char EOL = '\n';
 	const int eofSym = 0; /* pdt */
-	const int maxT = 138;
-	const int noSym = 138;
+	const int maxT = 139;
+	const int noSym = 139;
 
 
 	[ContractInvariantMethod]
@@ -541,55 +541,56 @@ public class Scanner {
 			case "requires": t.kind = 45; break;
 			case "include": t.kind = 60; break;
 			case "abstract": t.kind = 61; break;
-			case "module": t.kind = 62; break;
-			case "exclusively": t.kind = 63; break;
-			case "refines": t.kind = 64; break;
-			case "import": t.kind = 65; break;
-			case "opened": t.kind = 66; break;
-			case "as": t.kind = 68; break;
-			case "default": t.kind = 69; break;
-			case "class": t.kind = 70; break;
-			case "extends": t.kind = 71; break;
-			case "trait": t.kind = 72; break;
-			case "ghost": t.kind = 73; break;
-			case "static": t.kind = 74; break;
-			case "protected": t.kind = 75; break;
-			case "datatype": t.kind = 76; break;
-			case "codatatype": t.kind = 77; break;
-			case "var": t.kind = 78; break;
-			case "newtype": t.kind = 79; break;
-			case "type": t.kind = 80; break;
-			case "iterator": t.kind = 81; break;
-			case "yields": t.kind = 82; break;
-			case "returns": t.kind = 83; break;
-			case "method": t.kind = 84; break;
-			case "colemma": t.kind = 85; break;
-			case "comethod": t.kind = 86; break;
-			case "constructor": t.kind = 87; break;
-			case "free": t.kind = 88; break;
-			case "ensures": t.kind = 89; break;
-			case "yield": t.kind = 90; break;
-			case "label": t.kind = 92; break;
-			case "break": t.kind = 93; break;
-			case "where": t.kind = 94; break;
-			case "return": t.kind = 96; break;
-			case "new": t.kind = 97; break;
-			case "if": t.kind = 98; break;
-			case "while": t.kind = 99; break;
-			case "match": t.kind = 100; break;
-			case "assert": t.kind = 101; break;
-			case "print": t.kind = 102; break;
-			case "forall": t.kind = 103; break;
-			case "parallel": t.kind = 104; break;
-			case "modify": t.kind = 105; break;
-			case "exists": t.kind = 124; break;
-			case "in": t.kind = 126; break;
-			case "false": t.kind = 131; break;
-			case "true": t.kind = 132; break;
-			case "null": t.kind = 133; break;
-			case "this": t.kind = 134; break;
-			case "fresh": t.kind = 135; break;
-			case "old": t.kind = 136; break;
+			case "ghost": t.kind = 62; break;
+			case "static": t.kind = 63; break;
+			case "protected": t.kind = 64; break;
+			case "extern": t.kind = 65; break;
+			case "module": t.kind = 66; break;
+			case "exclusively": t.kind = 67; break;
+			case "refines": t.kind = 68; break;
+			case "import": t.kind = 69; break;
+			case "opened": t.kind = 70; break;
+			case "as": t.kind = 72; break;
+			case "default": t.kind = 73; break;
+			case "class": t.kind = 74; break;
+			case "extends": t.kind = 75; break;
+			case "trait": t.kind = 76; break;
+			case "datatype": t.kind = 77; break;
+			case "codatatype": t.kind = 78; break;
+			case "var": t.kind = 79; break;
+			case "newtype": t.kind = 80; break;
+			case "type": t.kind = 81; break;
+			case "iterator": t.kind = 82; break;
+			case "yields": t.kind = 83; break;
+			case "returns": t.kind = 84; break;
+			case "method": t.kind = 85; break;
+			case "colemma": t.kind = 86; break;
+			case "comethod": t.kind = 87; break;
+			case "constructor": t.kind = 88; break;
+			case "free": t.kind = 89; break;
+			case "ensures": t.kind = 90; break;
+			case "yield": t.kind = 91; break;
+			case "label": t.kind = 93; break;
+			case "break": t.kind = 94; break;
+			case "where": t.kind = 95; break;
+			case "return": t.kind = 97; break;
+			case "new": t.kind = 98; break;
+			case "if": t.kind = 99; break;
+			case "while": t.kind = 100; break;
+			case "match": t.kind = 101; break;
+			case "assert": t.kind = 102; break;
+			case "print": t.kind = 103; break;
+			case "forall": t.kind = 104; break;
+			case "parallel": t.kind = 105; break;
+			case "modify": t.kind = 106; break;
+			case "exists": t.kind = 125; break;
+			case "in": t.kind = 127; break;
+			case "false": t.kind = 132; break;
+			case "true": t.kind = 133; break;
+			case "null": t.kind = 134; break;
+			case "this": t.kind = 135; break;
+			case "fresh": t.kind = 136; break;
+			case "old": t.kind = 137; break;
 			default: break;
 		}
 	}
@@ -852,50 +853,50 @@ public class Scanner {
 				else if (ch >= '0' && ch <= '9') {AddCh(); goto case 66;}
 				else {t.kind = 5; break;}
 			case 67:
-				{t.kind = 91; break;}
+				{t.kind = 92; break;}
 			case 68:
-				{t.kind = 95; break;}
+				{t.kind = 96; break;}
 			case 69:
-				{t.kind = 106; break;}
+				{t.kind = 107; break;}
 			case 70:
-				{t.kind = 108; break;}
-			case 71:
 				{t.kind = 109; break;}
-			case 72:
+			case 71:
 				{t.kind = 110; break;}
-			case 73:
+			case 72:
 				{t.kind = 111; break;}
-			case 74:
+			case 73:
 				{t.kind = 112; break;}
-			case 75:
+			case 74:
 				{t.kind = 113; break;}
-			case 76:
+			case 75:
 				{t.kind = 114; break;}
+			case 76:
+				{t.kind = 115; break;}
 			case 77:
-				{t.kind = 116; break;}
+				{t.kind = 117; break;}
 			case 78:
 				if (ch == '&') {AddCh(); goto case 79;}
 				else {goto case 0;}
 			case 79:
-				{t.kind = 117; break;}
-			case 80:
 				{t.kind = 118; break;}
-			case 81:
+			case 80:
 				{t.kind = 119; break;}
-			case 82:
+			case 81:
 				{t.kind = 120; break;}
+			case 82:
+				{t.kind = 121; break;}
 			case 83:
-				{t.kind = 122; break;}
-			case 84:
 				{t.kind = 123; break;}
+			case 84:
+				{t.kind = 124; break;}
 			case 85:
-				{t.kind = 125; break;}
+				{t.kind = 126; break;}
 			case 86:
-				{t.kind = 127; break;}
+				{t.kind = 128; break;}
 			case 87:
-				{t.kind = 129; break;}
-			case 88:
 				{t.kind = 130; break;}
+			case 88:
+				{t.kind = 131; break;}
 			case 89:
 				recEnd = pos; recKind = 21;
 				if (ch == ':') {AddCh(); goto case 30;}
@@ -911,14 +912,14 @@ public class Scanner {
 				if (ch == '.') {AddCh(); goto case 97;}
 				else {t.kind = 27; break;}
 			case 92:
-				recEnd = pos; recKind = 67;
+				recEnd = pos; recKind = 71;
 				if (ch == '>') {AddCh(); goto case 34;}
 				else if (ch == '=') {AddCh(); goto case 98;}
-				else {t.kind = 67; break;}
+				else {t.kind = 71; break;}
 			case 93:
-				recEnd = pos; recKind = 128;
+				recEnd = pos; recKind = 129;
 				if (ch == '>') {AddCh(); goto case 35;}
-				else {t.kind = 128; break;}
+				else {t.kind = 129; break;}
 			case 94:
 				recEnd = pos; recKind = 52;
 				if (ch == '=') {AddCh(); goto case 99;}
@@ -928,26 +929,26 @@ public class Scanner {
 				if (ch == '=') {AddCh(); goto case 70;}
 				else {t.kind = 53; break;}
 			case 96:
-				recEnd = pos; recKind = 121;
+				recEnd = pos; recKind = 122;
 				if (ch == '=') {AddCh(); goto case 42;}
 				else if (ch == 'i') {AddCh(); goto case 45;}
-				else {t.kind = 121; break;}
+				else {t.kind = 122; break;}
 			case 97:
-				recEnd = pos; recKind = 137;
+				recEnd = pos; recKind = 138;
 				if (ch == '.') {AddCh(); goto case 48;}
-				else {t.kind = 137; break;}
+				else {t.kind = 138; break;}
 			case 98:
 				recEnd = pos; recKind = 54;
 				if (ch == '>') {AddCh(); goto case 75;}
 				else {t.kind = 54; break;}
 			case 99:
-				recEnd = pos; recKind = 107;
+				recEnd = pos; recKind = 108;
 				if (ch == '=') {AddCh(); goto case 100;}
-				else {t.kind = 107; break;}
+				else {t.kind = 108; break;}
 			case 100:
-				recEnd = pos; recKind = 115;
+				recEnd = pos; recKind = 116;
 				if (ch == '>') {AddCh(); goto case 73;}
-				else {t.kind = 115; break;}
+				else {t.kind = 116; break;}
 
 		}
 		t.val = new String(tval, 0, tlen);
diff --git a/Source/DafnyDriver/DafnyDriver.cs b/Source/DafnyDriver/DafnyDriver.cs
index 6cfbe7e1..a60971b1 100644
--- a/Source/DafnyDriver/DafnyDriver.cs
+++ b/Source/DafnyDriver/DafnyDriver.cs
@@ -13,6 +13,7 @@ namespace Microsoft.Dafny
   using System;
   using System.CodeDom.Compiler;
   using System.Collections.Generic;
+  using System.Collections.ObjectModel;
   using System.Diagnostics.Contracts;
   using System.IO;
   using System.Reflection;
@@ -82,18 +83,27 @@ namespace Microsoft.Dafny
         Console.WriteLine("--------------------");
       }
 
+      var dafnyFiles = new List<string>();
+      var otherFiles = new List<string>();
+
       foreach (string file in CommandLineOptions.Clo.Files)
-      {Contract.Assert(file != null);
+      { Contract.Assert(file != null);
         string extension = Path.GetExtension(file);
         if (extension != null) { extension = extension.ToLower(); }
-        if (extension != ".dfy") {
-          ExecutionEngine.printer.ErrorWriteLine(Console.Out, "*** Error: '{0}': Filename extension '{1}' is not supported. Input files must be Dafny programs (.dfy).", file,
+        if (extension == ".dfy") {
+          dafnyFiles.Add(file);
+        }
+        else if ((extension == ".cs") || (extension == ".dll")) {
+          otherFiles.Add(file);
+        }
+        else {
+          ExecutionEngine.printer.ErrorWriteLine(Console.Out, "*** Error: '{0}': Filename extension '{1}' is not supported. Input files must be Dafny programs (.dfy) or C# files (.cs) or managed DLLS (.dll)", file,
             extension == null ? "" : extension);
           exitValue = ExitValue.PREPROCESSING_ERROR;
           goto END;
         }
       }
-      exitValue = ProcessFiles(CommandLineOptions.Clo.Files, reporter);
+      exitValue = ProcessFiles(dafnyFiles, otherFiles.AsReadOnly(), reporter);
 
       END:
         if (CommandLineOptions.Clo.XmlSink != null) {
@@ -113,9 +123,10 @@ namespace Microsoft.Dafny
     }
 
 
-    static ExitValue ProcessFiles(IList<string/*!*/>/*!*/ fileNames, ErrorReporter reporter, bool lookForSnapshots = true, string programId = null)
-    {
-      Contract.Requires(cce.NonNullElements(fileNames));
+    static ExitValue ProcessFiles(IList<string/*!*/>/*!*/ dafnyFileNames, ReadOnlyCollection<string> otherFileNames, 
+                                  ErrorReporter reporter, bool lookForSnapshots = true, string programId = null)
+   {
+      Contract.Requires(cce.NonNullElements(dafnyFileNames));
 
       if (programId == null)
       {
@@ -123,13 +134,18 @@ namespace Microsoft.Dafny
       }
 
       ExitValue exitValue = ExitValue.VERIFIED;
-      if (CommandLineOptions.Clo.VerifySeparately && 1 < fileNames.Count)
+      if (CommandLineOptions.Clo.VerifySeparately && 1 < dafnyFileNames.Count)
       {
-        foreach (var f in fileNames)
+        foreach (var f in dafnyFileNames)
         {
+          string extension = Path.GetExtension(f);
+          if (extension != null) { extension = extension.ToLower(); }
+          if (extension != ".dfy"){
+            continue;
+          }
           Console.WriteLine();
           Console.WriteLine("-------------------- {0} --------------------", f);
-          var ev = ProcessFiles(new List<string> { f }, reporter, lookForSnapshots, f);
+          var ev = ProcessFiles(new List<string> { f }, new List<string>().AsReadOnly(), reporter, lookForSnapshots, f);
           if (exitValue != ev && ev != ExitValue.VERIFIED)
           {
             exitValue = ev;
@@ -140,10 +156,10 @@ namespace Microsoft.Dafny
 
       if (0 <= CommandLineOptions.Clo.VerifySnapshots && lookForSnapshots)
       {
-        var snapshotsByVersion = ExecutionEngine.LookForSnapshots(fileNames);
+        var snapshotsByVersion = ExecutionEngine.LookForSnapshots(dafnyFileNames);
         foreach (var s in snapshotsByVersion)
         {
-          var ev = ProcessFiles(new List<string>(s), reporter, false, programId);
+          var ev = ProcessFiles(new List<string>(s), new List<string>().AsReadOnly(), reporter, false, programId);
           if (exitValue != ev && ev != ExitValue.VERIFIED)
           {
             exitValue = ev;
@@ -152,10 +168,10 @@ namespace Microsoft.Dafny
         return exitValue;
       }
       
-      using (XmlFileScope xf = new XmlFileScope(CommandLineOptions.Clo.XmlSink, fileNames[fileNames.Count-1])) {
+      using (XmlFileScope xf = new XmlFileScope(CommandLineOptions.Clo.XmlSink, dafnyFileNames[dafnyFileNames.Count-1])) {
         Dafny.Program dafnyProgram;
-        string programName = fileNames.Count == 1 ? fileNames[0] : "the program";
-        string err = Dafny.Main.ParseCheck(fileNames, programName, reporter, out dafnyProgram);
+        string programName = dafnyFileNames.Count == 1 ? dafnyFileNames[0] : "the program";
+        string err = Dafny.Main.ParseCheck(dafnyFileNames, programName, reporter, out dafnyProgram);
         if (err != null) {
           exitValue = ExitValue.DAFNY_ERROR;
           ExecutionEngine.printer.ErrorWriteLine(Console.Out, err);
@@ -172,7 +188,7 @@ namespace Microsoft.Dafny
           if (CommandLineOptions.Clo.PrintFile != null) {
             bplFilename = CommandLineOptions.Clo.PrintFile;
           } else {
-            string baseName = cce.NonNull(Path.GetFileName(fileNames[fileNames.Count-1]));
+            string baseName = cce.NonNull(Path.GetFileName(dafnyFileNames[dafnyFileNames.Count-1]));
             baseName = cce.NonNull(Path.ChangeExtension(baseName, "bpl"));
             bplFilename = Path.Combine(Path.GetTempPath(), baseName);
           }
@@ -184,12 +200,12 @@ namespace Microsoft.Dafny
             case PipelineOutcome.VerificationCompleted:
               ExecutionEngine.printer.WriteTrailer(stats);
               if ((DafnyOptions.O.Compile && allOk && CommandLineOptions.Clo.ProcsToCheck == null) || DafnyOptions.O.ForceCompile)
-                CompileDafnyProgram(dafnyProgram, fileNames[0]);
+                CompileDafnyProgram(dafnyProgram, dafnyFileNames[0], otherFileNames);
               break;
             case PipelineOutcome.Done:
               ExecutionEngine.printer.WriteTrailer(stats);
               if (DafnyOptions.O.ForceCompile)
-                CompileDafnyProgram(dafnyProgram, fileNames[0]);
+                CompileDafnyProgram(dafnyProgram, dafnyFileNames[0], otherFileNames);
               break;
             default:
               // error has already been reported to user
@@ -289,7 +305,23 @@ namespace Microsoft.Dafny
 
     #region Compilation
 
-    public static void CompileDafnyProgram(Dafny.Program dafnyProgram, string dafnyProgramName, TextWriter outputWriter = null)
+    static string WriteDafnyProgramToFile(string dafnyProgramName, string csharpProgram, bool completeProgram, TextWriter outputWriter)
+    {
+      string targetFilename = Path.ChangeExtension(dafnyProgramName, "cs");
+      using (TextWriter target = new StreamWriter(new FileStream(targetFilename, System.IO.FileMode.Create))) {
+        target.Write(csharpProgram);
+        if (completeProgram) {
+          outputWriter.WriteLine("Compiled program written to {0}", targetFilename);
+        }
+        else {
+          outputWriter.WriteLine("File {0} contains the partially compiled program", targetFilename);
+        }
+      }
+      return targetFilename;
+    }
+
+    public static void CompileDafnyProgram(Dafny.Program dafnyProgram, string dafnyProgramName,
+                                           ReadOnlyCollection<string> otherFileNames, TextWriter outputWriter = null)
     {
       Contract.Requires(dafnyProgram != null);
 
@@ -311,22 +343,11 @@ namespace Microsoft.Dafny
       var csharpProgram = sw.ToString();
       bool completeProgram = compiler.ErrorCount == 0;
 
-      // blurt out the code to a file
-      if (DafnyOptions.O.SpillTargetCode)
+      // blurt out the code to a file, if requested, or if other files were specified for the C# command line.
+      string targetFilename = null;
+      if (DafnyOptions.O.SpillTargetCode || (otherFileNames.Count > 0))
       {
-        string targetFilename = Path.ChangeExtension(dafnyProgramName, "cs");
-        using (TextWriter target = new StreamWriter(new FileStream(targetFilename, System.IO.FileMode.Create)))
-        {
-          target.Write(csharpProgram);
-          if (completeProgram)
-          {
-            outputWriter.WriteLine("Compiled program written to {0}", targetFilename);
-          }
-          else
-          {
-            outputWriter.WriteLine("File {0} contains the partially compiled program", targetFilename);
-          }
-        }
+        targetFilename = WriteDafnyProgramToFile(dafnyProgramName, csharpProgram, completeProgram, outputWriter);
       }
 
       // compile the program into an assembly
@@ -367,7 +388,37 @@ namespace Microsoft.Dafny
           cp.ReferencedAssemblies.Add("System.Runtime.dll");
         }
 
-        var cr = provider.CompileAssemblyFromSource(cp, csharpProgram);
+        int numOtherSourceFiles = 0;
+        if (otherFileNames.Count > 0) {
+          foreach (var file in otherFileNames) {
+            string extension = Path.GetExtension(file);
+            if (extension != null) { extension = extension.ToLower(); }
+            if (extension == ".cs") {
+              numOtherSourceFiles++;
+            }
+            else if (extension == ".dll") {
+              cp.ReferencedAssemblies.Add(file);
+            }
+          }
+        }
+
+        CompilerResults cr;
+        if (numOtherSourceFiles > 0) {
+          string[] sourceFiles = new string[numOtherSourceFiles + 1];
+          sourceFiles[0] = targetFilename;
+          int index = 1;
+          foreach (var file in otherFileNames) {
+            string extension = Path.GetExtension(file);
+            if (extension != null) { extension = extension.ToLower(); }
+            if (extension == ".cs") {
+              sourceFiles[index++] = file;
+            }
+          }
+          cr = provider.CompileAssemblyFromFile(cp, sourceFiles);
+        }
+        else {
+          cr = provider.CompileAssemblyFromSource(cp, csharpProgram);
+        }
         var assemblyName = Path.GetFileName(cr.PathToAssembly);
         if (DafnyOptions.O.RunAfterCompile && cr.Errors.Count == 0) {
           outputWriter.WriteLine("Program compiled successfully");
diff --git a/Source/DafnyExtension/DafnyDriver.cs b/Source/DafnyExtension/DafnyDriver.cs
index 037d0cd3..13b53a1b 100644
--- a/Source/DafnyExtension/DafnyDriver.cs
+++ b/Source/DafnyExtension/DafnyDriver.cs
@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
+using System.Collections.ObjectModel;
 using System.Diagnostics.Contracts;
 using System.IO;
 using System.Linq;
@@ -198,7 +199,10 @@ namespace DafnyLanguage
     public static void Compile(Dafny.Program dafnyProgram, TextWriter outputWriter)
     {
       Microsoft.Dafny.DafnyOptions.O.SpillTargetCode = true;
-      Microsoft.Dafny.DafnyDriver.CompileDafnyProgram(dafnyProgram, dafnyProgram.FullName, outputWriter);
+      // Currently there are no provisions for specifying other files to compile with from the 
+      // VS interface, so just send an empty list.
+      ReadOnlyCollection<string> otherFileNames = new List<string>().AsReadOnly();
+      Microsoft.Dafny.DafnyDriver.CompileDafnyProgram(dafnyProgram, dafnyProgram.FullName, otherFileNames, outputWriter);
     }
 
     #endregion
diff --git a/Test/dafny0/Extern.dfy b/Test/dafny0/Extern.dfy
new file mode 100644
index 00000000..cbdffe34
--- /dev/null
+++ b/Test/dafny0/Extern.dfy
@@ -0,0 +1,27 @@
+// RUN: %dafny /compile:1 /print:"%t.print" /dprint:"%t.dprint" "%s" "%S\Extern2.cs" "%S\ExternHelloLibrary.dll" > "%t"
+// RUN: %diff "%s.expect" "%t"
+extern "Modx" module Mod1 
+{
+  extern "classx" class Class1
+  {
+    extern "Fun1x" static function method Fun1() : int
+      ensures Fun1() > 0
+    extern "Method1x" static method Method1() returns (x: int)
+      ensures x > 0
+    static function method Fun2() : int
+    	ensures Fun2() > 0
+    {
+    	Fun1()
+    }
+    static method Method2() returns (x: int)
+      ensures x > 0
+    {
+    	x := Method1();
+    }
+  }
+  method Main()
+  {
+    var m2 := Class1.Method2();
+    print ("Fun2() = ", Class1.Fun2(), "Method2() = ", m2, "\n");
+  }
+}
diff --git a/Test/dafny0/Extern.dfy.expect b/Test/dafny0/Extern.dfy.expect
new file mode 100644
index 00000000..fec087d9
--- /dev/null
+++ b/Test/dafny0/Extern.dfy.expect
@@ -0,0 +1,4 @@
+
+Dafny program verifier finished with 7 verified, 0 errors
+Compiled program written to D:\de\dafny\Test\dafny0\Extern.cs
+Compiled assembly into Extern.exe
diff --git a/Test/dafny0/Extern2.cs b/Test/dafny0/Extern2.cs
new file mode 100644
index 00000000..2fcaf18b
--- /dev/null
+++ b/Test/dafny0/Extern2.cs
@@ -0,0 +1,14 @@
+using System.Numerics;
+namespace @Modx {
+
+  public partial class @classx {
+    public static BigInteger @Fun1x() {
+      return BigInteger.One;
+    }
+    public static void @Method1x(out BigInteger @x)
+    {
+      ExternHelloLibrary.ExternHelloLibrary.SayHello();
+      @x = BigInteger.One;
+    }
+  }
+}
diff --git a/Test/dafny0/ExternHelloLibrary.cs b/Test/dafny0/ExternHelloLibrary.cs
new file mode 100644
index 00000000..81163997
--- /dev/null
+++ b/Test/dafny0/ExternHelloLibrary.cs
@@ -0,0 +1,15 @@
+// Note that  ExternHelloLibrary.dll was produced from this file using
+// csc /t:library ExternHelloLibrary.cs 
+
+using System;
+
+namespace ExternHelloLibrary
+{
+  public static class ExternHelloLibrary
+  {
+    public static void SayHello()
+    {
+      Console.WriteLine("Hello from ExternHelloLibrary.");
+    }
+  }
+}
diff --git a/Test/dafny0/ExternHelloLibrary.dll b/Test/dafny0/ExternHelloLibrary.dll
new file mode 100644
index 00000000..914e4248
Binary files /dev/null and b/Test/dafny0/ExternHelloLibrary.dll differ
diff --git a/Test/dafny0/ExternNegative.dfy b/Test/dafny0/ExternNegative.dfy
new file mode 100644
index 00000000..4ae73232
--- /dev/null
+++ b/Test/dafny0/ExternNegative.dfy
@@ -0,0 +1,26 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+extern "Modx" module Mod1 
+{
+  extern "classx" class Class1
+  {
+    extern "Fun1x" static function method Fun1() : int
+      ensures Fun1() > 0
+    extern "Method1x" static method Method1() returns (x: int)
+      ensures x > 0
+    static abstract function method Fun2() : int
+	ensures Fun2() > 0
+    {
+	Fun1()
+    }
+    static static method Method2() returns (x: int)
+      ensures x > 0
+    {
+	x := Method1();
+    }
+  }
+}
+// Will give error about duplicate CompileName for module.
+extern "Modx" module Mod2
+{
+}
diff --git a/Test/dafny0/ExternNegative.dfy.expect b/Test/dafny0/ExternNegative.dfy.expect
new file mode 100644
index 00000000..5d95ced7
--- /dev/null
+++ b/Test/dafny0/ExternNegative.dfy.expect
@@ -0,0 +1,3 @@
+ExternNegative.dfy(11,11): Error: Function methods cannot be declared 'abstract'.
+ExternNegative.dfy(16,11): Error: Duplicate declaration modifier: static
+2 parse errors detected in ExternNegative.dfy
diff --git a/Test/dafny0/ExternNegative2.dfy b/Test/dafny0/ExternNegative2.dfy
new file mode 100644
index 00000000..3d09913b
--- /dev/null
+++ b/Test/dafny0/ExternNegative2.dfy
@@ -0,0 +1,26 @@
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+extern "Modx" module Mod1 
+{
+  extern "classx" class Class1
+  {
+    extern "Fun1x" static function method Fun1() : int
+      ensures Fun1() > 0
+    extern "Method1x" static method Method1() returns (x: int)
+      ensures x > 0
+    static function method Fun2() : int
+	ensures Fun2() > 0
+    {
+	Fun1()
+    }
+    static method Method2() returns (x: int)
+      ensures x > 0
+    {
+	x := Method1();
+    }
+  }
+}
+// Will give error about duplicate CompileName for module.
+extern "Modx" module Mod2
+{
+}
-- 
cgit v1.2.3


From 348beb7f706f35256f5fb07349182e252aae8860 Mon Sep 17 00:00:00 2001
From: "Richard L. Ford" <richford@microsoft.com>
Date: Wed, 27 Jan 2016 16:43:01 -0800
Subject: Fix build and test failures, cleanup grammar.

1. A build failure caused by a method call before a contract was fixed.
2. An absolute path in an ".expect" file was changed to relative.
3. I eliminated the TopDecls and DeclModifiers non-terminals.
   They were giving a warning from Coco/R about being deletable.
   Instead I used repetition of the TopDecl or DeclModifier
   non-terminals where they had been used. I think this is
   also cleaner to talk about.
---
 Source/Dafny/Dafny.atg            |  33 ++-
 Source/Dafny/Parser.cs            | 472 +++++++++++++++++++-------------------
 Source/DafnyDriver/DafnyDriver.cs |   5 +-
 Test/dafny0/Extern.dfy.expect     |   2 +-
 4 files changed, 258 insertions(+), 254 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index 87e75541..eb0c3303 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -640,7 +640,7 @@ Dafny
                                            }
                                         .)
   }
-  TopDecls<defaultModule, membersDefaultClass, /* isTopLevel */ true, /* isAbstract */ false>
+  { TopDecl<defaultModule, membersDefaultClass, /* isTopLevel */ true, /* isAbstract */ false> }
   (. // find the default class in the default module, then append membersDefaultClass to its member list
      DefaultClassDecl defaultClass = null;
      foreach (TopLevelDecl topleveldecl in defaultModule.TopLevelDecls) {
@@ -657,13 +657,8 @@ Dafny
   EOF
   .
 
-TopDecls<. ModuleDefinition module, List<MemberDecl/*!*/> membersDefaultClass, bool isTopLevel, bool isAbstract .>
-= { TopDecl<module, membersDefaultClass, isTopLevel, isAbstract> }
-  .
-
-DeclModifiers<out DeclModifierData dmod>
-= (. dmod = new DeclModifierData(); .)
-  { "abstract"                             (. dmod.IsAbstract = true;  CheckAndSetToken(ref dmod.AbstractToken); .)
+DeclModifier<ref DeclModifierData dmod>
+= ( "abstract"                             (. dmod.IsAbstract = true;  CheckAndSetToken(ref dmod.AbstractToken); .)
   | "ghost"                                (. dmod.IsGhost = true;  CheckAndSetToken(ref dmod.GhostToken); .)
   | "static"                               (. dmod.IsStatic = true; CheckAndSetToken(ref dmod.StaticToken); .)
   | "protected"                            (. dmod.IsProtected = true; CheckAndSetToken(ref dmod.ProtectedToken); .)
@@ -673,15 +668,15 @@ DeclModifiers<out DeclModifierData dmod>
                                               dmod.ExternName = new StringLiteralExpr(t, s, isVerbatimString);
                                            .)
     ]
-  }
+  )
   .
 
 TopDecl<. ModuleDefinition module, List<MemberDecl/*!*/> membersDefaultClass, bool isTopLevel, bool isAbstract .>
-= (. DeclModifierData dmod; ModuleDecl submodule;
+= (. DeclModifierData dmod = new DeclModifierData(); ModuleDecl submodule;
      ClassDecl/*!*/ c; DatatypeDecl/*!*/ dt; TopLevelDecl td; IteratorDecl iter;
   	 TraitDecl/*!*/ trait;
   .)
-  DeclModifiers<out dmod>
+  { DeclModifier<ref dmod> }
   ( SubModuleDecl<dmod, module, out submodule> (. module.TopLevelDecls.Add(submodule); .)
   | ClassDecl<dmod, module, out c>             (. module.TopLevelDecls.Add(c); .)
   | DatatypeDecl<dmod, module, out dt>         (. module.TopLevelDecls.Add(dt); .)
@@ -713,7 +708,7 @@ SubModuleDecl<DeclModifierData dmod, ModuleDefinition parent, out ModuleDecl sub
       | "refines" QualifiedModuleName<out idRefined> (. isExclusively = false; .) ] 
             (. module = new ModuleDefinition(id, id.val, isAbstract, false, isExclusively, idRefined == null ? null : idRefined, parent, attrs, false, this); .)  
        "{"                                             (. module.BodyStartTok = t; .)
-            TopDecls<module, namedModuleDefaultClassMembers, /* isTopLevel */ false, isAbstract>
+            { TopDecl<module, namedModuleDefaultClassMembers, /* isTopLevel */ false, isAbstract> }
        "}"                                 (. module.BodyEndTok = t;
                                               module.TopLevelDecls.Add(new DefaultClassDecl(module, namedModuleDefaultClassMembers));
                                               submodule = new LiteralModuleDecl(module, parent); .)
@@ -773,7 +768,9 @@ ClassDecl<DeclModifierData dmodClass, ModuleDefinition/*!*/ module, out ClassDec
   {"," Type<out trait>  (. traits.Add(trait); .) }
   ]         
   "{"                                            (. bodyStart = t;  .)
-  { DeclModifiers<out dmod> ClassMemberDecl<dmod, members, true, false, false>
+  { (. dmod = new DeclModifierData(); .)
+    { DeclModifier<ref dmod> }
+    ClassMemberDecl<dmod, members, true, false, false>
   }
   "}"
   (. c = new ClassDecl(id, id.val, module, typeArgs, members, attrs, traits);
@@ -784,8 +781,8 @@ ClassDecl<DeclModifierData dmodClass, ModuleDefinition/*!*/ module, out ClassDec
 
 TraitDecl<DeclModifierData dmodIn, ModuleDefinition/*!*/ module, out TraitDecl/*!*/ trait>
   = (. Contract.Requires(module != null);     
-     CheckDeclModifiers(dmodIn, "Traits", AllowedDeclModifiers.None);
 	   Contract.Ensures(Contract.ValueAtReturn(out trait) != null);
+     CheckDeclModifiers(dmodIn, "Traits", AllowedDeclModifiers.None);
 	   IToken/*!*/ id;
 	   Attributes attrs = null;
 	   List<TypeParameter/*!*/> typeArgs = new List<TypeParameter/*!*/>(); //traits should not support type parameters at the moment
@@ -798,9 +795,11 @@ TraitDecl<DeclModifierData dmodIn, ModuleDefinition/*!*/ module, out TraitDecl/*
 	{ Attribute<ref attrs> }
 	NoUSIdent<out id>
 	[ GenericParameters<typeArgs> ]
-	"{"                                            (. bodyStart = t; .)
-    { DeclModifiers<out dmod> ClassMemberDecl<dmod, members, true, false, false>
-    }
+  	"{"                                            (. bodyStart = t; .)
+      {                                            (. dmod  = new DeclModifierData(); .)
+        { DeclModifier<ref dmod> }
+        ClassMemberDecl<dmod, members, true, false, false>
+      }
     "}"
 	(. trait = new TraitDecl(id, id.val, module, typeArgs, members, attrs);
      trait.BodyStartTok = bodyStart;
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index dc661fc5..943e2cf6 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -670,7 +670,9 @@ bool IsType(ref IToken pt) {
 			}
 			
 		}
-		TopDecls(defaultModule, membersDefaultClass, /* isTopLevel */ true, /* isAbstract */ false);
+		while (StartOf(1)) {
+			TopDecl(defaultModule, membersDefaultClass, /* isTopLevel */ true, /* isAbstract */ false);
+		}
 		DefaultClassDecl defaultClass = null;
 		foreach (TopLevelDecl topleveldecl in defaultModule.TopLevelDecls) {
 		 defaultClass = topleveldecl as DefaultClassDecl;
@@ -686,18 +688,14 @@ bool IsType(ref IToken pt) {
 		Expect(0);
 	}
 
-	void TopDecls(ModuleDefinition module, List<MemberDecl/*!*/> membersDefaultClass, bool isTopLevel, bool isAbstract ) {
-		while (StartOf(1)) {
-			TopDecl(module, membersDefaultClass, isTopLevel, isAbstract);
-		}
-	}
-
 	void TopDecl(ModuleDefinition module, List<MemberDecl/*!*/> membersDefaultClass, bool isTopLevel, bool isAbstract ) {
-		DeclModifierData dmod; ModuleDecl submodule;
+		DeclModifierData dmod = new DeclModifierData(); ModuleDecl submodule;
 		ClassDecl/*!*/ c; DatatypeDecl/*!*/ dt; TopLevelDecl td; IteratorDecl iter;
 		TraitDecl/*!*/ trait;
 		
-		DeclModifiers(out dmod);
+		while (StartOf(2)) {
+			DeclModifier(ref dmod);
+		}
 		switch (la.kind) {
 		case 66: case 69: {
 			SubModuleDecl(dmod, module, out submodule);
@@ -743,33 +741,30 @@ bool IsType(ref IToken pt) {
 		}
 	}
 
-	void DeclModifiers(out DeclModifierData dmod) {
-		dmod = new DeclModifierData(); 
-		while (StartOf(2)) {
-			if (la.kind == 61) {
-				Get();
-				dmod.IsAbstract = true;  CheckAndSetToken(ref dmod.AbstractToken); 
-			} else if (la.kind == 62) {
-				Get();
-				dmod.IsGhost = true;  CheckAndSetToken(ref dmod.GhostToken); 
-			} else if (la.kind == 63) {
-				Get();
-				dmod.IsStatic = true; CheckAndSetToken(ref dmod.StaticToken); 
-			} else if (la.kind == 64) {
-				Get();
-				dmod.IsProtected = true; CheckAndSetToken(ref dmod.ProtectedToken); 
-			} else {
+	void DeclModifier(ref DeclModifierData dmod) {
+		if (la.kind == 61) {
+			Get();
+			dmod.IsAbstract = true;  CheckAndSetToken(ref dmod.AbstractToken); 
+		} else if (la.kind == 62) {
+			Get();
+			dmod.IsGhost = true;  CheckAndSetToken(ref dmod.GhostToken); 
+		} else if (la.kind == 63) {
+			Get();
+			dmod.IsStatic = true; CheckAndSetToken(ref dmod.StaticToken); 
+		} else if (la.kind == 64) {
+			Get();
+			dmod.IsProtected = true; CheckAndSetToken(ref dmod.ProtectedToken); 
+		} else if (la.kind == 65) {
+			Get();
+			dmod.IsExtern = true; CheckAndSetToken(ref dmod.ExternToken); 
+			if (la.kind == 20) {
 				Get();
-				dmod.IsExtern = true; CheckAndSetToken(ref dmod.ExternToken); 
-				if (la.kind == 20) {
-					Get();
-					bool isVerbatimString;
-					string s = Util.RemoveParsedStringQuotes(t.val, out isVerbatimString);
-					dmod.ExternName = new StringLiteralExpr(t, s, isVerbatimString);
-					
-				}
+				bool isVerbatimString;
+				string s = Util.RemoveParsedStringQuotes(t.val, out isVerbatimString);
+				dmod.ExternName = new StringLiteralExpr(t, s, isVerbatimString);
+				
 			}
-		}
+		} else SynErr(141);
 	}
 
 	void SubModuleDecl(DeclModifierData dmod, ModuleDefinition parent, out ModuleDecl submodule) {
@@ -805,7 +800,9 @@ bool IsType(ref IToken pt) {
 			module = new ModuleDefinition(id, id.val, isAbstract, false, isExclusively, idRefined == null ? null : idRefined, parent, attrs, false, this); 
 			Expect(46);
 			module.BodyStartTok = t; 
-			TopDecls(module, namedModuleDefaultClassMembers, /* isTopLevel */ false, isAbstract);
+			while (StartOf(1)) {
+				TopDecl(module, namedModuleDefaultClassMembers, /* isTopLevel */ false, isAbstract);
+			}
 			Expect(47);
 			module.BodyEndTok = t;
 			module.TopLevelDecls.Add(new DefaultClassDecl(module, namedModuleDefaultClassMembers));
@@ -834,7 +831,7 @@ bool IsType(ref IToken pt) {
 				}
 			}
 			if (la.kind == 28) {
-				while (!(la.kind == 0 || la.kind == 28)) {SynErr(141); Get();}
+				while (!(la.kind == 0 || la.kind == 28)) {SynErr(142); Get();}
 				Get();
 				errors.Warning(t, "the semi-colon that used to terminate a sub-module declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 			}
@@ -844,7 +841,7 @@ bool IsType(ref IToken pt) {
 			 submodule = new AliasModuleDecl(idPath, id, parent, opened);
 			}
 			
-		} else SynErr(142);
+		} else SynErr(143);
 	}
 
 	void ClassDecl(DeclModifierData dmodClass, ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c) {
@@ -860,7 +857,7 @@ bool IsType(ref IToken pt) {
 		CheckDeclModifiers(dmodClass, "Classes", AllowedDeclModifiers.Extern);
 		DeclModifierData dmod; 
 		
-		while (!(la.kind == 0 || la.kind == 74)) {SynErr(143); Get();}
+		while (!(la.kind == 0 || la.kind == 74)) {SynErr(144); Get();}
 		Expect(74);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
@@ -883,7 +880,10 @@ bool IsType(ref IToken pt) {
 		Expect(46);
 		bodyStart = t;  
 		while (StartOf(3)) {
-			DeclModifiers(out dmod);
+			dmod = new DeclModifierData(); 
+			while (StartOf(2)) {
+				DeclModifier(ref dmod);
+			}
 			ClassMemberDecl(dmod, members, true, false, false);
 		}
 		Expect(47);
@@ -904,13 +904,13 @@ bool IsType(ref IToken pt) {
 		bool co = false;
 		CheckDeclModifiers(dmod, "Datatypes or codatatypes", AllowedDeclModifiers.None);
 		
-		while (!(la.kind == 0 || la.kind == 77 || la.kind == 78)) {SynErr(144); Get();}
+		while (!(la.kind == 0 || la.kind == 77 || la.kind == 78)) {SynErr(145); Get();}
 		if (la.kind == 77) {
 			Get();
 		} else if (la.kind == 78) {
 			Get();
 			co = true; 
-		} else SynErr(145);
+		} else SynErr(146);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -926,7 +926,7 @@ bool IsType(ref IToken pt) {
 			DatatypeMemberDecl(ctors);
 		}
 		if (la.kind == 28) {
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(146); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(147); Get();}
 			Get();
 			errors.Warning(t, "the semi-colon that used to terminate a (co)datatype declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 		}
@@ -967,7 +967,7 @@ bool IsType(ref IToken pt) {
 		} else if (StartOf(4)) {
 			Type(out baseType);
 			td = new NewtypeDecl(theVerifyThisFile ? id : new IncludeToken(id), id.val, module, baseType, attrs); 
-		} else SynErr(147);
+		} else SynErr(148);
 	}
 
 	void OtherTypeDecl(DeclModifierData dmod, ModuleDefinition module, out TopLevelDecl td) {
@@ -1001,13 +1001,13 @@ bool IsType(ref IToken pt) {
 				Type(out ty);
 				td = new TypeSynonymDecl(id, id.val, typeArgs, module, ty, attrs); 
 			}
-		} else SynErr(148);
+		} else SynErr(149);
 		if (td == null) {
 		 td = new OpaqueTypeDecl(id, id.val, module, eqSupport, typeArgs, attrs);
 		}
 		
 		if (la.kind == 28) {
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(149); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(150); Get();}
 			Get();
 			errors.Warning(t, "the semi-colon that used to terminate an opaque-type declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 		}
@@ -1037,7 +1037,7 @@ bool IsType(ref IToken pt) {
 		IToken bodyEnd = Token.NoToken;
 		CheckDeclModifiers(dmod, "Iterators", AllowedDeclModifiers.None);
 		
-		while (!(la.kind == 0 || la.kind == 82)) {SynErr(150); Get();}
+		while (!(la.kind == 0 || la.kind == 82)) {SynErr(151); Get();}
 		Expect(82);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
@@ -1060,7 +1060,7 @@ bool IsType(ref IToken pt) {
 		} else if (la.kind == 59) {
 			Get();
 			signatureEllipsis = t; 
-		} else SynErr(151);
+		} else SynErr(152);
 		while (StartOf(6)) {
 			IteratorSpec(reads, mod, decreases, req, ens, yieldReq, yieldEns, ref readsAttrs, ref modAttrs, ref decrAttrs);
 		}
@@ -1089,7 +1089,7 @@ bool IsType(ref IToken pt) {
 		IToken bodyStart;
 		DeclModifierData dmod; 
 		
-		while (!(la.kind == 0 || la.kind == 76)) {SynErr(152); Get();}
+		while (!(la.kind == 0 || la.kind == 76)) {SynErr(153); Get();}
 		Expect(76);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
@@ -1101,7 +1101,10 @@ bool IsType(ref IToken pt) {
 		Expect(46);
 		bodyStart = t; 
 		while (StartOf(3)) {
-			DeclModifiers(out dmod);
+			dmod  = new DeclModifierData(); 
+			while (StartOf(2)) {
+				DeclModifier(ref dmod);
+			}
 			ClassMemberDecl(dmod, members, true, false, false);
 		}
 		Expect(47);
@@ -1139,7 +1142,7 @@ bool IsType(ref IToken pt) {
 			
 			MethodDecl(dmod, allowConstructors, isWithinAbstractModule, out m);
 			mm.Add(m); 
-		} else SynErr(153);
+		} else SynErr(154);
 	}
 
 	void Attribute(ref Attributes attrs) {
@@ -1225,7 +1228,7 @@ bool IsType(ref IToken pt) {
 		IToken/*!*/ id;  Type/*!*/ ty;
 		CheckDeclModifiers(dmod, "Fields", AllowedDeclModifiers.Ghost);
 		
-		while (!(la.kind == 0 || la.kind == 79)) {SynErr(154); Get();}
+		while (!(la.kind == 0 || la.kind == 79)) {SynErr(155); Get();}
 		Expect(79);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
@@ -1287,7 +1290,7 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(155);
+			} else SynErr(156);
 		} else if (la.kind == 39) {
 			Get();
 			isPredicate = true; 
@@ -1324,7 +1327,7 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(156);
+			} else SynErr(157);
 		} else if (la.kind == 40) {
 			Get();
 			Expect(39);
@@ -1348,7 +1351,7 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(157);
+			} else SynErr(158);
 		} else if (la.kind == 42) {
 			Get();
 			isCoPredicate = true; 
@@ -1371,8 +1374,8 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(158);
-		} else SynErr(159);
+			} else SynErr(159);
+		} else SynErr(160);
 		decreases = isIndPredicate || isCoPredicate ? null : new List<Expression/*!*/>(); 
 		while (StartOf(10)) {
 			FunctionSpec(reqs, reads, ens, decreases);
@@ -1434,7 +1437,7 @@ bool IsType(ref IToken pt) {
 		AllowedDeclModifiers allowed = AllowedDeclModifiers.None;
 		string caption = "";
 		
-		while (!(StartOf(11))) {SynErr(160); Get();}
+		while (!(StartOf(11))) {SynErr(161); Get();}
 		switch (la.kind) {
 		case 85: {
 			Get();
@@ -1485,7 +1488,7 @@ bool IsType(ref IToken pt) {
 			
 			break;
 		}
-		default: SynErr(161); break;
+		default: SynErr(162); break;
 		}
 		keywordToken = t; 
 		CheckDeclModifiers(dmod, caption, allowed); 
@@ -1517,7 +1520,7 @@ bool IsType(ref IToken pt) {
 		} else if (la.kind == 59) {
 			Get();
 			signatureEllipsis = t; 
-		} else SynErr(162);
+		} else SynErr(163);
 		while (StartOf(12)) {
 			MethodSpec(req, mod, ens, dec, ref decAttrs, ref modAttrs);
 		}
@@ -1590,14 +1593,14 @@ bool IsType(ref IToken pt) {
 		} else if (la.kind == 2) {
 			Get();
 			id = t; 
-		} else SynErr(163);
+		} else SynErr(164);
 		Expect(21);
 		Type(out ty);
 	}
 
 	void OldSemi() {
 		if (la.kind == 28) {
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(164); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(165); Get();}
 			Get();
 		}
 	}
@@ -1694,7 +1697,7 @@ bool IsType(ref IToken pt) {
 			id = t; name = id.val;
 			Expect(21);
 			Type(out ty);
-		} else SynErr(165);
+		} else SynErr(166);
 		if (name != null) {
 		 identName = name;
 		} else {
@@ -1882,7 +1885,7 @@ bool IsType(ref IToken pt) {
 			ty = new UserDefinedType(e.tok, e); 
 			break;
 		}
-		default: SynErr(166); break;
+		default: SynErr(167); break;
 		}
 		if (la.kind == 30) {
 			Type t2; 
@@ -1921,7 +1924,7 @@ List<MaybeFreeExpression/*!*/>/*!*/ yieldReq, List<MaybeFreeExpression/*!*/>/*!*
 ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 		Expression/*!*/ e; FrameExpression/*!*/ fe; bool isFree = false; bool isYield = false; Attributes ensAttrs = null;
 		
-		while (!(StartOf(14))) {SynErr(167); Get();}
+		while (!(StartOf(14))) {SynErr(168); Get();}
 		if (la.kind == 44) {
 			Get();
 			while (IsAttribute()) {
@@ -1982,7 +1985,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 				 ens.Add(new MaybeFreeExpression(e, isFree, ensAttrs));
 				}
 				
-			} else SynErr(168);
+			} else SynErr(169);
 		} else if (la.kind == 36) {
 			Get();
 			while (IsAttribute()) {
@@ -1990,7 +1993,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 			}
 			DecreasesList(decreases, false, false);
 			OldSemi();
-		} else SynErr(169);
+		} else SynErr(170);
 	}
 
 	void BlockStmt(out BlockStmt/*!*/ block, out IToken bodyStart, out IToken bodyEnd) {
@@ -2012,7 +2015,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Requires(cce.NonNullElements(req)); Contract.Requires(cce.NonNullElements(mod)); Contract.Requires(cce.NonNullElements(ens)); Contract.Requires(cce.NonNullElements(decreases));
 		Expression/*!*/ e;  FrameExpression/*!*/ fe;  bool isFree = false; Attributes ensAttrs = null;
 		
-		while (!(StartOf(17))) {SynErr(170); Get();}
+		while (!(StartOf(17))) {SynErr(171); Get();}
 		if (la.kind == 43) {
 			Get();
 			while (IsAttribute()) {
@@ -2046,7 +2049,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Expression(out e, false, false);
 				OldSemi();
 				ens.Add(new MaybeFreeExpression(e, isFree, ensAttrs)); 
-			} else SynErr(171);
+			} else SynErr(172);
 		} else if (la.kind == 36) {
 			Get();
 			while (IsAttribute()) {
@@ -2054,7 +2057,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			DecreasesList(decreases, true, false);
 			OldSemi();
-		} else SynErr(172);
+		} else SynErr(173);
 	}
 
 	void FrameExpression(out FrameExpression fe, bool allowSemi, bool allowLambda) {
@@ -2078,7 +2081,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Ident(out id);
 			fieldName = id.val; 
 			fe = new FrameExpression(id, new ImplicitThisExpr(id), fieldName); 
-		} else SynErr(173);
+		} else SynErr(174);
 	}
 
 	void DecreasesList(List<Expression> decreases, bool allowWildcard, bool allowLambda) {
@@ -2133,7 +2136,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Requires(cce.NonNullElements(reads));
 		Contract.Requires(decreases == null || cce.NonNullElements(decreases));
 		Expression/*!*/ e;  FrameExpression/*!*/ fe; 
-		while (!(StartOf(18))) {SynErr(174); Get();}
+		while (!(StartOf(18))) {SynErr(175); Get();}
 		if (la.kind == 45) {
 			Get();
 			Expression(out e, false, false);
@@ -2163,7 +2166,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			
 			DecreasesList(decreases, false, false);
 			OldSemi();
-		} else SynErr(175);
+		} else SynErr(176);
 	}
 
 	void FunctionBody(out Expression/*!*/ e, out IToken bodyStart, out IToken bodyEnd) {
@@ -2182,7 +2185,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			fe = new FrameExpression(t, new WildcardExpr(t), null); 
 		} else if (StartOf(19)) {
 			FrameExpression(out fe, allowSemi, false);
-		} else SynErr(176);
+		} else SynErr(177);
 	}
 
 	void PossiblyWildExpression(out Expression e, bool allowLambda) {
@@ -2193,7 +2196,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			e = new WildcardExpr(t); 
 		} else if (StartOf(8)) {
 			Expression(out e, false, allowLambda);
-		} else SynErr(177);
+		} else SynErr(178);
 	}
 
 	void Stmt(List<Statement/*!*/>/*!*/ ss) {
@@ -2210,7 +2213,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken bodyStart, bodyEnd;
 		int breakCount;
 		
-		while (!(StartOf(20))) {SynErr(178); Get();}
+		while (!(StartOf(20))) {SynErr(179); Get();}
 		switch (la.kind) {
 		case 46: {
 			BlockStmt(out bs, out bodyStart, out bodyEnd);
@@ -2281,8 +2284,8 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					Get();
 					breakCount++; 
 				}
-			} else SynErr(179);
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(180); Get();}
+			} else SynErr(180);
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(181); Get();}
 			Expect(28);
 			s = label != null ? new BreakStmt(x, t, label) : new BreakStmt(x, t, breakCount); 
 			break;
@@ -2295,7 +2298,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			SkeletonStmt(out s);
 			break;
 		}
-		default: SynErr(181); break;
+		default: SynErr(182); break;
 		}
 	}
 
@@ -2314,7 +2317,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 59) {
 			Get();
 			dotdotdot = t; 
-		} else SynErr(182);
+		} else SynErr(183);
 		Expect(28);
 		if (dotdotdot != null) {
 		 s = new SkeletonStatement(new AssertStmt(x, t, new LiteralExpr(x, true), attrs), dotdotdot, null);
@@ -2339,7 +2342,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 59) {
 			Get();
 			dotdotdot = t; 
-		} else SynErr(183);
+		} else SynErr(184);
 		Expect(28);
 		if (dotdotdot != null) {
 		 s = new SkeletonStatement(new AssumeStmt(x, t, new LiteralExpr(x, true), attrs), dotdotdot, null);
@@ -2409,13 +2412,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					suchThatAssume = t; 
 				}
 				Expression(out suchThat, false, true);
-			} else SynErr(184);
+			} else SynErr(185);
 			Expect(28);
 			endTok = t; 
 		} else if (la.kind == 21) {
 			Get();
 			SemErr(t, "invalid statement (did you forget the 'label' keyword?)"); 
-		} else SynErr(185);
+		} else SynErr(186);
 		if (suchThat != null) {
 		 s = new AssignSuchThatStmt(x, endTok, lhss, suchThat, suchThatAssume, null);
 		} else {
@@ -2484,7 +2487,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					Expression(out suchThat, false, true);
 				}
 			}
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(186); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(187); Get();}
 			Expect(28);
 			endTok = t; 
 			ConcreteUpdateStatement update;
@@ -2538,12 +2541,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				}
 				Expect(25);
 				SemErr(pat.tok, "LHS of assign-such-that expression must be variables, not general patterns"); 
-			} else SynErr(187);
+			} else SynErr(188);
 			Expression(out e, false, true);
 			letRHSs.Add(e); 
 			Expect(28);
 			s = new LetStmt(e.tok, e.tok, letLHSs, letRHSs); 
-		} else SynErr(188);
+		} else SynErr(189);
 	}
 
 	void IfStmt(out Statement/*!*/ ifStmt) {
@@ -2582,7 +2585,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				} else if (la.kind == 46) {
 					BlockStmt(out bs, out bodyStart, out bodyEnd);
 					els = bs; endTok = bs.EndTok; 
-				} else SynErr(189);
+				} else SynErr(190);
 			}
 			if (guardEllipsis != null) {
 			 ifStmt = new SkeletonStatement(new IfStmt(x, endTok, isExistentialGuard, guard, thn, els), guardEllipsis, null);
@@ -2590,7 +2593,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 ifStmt = new IfStmt(x, endTok, isExistentialGuard, guard, thn, els);
 			}
 			
-		} else SynErr(190);
+		} else SynErr(191);
 	}
 
 	void WhileStmt(out Statement stmt) {
@@ -2635,7 +2638,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Expect(59);
 				bodyEllipsis = t; endTok = t; isDirtyLoop = false; 
 			} else if (StartOf(24)) {
-			} else SynErr(191);
+			} else SynErr(192);
 			if (guardEllipsis != null || bodyEllipsis != null) {
 			 if (mod != null) {
 			   SemErr(mod[0].E.tok, "'modifies' clauses are not allowed on refining loops");
@@ -2653,7 +2656,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 stmt = new WhileStmt(x, endTok, guard, invariants, new Specification<Expression>(decreases, decAttrs), new Specification<FrameExpression>(mod, modAttrs), body);
 			}
 			
-		} else SynErr(192);
+		} else SynErr(193);
 	}
 
 	void MatchStmt(out Statement/*!*/ s) {
@@ -2678,7 +2681,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				CaseStatement(out c);
 				cases.Add(c); 
 			}
-		} else SynErr(193);
+		} else SynErr(194);
 		s = new MatchStmt(x, t, e, cases, usesOptionalBrace); 
 	}
 
@@ -2703,7 +2706,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;
 			errors.Warning(t, "the 'parallel' keyword has been deprecated; the comprehension statement now uses the keyword 'forall' (and the parentheses around the bound variables are now optional)");
 			
-		} else SynErr(194);
+		} else SynErr(195);
 		if (la.kind == _openparen) {
 			Expect(50);
 			if (la.kind == 1) {
@@ -2714,7 +2717,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			if (la.kind == _ident) {
 				QuantifierDomain(out bvars, out attrs, out range);
 			}
-		} else SynErr(195);
+		} else SynErr(196);
 		if (bvars == null) { bvars = new List<BoundVar>(); }
 		if (range == null) { range = new LiteralExpr(x, true); }
 		
@@ -2804,7 +2807,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				} else if (la.kind == 32) {
 					CalcStmt(out subCalc);
 					hintEnd = subCalc.EndTok; subhints.Add(subCalc); 
-				} else SynErr(196);
+				} else SynErr(197);
 			}
 			var h = new BlockStmt(hintStart, hintEnd, subhints); // if the hint is empty, hintStart is the first token of the next line, but it doesn't matter because the block statement is just used as a container
 			hints.Add(h);
@@ -2846,14 +2849,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 59) {
 			Get();
 			ellipsisToken = t; 
-		} else SynErr(197);
+		} else SynErr(198);
 		if (la.kind == 46) {
 			BlockStmt(out body, out bodyStart, out endTok);
 		} else if (la.kind == 28) {
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(198); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(199); Get();}
 			Get();
 			endTok = t; 
-		} else SynErr(199);
+		} else SynErr(200);
 		s = new ModifyStmt(tok, endTok, mod, attrs, body);
 		if (ellipsisToken != null) {
 		 s = new SkeletonStatement(s, ellipsisToken, null);
@@ -2873,7 +2876,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 91) {
 			Get();
 			returnTok = t; isYield = true; 
-		} else SynErr(200);
+		} else SynErr(201);
 		if (StartOf(27)) {
 			Rhs(out r);
 			rhss = new List<AssignmentRhs>(); rhss.Add(r); 
@@ -2971,7 +2974,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (StartOf(8)) {
 			Expression(out e, false, true);
 			r = new ExprRhs(e); 
-		} else SynErr(201);
+		} else SynErr(202);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -2992,7 +2995,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (la.kind == 27 || la.kind == 48 || la.kind == 50) {
 				Suffix(ref e);
 			}
-		} else SynErr(202);
+		} else SynErr(203);
 	}
 
 	void Expressions(List<Expression> args) {
@@ -3049,7 +3052,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			IdentTypeOptional(out bv);
 			pat = new CasePattern(bv.tok, bv);
 			
-		} else SynErr(203);
+		} else SynErr(204);
 		if (pat == null) {
 		 pat = new CasePattern(t, "_ParseError", new List<CasePattern>());
 		}
@@ -3071,7 +3074,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				isExistentialGuard = true; 
 			} else if (StartOf(8)) {
 				Expression(out e, true, false);
-			} else SynErr(204);
+			} else SynErr(205);
 			Expect(29);
 			body = new List<Statement>(); 
 			while (StartOf(16)) {
@@ -3117,7 +3120,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (StartOf(8)) {
 			Expression(out ee, true, true);
 			e = ee; 
-		} else SynErr(205);
+		} else SynErr(206);
 	}
 
 	void LoopSpec(List<MaybeFreeExpression> invariants, List<Expression> decreases, ref List<FrameExpression> mod, ref Attributes decAttrs, ref Attributes modAttrs) {
@@ -3125,7 +3128,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		bool isFree = false; Attributes attrs = null;
 		
 		if (la.kind == 37 || la.kind == 89) {
-			while (!(la.kind == 0 || la.kind == 37 || la.kind == 89)) {SynErr(206); Get();}
+			while (!(la.kind == 0 || la.kind == 37 || la.kind == 89)) {SynErr(207); Get();}
 			if (la.kind == 89) {
 				Get();
 				isFree = true; errors.Warning(t, "the 'free' keyword is soon to be deprecated"); 
@@ -3138,7 +3141,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			invariants.Add(new MaybeFreeExpression(e, isFree, attrs)); 
 			OldSemi();
 		} else if (la.kind == 36) {
-			while (!(la.kind == 0 || la.kind == 36)) {SynErr(207); Get();}
+			while (!(la.kind == 0 || la.kind == 36)) {SynErr(208); Get();}
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref decAttrs);
@@ -3146,7 +3149,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			DecreasesList(decreases, true, true);
 			OldSemi();
 		} else if (la.kind == 43) {
-			while (!(la.kind == 0 || la.kind == 43)) {SynErr(208); Get();}
+			while (!(la.kind == 0 || la.kind == 43)) {SynErr(209); Get();}
 			Get();
 			mod = mod ?? new List<FrameExpression>(); 
 			while (IsAttribute()) {
@@ -3160,7 +3163,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				mod.Add(fe); 
 			}
 			OldSemi();
-		} else SynErr(209);
+		} else SynErr(210);
 	}
 
 	void CaseStatement(out MatchCaseStmt/*!*/ c) {
@@ -3197,12 +3200,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				arguments.Add(pat); 
 			}
 			Expect(51);
-		} else SynErr(210);
+		} else SynErr(211);
 		Expect(29);
-		while (!(StartOf(29))) {SynErr(211); Get();}
+		while (!(StartOf(29))) {SynErr(212); Get();}
 		while (IsNotEndOfCase()) {
 			Stmt(body);
-			while (!(StartOf(29))) {SynErr(212); Get();}
+			while (!(StartOf(29))) {SynErr(213); Get();}
 		}
 		c = new MatchCaseStmt(x, name, arguments, body); 
 	}
@@ -3301,7 +3304,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  binOp = BinaryExpr.Opcode.Exp; 
 			break;
 		}
-		default: SynErr(213); break;
+		default: SynErr(214); break;
 		}
 		if (k == null) {
 		 op = new Microsoft.Dafny.CalcStmt.BinaryCalcOp(binOp);
@@ -3316,7 +3319,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 113) {
 			Get();
-		} else SynErr(214);
+		} else SynErr(215);
 	}
 
 	void ImpliesOp() {
@@ -3324,7 +3327,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 115) {
 			Get();
-		} else SynErr(215);
+		} else SynErr(216);
 	}
 
 	void ExpliesOp() {
@@ -3332,7 +3335,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 117) {
 			Get();
-		} else SynErr(216);
+		} else SynErr(217);
 	}
 
 	void AndOp() {
@@ -3340,7 +3343,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 119) {
 			Get();
-		} else SynErr(217);
+		} else SynErr(218);
 	}
 
 	void OrOp() {
@@ -3348,7 +3351,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 121) {
 			Get();
-		} else SynErr(218);
+		} else SynErr(219);
 	}
 
 	void NegOp() {
@@ -3356,7 +3359,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 123) {
 			Get();
-		} else SynErr(219);
+		} else SynErr(220);
 	}
 
 	void Forall() {
@@ -3364,7 +3367,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 124) {
 			Get();
-		} else SynErr(220);
+		} else SynErr(221);
 	}
 
 	void Exists() {
@@ -3372,7 +3375,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 126) {
 			Get();
-		} else SynErr(221);
+		} else SynErr(222);
 	}
 
 	void QSep() {
@@ -3380,7 +3383,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 		} else if (la.kind == 26) {
 			Get();
-		} else SynErr(222);
+		} else SynErr(223);
 	}
 
 	void EquivExpression(out Expression e0, bool allowSemi, bool allowLambda) {
@@ -3415,7 +3418,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e1, e0); 
 					
 				}
-			} else SynErr(223);
+			} else SynErr(224);
 		}
 	}
 
@@ -3445,7 +3448,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					RelationalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Or, e0, e1); 
 				}
-			} else SynErr(224);
+			} else SynErr(225);
 		}
 	}
 
@@ -3663,7 +3666,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  op = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		default: SynErr(225); break;
+		default: SynErr(226); break;
 		}
 	}
 
@@ -3685,7 +3688,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 129) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Sub; 
-		} else SynErr(226);
+		} else SynErr(227);
 	}
 
 	void UnaryExpression(out Expression e, bool allowSemi, bool allowLambda) {
@@ -3745,7 +3748,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (IsSuffix()) {
 				Suffix(ref e);
 			}
-		} else SynErr(227);
+		} else SynErr(228);
 	}
 
 	void MulOp(out IToken x, out BinaryExpr.Opcode op) {
@@ -3759,7 +3762,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 131) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Mod; 
-		} else SynErr(228);
+		} else SynErr(229);
 	}
 
 	void MapDisplayExpr(IToken/*!*/ mapToken, bool finite, out Expression e) {
@@ -3813,13 +3816,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				} else if (la.kind == 107) {
 					HashCall(id, out openParen, out typeArgs, out args);
 				} else if (StartOf(32)) {
-				} else SynErr(229);
+				} else SynErr(230);
 				e = new ExprDotName(id, e, id.val, typeArgs);
 				if (openParen != null) {
 				 e = new ApplySuffix(openParen, e, args);
 				}
 				
-			} else SynErr(230);
+			} else SynErr(231);
 		} else if (la.kind == 48) {
 			Get();
 			x = t; 
@@ -3867,7 +3870,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 						multipleIndices.Add(ee);
 						
 					}
-				} else SynErr(231);
+				} else SynErr(232);
 			} else if (la.kind == 138) {
 				Get();
 				anyDots = true; 
@@ -3875,7 +3878,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					Expression(out ee, true, true);
 					e1 = ee; 
 				}
-			} else SynErr(232);
+			} else SynErr(233);
 			if (multipleIndices != null) {
 			 e = new MultiSelectExpr(x, e, multipleIndices);
 			 // make sure an array class with this dimensionality exists
@@ -3919,7 +3922,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			Expect(51);
 			e = new ApplySuffix(openParen, e, args); 
-		} else SynErr(233);
+		} else SynErr(234);
 	}
 
 	void ISetDisplayExpr(IToken/*!*/ setToken, bool finite, out Expression e) {
@@ -3961,7 +3964,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				}
 			}
 			Expect(51);
-		} else SynErr(234);
+		} else SynErr(235);
 		while (la.kind == 44 || la.kind == 45) {
 			if (la.kind == 44) {
 				Get();
@@ -4044,7 +4047,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			NamedExpr(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(235); break;
+		default: SynErr(236); break;
 		}
 	}
 
@@ -4059,7 +4062,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 107) {
 			HashCall(id, out openParen, out typeArgs, out args);
 		} else if (StartOf(32)) {
-		} else SynErr(236);
+		} else SynErr(237);
 		e = new NameSegment(id, id.val, typeArgs);
 		if (openParen != null) {
 		 e = new ApplySuffix(openParen, e, args);
@@ -4088,7 +4091,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			e = new SeqDisplayExpr(x, elements); 
 			Expect(49);
-		} else SynErr(237);
+		} else SynErr(238);
 	}
 
 	void MultiSetExpr(out Expression e) {
@@ -4112,7 +4115,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Expression(out e, true, true);
 			e = new MultiSetFormingExpr(x, e); 
 			Expect(51);
-		} else SynErr(238);
+		} else SynErr(239);
 	}
 
 	void ConstAtomExpression(out Expression e, bool allowSemi, bool allowLambda) {
@@ -4208,7 +4211,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			ParensExpression(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(239); break;
+		default: SynErr(240); break;
 		}
 	}
 
@@ -4237,7 +4240,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 n = BigInteger.Zero;
 			}
 			
-		} else SynErr(240);
+		} else SynErr(241);
 	}
 
 	void Dec(out Basetypes.BigDec d) {
@@ -4281,7 +4284,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 30) {
 			Get();
 			oneShot = true; 
-		} else SynErr(241);
+		} else SynErr(242);
 	}
 
 	void MapLiteralExpressions(out List<ExpressionPair> elements) {
@@ -4344,7 +4347,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				CaseExpression(out c, allowSemi, allowLambda);
 				cases.Add(c); 
 			}
-		} else SynErr(242);
+		} else SynErr(243);
 		e = new MatchExpr(x, e, cases, usesOptionalBrace); 
 	}
 
@@ -4362,7 +4365,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 125 || la.kind == 126) {
 			Exists();
 			x = t; 
-		} else SynErr(243);
+		} else SynErr(244);
 		QuantifierDomain(out bvars, out attrs, out range);
 		QSep();
 		Expression(out body, allowSemi, allowLambda);
@@ -4411,7 +4414,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			AssumeStmt(out s);
 		} else if (la.kind == 32) {
 			CalcStmt(out s);
-		} else SynErr(244);
+		} else SynErr(245);
 	}
 
 	void LetExpr(out Expression e, bool allowSemi, bool allowLambda) {
@@ -4455,7 +4458,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 }
 			}
 			
-		} else SynErr(245);
+		} else SynErr(246);
 		Expression(out e, false, true);
 		letRHSs.Add(e); 
 		while (la.kind == 22) {
@@ -4515,7 +4518,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				arguments.Add(pat); 
 			}
 			Expect(51);
-		} else SynErr(246);
+		} else SynErr(247);
 		Expect(29);
 		Expression(out body, allowSemi, allowLambda);
 		c = new MatchCaseExpr(x, name, arguments, body); 
@@ -4549,7 +4552,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 2) {
 			Get();
 			id = t; 
-		} else SynErr(247);
+		} else SynErr(248);
 		Expect(96);
 		Expression(out e, true, true);
 	}
@@ -4592,7 +4595,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 44) {
 			Get();
 			x = t; 
-		} else SynErr(248);
+		} else SynErr(249);
 	}
 
 
@@ -4809,114 +4812,115 @@ public class Errors {
 			case 138: s = "\"..\" expected"; break;
 			case 139: s = "??? expected"; break;
 			case 140: s = "invalid TopDecl"; break;
-			case 141: s = "this symbol not expected in SubModuleDecl"; break;
-			case 142: s = "invalid SubModuleDecl"; break;
-			case 143: s = "this symbol not expected in ClassDecl"; break;
-			case 144: s = "this symbol not expected in DatatypeDecl"; break;
-			case 145: s = "invalid DatatypeDecl"; break;
-			case 146: s = "this symbol not expected in DatatypeDecl"; break;
-			case 147: s = "invalid NewtypeDecl"; break;
-			case 148: s = "invalid OtherTypeDecl"; break;
-			case 149: s = "this symbol not expected in OtherTypeDecl"; break;
-			case 150: s = "this symbol not expected in IteratorDecl"; break;
-			case 151: s = "invalid IteratorDecl"; break;
-			case 152: s = "this symbol not expected in TraitDecl"; break;
-			case 153: s = "invalid ClassMemberDecl"; break;
-			case 154: s = "this symbol not expected in FieldDecl"; break;
-			case 155: s = "invalid FunctionDecl"; break;
+			case 141: s = "invalid DeclModifier"; break;
+			case 142: s = "this symbol not expected in SubModuleDecl"; break;
+			case 143: s = "invalid SubModuleDecl"; break;
+			case 144: s = "this symbol not expected in ClassDecl"; break;
+			case 145: s = "this symbol not expected in DatatypeDecl"; break;
+			case 146: s = "invalid DatatypeDecl"; break;
+			case 147: s = "this symbol not expected in DatatypeDecl"; break;
+			case 148: s = "invalid NewtypeDecl"; break;
+			case 149: s = "invalid OtherTypeDecl"; break;
+			case 150: s = "this symbol not expected in OtherTypeDecl"; break;
+			case 151: s = "this symbol not expected in IteratorDecl"; break;
+			case 152: s = "invalid IteratorDecl"; break;
+			case 153: s = "this symbol not expected in TraitDecl"; break;
+			case 154: s = "invalid ClassMemberDecl"; break;
+			case 155: s = "this symbol not expected in FieldDecl"; break;
 			case 156: s = "invalid FunctionDecl"; break;
 			case 157: s = "invalid FunctionDecl"; break;
 			case 158: s = "invalid FunctionDecl"; break;
 			case 159: s = "invalid FunctionDecl"; break;
-			case 160: s = "this symbol not expected in MethodDecl"; break;
-			case 161: s = "invalid MethodDecl"; break;
+			case 160: s = "invalid FunctionDecl"; break;
+			case 161: s = "this symbol not expected in MethodDecl"; break;
 			case 162: s = "invalid MethodDecl"; break;
-			case 163: s = "invalid FIdentType"; break;
-			case 164: s = "this symbol not expected in OldSemi"; break;
-			case 165: s = "invalid TypeIdentOptional"; break;
-			case 166: s = "invalid TypeAndToken"; break;
-			case 167: s = "this symbol not expected in IteratorSpec"; break;
-			case 168: s = "invalid IteratorSpec"; break;
+			case 163: s = "invalid MethodDecl"; break;
+			case 164: s = "invalid FIdentType"; break;
+			case 165: s = "this symbol not expected in OldSemi"; break;
+			case 166: s = "invalid TypeIdentOptional"; break;
+			case 167: s = "invalid TypeAndToken"; break;
+			case 168: s = "this symbol not expected in IteratorSpec"; break;
 			case 169: s = "invalid IteratorSpec"; break;
-			case 170: s = "this symbol not expected in MethodSpec"; break;
-			case 171: s = "invalid MethodSpec"; break;
+			case 170: s = "invalid IteratorSpec"; break;
+			case 171: s = "this symbol not expected in MethodSpec"; break;
 			case 172: s = "invalid MethodSpec"; break;
-			case 173: s = "invalid FrameExpression"; break;
-			case 174: s = "this symbol not expected in FunctionSpec"; break;
-			case 175: s = "invalid FunctionSpec"; break;
-			case 176: s = "invalid PossiblyWildFrameExpression"; break;
-			case 177: s = "invalid PossiblyWildExpression"; break;
-			case 178: s = "this symbol not expected in OneStmt"; break;
-			case 179: s = "invalid OneStmt"; break;
-			case 180: s = "this symbol not expected in OneStmt"; break;
-			case 181: s = "invalid OneStmt"; break;
-			case 182: s = "invalid AssertStmt"; break;
-			case 183: s = "invalid AssumeStmt"; break;
-			case 184: s = "invalid UpdateStmt"; break;
+			case 173: s = "invalid MethodSpec"; break;
+			case 174: s = "invalid FrameExpression"; break;
+			case 175: s = "this symbol not expected in FunctionSpec"; break;
+			case 176: s = "invalid FunctionSpec"; break;
+			case 177: s = "invalid PossiblyWildFrameExpression"; break;
+			case 178: s = "invalid PossiblyWildExpression"; break;
+			case 179: s = "this symbol not expected in OneStmt"; break;
+			case 180: s = "invalid OneStmt"; break;
+			case 181: s = "this symbol not expected in OneStmt"; break;
+			case 182: s = "invalid OneStmt"; break;
+			case 183: s = "invalid AssertStmt"; break;
+			case 184: s = "invalid AssumeStmt"; break;
 			case 185: s = "invalid UpdateStmt"; break;
-			case 186: s = "this symbol not expected in VarDeclStatement"; break;
-			case 187: s = "invalid VarDeclStatement"; break;
+			case 186: s = "invalid UpdateStmt"; break;
+			case 187: s = "this symbol not expected in VarDeclStatement"; break;
 			case 188: s = "invalid VarDeclStatement"; break;
-			case 189: s = "invalid IfStmt"; break;
+			case 189: s = "invalid VarDeclStatement"; break;
 			case 190: s = "invalid IfStmt"; break;
-			case 191: s = "invalid WhileStmt"; break;
+			case 191: s = "invalid IfStmt"; break;
 			case 192: s = "invalid WhileStmt"; break;
-			case 193: s = "invalid MatchStmt"; break;
-			case 194: s = "invalid ForallStmt"; break;
+			case 193: s = "invalid WhileStmt"; break;
+			case 194: s = "invalid MatchStmt"; break;
 			case 195: s = "invalid ForallStmt"; break;
-			case 196: s = "invalid CalcStmt"; break;
-			case 197: s = "invalid ModifyStmt"; break;
-			case 198: s = "this symbol not expected in ModifyStmt"; break;
-			case 199: s = "invalid ModifyStmt"; break;
-			case 200: s = "invalid ReturnStmt"; break;
-			case 201: s = "invalid Rhs"; break;
-			case 202: s = "invalid Lhs"; break;
-			case 203: s = "invalid CasePattern"; break;
-			case 204: s = "invalid AlternativeBlock"; break;
-			case 205: s = "invalid Guard"; break;
-			case 206: s = "this symbol not expected in LoopSpec"; break;
+			case 196: s = "invalid ForallStmt"; break;
+			case 197: s = "invalid CalcStmt"; break;
+			case 198: s = "invalid ModifyStmt"; break;
+			case 199: s = "this symbol not expected in ModifyStmt"; break;
+			case 200: s = "invalid ModifyStmt"; break;
+			case 201: s = "invalid ReturnStmt"; break;
+			case 202: s = "invalid Rhs"; break;
+			case 203: s = "invalid Lhs"; break;
+			case 204: s = "invalid CasePattern"; break;
+			case 205: s = "invalid AlternativeBlock"; break;
+			case 206: s = "invalid Guard"; break;
 			case 207: s = "this symbol not expected in LoopSpec"; break;
 			case 208: s = "this symbol not expected in LoopSpec"; break;
-			case 209: s = "invalid LoopSpec"; break;
-			case 210: s = "invalid CaseStatement"; break;
-			case 211: s = "this symbol not expected in CaseStatement"; break;
+			case 209: s = "this symbol not expected in LoopSpec"; break;
+			case 210: s = "invalid LoopSpec"; break;
+			case 211: s = "invalid CaseStatement"; break;
 			case 212: s = "this symbol not expected in CaseStatement"; break;
-			case 213: s = "invalid CalcOp"; break;
-			case 214: s = "invalid EquivOp"; break;
-			case 215: s = "invalid ImpliesOp"; break;
-			case 216: s = "invalid ExpliesOp"; break;
-			case 217: s = "invalid AndOp"; break;
-			case 218: s = "invalid OrOp"; break;
-			case 219: s = "invalid NegOp"; break;
-			case 220: s = "invalid Forall"; break;
-			case 221: s = "invalid Exists"; break;
-			case 222: s = "invalid QSep"; break;
-			case 223: s = "invalid ImpliesExpliesExpression"; break;
-			case 224: s = "invalid LogicalExpression"; break;
-			case 225: s = "invalid RelOp"; break;
-			case 226: s = "invalid AddOp"; break;
-			case 227: s = "invalid UnaryExpression"; break;
-			case 228: s = "invalid MulOp"; break;
-			case 229: s = "invalid Suffix"; break;
+			case 213: s = "this symbol not expected in CaseStatement"; break;
+			case 214: s = "invalid CalcOp"; break;
+			case 215: s = "invalid EquivOp"; break;
+			case 216: s = "invalid ImpliesOp"; break;
+			case 217: s = "invalid ExpliesOp"; break;
+			case 218: s = "invalid AndOp"; break;
+			case 219: s = "invalid OrOp"; break;
+			case 220: s = "invalid NegOp"; break;
+			case 221: s = "invalid Forall"; break;
+			case 222: s = "invalid Exists"; break;
+			case 223: s = "invalid QSep"; break;
+			case 224: s = "invalid ImpliesExpliesExpression"; break;
+			case 225: s = "invalid LogicalExpression"; break;
+			case 226: s = "invalid RelOp"; break;
+			case 227: s = "invalid AddOp"; break;
+			case 228: s = "invalid UnaryExpression"; break;
+			case 229: s = "invalid MulOp"; break;
 			case 230: s = "invalid Suffix"; break;
 			case 231: s = "invalid Suffix"; break;
 			case 232: s = "invalid Suffix"; break;
 			case 233: s = "invalid Suffix"; break;
-			case 234: s = "invalid LambdaExpression"; break;
-			case 235: s = "invalid EndlessExpression"; break;
-			case 236: s = "invalid NameSegment"; break;
-			case 237: s = "invalid DisplayExpr"; break;
-			case 238: s = "invalid MultiSetExpr"; break;
-			case 239: s = "invalid ConstAtomExpression"; break;
-			case 240: s = "invalid Nat"; break;
-			case 241: s = "invalid LambdaArrow"; break;
-			case 242: s = "invalid MatchExpression"; break;
-			case 243: s = "invalid QuantifierGuts"; break;
-			case 244: s = "invalid StmtInExpr"; break;
-			case 245: s = "invalid LetExpr"; break;
-			case 246: s = "invalid CaseExpression"; break;
-			case 247: s = "invalid MemberBindingUpdate"; break;
-			case 248: s = "invalid DotSuffix"; break;
+			case 234: s = "invalid Suffix"; break;
+			case 235: s = "invalid LambdaExpression"; break;
+			case 236: s = "invalid EndlessExpression"; break;
+			case 237: s = "invalid NameSegment"; break;
+			case 238: s = "invalid DisplayExpr"; break;
+			case 239: s = "invalid MultiSetExpr"; break;
+			case 240: s = "invalid ConstAtomExpression"; break;
+			case 241: s = "invalid Nat"; break;
+			case 242: s = "invalid LambdaArrow"; break;
+			case 243: s = "invalid MatchExpression"; break;
+			case 244: s = "invalid QuantifierGuts"; break;
+			case 245: s = "invalid StmtInExpr"; break;
+			case 246: s = "invalid LetExpr"; break;
+			case 247: s = "invalid CaseExpression"; break;
+			case 248: s = "invalid MemberBindingUpdate"; break;
+			case 249: s = "invalid DotSuffix"; break;
 
 			default: s = "error " + n; break;
 		}
diff --git a/Source/DafnyDriver/DafnyDriver.cs b/Source/DafnyDriver/DafnyDriver.cs
index a60971b1..464aff79 100644
--- a/Source/DafnyDriver/DafnyDriver.cs
+++ b/Source/DafnyDriver/DafnyDriver.cs
@@ -310,11 +310,12 @@ namespace Microsoft.Dafny
       string targetFilename = Path.ChangeExtension(dafnyProgramName, "cs");
       using (TextWriter target = new StreamWriter(new FileStream(targetFilename, System.IO.FileMode.Create))) {
         target.Write(csharpProgram);
+        string relativeTarget = Path.GetFileName(targetFilename);
         if (completeProgram) {
-          outputWriter.WriteLine("Compiled program written to {0}", targetFilename);
+          outputWriter.WriteLine("Compiled program written to {0}", relativeTarget);
         }
         else {
-          outputWriter.WriteLine("File {0} contains the partially compiled program", targetFilename);
+          outputWriter.WriteLine("File {0} contains the partially compiled program", relativeTarget);
         }
       }
       return targetFilename;
diff --git a/Test/dafny0/Extern.dfy.expect b/Test/dafny0/Extern.dfy.expect
index fec087d9..25c1c3ee 100644
--- a/Test/dafny0/Extern.dfy.expect
+++ b/Test/dafny0/Extern.dfy.expect
@@ -1,4 +1,4 @@
 
 Dafny program verifier finished with 7 verified, 0 errors
-Compiled program written to D:\de\dafny\Test\dafny0\Extern.cs
+Compiled program written to Extern.cs
 Compiled assembly into Extern.exe
-- 
cgit v1.2.3


From 7fb4b7f9ad53ad793eb7a66cf5ca89499d275121 Mon Sep 17 00:00:00 2001
From: "Richard L. Ford" <richford@microsoft.com>
Date: Fri, 29 Jan 2016 09:28:06 -0800
Subject: Revert Makefile to its prior settings

The prior change did not work for people who had their
setup using the previous values.
---
 Source/Dafny/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Makefile b/Source/Dafny/Makefile
index a61539b0..68ab7a2d 100644
--- a/Source/Dafny/Makefile
+++ b/Source/Dafny/Makefile
@@ -4,8 +4,8 @@
 # from http://boogiepartners.codeplex.com/. Update the FRAME_DIR variable to
 # point to whatever directory you install that into.
 # ###############################################################################
-COCO_EXE_DIR = ..\..\..\coco
-FRAME_DIR = ..\..\..\boogiepartners\CocoR\Modified
+COCO_EXE_DIR = ..\..\..\boogie-partners\CocoR\bin
+FRAME_DIR = ..\..\..\boogie-partners\CocoR\Modified
 COCO = $(COCO_EXE_DIR)\Coco.exe
 
 # "all" depends on 2 files, really (Parser.cs and Scanner.cs), but they
-- 
cgit v1.2.3


From e4da5fcd52bbdd0b8345056a3475333d6e27e65f Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Fri, 29 Jan 2016 13:01:02 -0800
Subject: Implement module export so we can export a subset of items defined in
 the module.

---
 Source/Dafny/Cloner.cs              |    5 +
 Source/Dafny/Dafny.atg              |   47 +-
 Source/Dafny/DafnyAst.cs            |   36 ++
 Source/Dafny/Parser.cs              | 1069 +++++++++++++++++++----------------
 Source/Dafny/Resolver.cs            |  106 +++-
 Source/Dafny/Scanner.cs             |  175 +++---
 Test/dafny0/ModuleExport.dfy        |   68 +++
 Test/dafny0/ModuleExport.dfy.expect |    9 +
 8 files changed, 923 insertions(+), 592 deletions(-)
 create mode 100644 Test/dafny0/ModuleExport.dfy
 create mode 100644 Test/dafny0/ModuleExport.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index 6b3b0caa..8971d2c1 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -126,6 +126,11 @@ namespace Microsoft.Dafny
           abs.Signature = a.Signature;
           abs.OriginalSignature = a.OriginalSignature;
           return abs;
+        } else if (d is ModuleExportDecl) {
+          var a = (ModuleExportDecl)d;
+          var export = new ModuleExportDecl(a.tok, m, a.IsDefault, a.Exports, a.Extends);
+          export.Signature = a.Signature;
+          return export;
         } else {
           Contract.Assert(false);  // unexpected declaration
           return null;  // to please compiler
diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index eb0c3303..e3696c5b 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -502,6 +502,13 @@ bool IsType(ref IToken pt) {
   }
 }
 
+
+bool IsDefaultImport() {
+  scanner.ResetPeek();  
+  Token x = scanner.Peek();  // lookahead token again 
+  return la.val == "default" && x.val != "export";
+}
+
 /*--------------------------------------------------------------------------*/
 CHARACTERS
   letter = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz".
@@ -708,7 +715,7 @@ SubModuleDecl<DeclModifierData dmod, ModuleDefinition parent, out ModuleDecl sub
       | "refines" QualifiedModuleName<out idRefined> (. isExclusively = false; .) ] 
             (. module = new ModuleDefinition(id, id.val, isAbstract, false, isExclusively, idRefined == null ? null : idRefined, parent, attrs, false, this); .)  
        "{"                                             (. module.BodyStartTok = t; .)
-            { TopDecl<module, namedModuleDefaultClassMembers, /* isTopLevel */ false, isAbstract> }
+            { TopDecl<module, namedModuleDefaultClassMembers, /* isTopLevel */ false, isAbstract>}
        "}"                                 (. module.BodyEndTok = t;
                                               module.TopLevelDecls.Add(new DefaultClassDecl(module, namedModuleDefaultClassMembers));
                                               submodule = new LiteralModuleDecl(module, parent); .)
@@ -718,8 +725,16 @@ SubModuleDecl<DeclModifierData dmod, ModuleDefinition parent, out ModuleDecl sub
     (. EncodeExternAsAttribute(dmod, ref attrs, id, /* needAxiom */ false); .)
     [ "=" QualifiedModuleName<out idPath>
       (. submodule = new AliasModuleDecl(idPath, id, parent, opened); .)
-    | "as" QualifiedModuleName<out idPath>  ["default" QualifiedModuleName<out idAssignment> ]
+    | "as" QualifiedModuleName<out idPath> [IF(IsDefaultImport()) "default" QualifiedModuleName<out idAssignment> ]
+      (. submodule = new ModuleFacadeDecl(idPath, id, parent, idAssignment, opened); 
+         //errors.Warning(t, "\"import A as B\" has been deprecated; in the new syntax, it is \"import A:B\"");
+      .)
+    | ":" QualifiedModuleName<out idPath>
       (. submodule = new ModuleFacadeDecl(idPath, id, parent, idAssignment, opened); .)
+    | "." QualifiedModuleName<out idPath>
+      (. idPath.Insert(0, id);
+			   submodule = new AliasModuleDecl(idPath, id, parent, opened); 
+      .)
     ]
     [ SYNC ";"
         // This semi-colon used to be required, but it seems silly to have it.
@@ -733,6 +748,33 @@ SubModuleDecl<DeclModifierData dmod, ModuleDefinition parent, out ModuleDecl sub
          submodule = new AliasModuleDecl(idPath, id, parent, opened);
        }
     .)
+	| (. 		 
+		  bool isDefault = false;
+			bool includeBody;
+			IToken exportId;
+			List<ExportSignature> exports = new List<ExportSignature>();;
+      List<string> extends = new List<string>(); 
+		.)
+	  ["default"  (. isDefault = true; .) ]
+		"export"
+		NoUSIdent<out exportId>
+		["extends" 
+     NoUSIdent<out id>(. extends.Add(id.val); .) 
+     {"," NoUSIdent<out id>  (. extends.Add(id.val); .) }
+    ] 
+		"{"
+		   NoUSIdent<out id>   (. includeBody = false; .)
+			 ['+' (. includeBody = true; .)]
+			 (. exports.Add(new ExportSignature(id, includeBody)); .)
+       { ","
+         NoUSIdent<out id> (. includeBody = false; .)
+			   ['+' (. includeBody = true; .)]
+			   (. exports.Add(new ExportSignature(id, includeBody)); .)
+       }
+		"}"
+		(.
+		   submodule = new ModuleExportDecl(exportId, parent, isDefault, exports, extends);
+		.)
   )
 .
 
@@ -744,6 +786,7 @@ QualifiedModuleName<.out List<IToken> ids.>
   }
   .
 
+
 ClassDecl<DeclModifierData dmodClass, ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c>
 = (. Contract.Requires(module != null);
      Contract.Ensures(Contract.ValueAtReturn(out c) != null);
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index a51e30de..33186a76 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -1662,6 +1662,8 @@ namespace Microsoft.Dafny {
   public class LiteralModuleDecl : ModuleDecl
   {
     public readonly ModuleDefinition ModuleDef;
+    public ModuleSignature DefaultExport;  // the default export of the module. fill in by the resolver.
+
     public LiteralModuleDecl(ModuleDefinition module, ModuleDefinition parent)
       : base(module.tok, module.Name, parent, false) {
       ModuleDef = module;
@@ -1680,6 +1682,7 @@ namespace Microsoft.Dafny {
     }
     public override object Dereference() { return Signature.ModuleDef; }
   }
+
   // Represents "module name as path [ = compilePath];", where name is a identifier and path is a possibly qualified name.
   public class ModuleFacadeDecl : ModuleDecl
   {
@@ -1698,6 +1701,39 @@ namespace Microsoft.Dafny {
     public override object Dereference() { return this; }
   }
 
+  // Represents the exports of a module. 
+  public class ModuleExportDecl : ModuleDecl
+  {
+    public bool IsDefault;
+    public List<ExportSignature> Exports; // list of TopLevelDecl that are included in the export
+    public List<string> Extends; // list of exports that are extended
+    public readonly List<ModuleExportDecl> ExtendDecls = new List<ModuleExportDecl>(); // fill in by the resolver
+
+    public ModuleExportDecl(IToken tok, ModuleDefinition parent, bool isDefault, 
+      List<ExportSignature> exports, List<string> extends) 
+      : base(tok, tok.val, parent, false) {
+      IsDefault = isDefault;
+      Exports = exports;
+      Extends = extends;
+    }
+
+    public override object Dereference() { return this; }
+  }
+
+  public class ExportSignature
+  {
+    public bool IncludeBody;
+    public IToken Id;
+    public string Name;
+    public Declaration Decl;  // fill in  by the resolver
+
+    public ExportSignature(IToken id, bool includeBody) {
+      Id = id;
+      Name = id.val;
+      IncludeBody = includeBody;
+    }
+  }
+
   public class ModuleSignature {
     private ModuleDefinition exclusiveRefinement = null;
     public readonly Dictionary<string, TopLevelDecl> TopLevels = new Dictionary<string, TopLevelDecl>();
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index 943e2cf6..c7955dc8 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -73,7 +73,7 @@ public class Parser {
 	public const int _star = 57;
 	public const int _notIn = 58;
 	public const int _ellipsis = 59;
-	public const int maxT = 139;
+	public const int maxT = 140;
 
 	const bool _T = true;
 	const bool _x = false;
@@ -574,6 +574,13 @@ bool IsType(ref IToken pt) {
   }
 }
 
+
+bool IsDefaultImport() {
+  scanner.ResetPeek();  
+  Token x = scanner.Peek();  // lookahead token again 
+  return la.val == "default" && x.val != "export";
+}
+
 /*--------------------------------------------------------------------------*/
 
 
@@ -697,47 +704,47 @@ bool IsType(ref IToken pt) {
 			DeclModifier(ref dmod);
 		}
 		switch (la.kind) {
-		case 66: case 69: {
+		case 66: case 69: case 73: case 74: {
 			SubModuleDecl(dmod, module, out submodule);
 			module.TopLevelDecls.Add(submodule); 
 			break;
 		}
-		case 74: {
+		case 77: {
 			ClassDecl(dmod, module, out c);
 			module.TopLevelDecls.Add(c); 
 			break;
 		}
-		case 77: case 78: {
+		case 79: case 80: {
 			DatatypeDecl(dmod, module, out dt);
 			module.TopLevelDecls.Add(dt); 
 			break;
 		}
-		case 80: {
+		case 82: {
 			NewtypeDecl(dmod, module, out td);
 			module.TopLevelDecls.Add(td); 
 			break;
 		}
-		case 81: {
+		case 83: {
 			OtherTypeDecl(dmod, module, out td);
 			module.TopLevelDecls.Add(td); 
 			break;
 		}
-		case 82: {
+		case 84: {
 			IteratorDecl(dmod, module, out iter);
 			module.TopLevelDecls.Add(iter); 
 			break;
 		}
-		case 76: {
+		case 78: {
 			TraitDecl(dmod, module, out trait);
 			module.TopLevelDecls.Add(trait); 
 			break;
 		}
-		case 38: case 39: case 40: case 41: case 42: case 79: case 85: case 86: case 87: case 88: {
+		case 38: case 39: case 40: case 41: case 42: case 81: case 87: case 88: case 89: case 90: {
 			ClassMemberDecl(dmod, membersDefaultClass, false, !DafnyOptions.O.AllowGlobals, 
 !isTopLevel && DafnyOptions.O.IronDafny && isAbstract);
 			break;
 		}
-		default: SynErr(140); break;
+		default: SynErr(141); break;
 		}
 	}
 
@@ -764,7 +771,7 @@ bool IsType(ref IToken pt) {
 				dmod.ExternName = new StringLiteralExpr(t, s, isVerbatimString);
 				
 			}
-		} else SynErr(141);
+		} else SynErr(142);
 	}
 
 	void SubModuleDecl(DeclModifierData dmod, ModuleDefinition parent, out ModuleDecl submodule) {
@@ -815,23 +822,35 @@ bool IsType(ref IToken pt) {
 			}
 			NoUSIdent(out id);
 			EncodeExternAsAttribute(dmod, ref attrs, id, /* needAxiom */ false); 
-			if (la.kind == 71 || la.kind == 72) {
+			if (StartOf(3)) {
 				if (la.kind == 71) {
 					Get();
 					QualifiedModuleName(out idPath);
 					submodule = new AliasModuleDecl(idPath, id, parent, opened); 
-				} else {
+				} else if (la.kind == 72) {
 					Get();
 					QualifiedModuleName(out idPath);
-					if (la.kind == 73) {
-						Get();
+					if (IsDefaultImport()) {
+						Expect(73);
 						QualifiedModuleName(out idAssignment);
 					}
 					submodule = new ModuleFacadeDecl(idPath, id, parent, idAssignment, opened); 
+					//errors.Warning(t, "\"import A as B\" has been deprecated; in the new syntax, it is \"import A:B\"");
+					
+				} else if (la.kind == 21) {
+					Get();
+					QualifiedModuleName(out idPath);
+					submodule = new ModuleFacadeDecl(idPath, id, parent, idAssignment, opened); 
+				} else {
+					Get();
+					QualifiedModuleName(out idPath);
+					idPath.Insert(0, id);
+					submodule = new AliasModuleDecl(idPath, id, parent, opened); 
+					
 				}
 			}
 			if (la.kind == 28) {
-				while (!(la.kind == 0 || la.kind == 28)) {SynErr(142); Get();}
+				while (!(la.kind == 0 || la.kind == 28)) {SynErr(143); Get();}
 				Get();
 				errors.Warning(t, "the semi-colon that used to terminate a sub-module declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 			}
@@ -841,7 +860,51 @@ bool IsType(ref IToken pt) {
 			 submodule = new AliasModuleDecl(idPath, id, parent, opened);
 			}
 			
-		} else SynErr(143);
+		} else if (la.kind == 73 || la.kind == 74) {
+			bool isDefault = false;
+			bool includeBody;
+			IToken exportId;
+			List<ExportSignature> exports = new List<ExportSignature>();;
+			 List<string> extends = new List<string>(); 
+			
+			if (la.kind == 73) {
+				Get();
+				isDefault = true; 
+			}
+			Expect(74);
+			NoUSIdent(out exportId);
+			if (la.kind == 75) {
+				Get();
+				NoUSIdent(out id);
+				extends.Add(id.val); 
+				while (la.kind == 22) {
+					Get();
+					NoUSIdent(out id);
+					extends.Add(id.val); 
+				}
+			}
+			Expect(46);
+			NoUSIdent(out id);
+			includeBody = false; 
+			if (la.kind == 76) {
+				Get();
+				includeBody = true; 
+			}
+			exports.Add(new ExportSignature(id, includeBody)); 
+			while (la.kind == 22) {
+				Get();
+				NoUSIdent(out id);
+				includeBody = false; 
+				if (la.kind == 76) {
+					Get();
+					includeBody = true; 
+				}
+				exports.Add(new ExportSignature(id, includeBody)); 
+			}
+			Expect(47);
+			submodule = new ModuleExportDecl(exportId, parent, isDefault, exports, extends);
+			
+		} else SynErr(144);
 	}
 
 	void ClassDecl(DeclModifierData dmodClass, ModuleDefinition/*!*/ module, out ClassDecl/*!*/ c) {
@@ -857,8 +920,8 @@ bool IsType(ref IToken pt) {
 		CheckDeclModifiers(dmodClass, "Classes", AllowedDeclModifiers.Extern);
 		DeclModifierData dmod; 
 		
-		while (!(la.kind == 0 || la.kind == 74)) {SynErr(144); Get();}
-		Expect(74);
+		while (!(la.kind == 0 || la.kind == 77)) {SynErr(145); Get();}
+		Expect(77);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -879,7 +942,7 @@ bool IsType(ref IToken pt) {
 		}
 		Expect(46);
 		bodyStart = t;  
-		while (StartOf(3)) {
+		while (StartOf(4)) {
 			dmod = new DeclModifierData(); 
 			while (StartOf(2)) {
 				DeclModifier(ref dmod);
@@ -904,13 +967,13 @@ bool IsType(ref IToken pt) {
 		bool co = false;
 		CheckDeclModifiers(dmod, "Datatypes or codatatypes", AllowedDeclModifiers.None);
 		
-		while (!(la.kind == 0 || la.kind == 77 || la.kind == 78)) {SynErr(145); Get();}
-		if (la.kind == 77) {
+		while (!(la.kind == 0 || la.kind == 79 || la.kind == 80)) {SynErr(146); Get();}
+		if (la.kind == 79) {
 			Get();
-		} else if (la.kind == 78) {
+		} else if (la.kind == 80) {
 			Get();
 			co = true; 
-		} else SynErr(146);
+		} else SynErr(147);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -926,7 +989,7 @@ bool IsType(ref IToken pt) {
 			DatatypeMemberDecl(ctors);
 		}
 		if (la.kind == 28) {
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(147); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(148); Get();}
 			Get();
 			errors.Warning(t, "the semi-colon that used to terminate a (co)datatype declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 		}
@@ -948,7 +1011,7 @@ bool IsType(ref IToken pt) {
 		Expression wh;
 		CheckDeclModifiers(dmod, "Newtypes", AllowedDeclModifiers.None);
 		
-		Expect(80);
+		Expect(82);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -964,10 +1027,10 @@ bool IsType(ref IToken pt) {
 			Expect(23);
 			Expression(out wh, false, true);
 			td = new NewtypeDecl(theVerifyThisFile ? id : new IncludeToken(id), id.val, module, new BoundVar(bvId, bvId.val, baseType), wh, attrs); 
-		} else if (StartOf(4)) {
+		} else if (StartOf(5)) {
 			Type(out baseType);
 			td = new NewtypeDecl(theVerifyThisFile ? id : new IncludeToken(id), id.val, module, baseType, attrs); 
-		} else SynErr(148);
+		} else SynErr(149);
 	}
 
 	void OtherTypeDecl(DeclModifierData dmod, ModuleDefinition module, out TopLevelDecl td) {
@@ -979,7 +1042,7 @@ bool IsType(ref IToken pt) {
 		Type ty;
 		CheckDeclModifiers(dmod, "Type aliases", AllowedDeclModifiers.None);
 		
-		Expect(81);
+		Expect(83);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -992,7 +1055,7 @@ bool IsType(ref IToken pt) {
 			if (la.kind == 52) {
 				GenericParameters(typeArgs);
 			}
-		} else if (StartOf(5)) {
+		} else if (StartOf(6)) {
 			if (la.kind == 52) {
 				GenericParameters(typeArgs);
 			}
@@ -1001,13 +1064,13 @@ bool IsType(ref IToken pt) {
 				Type(out ty);
 				td = new TypeSynonymDecl(id, id.val, typeArgs, module, ty, attrs); 
 			}
-		} else SynErr(149);
+		} else SynErr(150);
 		if (td == null) {
 		 td = new OpaqueTypeDecl(id, id.val, module, eqSupport, typeArgs, attrs);
 		}
 		
 		if (la.kind == 28) {
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(150); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(151); Get();}
 			Get();
 			errors.Warning(t, "the semi-colon that used to terminate an opaque-type declaration has been deprecated; in the new syntax, just leave off the semi-colon"); 
 		}
@@ -1037,8 +1100,8 @@ bool IsType(ref IToken pt) {
 		IToken bodyEnd = Token.NoToken;
 		CheckDeclModifiers(dmod, "Iterators", AllowedDeclModifiers.None);
 		
-		while (!(la.kind == 0 || la.kind == 82)) {SynErr(151); Get();}
-		Expect(82);
+		while (!(la.kind == 0 || la.kind == 84)) {SynErr(152); Get();}
+		Expect(84);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -1048,8 +1111,8 @@ bool IsType(ref IToken pt) {
 				GenericParameters(typeArgs);
 			}
 			Formals(true, true, ins);
-			if (la.kind == 83 || la.kind == 84) {
-				if (la.kind == 83) {
+			if (la.kind == 85 || la.kind == 86) {
+				if (la.kind == 85) {
 					Get();
 				} else {
 					Get();
@@ -1060,8 +1123,8 @@ bool IsType(ref IToken pt) {
 		} else if (la.kind == 59) {
 			Get();
 			signatureEllipsis = t; 
-		} else SynErr(152);
-		while (StartOf(6)) {
+		} else SynErr(153);
+		while (StartOf(7)) {
 			IteratorSpec(reads, mod, decreases, req, ens, yieldReq, yieldEns, ref readsAttrs, ref modAttrs, ref decrAttrs);
 		}
 		if (la.kind == 46) {
@@ -1080,8 +1143,8 @@ bool IsType(ref IToken pt) {
 
 	void TraitDecl(DeclModifierData dmodIn, ModuleDefinition/*!*/ module, out TraitDecl/*!*/ trait) {
 		Contract.Requires(module != null);     
-		CheckDeclModifiers(dmodIn, "Traits", AllowedDeclModifiers.None);
 		Contract.Ensures(Contract.ValueAtReturn(out trait) != null);
+		CheckDeclModifiers(dmodIn, "Traits", AllowedDeclModifiers.None);
 		IToken/*!*/ id;
 		Attributes attrs = null;
 		List<TypeParameter/*!*/> typeArgs = new List<TypeParameter/*!*/>(); //traits should not support type parameters at the moment
@@ -1089,8 +1152,8 @@ bool IsType(ref IToken pt) {
 		IToken bodyStart;
 		DeclModifierData dmod; 
 		
-		while (!(la.kind == 0 || la.kind == 76)) {SynErr(153); Get();}
-		Expect(76);
+		while (!(la.kind == 0 || la.kind == 78)) {SynErr(154); Get();}
+		Expect(78);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -1100,7 +1163,7 @@ bool IsType(ref IToken pt) {
 		}
 		Expect(46);
 		bodyStart = t; 
-		while (StartOf(3)) {
+		while (StartOf(4)) {
 			dmod  = new DeclModifierData(); 
 			while (StartOf(2)) {
 				DeclModifier(ref dmod);
@@ -1119,7 +1182,7 @@ bool IsType(ref IToken pt) {
 		Method/*!*/ m;
 		Function/*!*/ f;
 		
-		if (la.kind == 79) {
+		if (la.kind == 81) {
 			if (moduleLevelDecl) {
 			 SemErr(la, "fields are not allowed to be declared at the module level; instead, wrap the field in a 'class' declaration");
 			 dmod.IsStatic = false;
@@ -1134,7 +1197,7 @@ bool IsType(ref IToken pt) {
 			
 			FunctionDecl(dmod, isWithinAbstractModule, out f);
 			mm.Add(f); 
-		} else if (StartOf(7)) {
+		} else if (StartOf(8)) {
 			if (moduleLevelDecl && dmod.StaticToken != null) {
 			 errors.Warning(dmod.StaticToken, "module-level methods are always non-instance, so the 'static' keyword is not allowed here");
 			 dmod.IsStatic = false;
@@ -1142,7 +1205,7 @@ bool IsType(ref IToken pt) {
 			
 			MethodDecl(dmod, allowConstructors, isWithinAbstractModule, out m);
 			mm.Add(m); 
-		} else SynErr(154);
+		} else SynErr(155);
 	}
 
 	void Attribute(ref Attributes attrs) {
@@ -1153,7 +1216,7 @@ bool IsType(ref IToken pt) {
 		Expect(21);
 		NoUSIdent(out x);
 		name = x.val; 
-		if (StartOf(8)) {
+		if (StartOf(9)) {
 			Expressions(args);
 		}
 		Expect(47);
@@ -1228,8 +1291,8 @@ bool IsType(ref IToken pt) {
 		IToken/*!*/ id;  Type/*!*/ ty;
 		CheckDeclModifiers(dmod, "Fields", AllowedDeclModifiers.Ghost);
 		
-		while (!(la.kind == 0 || la.kind == 79)) {SynErr(155); Get();}
-		Expect(79);
+		while (!(la.kind == 0 || la.kind == 81)) {SynErr(156); Get();}
+		Expect(81);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -1264,7 +1327,7 @@ bool IsType(ref IToken pt) {
 		
 		if (la.kind == 38) {
 			Get();
-			if (la.kind == 85) {
+			if (la.kind == 87) {
 				Get();
 				isFunctionMethod = true; 
 			}
@@ -1290,11 +1353,11 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(156);
+			} else SynErr(157);
 		} else if (la.kind == 39) {
 			Get();
 			isPredicate = true; 
-			if (la.kind == 85) {
+			if (la.kind == 87) {
 				Get();
 				isFunctionMethod = true; 
 			}
@@ -1310,7 +1373,7 @@ bool IsType(ref IToken pt) {
 				Attribute(ref attrs);
 			}
 			NoUSIdent(out id);
-			if (StartOf(9)) {
+			if (StartOf(10)) {
 				if (la.kind == 52) {
 					GenericParameters(typeArgs);
 				}
@@ -1327,7 +1390,7 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(157);
+			} else SynErr(158);
 		} else if (la.kind == 40) {
 			Get();
 			Expect(39);
@@ -1351,7 +1414,7 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(158);
+			} else SynErr(159);
 		} else if (la.kind == 42) {
 			Get();
 			isCoPredicate = true; 
@@ -1374,10 +1437,10 @@ bool IsType(ref IToken pt) {
 			} else if (la.kind == 59) {
 				Get();
 				signatureEllipsis = t; 
-			} else SynErr(159);
-		} else SynErr(160);
+			} else SynErr(160);
+		} else SynErr(161);
 		decreases = isIndPredicate || isCoPredicate ? null : new List<Expression/*!*/>(); 
-		while (StartOf(10)) {
+		while (StartOf(11)) {
 			FunctionSpec(reqs, reads, ens, decreases);
 		}
 		if (la.kind == 46) {
@@ -1437,9 +1500,9 @@ bool IsType(ref IToken pt) {
 		AllowedDeclModifiers allowed = AllowedDeclModifiers.None;
 		string caption = "";
 		
-		while (!(StartOf(11))) {SynErr(161); Get();}
+		while (!(StartOf(12))) {SynErr(162); Get();}
 		switch (la.kind) {
-		case 85: {
+		case 87: {
 			Get();
 			caption = "Methods";
 			allowed = AllowedDeclModifiers.Ghost | AllowedDeclModifiers.Static 
@@ -1453,14 +1516,14 @@ bool IsType(ref IToken pt) {
 			 | AllowedDeclModifiers.Protected; 
 			break;
 		}
-		case 86: {
+		case 88: {
 			Get();
 			isCoLemma = true; caption = "Colemmas";
 			allowed = AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static 
 			 | AllowedDeclModifiers.Protected; 
 			break;
 		}
-		case 87: {
+		case 89: {
 			Get();
 			isCoLemma = true; caption = "Comethods";
 			allowed = AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static 
@@ -1476,7 +1539,7 @@ bool IsType(ref IToken pt) {
 			allowed = AllowedDeclModifiers.AlreadyGhost | AllowedDeclModifiers.Static;
 			break;
 		}
-		case 88: {
+		case 90: {
 			Get();
 			if (allowConstructor) {
 			 isConstructor = true;
@@ -1488,7 +1551,7 @@ bool IsType(ref IToken pt) {
 			
 			break;
 		}
-		default: SynErr(162); break;
+		default: SynErr(163); break;
 		}
 		keywordToken = t; 
 		CheckDeclModifiers(dmod, caption, allowed); 
@@ -1512,7 +1575,7 @@ bool IsType(ref IToken pt) {
 				GenericParameters(typeArgs);
 			}
 			Formals(true, !dmod.IsGhost, ins);
-			if (la.kind == 84) {
+			if (la.kind == 86) {
 				Get();
 				if (isConstructor) { SemErr(t, "constructors cannot have out-parameters"); } 
 				Formals(false, !dmod.IsGhost, outs);
@@ -1520,8 +1583,8 @@ bool IsType(ref IToken pt) {
 		} else if (la.kind == 59) {
 			Get();
 			signatureEllipsis = t; 
-		} else SynErr(163);
-		while (StartOf(12)) {
+		} else SynErr(164);
+		while (StartOf(13)) {
 			MethodSpec(req, mod, ens, dec, ref decAttrs, ref modAttrs);
 		}
 		if (la.kind == 46) {
@@ -1572,7 +1635,7 @@ bool IsType(ref IToken pt) {
 	void FormalsOptionalIds(List<Formal/*!*/>/*!*/ formals) {
 		Contract.Requires(cce.NonNullElements(formals)); IToken/*!*/ id;  Type/*!*/ ty;  string/*!*/ name;  bool isGhost; 
 		Expect(50);
-		if (StartOf(13)) {
+		if (StartOf(14)) {
 			TypeIdentOptional(out id, out name, out ty, out isGhost);
 			formals.Add(new Formal(id, name, ty, true, isGhost)); 
 			while (la.kind == 22) {
@@ -1593,14 +1656,14 @@ bool IsType(ref IToken pt) {
 		} else if (la.kind == 2) {
 			Get();
 			id = t; 
-		} else SynErr(164);
+		} else SynErr(165);
 		Expect(21);
 		Type(out ty);
 	}
 
 	void OldSemi() {
 		if (la.kind == 28) {
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(165); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(166); Get();}
 			Get();
 		}
 	}
@@ -1679,7 +1742,7 @@ bool IsType(ref IToken pt) {
 			Get();
 			isGhost = true; 
 		}
-		if (StartOf(4)) {
+		if (StartOf(5)) {
 			TypeAndToken(out id, out ty);
 			if (la.kind == 21) {
 				Get();
@@ -1697,7 +1760,7 @@ bool IsType(ref IToken pt) {
 			id = t; name = id.val;
 			Expect(21);
 			Type(out ty);
-		} else SynErr(166);
+		} else SynErr(167);
 		if (name != null) {
 		 identName = name;
 		} else {
@@ -1848,7 +1911,7 @@ bool IsType(ref IToken pt) {
 		case 50: {
 			Get();
 			tok = t; tupleArgTypes = new List<Type>(); 
-			if (StartOf(4)) {
+			if (StartOf(5)) {
 				Type(out ty);
 				tupleArgTypes.Add(ty); 
 				while (la.kind == 22) {
@@ -1885,7 +1948,7 @@ bool IsType(ref IToken pt) {
 			ty = new UserDefinedType(e.tok, e); 
 			break;
 		}
-		default: SynErr(167); break;
+		default: SynErr(168); break;
 		}
 		if (la.kind == 30) {
 			Type t2; 
@@ -1924,7 +1987,7 @@ List<MaybeFreeExpression/*!*/>/*!*/ yieldReq, List<MaybeFreeExpression/*!*/>/*!*
 ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 		Expression/*!*/ e; FrameExpression/*!*/ fe; bool isFree = false; bool isYield = false; Attributes ensAttrs = null;
 		
-		while (!(StartOf(14))) {SynErr(168); Get();}
+		while (!(StartOf(15))) {SynErr(169); Get();}
 		if (la.kind == 44) {
 			Get();
 			while (IsAttribute()) {
@@ -1951,14 +2014,14 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 				mod.Add(fe); 
 			}
 			OldSemi();
-		} else if (StartOf(15)) {
-			if (la.kind == 89) {
+		} else if (StartOf(16)) {
+			if (la.kind == 91) {
 				Get();
 				isFree = true;
 				errors.Warning(t, "the 'free' keyword is soon to be deprecated");
 				
 			}
-			if (la.kind == 91) {
+			if (la.kind == 93) {
 				Get();
 				isYield = true; 
 			}
@@ -1972,7 +2035,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 				 req.Add(new MaybeFreeExpression(e, isFree));
 				}
 				
-			} else if (la.kind == 90) {
+			} else if (la.kind == 92) {
 				Get();
 				while (IsAttribute()) {
 					Attribute(ref ensAttrs);
@@ -1985,7 +2048,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 				 ens.Add(new MaybeFreeExpression(e, isFree, ensAttrs));
 				}
 				
-			} else SynErr(169);
+			} else SynErr(170);
 		} else if (la.kind == 36) {
 			Get();
 			while (IsAttribute()) {
@@ -1993,7 +2056,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 			}
 			DecreasesList(decreases, false, false);
 			OldSemi();
-		} else SynErr(170);
+		} else SynErr(171);
 	}
 
 	void BlockStmt(out BlockStmt/*!*/ block, out IToken bodyStart, out IToken bodyEnd) {
@@ -2002,7 +2065,7 @@ ref Attributes readsAttrs, ref Attributes modAttrs, ref Attributes decrAttrs) {
 		
 		Expect(46);
 		bodyStart = t; 
-		while (StartOf(16)) {
+		while (StartOf(17)) {
 			Stmt(body);
 		}
 		Expect(47);
@@ -2015,7 +2078,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Requires(cce.NonNullElements(req)); Contract.Requires(cce.NonNullElements(mod)); Contract.Requires(cce.NonNullElements(ens)); Contract.Requires(cce.NonNullElements(decreases));
 		Expression/*!*/ e;  FrameExpression/*!*/ fe;  bool isFree = false; Attributes ensAttrs = null;
 		
-		while (!(StartOf(17))) {SynErr(171); Get();}
+		while (!(StartOf(18))) {SynErr(172); Get();}
 		if (la.kind == 43) {
 			Get();
 			while (IsAttribute()) {
@@ -2029,8 +2092,8 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				mod.Add(fe); 
 			}
 			OldSemi();
-		} else if (la.kind == 45 || la.kind == 89 || la.kind == 90) {
-			if (la.kind == 89) {
+		} else if (la.kind == 45 || la.kind == 91 || la.kind == 92) {
+			if (la.kind == 91) {
 				Get();
 				isFree = true;
 				errors.Warning(t, "the 'free' keyword is soon to be deprecated");
@@ -2041,7 +2104,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Expression(out e, false, false);
 				OldSemi();
 				req.Add(new MaybeFreeExpression(e, isFree)); 
-			} else if (la.kind == 90) {
+			} else if (la.kind == 92) {
 				Get();
 				while (IsAttribute()) {
 					Attribute(ref ensAttrs);
@@ -2049,7 +2112,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Expression(out e, false, false);
 				OldSemi();
 				ens.Add(new MaybeFreeExpression(e, isFree, ensAttrs)); 
-			} else SynErr(172);
+			} else SynErr(173);
 		} else if (la.kind == 36) {
 			Get();
 			while (IsAttribute()) {
@@ -2057,7 +2120,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			DecreasesList(decreases, true, false);
 			OldSemi();
-		} else SynErr(173);
+		} else SynErr(174);
 	}
 
 	void FrameExpression(out FrameExpression fe, bool allowSemi, bool allowLambda) {
@@ -2067,21 +2130,21 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		string fieldName = null;  IToken feTok = null;
 		fe = null;
 		
-		if (StartOf(8)) {
+		if (StartOf(9)) {
 			Expression(out e, allowSemi, allowLambda);
 			feTok = e.tok; 
-			if (la.kind == 92) {
+			if (la.kind == 94) {
 				Get();
 				Ident(out id);
 				fieldName = id.val;  feTok = id; 
 			}
 			fe = new FrameExpression(feTok, e, fieldName); 
-		} else if (la.kind == 92) {
+		} else if (la.kind == 94) {
 			Get();
 			Ident(out id);
 			fieldName = id.val; 
 			fe = new FrameExpression(id, new ImplicitThisExpr(id), fieldName); 
-		} else SynErr(174);
+		} else SynErr(175);
 	}
 
 	void DecreasesList(List<Expression> decreases, bool allowWildcard, bool allowLambda) {
@@ -2136,7 +2199,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Requires(cce.NonNullElements(reads));
 		Contract.Requires(decreases == null || cce.NonNullElements(decreases));
 		Expression/*!*/ e;  FrameExpression/*!*/ fe; 
-		while (!(StartOf(18))) {SynErr(175); Get();}
+		while (!(StartOf(19))) {SynErr(176); Get();}
 		if (la.kind == 45) {
 			Get();
 			Expression(out e, false, false);
@@ -2152,7 +2215,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				reads.Add(fe); 
 			}
 			OldSemi();
-		} else if (la.kind == 90) {
+		} else if (la.kind == 92) {
 			Get();
 			Expression(out e, false, false);
 			OldSemi();
@@ -2166,7 +2229,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			
 			DecreasesList(decreases, false, false);
 			OldSemi();
-		} else SynErr(176);
+		} else SynErr(177);
 	}
 
 	void FunctionBody(out Expression/*!*/ e, out IToken bodyStart, out IToken bodyEnd) {
@@ -2183,9 +2246,9 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (la.kind == 57) {
 			Get();
 			fe = new FrameExpression(t, new WildcardExpr(t), null); 
-		} else if (StartOf(19)) {
+		} else if (StartOf(20)) {
 			FrameExpression(out fe, allowSemi, false);
-		} else SynErr(177);
+		} else SynErr(178);
 	}
 
 	void PossiblyWildExpression(out Expression e, bool allowLambda) {
@@ -2194,9 +2257,9 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (la.kind == 57) {
 			Get();
 			e = new WildcardExpr(t); 
-		} else if (StartOf(8)) {
+		} else if (StartOf(9)) {
 			Expression(out e, false, allowLambda);
-		} else SynErr(178);
+		} else SynErr(179);
 	}
 
 	void Stmt(List<Statement/*!*/>/*!*/ ss) {
@@ -2213,14 +2276,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken bodyStart, bodyEnd;
 		int breakCount;
 		
-		while (!(StartOf(20))) {SynErr(179); Get();}
+		while (!(StartOf(21))) {SynErr(180); Get();}
 		switch (la.kind) {
 		case 46: {
 			BlockStmt(out bs, out bodyStart, out bodyEnd);
 			s = bs; 
 			break;
 		}
-		case 102: {
+		case 104: {
 			AssertStmt(out s);
 			break;
 		}
@@ -2228,31 +2291,31 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			AssumeStmt(out s);
 			break;
 		}
-		case 103: {
+		case 105: {
 			PrintStmt(out s);
 			break;
 		}
-		case 1: case 2: case 3: case 4: case 8: case 10: case 19: case 20: case 23: case 50: case 132: case 133: case 134: case 135: case 136: case 137: {
+		case 1: case 2: case 3: case 4: case 8: case 10: case 19: case 20: case 23: case 50: case 133: case 134: case 135: case 136: case 137: case 138: {
 			UpdateStmt(out s);
 			break;
 		}
-		case 62: case 79: {
+		case 62: case 81: {
 			VarDeclStatement(out s);
 			break;
 		}
-		case 99: {
+		case 101: {
 			IfStmt(out s);
 			break;
 		}
-		case 100: {
+		case 102: {
 			WhileStmt(out s);
 			break;
 		}
-		case 101: {
+		case 103: {
 			MatchStmt(out s);
 			break;
 		}
-		case 104: case 105: {
+		case 106: case 107: {
 			ForallStmt(out s);
 			break;
 		}
@@ -2260,11 +2323,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			CalcStmt(out s);
 			break;
 		}
-		case 106: {
+		case 108: {
 			ModifyStmt(out s);
 			break;
 		}
-		case 93: {
+		case 95: {
 			Get();
 			x = t; 
 			NoUSIdent(out id);
@@ -2273,24 +2336,24 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			s.Labels = new LList<Label>(new Label(x, id.val), s.Labels); 
 			break;
 		}
-		case 94: {
+		case 96: {
 			Get();
 			x = t; breakCount = 1; label = null; 
 			if (la.kind == 1) {
 				NoUSIdent(out id);
 				label = id.val; 
-			} else if (la.kind == 28 || la.kind == 94) {
-				while (la.kind == 94) {
+			} else if (la.kind == 28 || la.kind == 96) {
+				while (la.kind == 96) {
 					Get();
 					breakCount++; 
 				}
-			} else SynErr(180);
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(181); Get();}
+			} else SynErr(181);
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(182); Get();}
 			Expect(28);
 			s = label != null ? new BreakStmt(x, t, label) : new BreakStmt(x, t, breakCount); 
 			break;
 		}
-		case 91: case 97: {
+		case 93: case 99: {
 			ReturnStmt(out s);
 			break;
 		}
@@ -2298,7 +2361,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			SkeletonStmt(out s);
 			break;
 		}
-		default: SynErr(182); break;
+		default: SynErr(183); break;
 		}
 	}
 
@@ -2307,17 +2370,17 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression e = dummyExpr; Attributes attrs = null;
 		IToken dotdotdot = null;
 		
-		Expect(102);
+		Expect(104);
 		x = t; 
 		while (IsAttribute()) {
 			Attribute(ref attrs);
 		}
-		if (StartOf(8)) {
+		if (StartOf(9)) {
 			Expression(out e, false, true);
 		} else if (la.kind == 59) {
 			Get();
 			dotdotdot = t; 
-		} else SynErr(183);
+		} else SynErr(184);
 		Expect(28);
 		if (dotdotdot != null) {
 		 s = new SkeletonStatement(new AssertStmt(x, t, new LiteralExpr(x, true), attrs), dotdotdot, null);
@@ -2337,12 +2400,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		while (IsAttribute()) {
 			Attribute(ref attrs);
 		}
-		if (StartOf(8)) {
+		if (StartOf(9)) {
 			Expression(out e, false, true);
 		} else if (la.kind == 59) {
 			Get();
 			dotdotdot = t; 
-		} else SynErr(184);
+		} else SynErr(185);
 		Expect(28);
 		if (dotdotdot != null) {
 		 s = new SkeletonStatement(new AssumeStmt(x, t, new LiteralExpr(x, true), attrs), dotdotdot, null);
@@ -2357,7 +2420,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken x;  Expression e;
 		var args = new List<Expression>();
 		
-		Expect(103);
+		Expect(105);
 		x = t; 
 		Expression(out e, false, true);
 		args.Add(e); 
@@ -2387,14 +2450,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			Expect(28);
 			endTok = t; rhss.Add(new ExprRhs(e, attrs)); 
-		} else if (la.kind == 22 || la.kind == 25 || la.kind == 96) {
+		} else if (la.kind == 22 || la.kind == 25 || la.kind == 98) {
 			lhss.Add(e); 
 			while (la.kind == 22) {
 				Get();
 				Lhs(out e);
 				lhss.Add(e); 
 			}
-			if (la.kind == 96) {
+			if (la.kind == 98) {
 				Get();
 				x = t; 
 				Rhs(out r);
@@ -2412,13 +2475,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					suchThatAssume = t; 
 				}
 				Expression(out suchThat, false, true);
-			} else SynErr(185);
+			} else SynErr(186);
 			Expect(28);
 			endTok = t; 
 		} else if (la.kind == 21) {
 			Get();
 			SemErr(t, "invalid statement (did you forget the 'label' keyword?)"); 
-		} else SynErr(186);
+		} else SynErr(187);
 		if (suchThat != null) {
 		 s = new AssignSuchThatStmt(x, endTok, lhss, suchThat, suchThatAssume, null);
 		} else {
@@ -2447,7 +2510,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 			isGhost = true;  x = t; 
 		}
-		Expect(79);
+		Expect(81);
 		if (!isGhost) { x = t; } 
 		if (la.kind == 1 || la.kind == 46) {
 			while (la.kind == 46) {
@@ -2463,8 +2526,8 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				LocalIdentTypeOptional(out d, isGhost);
 				lhss.Add(d); d.Attributes = attrs; attrs = null; 
 			}
-			if (la.kind == 25 || la.kind == 46 || la.kind == 96) {
-				if (la.kind == 96) {
+			if (la.kind == 25 || la.kind == 46 || la.kind == 98) {
+				if (la.kind == 98) {
 					Get();
 					assignTok = t; 
 					Rhs(out r);
@@ -2487,7 +2550,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					Expression(out suchThat, false, true);
 				}
 			}
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(187); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(188); Get();}
 			Expect(28);
 			endTok = t; 
 			ConcreteUpdateStatement update;
@@ -2533,7 +2596,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			if (isGhost) { pat.Vars.Iter(bv => bv.IsGhost = true); }
 			letLHSs.Add(pat);
 			
-			if (la.kind == 96) {
+			if (la.kind == 98) {
 				Get();
 			} else if (la.kind == 25 || la.kind == 46) {
 				while (la.kind == 46) {
@@ -2541,12 +2604,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				}
 				Expect(25);
 				SemErr(pat.tok, "LHS of assign-such-that expression must be variables, not general patterns"); 
-			} else SynErr(188);
+			} else SynErr(189);
 			Expression(out e, false, true);
 			letRHSs.Add(e); 
 			Expect(28);
 			s = new LetStmt(e.tok, e.tok, letLHSs, letRHSs); 
-		} else SynErr(189);
+		} else SynErr(190);
 	}
 
 	void IfStmt(out Statement/*!*/ ifStmt) {
@@ -2560,16 +2623,16 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<GuardedAlternative> alternatives;
 		ifStmt = dummyStmt;  // to please the compiler
 		
-		Expect(99);
+		Expect(101);
 		x = t; 
 		if (IsAlternative()) {
 			AlternativeBlock(true, out alternatives, out endTok);
 			ifStmt = new AlternativeStmt(x, endTok, alternatives); 
-		} else if (StartOf(21)) {
+		} else if (StartOf(22)) {
 			if (IsExistentialGuard()) {
 				ExistentialGuard(out guard, true);
 				isExistentialGuard = true; 
-			} else if (StartOf(22)) {
+			} else if (StartOf(23)) {
 				Guard(out guard);
 			} else {
 				Get();
@@ -2579,13 +2642,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			endTok = thn.EndTok; 
 			if (la.kind == 35) {
 				Get();
-				if (la.kind == 99) {
+				if (la.kind == 101) {
 					IfStmt(out s);
 					els = s; endTok = s.EndTok; 
 				} else if (la.kind == 46) {
 					BlockStmt(out bs, out bodyStart, out bodyEnd);
 					els = bs; endTok = bs.EndTok; 
-				} else SynErr(190);
+				} else SynErr(191);
 			}
 			if (guardEllipsis != null) {
 			 ifStmt = new SkeletonStatement(new IfStmt(x, endTok, isExistentialGuard, guard, thn, els), guardEllipsis, null);
@@ -2593,7 +2656,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 ifStmt = new IfStmt(x, endTok, isExistentialGuard, guard, thn, els);
 			}
 			
-		} else SynErr(191);
+		} else SynErr(192);
 	}
 
 	void WhileStmt(out Statement stmt) {
@@ -2612,23 +2675,23 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		stmt = dummyStmt;  // to please the compiler
 		bool isDirtyLoop = true;
 		
-		Expect(100);
+		Expect(102);
 		x = t; 
 		if (IsLoopSpec() || IsAlternative()) {
-			while (StartOf(23)) {
+			while (StartOf(24)) {
 				LoopSpec(invariants, decreases, ref mod, ref decAttrs, ref modAttrs);
 			}
 			AlternativeBlock(false, out alternatives, out endTok);
 			stmt = new AlternativeLoopStmt(x, endTok, invariants, new Specification<Expression>(decreases, decAttrs), new Specification<FrameExpression>(mod, modAttrs), alternatives); 
-		} else if (StartOf(21)) {
-			if (StartOf(22)) {
+		} else if (StartOf(22)) {
+			if (StartOf(23)) {
 				Guard(out guard);
 				Contract.Assume(guard == null || cce.Owner.None(guard)); 
 			} else {
 				Get();
 				guardEllipsis = t; 
 			}
-			while (StartOf(23)) {
+			while (StartOf(24)) {
 				LoopSpec(invariants, decreases, ref mod, ref decAttrs, ref modAttrs);
 			}
 			if (la.kind == _lbrace) {
@@ -2637,8 +2700,8 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			} else if (la.kind == _ellipsis) {
 				Expect(59);
 				bodyEllipsis = t; endTok = t; isDirtyLoop = false; 
-			} else if (StartOf(24)) {
-			} else SynErr(192);
+			} else if (StartOf(25)) {
+			} else SynErr(193);
 			if (guardEllipsis != null || bodyEllipsis != null) {
 			 if (mod != null) {
 			   SemErr(mod[0].E.tok, "'modifies' clauses are not allowed on refining loops");
@@ -2656,7 +2719,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 stmt = new WhileStmt(x, endTok, guard, invariants, new Specification<Expression>(decreases, decAttrs), new Specification<FrameExpression>(mod, modAttrs), body);
 			}
 			
-		} else SynErr(193);
+		} else SynErr(194);
 	}
 
 	void MatchStmt(out Statement/*!*/ s) {
@@ -2665,7 +2728,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<MatchCaseStmt/*!*/> cases = new List<MatchCaseStmt/*!*/>();
 		bool usesOptionalBrace = false;
 		
-		Expect(101);
+		Expect(103);
 		x = t; 
 		Expression(out e, true, true);
 		if (la.kind == _lbrace) {
@@ -2676,12 +2739,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				cases.Add(c); 
 			}
 			Expect(47);
-		} else if (StartOf(24)) {
+		} else if (StartOf(25)) {
 			while (la.kind == _case) {
 				CaseStatement(out c);
 				cases.Add(c); 
 			}
-		} else SynErr(194);
+		} else SynErr(195);
 		s = new MatchStmt(x, t, e, cases, usesOptionalBrace); 
 	}
 
@@ -2698,38 +2761,38 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		IToken bodyStart, bodyEnd;
 		IToken tok = Token.NoToken;
 		
-		if (la.kind == 104) {
+		if (la.kind == 106) {
 			Get();
 			x = t; tok = x; 
-		} else if (la.kind == 105) {
+		} else if (la.kind == 107) {
 			Get();
 			x = t;
 			errors.Warning(t, "the 'parallel' keyword has been deprecated; the comprehension statement now uses the keyword 'forall' (and the parentheses around the bound variables are now optional)");
 			
-		} else SynErr(195);
+		} else SynErr(196);
 		if (la.kind == _openparen) {
 			Expect(50);
 			if (la.kind == 1) {
 				QuantifierDomain(out bvars, out attrs, out range);
 			}
 			Expect(51);
-		} else if (StartOf(25)) {
+		} else if (StartOf(26)) {
 			if (la.kind == _ident) {
 				QuantifierDomain(out bvars, out attrs, out range);
 			}
-		} else SynErr(196);
+		} else SynErr(197);
 		if (bvars == null) { bvars = new List<BoundVar>(); }
 		if (range == null) { range = new LiteralExpr(x, true); }
 		
-		while (la.kind == 89 || la.kind == 90) {
+		while (la.kind == 91 || la.kind == 92) {
 			isFree = false; 
-			if (la.kind == 89) {
+			if (la.kind == 91) {
 				Get();
 				isFree = true;
 				errors.Warning(t, "the 'free' keyword is soon to be deprecated");
 				
 			}
-			Expect(90);
+			Expect(92);
 			Expression(out e, false, true);
 			ens.Add(new MaybeFreeExpression(e, isFree)); 
 			OldSemi();
@@ -2768,7 +2831,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		while (IsAttribute()) {
 			Attribute(ref attrs);
 		}
-		if (StartOf(26)) {
+		if (StartOf(27)) {
 			CalcOp(out opTok, out calcOp);
 			maybeOp = calcOp.ResultOp(calcOp); // guard against non-transitive calcOp (like !=)
 			if (maybeOp == null) {
@@ -2778,11 +2841,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			
 		}
 		Expect(46);
-		while (StartOf(8)) {
+		while (StartOf(9)) {
 			Expression(out e, false, true);
 			lines.Add(e); stepOp = calcOp; danglingOperator = null; 
 			Expect(28);
-			if (StartOf(26)) {
+			if (StartOf(27)) {
 				CalcOp(out opTok, out op);
 				maybeOp = resOp.ResultOp(op);
 				if (maybeOp == null) {
@@ -2807,7 +2870,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				} else if (la.kind == 32) {
 					CalcStmt(out subCalc);
 					hintEnd = subCalc.EndTok; subhints.Add(subCalc); 
-				} else SynErr(197);
+				} else SynErr(198);
 			}
 			var h = new BlockStmt(hintStart, hintEnd, subhints); // if the hint is empty, hintStart is the first token of the next line, but it doesn't matter because the block statement is just used as a container
 			hints.Add(h);
@@ -2833,12 +2896,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		BlockStmt body = null;  IToken bodyStart;
 		IToken ellipsisToken = null;
 		
-		Expect(106);
+		Expect(108);
 		tok = t; 
 		while (IsAttribute()) {
 			Attribute(ref attrs);
 		}
-		if (StartOf(19)) {
+		if (StartOf(20)) {
 			FrameExpression(out fe, false, true);
 			mod.Add(fe); 
 			while (la.kind == 22) {
@@ -2849,14 +2912,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 59) {
 			Get();
 			ellipsisToken = t; 
-		} else SynErr(198);
+		} else SynErr(199);
 		if (la.kind == 46) {
 			BlockStmt(out body, out bodyStart, out endTok);
 		} else if (la.kind == 28) {
-			while (!(la.kind == 0 || la.kind == 28)) {SynErr(199); Get();}
+			while (!(la.kind == 0 || la.kind == 28)) {SynErr(200); Get();}
 			Get();
 			endTok = t; 
-		} else SynErr(200);
+		} else SynErr(201);
 		s = new ModifyStmt(tok, endTok, mod, attrs, body);
 		if (ellipsisToken != null) {
 		 s = new SkeletonStatement(s, ellipsisToken, null);
@@ -2870,14 +2933,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		AssignmentRhs r;
 		bool isYield = false;
 		
-		if (la.kind == 97) {
+		if (la.kind == 99) {
 			Get();
 			returnTok = t; 
-		} else if (la.kind == 91) {
+		} else if (la.kind == 93) {
 			Get();
 			returnTok = t; isYield = true; 
-		} else SynErr(201);
-		if (StartOf(27)) {
+		} else SynErr(202);
+		if (StartOf(28)) {
 			Rhs(out r);
 			rhss = new List<AssignmentRhs>(); rhss.Add(r); 
 			while (la.kind == 22) {
@@ -2902,7 +2965,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression e; 
 		Expect(59);
 		dotdotdot = t; 
-		if (la.kind == 95) {
+		if (la.kind == 97) {
 			Get();
 			names = new List<IToken>(); exprs = new List<Expression>(); whereTok = t;
 			Ident(out tok);
@@ -2912,7 +2975,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				Ident(out tok);
 				names.Add(tok); 
 			}
-			Expect(96);
+			Expect(98);
 			Expression(out e, false, true);
 			exprs.Add(e); 
 			while (la.kind == 22) {
@@ -2939,7 +3002,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		r = dummyRhs;  // to please compiler
 		Attributes attrs = null;
 		
-		if (la.kind == 98) {
+		if (la.kind == 100) {
 			Get();
 			newToken = t; 
 			TypeAndToken(out x, out ty);
@@ -2954,7 +3017,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				} else {
 					x = null; args = new List<Expression/*!*/>(); 
 					Get();
-					if (StartOf(8)) {
+					if (StartOf(9)) {
 						Expressions(args);
 					}
 					Expect(51);
@@ -2971,10 +3034,10 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 57) {
 			Get();
 			r = new HavocRhs(t); 
-		} else if (StartOf(8)) {
+		} else if (StartOf(9)) {
 			Expression(out e, false, true);
 			r = new ExprRhs(e); 
-		} else SynErr(202);
+		} else SynErr(203);
 		while (la.kind == 46) {
 			Attribute(ref attrs);
 		}
@@ -2989,13 +3052,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (la.kind == 27 || la.kind == 48 || la.kind == 50) {
 				Suffix(ref e);
 			}
-		} else if (StartOf(28)) {
+		} else if (StartOf(29)) {
 			ConstAtomExpression(out e, false, false);
 			Suffix(ref e);
 			while (la.kind == 27 || la.kind == 48 || la.kind == 50) {
 				Suffix(ref e);
 			}
-		} else SynErr(203);
+		} else SynErr(204);
 	}
 
 	void Expressions(List<Expression> args) {
@@ -3052,7 +3115,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			IdentTypeOptional(out bv);
 			pat = new CasePattern(bv.tok, bv);
 			
-		} else SynErr(204);
+		} else SynErr(205);
 		if (pat == null) {
 		 pat = new CasePattern(t, "_ParseError", new List<CasePattern>());
 		}
@@ -3072,12 +3135,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			if (allowExistentialGuards && IsExistentialGuard()) {
 				ExistentialGuard(out e, false );
 				isExistentialGuard = true; 
-			} else if (StartOf(8)) {
+			} else if (StartOf(9)) {
 				Expression(out e, true, false);
-			} else SynErr(205);
+			} else SynErr(206);
 			Expect(29);
 			body = new List<Statement>(); 
-			while (StartOf(16)) {
+			while (StartOf(17)) {
 				Stmt(body);
 			}
 			alternatives.Add(new GuardedAlternative(x, isExistentialGuard, e, body)); 
@@ -3117,19 +3180,19 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Expect(57);
 			Expect(51);
 			e = null; 
-		} else if (StartOf(8)) {
+		} else if (StartOf(9)) {
 			Expression(out ee, true, true);
 			e = ee; 
-		} else SynErr(206);
+		} else SynErr(207);
 	}
 
 	void LoopSpec(List<MaybeFreeExpression> invariants, List<Expression> decreases, ref List<FrameExpression> mod, ref Attributes decAttrs, ref Attributes modAttrs) {
 		Expression e; FrameExpression fe;
 		bool isFree = false; Attributes attrs = null;
 		
-		if (la.kind == 37 || la.kind == 89) {
-			while (!(la.kind == 0 || la.kind == 37 || la.kind == 89)) {SynErr(207); Get();}
-			if (la.kind == 89) {
+		if (la.kind == 37 || la.kind == 91) {
+			while (!(la.kind == 0 || la.kind == 37 || la.kind == 91)) {SynErr(208); Get();}
+			if (la.kind == 91) {
 				Get();
 				isFree = true; errors.Warning(t, "the 'free' keyword is soon to be deprecated"); 
 			}
@@ -3141,7 +3204,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			invariants.Add(new MaybeFreeExpression(e, isFree, attrs)); 
 			OldSemi();
 		} else if (la.kind == 36) {
-			while (!(la.kind == 0 || la.kind == 36)) {SynErr(208); Get();}
+			while (!(la.kind == 0 || la.kind == 36)) {SynErr(209); Get();}
 			Get();
 			while (IsAttribute()) {
 				Attribute(ref decAttrs);
@@ -3149,7 +3212,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			DecreasesList(decreases, true, true);
 			OldSemi();
 		} else if (la.kind == 43) {
-			while (!(la.kind == 0 || la.kind == 43)) {SynErr(209); Get();}
+			while (!(la.kind == 0 || la.kind == 43)) {SynErr(210); Get();}
 			Get();
 			mod = mod ?? new List<FrameExpression>(); 
 			while (IsAttribute()) {
@@ -3163,7 +3226,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				mod.Add(fe); 
 			}
 			OldSemi();
-		} else SynErr(210);
+		} else SynErr(211);
 	}
 
 	void CaseStatement(out MatchCaseStmt/*!*/ c) {
@@ -3200,12 +3263,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				arguments.Add(pat); 
 			}
 			Expect(51);
-		} else SynErr(211);
+		} else SynErr(212);
 		Expect(29);
-		while (!(StartOf(29))) {SynErr(212); Get();}
+		while (!(StartOf(30))) {SynErr(213); Get();}
 		while (IsNotEndOfCase()) {
 			Stmt(body);
-			while (!(StartOf(29))) {SynErr(213); Get();}
+			while (!(StartOf(30))) {SynErr(214); Get();}
 		}
 		c = new MatchCaseStmt(x, name, arguments, body); 
 	}
@@ -3241,7 +3304,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		case 54: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Eq; 
-			if (la.kind == 107) {
+			if (la.kind == 109) {
 				Get();
 				Expect(48);
 				Expression(out k, true, true);
@@ -3259,12 +3322,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  binOp = BinaryExpr.Opcode.Gt; 
 			break;
 		}
-		case 108: {
+		case 110: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 109: {
+		case 111: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Ge; 
 			break;
@@ -3279,32 +3342,32 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  binOp = BinaryExpr.Opcode.Neq; 
 			break;
 		}
-		case 110: {
+		case 112: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 111: {
+		case 113: {
 			Get();
 			x = t;  binOp = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		case 112: case 113: {
+		case 114: case 115: {
 			EquivOp();
 			x = t;  binOp = BinaryExpr.Opcode.Iff; 
 			break;
 		}
-		case 114: case 115: {
+		case 116: case 117: {
 			ImpliesOp();
 			x = t;  binOp = BinaryExpr.Opcode.Imp; 
 			break;
 		}
-		case 116: case 117: {
+		case 118: case 119: {
 			ExpliesOp();
 			x = t;  binOp = BinaryExpr.Opcode.Exp; 
 			break;
 		}
-		default: SynErr(214); break;
+		default: SynErr(215); break;
 		}
 		if (k == null) {
 		 op = new Microsoft.Dafny.CalcStmt.BinaryCalcOp(binOp);
@@ -3315,14 +3378,6 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 	}
 
 	void EquivOp() {
-		if (la.kind == 112) {
-			Get();
-		} else if (la.kind == 113) {
-			Get();
-		} else SynErr(215);
-	}
-
-	void ImpliesOp() {
 		if (la.kind == 114) {
 			Get();
 		} else if (la.kind == 115) {
@@ -3330,7 +3385,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else SynErr(216);
 	}
 
-	void ExpliesOp() {
+	void ImpliesOp() {
 		if (la.kind == 116) {
 			Get();
 		} else if (la.kind == 117) {
@@ -3338,7 +3393,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else SynErr(217);
 	}
 
-	void AndOp() {
+	void ExpliesOp() {
 		if (la.kind == 118) {
 			Get();
 		} else if (la.kind == 119) {
@@ -3346,7 +3401,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else SynErr(218);
 	}
 
-	void OrOp() {
+	void AndOp() {
 		if (la.kind == 120) {
 			Get();
 		} else if (la.kind == 121) {
@@ -3354,7 +3409,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else SynErr(219);
 	}
 
-	void NegOp() {
+	void OrOp() {
 		if (la.kind == 122) {
 			Get();
 		} else if (la.kind == 123) {
@@ -3362,28 +3417,36 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else SynErr(220);
 	}
 
-	void Forall() {
-		if (la.kind == 104) {
+	void NegOp() {
+		if (la.kind == 124) {
 			Get();
-		} else if (la.kind == 124) {
+		} else if (la.kind == 125) {
 			Get();
 		} else SynErr(221);
 	}
 
-	void Exists() {
-		if (la.kind == 125) {
+	void Forall() {
+		if (la.kind == 106) {
 			Get();
 		} else if (la.kind == 126) {
 			Get();
 		} else SynErr(222);
 	}
 
+	void Exists() {
+		if (la.kind == 127) {
+			Get();
+		} else if (la.kind == 128) {
+			Get();
+		} else SynErr(223);
+	}
+
 	void QSep() {
 		if (la.kind == 24) {
 			Get();
 		} else if (la.kind == 26) {
 			Get();
-		} else SynErr(223);
+		} else SynErr(224);
 	}
 
 	void EquivExpression(out Expression e0, bool allowSemi, bool allowLambda) {
@@ -3401,12 +3464,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Ensures(Contract.ValueAtReturn(out e0) != null); IToken/*!*/ x;  Expression/*!*/ e1; 
 		LogicalExpression(out e0, allowSemi, allowLambda);
 		if (IsImpliesOp() || IsExpliesOp()) {
-			if (la.kind == 114 || la.kind == 115) {
+			if (la.kind == 116 || la.kind == 117) {
 				ImpliesOp();
 				x = t; 
 				ImpliesExpression(out e1, allowSemi, allowLambda);
 				e0 = new BinaryExpr(x, BinaryExpr.Opcode.Imp, e0, e1); 
-			} else if (la.kind == 116 || la.kind == 117) {
+			} else if (la.kind == 118 || la.kind == 119) {
 				ExpliesOp();
 				x = t; 
 				LogicalExpression(out e1, allowSemi, allowLambda);
@@ -3418,7 +3481,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Exp, e1, e0); 
 					
 				}
-			} else SynErr(224);
+			} else SynErr(225);
 		}
 	}
 
@@ -3426,7 +3489,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Contract.Ensures(Contract.ValueAtReturn(out e0) != null); IToken/*!*/ x;  Expression/*!*/ e1; 
 		RelationalExpression(out e0, allowSemi, allowLambda);
 		if (IsAndOp() || IsOrOp()) {
-			if (la.kind == 118 || la.kind == 119) {
+			if (la.kind == 120 || la.kind == 121) {
 				AndOp();
 				x = t; 
 				RelationalExpression(out e1, allowSemi, allowLambda);
@@ -3437,7 +3500,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					RelationalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.And, e0, e1); 
 				}
-			} else if (la.kind == 120 || la.kind == 121) {
+			} else if (la.kind == 122 || la.kind == 123) {
 				OrOp();
 				x = t; 
 				RelationalExpression(out e1, allowSemi, allowLambda);
@@ -3448,7 +3511,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					RelationalExpression(out e1, allowSemi, allowLambda);
 					e0 = new BinaryExpr(x, BinaryExpr.Opcode.Or, e0, e1); 
 				}
-			} else SynErr(225);
+			} else SynErr(226);
 		}
 	}
 
@@ -3584,7 +3647,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		case 54: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Eq; 
-			if (la.kind == 107) {
+			if (la.kind == 109) {
 				Get();
 				Expect(48);
 				Expression(out k, true, true);
@@ -3602,12 +3665,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  op = BinaryExpr.Opcode.Gt; 
 			break;
 		}
-		case 108: {
+		case 110: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 109: {
+		case 111: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Ge; 
 			break;
@@ -3615,7 +3678,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		case 55: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Neq; 
-			if (la.kind == 107) {
+			if (la.kind == 109) {
 				Get();
 				Expect(48);
 				Expression(out k, true, true);
@@ -3623,7 +3686,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 			break;
 		}
-		case 127: {
+		case 129: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.In; 
 			break;
@@ -3633,11 +3696,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  op = BinaryExpr.Opcode.NotIn; 
 			break;
 		}
-		case 122: {
+		case 124: {
 			Get();
 			x = t;  y = Token.NoToken; 
 			if (la.val == "!") {
-				Expect(122);
+				Expect(124);
 				y = t; 
 			}
 			if (y == Token.NoToken) {
@@ -3656,17 +3719,17 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			x = t;  op = BinaryExpr.Opcode.Neq; 
 			break;
 		}
-		case 110: {
+		case 112: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Le; 
 			break;
 		}
-		case 111: {
+		case 113: {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Ge; 
 			break;
 		}
-		default: SynErr(226); break;
+		default: SynErr(227); break;
 		}
 	}
 
@@ -3682,23 +3745,23 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void AddOp(out IToken x, out BinaryExpr.Opcode op) {
 		Contract.Ensures(Contract.ValueAtReturn(out x) != null); x = Token.NoToken;  op=BinaryExpr.Opcode.Add/*(dummy)*/; 
-		if (la.kind == 128) {
+		if (la.kind == 76) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Add; 
-		} else if (la.kind == 129) {
+		} else if (la.kind == 130) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Sub; 
-		} else SynErr(227);
+		} else SynErr(228);
 	}
 
 	void UnaryExpression(out Expression e, bool allowSemi, bool allowLambda) {
 		Contract.Ensures(Contract.ValueAtReturn(out e) != null); IToken/*!*/ x;  e = dummyExpr; 
-		if (la.kind == 129) {
+		if (la.kind == 130) {
 			Get();
 			x = t; 
 			UnaryExpression(out e, allowSemi, allowLambda);
 			e = new NegationExpression(x, e); 
-		} else if (la.kind == 122 || la.kind == 123) {
+		} else if (la.kind == 124 || la.kind == 125) {
 			NegOp();
 			x = t; 
 			UnaryExpression(out e, allowSemi, allowLambda);
@@ -3726,7 +3789,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			}
 		} else if (IsLambda(allowLambda)) {
 			LambdaExpression(out e, allowSemi);
-		} else if (StartOf(30)) {
+		} else if (StartOf(31)) {
 			EndlessExpression(out e, allowSemi, allowLambda);
 		} else if (la.kind == 1) {
 			NameSegment(out e);
@@ -3743,12 +3806,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			while (IsSuffix()) {
 				Suffix(ref e);
 			}
-		} else if (StartOf(28)) {
+		} else if (StartOf(29)) {
 			ConstAtomExpression(out e, allowSemi, allowLambda);
 			while (IsSuffix()) {
 				Suffix(ref e);
 			}
-		} else SynErr(228);
+		} else SynErr(229);
 	}
 
 	void MulOp(out IToken x, out BinaryExpr.Opcode op) {
@@ -3756,13 +3819,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (la.kind == 57) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Mul; 
-		} else if (la.kind == 130) {
+		} else if (la.kind == 131) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Div; 
-		} else if (la.kind == 131) {
+		} else if (la.kind == 132) {
 			Get();
 			x = t;  op = BinaryExpr.Opcode.Mod; 
-		} else SynErr(229);
+		} else SynErr(230);
 	}
 
 	void MapDisplayExpr(IToken/*!*/ mapToken, bool finite, out Expression e) {
@@ -3771,7 +3834,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;
 		
 		Expect(48);
-		if (StartOf(8)) {
+		if (StartOf(9)) {
 			MapLiteralExpressions(out elements);
 		}
 		e = new MapDisplayExpr(mapToken, finite, elements);
@@ -3801,7 +3864,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				}
 				Expect(51);
 				e = new DatatypeUpdateExpr(x, e, updates); 
-			} else if (StartOf(31)) {
+			} else if (StartOf(32)) {
 				DotSuffix(out id, out x);
 				if (x != null) {
 				 // process id as a Suffix in its own right
@@ -3813,30 +3876,30 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				if (IsGenericInstantiation()) {
 					typeArgs = new List<Type>(); 
 					GenericInstantiation(typeArgs);
-				} else if (la.kind == 107) {
+				} else if (la.kind == 109) {
 					HashCall(id, out openParen, out typeArgs, out args);
-				} else if (StartOf(32)) {
-				} else SynErr(230);
+				} else if (StartOf(33)) {
+				} else SynErr(231);
 				e = new ExprDotName(id, e, id.val, typeArgs);
 				if (openParen != null) {
 				 e = new ApplySuffix(openParen, e, args);
 				}
 				
-			} else SynErr(231);
+			} else SynErr(232);
 		} else if (la.kind == 48) {
 			Get();
 			x = t; 
-			if (StartOf(8)) {
+			if (StartOf(9)) {
 				Expression(out ee, true, true);
 				e0 = ee; 
-				if (la.kind == 138) {
+				if (la.kind == 139) {
 					Get();
 					anyDots = true; 
-					if (StartOf(8)) {
+					if (StartOf(9)) {
 						Expression(out ee, true, true);
 						e1 = ee; 
 					}
-				} else if (la.kind == 96) {
+				} else if (la.kind == 98) {
 					Get();
 					Expression(out ee, true, true);
 					e1 = ee; 
@@ -3846,7 +3909,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 					multipleLengths.Add(e0);  // account for the Expression read before the colon
 					takeRest = true;
 					
-					if (StartOf(8)) {
+					if (StartOf(9)) {
 						Expression(out ee, true, true);
 						multipleLengths.Add(ee); takeRest = false; 
 						while (IsNonFinalColon()) {
@@ -3870,15 +3933,15 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 						multipleIndices.Add(ee);
 						
 					}
-				} else SynErr(232);
-			} else if (la.kind == 138) {
+				} else SynErr(233);
+			} else if (la.kind == 139) {
 				Get();
 				anyDots = true; 
-				if (StartOf(8)) {
+				if (StartOf(9)) {
 					Expression(out ee, true, true);
 					e1 = ee; 
 				}
-			} else SynErr(233);
+			} else SynErr(234);
 			if (multipleIndices != null) {
 			 e = new MultiSelectExpr(x, e, multipleIndices);
 			 // make sure an array class with this dimensionality exists
@@ -3917,12 +3980,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 50) {
 			Get();
 			IToken openParen = t; var args = new List<Expression>(); 
-			if (StartOf(8)) {
+			if (StartOf(9)) {
 				Expressions(args);
 			}
 			Expect(51);
 			e = new ApplySuffix(openParen, e, args); 
-		} else SynErr(234);
+		} else SynErr(235);
 	}
 
 	void ISetDisplayExpr(IToken/*!*/ setToken, bool finite, out Expression e) {
@@ -3931,7 +3994,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;
 		
 		Expect(46);
-		if (StartOf(8)) {
+		if (StartOf(9)) {
 			Expressions(elements);
 		}
 		e = new SetDisplayExpr(setToken, finite, elements);
@@ -3964,7 +4027,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				}
 			}
 			Expect(51);
-		} else SynErr(235);
+		} else SynErr(236);
 		while (la.kind == 44 || la.kind == 45) {
 			if (la.kind == 44) {
 				Get();
@@ -3990,7 +4053,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;
 		
 		switch (la.kind) {
-		case 99: {
+		case 101: {
 			Get();
 			x = t; 
 			Expression(out e, true, true);
@@ -4001,11 +4064,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			e = new ITEExpr(x, e, e0, e1); 
 			break;
 		}
-		case 101: {
+		case 103: {
 			MatchExpression(out e, allowSemi, allowLambda);
 			break;
 		}
-		case 104: case 124: case 125: case 126: {
+		case 106: case 126: case 127: case 128: {
 			QuantifierGuts(out e, allowSemi, allowLambda);
 			break;
 		}
@@ -4021,13 +4084,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			SetComprehensionExpr(x, false, out e, allowSemi, allowLambda);
 			break;
 		}
-		case 31: case 32: case 102: {
+		case 31: case 32: case 104: {
 			StmtInExpr(out s);
 			Expression(out e, allowSemi, allowLambda);
 			e = new StmtExpr(s.Tok, s, e); 
 			break;
 		}
-		case 62: case 79: {
+		case 62: case 81: {
 			LetExpr(out e, allowSemi, allowLambda);
 			break;
 		}
@@ -4043,11 +4106,11 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			MapComprehensionExpr(x, false, out e, allowSemi, allowLambda);
 			break;
 		}
-		case 93: {
+		case 95: {
 			NamedExpr(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(236); break;
+		default: SynErr(237); break;
 		}
 	}
 
@@ -4059,10 +4122,10 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (IsGenericInstantiation()) {
 			typeArgs = new List<Type>(); 
 			GenericInstantiation(typeArgs);
-		} else if (la.kind == 107) {
+		} else if (la.kind == 109) {
 			HashCall(id, out openParen, out typeArgs, out args);
-		} else if (StartOf(32)) {
-		} else SynErr(237);
+		} else if (StartOf(33)) {
+		} else SynErr(238);
 		e = new NameSegment(id, id.val, typeArgs);
 		if (openParen != null) {
 		 e = new ApplySuffix(openParen, e, args);
@@ -4078,7 +4141,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (la.kind == 46) {
 			Get();
 			x = t;  elements = new List<Expression/*!*/>(); 
-			if (StartOf(8)) {
+			if (StartOf(9)) {
 				Expressions(elements);
 			}
 			e = new SetDisplayExpr(x, true, elements);
@@ -4086,12 +4149,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 48) {
 			Get();
 			x = t;  elements = new List<Expression/*!*/>(); 
-			if (StartOf(8)) {
+			if (StartOf(9)) {
 				Expressions(elements);
 			}
 			e = new SeqDisplayExpr(x, elements); 
 			Expect(49);
-		} else SynErr(238);
+		} else SynErr(239);
 	}
 
 	void MultiSetExpr(out Expression e) {
@@ -4104,7 +4167,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		if (la.kind == 46) {
 			Get();
 			elements = new List<Expression/*!*/>(); 
-			if (StartOf(8)) {
+			if (StartOf(9)) {
 				Expressions(elements);
 			}
 			e = new MultiSetDisplayExpr(x, elements);
@@ -4115,7 +4178,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Expression(out e, true, true);
 			e = new MultiSetFormingExpr(x, e); 
 			Expect(51);
-		} else SynErr(239);
+		} else SynErr(240);
 	}
 
 	void ConstAtomExpression(out Expression e, bool allowSemi, bool allowLambda) {
@@ -4124,17 +4187,17 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;  Type toType = null;
 		
 		switch (la.kind) {
-		case 132: {
+		case 133: {
 			Get();
 			e = new LiteralExpr(t, false); 
 			break;
 		}
-		case 133: {
+		case 134: {
 			Get();
 			e = new LiteralExpr(t, true); 
 			break;
 		}
-		case 134: {
+		case 135: {
 			Get();
 			e = new LiteralExpr(t); 
 			break;
@@ -4162,12 +4225,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			
 			break;
 		}
-		case 135: {
+		case 136: {
 			Get();
 			e = new ThisExpr(t); 
 			break;
 		}
-		case 136: {
+		case 137: {
 			Get();
 			x = t; 
 			Expect(50);
@@ -4176,7 +4239,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			e = new UnaryOpExpr(x, UnaryOpExpr.Opcode.Fresh, e); 
 			break;
 		}
-		case 137: {
+		case 138: {
 			Get();
 			x = t; 
 			Expect(50);
@@ -4211,7 +4274,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			ParensExpression(out e, allowSemi, allowLambda);
 			break;
 		}
-		default: SynErr(240); break;
+		default: SynErr(241); break;
 		}
 	}
 
@@ -4240,7 +4303,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 n = BigInteger.Zero;
 			}
 			
-		} else SynErr(241);
+		} else SynErr(242);
 	}
 
 	void Dec(out Basetypes.BigDec d) {
@@ -4262,7 +4325,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		
 		Expect(50);
 		x = t; 
-		if (StartOf(8)) {
+		if (StartOf(9)) {
 			Expressions(args);
 		}
 		Expect(51);
@@ -4284,20 +4347,20 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 30) {
 			Get();
 			oneShot = true; 
-		} else SynErr(242);
+		} else SynErr(243);
 	}
 
 	void MapLiteralExpressions(out List<ExpressionPair> elements) {
 		Expression/*!*/ d, r;
 		elements = new List<ExpressionPair/*!*/>(); 
 		Expression(out d, true, true);
-		Expect(96);
+		Expect(98);
 		Expression(out r, true, true);
 		elements.Add(new ExpressionPair(d,r)); 
 		while (la.kind == 22) {
 			Get();
 			Expression(out d, true, true);
-			Expect(96);
+			Expect(98);
 			Expression(out r, true, true);
 			elements.Add(new ExpressionPair(d,r)); 
 		}
@@ -4331,7 +4394,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		List<MatchCaseExpr/*!*/> cases = new List<MatchCaseExpr/*!*/>();
 		bool usesOptionalBrace = false;
 		
-		Expect(101);
+		Expect(103);
 		x = t; 
 		Expression(out e, allowSemi, allowLambda);
 		if (la.kind == _lbrace) {
@@ -4342,12 +4405,12 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				cases.Add(c); 
 			}
 			Expect(47);
-		} else if (StartOf(33)) {
+		} else if (StartOf(34)) {
 			while (la.kind == _case) {
 				CaseExpression(out c, allowSemi, allowLambda);
 				cases.Add(c); 
 			}
-		} else SynErr(243);
+		} else SynErr(244);
 		e = new MatchExpr(x, e, cases, usesOptionalBrace); 
 	}
 
@@ -4359,13 +4422,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		Expression range;
 		Expression/*!*/ body;
 		
-		if (la.kind == 104 || la.kind == 124) {
+		if (la.kind == 106 || la.kind == 126) {
 			Forall();
 			x = t;  univ = true; 
-		} else if (la.kind == 125 || la.kind == 126) {
+		} else if (la.kind == 127 || la.kind == 128) {
 			Exists();
 			x = t; 
-		} else SynErr(244);
+		} else SynErr(245);
 		QuantifierDomain(out bvars, out attrs, out range);
 		QSep();
 		Expression(out body, allowSemi, allowLambda);
@@ -4408,13 +4471,13 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void StmtInExpr(out Statement s) {
 		s = dummyStmt; 
-		if (la.kind == 102) {
+		if (la.kind == 104) {
 			AssertStmt(out s);
 		} else if (la.kind == 31) {
 			AssumeStmt(out s);
 		} else if (la.kind == 32) {
 			CalcStmt(out s);
-		} else SynErr(245);
+		} else SynErr(246);
 	}
 
 	void LetExpr(out Expression e, bool allowSemi, bool allowLambda) {
@@ -4431,7 +4494,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			Get();
 			isGhost = true;  x = t; 
 		}
-		Expect(79);
+		Expect(81);
 		if (!isGhost) { x = t; } 
 		CasePattern(out pat);
 		if (isGhost) { pat.Vars.Iter(bv => bv.IsGhost = true); }
@@ -4444,7 +4507,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			letLHSs.Add(pat);
 			
 		}
-		if (la.kind == 96) {
+		if (la.kind == 98) {
 			Get();
 		} else if (la.kind == 25 || la.kind == 46) {
 			while (la.kind == 46) {
@@ -4458,7 +4521,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			 }
 			}
 			
-		} else SynErr(246);
+		} else SynErr(247);
 		Expression(out e, false, true);
 		letRHSs.Add(e); 
 		while (la.kind == 22) {
@@ -4476,7 +4539,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		e = dummyExpr;
 		Expression expr;
 		
-		Expect(93);
+		Expect(95);
 		x = t; 
 		NoUSIdent(out d);
 		Expect(21);
@@ -4518,7 +4581,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 				arguments.Add(pat); 
 			}
 			Expect(51);
-		} else SynErr(247);
+		} else SynErr(248);
 		Expect(29);
 		Expression(out body, allowSemi, allowLambda);
 		c = new MatchCaseExpr(x, name, arguments, body); 
@@ -4526,7 +4589,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 
 	void HashCall(IToken id, out IToken openParen, out List<Type> typeArgs, out List<Expression> args) {
 		Expression k; args = new List<Expression>(); typeArgs = null; 
-		Expect(107);
+		Expect(109);
 		id.val = id.val + "#"; 
 		if (la.kind == 52) {
 			typeArgs = new List<Type>(); 
@@ -4538,7 +4601,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		args.Add(k); 
 		Expect(50);
 		openParen = t; 
-		if (StartOf(8)) {
+		if (StartOf(9)) {
 			Expressions(args);
 		}
 		Expect(51);
@@ -4552,8 +4615,8 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 2) {
 			Get();
 			id = t; 
-		} else SynErr(248);
-		Expect(96);
+		} else SynErr(249);
+		Expect(98);
 		Expression(out e, true, true);
 	}
 
@@ -4595,7 +4658,7 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 		} else if (la.kind == 44) {
 			Get();
 			x = t; 
-		} else SynErr(249);
+		} else SynErr(250);
 	}
 
 
@@ -4610,40 +4673,41 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 	}
 
 	static readonly bool[,] set = {
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_T, _T,_T,_x,_x, _T,_T,_x,_x, _T,_T,_x,_T, _T,_T,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _x,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_x, _x,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_x,_T,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_T,_x,_T, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_x, _x,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _T,_T,_T,_x, _T,_T,_T,_T, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_x, _x,_T,_T,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _x,_T,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_T, _x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
-		{_x,_x,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _x,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_T,_x,_x, _x},
-		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_T, _x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x},
-		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_x,_T, _T,_T,_T,_T, _T,_T,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x}
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_T, _T,_T,_x,_x, _T,_T,_x,_x, _T,_T,_x,_T, _T,_T,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_x,_T, _T,_x,_x,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_T,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_T,_x,_T, _x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_T,_T, _T,_T,_T,_x, _T,_T,_T,_T, _x,_x,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_T,_T,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_T, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_T, _T,_x,_x,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_T,_T,_T, _x,_T,_T,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _T,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_T,_T, _T,_x,_T,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
+		{_x,_x,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_T, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_x,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_x, _x,_x},
+		{_x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_T,_x, _x,_T,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_T, _x,_x,_x,_x, _x,_T,_x,_T, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_T,_T, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_x,_T,_T,_x, _T,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _T,_T,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x,_x,_x, _x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_T,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x},
+		{_T,_T,_T,_T, _T,_x,_x,_x, _T,_x,_T,_x, _x,_x,_x,_x, _x,_x,_x,_T, _T,_T,_T,_T, _T,_x,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_T,_T,_T, _T,_T,_T,_x, _x,_T,_x,_x, _x,_T,_T,_x, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _x,_T,_T,_T, _T,_T,_T,_T, _T,_x,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _T,_x,_x,_x, _x,_T,_T,_T, _T,_T,_T,_T, _T,_T,_T,_T, _x,_x}
 
 	};
 } // end Parser
@@ -4745,182 +4809,183 @@ public class Errors {
 			case 71: s = "\"=\" expected"; break;
 			case 72: s = "\"as\" expected"; break;
 			case 73: s = "\"default\" expected"; break;
-			case 74: s = "\"class\" expected"; break;
+			case 74: s = "\"export\" expected"; break;
 			case 75: s = "\"extends\" expected"; break;
-			case 76: s = "\"trait\" expected"; break;
-			case 77: s = "\"datatype\" expected"; break;
-			case 78: s = "\"codatatype\" expected"; break;
-			case 79: s = "\"var\" expected"; break;
-			case 80: s = "\"newtype\" expected"; break;
-			case 81: s = "\"type\" expected"; break;
-			case 82: s = "\"iterator\" expected"; break;
-			case 83: s = "\"yields\" expected"; break;
-			case 84: s = "\"returns\" expected"; break;
-			case 85: s = "\"method\" expected"; break;
-			case 86: s = "\"colemma\" expected"; break;
-			case 87: s = "\"comethod\" expected"; break;
-			case 88: s = "\"constructor\" expected"; break;
-			case 89: s = "\"free\" expected"; break;
-			case 90: s = "\"ensures\" expected"; break;
-			case 91: s = "\"yield\" expected"; break;
-			case 92: s = "\"`\" expected"; break;
-			case 93: s = "\"label\" expected"; break;
-			case 94: s = "\"break\" expected"; break;
-			case 95: s = "\"where\" expected"; break;
-			case 96: s = "\":=\" expected"; break;
-			case 97: s = "\"return\" expected"; break;
-			case 98: s = "\"new\" expected"; break;
-			case 99: s = "\"if\" expected"; break;
-			case 100: s = "\"while\" expected"; break;
-			case 101: s = "\"match\" expected"; break;
-			case 102: s = "\"assert\" expected"; break;
-			case 103: s = "\"print\" expected"; break;
-			case 104: s = "\"forall\" expected"; break;
-			case 105: s = "\"parallel\" expected"; break;
-			case 106: s = "\"modify\" expected"; break;
-			case 107: s = "\"#\" expected"; break;
-			case 108: s = "\"<=\" expected"; break;
-			case 109: s = "\">=\" expected"; break;
-			case 110: s = "\"\\u2264\" expected"; break;
-			case 111: s = "\"\\u2265\" expected"; break;
-			case 112: s = "\"<==>\" expected"; break;
-			case 113: s = "\"\\u21d4\" expected"; break;
-			case 114: s = "\"==>\" expected"; break;
-			case 115: s = "\"\\u21d2\" expected"; break;
-			case 116: s = "\"<==\" expected"; break;
-			case 117: s = "\"\\u21d0\" expected"; break;
-			case 118: s = "\"&&\" expected"; break;
-			case 119: s = "\"\\u2227\" expected"; break;
-			case 120: s = "\"||\" expected"; break;
-			case 121: s = "\"\\u2228\" expected"; break;
-			case 122: s = "\"!\" expected"; break;
-			case 123: s = "\"\\u00ac\" expected"; break;
-			case 124: s = "\"\\u2200\" expected"; break;
-			case 125: s = "\"exists\" expected"; break;
-			case 126: s = "\"\\u2203\" expected"; break;
-			case 127: s = "\"in\" expected"; break;
-			case 128: s = "\"+\" expected"; break;
-			case 129: s = "\"-\" expected"; break;
-			case 130: s = "\"/\" expected"; break;
-			case 131: s = "\"%\" expected"; break;
-			case 132: s = "\"false\" expected"; break;
-			case 133: s = "\"true\" expected"; break;
-			case 134: s = "\"null\" expected"; break;
-			case 135: s = "\"this\" expected"; break;
-			case 136: s = "\"fresh\" expected"; break;
-			case 137: s = "\"old\" expected"; break;
-			case 138: s = "\"..\" expected"; break;
-			case 139: s = "??? expected"; break;
-			case 140: s = "invalid TopDecl"; break;
-			case 141: s = "invalid DeclModifier"; break;
-			case 142: s = "this symbol not expected in SubModuleDecl"; break;
-			case 143: s = "invalid SubModuleDecl"; break;
-			case 144: s = "this symbol not expected in ClassDecl"; break;
-			case 145: s = "this symbol not expected in DatatypeDecl"; break;
-			case 146: s = "invalid DatatypeDecl"; break;
-			case 147: s = "this symbol not expected in DatatypeDecl"; break;
-			case 148: s = "invalid NewtypeDecl"; break;
-			case 149: s = "invalid OtherTypeDecl"; break;
-			case 150: s = "this symbol not expected in OtherTypeDecl"; break;
-			case 151: s = "this symbol not expected in IteratorDecl"; break;
-			case 152: s = "invalid IteratorDecl"; break;
-			case 153: s = "this symbol not expected in TraitDecl"; break;
-			case 154: s = "invalid ClassMemberDecl"; break;
-			case 155: s = "this symbol not expected in FieldDecl"; break;
-			case 156: s = "invalid FunctionDecl"; break;
+			case 76: s = "\"+\" expected"; break;
+			case 77: s = "\"class\" expected"; break;
+			case 78: s = "\"trait\" expected"; break;
+			case 79: s = "\"datatype\" expected"; break;
+			case 80: s = "\"codatatype\" expected"; break;
+			case 81: s = "\"var\" expected"; break;
+			case 82: s = "\"newtype\" expected"; break;
+			case 83: s = "\"type\" expected"; break;
+			case 84: s = "\"iterator\" expected"; break;
+			case 85: s = "\"yields\" expected"; break;
+			case 86: s = "\"returns\" expected"; break;
+			case 87: s = "\"method\" expected"; break;
+			case 88: s = "\"colemma\" expected"; break;
+			case 89: s = "\"comethod\" expected"; break;
+			case 90: s = "\"constructor\" expected"; break;
+			case 91: s = "\"free\" expected"; break;
+			case 92: s = "\"ensures\" expected"; break;
+			case 93: s = "\"yield\" expected"; break;
+			case 94: s = "\"`\" expected"; break;
+			case 95: s = "\"label\" expected"; break;
+			case 96: s = "\"break\" expected"; break;
+			case 97: s = "\"where\" expected"; break;
+			case 98: s = "\":=\" expected"; break;
+			case 99: s = "\"return\" expected"; break;
+			case 100: s = "\"new\" expected"; break;
+			case 101: s = "\"if\" expected"; break;
+			case 102: s = "\"while\" expected"; break;
+			case 103: s = "\"match\" expected"; break;
+			case 104: s = "\"assert\" expected"; break;
+			case 105: s = "\"print\" expected"; break;
+			case 106: s = "\"forall\" expected"; break;
+			case 107: s = "\"parallel\" expected"; break;
+			case 108: s = "\"modify\" expected"; break;
+			case 109: s = "\"#\" expected"; break;
+			case 110: s = "\"<=\" expected"; break;
+			case 111: s = "\">=\" expected"; break;
+			case 112: s = "\"\\u2264\" expected"; break;
+			case 113: s = "\"\\u2265\" expected"; break;
+			case 114: s = "\"<==>\" expected"; break;
+			case 115: s = "\"\\u21d4\" expected"; break;
+			case 116: s = "\"==>\" expected"; break;
+			case 117: s = "\"\\u21d2\" expected"; break;
+			case 118: s = "\"<==\" expected"; break;
+			case 119: s = "\"\\u21d0\" expected"; break;
+			case 120: s = "\"&&\" expected"; break;
+			case 121: s = "\"\\u2227\" expected"; break;
+			case 122: s = "\"||\" expected"; break;
+			case 123: s = "\"\\u2228\" expected"; break;
+			case 124: s = "\"!\" expected"; break;
+			case 125: s = "\"\\u00ac\" expected"; break;
+			case 126: s = "\"\\u2200\" expected"; break;
+			case 127: s = "\"exists\" expected"; break;
+			case 128: s = "\"\\u2203\" expected"; break;
+			case 129: s = "\"in\" expected"; break;
+			case 130: s = "\"-\" expected"; break;
+			case 131: s = "\"/\" expected"; break;
+			case 132: s = "\"%\" expected"; break;
+			case 133: s = "\"false\" expected"; break;
+			case 134: s = "\"true\" expected"; break;
+			case 135: s = "\"null\" expected"; break;
+			case 136: s = "\"this\" expected"; break;
+			case 137: s = "\"fresh\" expected"; break;
+			case 138: s = "\"old\" expected"; break;
+			case 139: s = "\"..\" expected"; break;
+			case 140: s = "??? expected"; break;
+			case 141: s = "invalid TopDecl"; break;
+			case 142: s = "invalid DeclModifier"; break;
+			case 143: s = "this symbol not expected in SubModuleDecl"; break;
+			case 144: s = "invalid SubModuleDecl"; break;
+			case 145: s = "this symbol not expected in ClassDecl"; break;
+			case 146: s = "this symbol not expected in DatatypeDecl"; break;
+			case 147: s = "invalid DatatypeDecl"; break;
+			case 148: s = "this symbol not expected in DatatypeDecl"; break;
+			case 149: s = "invalid NewtypeDecl"; break;
+			case 150: s = "invalid OtherTypeDecl"; break;
+			case 151: s = "this symbol not expected in OtherTypeDecl"; break;
+			case 152: s = "this symbol not expected in IteratorDecl"; break;
+			case 153: s = "invalid IteratorDecl"; break;
+			case 154: s = "this symbol not expected in TraitDecl"; break;
+			case 155: s = "invalid ClassMemberDecl"; break;
+			case 156: s = "this symbol not expected in FieldDecl"; break;
 			case 157: s = "invalid FunctionDecl"; break;
 			case 158: s = "invalid FunctionDecl"; break;
 			case 159: s = "invalid FunctionDecl"; break;
 			case 160: s = "invalid FunctionDecl"; break;
-			case 161: s = "this symbol not expected in MethodDecl"; break;
-			case 162: s = "invalid MethodDecl"; break;
+			case 161: s = "invalid FunctionDecl"; break;
+			case 162: s = "this symbol not expected in MethodDecl"; break;
 			case 163: s = "invalid MethodDecl"; break;
-			case 164: s = "invalid FIdentType"; break;
-			case 165: s = "this symbol not expected in OldSemi"; break;
-			case 166: s = "invalid TypeIdentOptional"; break;
-			case 167: s = "invalid TypeAndToken"; break;
-			case 168: s = "this symbol not expected in IteratorSpec"; break;
-			case 169: s = "invalid IteratorSpec"; break;
+			case 164: s = "invalid MethodDecl"; break;
+			case 165: s = "invalid FIdentType"; break;
+			case 166: s = "this symbol not expected in OldSemi"; break;
+			case 167: s = "invalid TypeIdentOptional"; break;
+			case 168: s = "invalid TypeAndToken"; break;
+			case 169: s = "this symbol not expected in IteratorSpec"; break;
 			case 170: s = "invalid IteratorSpec"; break;
-			case 171: s = "this symbol not expected in MethodSpec"; break;
-			case 172: s = "invalid MethodSpec"; break;
+			case 171: s = "invalid IteratorSpec"; break;
+			case 172: s = "this symbol not expected in MethodSpec"; break;
 			case 173: s = "invalid MethodSpec"; break;
-			case 174: s = "invalid FrameExpression"; break;
-			case 175: s = "this symbol not expected in FunctionSpec"; break;
-			case 176: s = "invalid FunctionSpec"; break;
-			case 177: s = "invalid PossiblyWildFrameExpression"; break;
-			case 178: s = "invalid PossiblyWildExpression"; break;
-			case 179: s = "this symbol not expected in OneStmt"; break;
-			case 180: s = "invalid OneStmt"; break;
-			case 181: s = "this symbol not expected in OneStmt"; break;
-			case 182: s = "invalid OneStmt"; break;
-			case 183: s = "invalid AssertStmt"; break;
-			case 184: s = "invalid AssumeStmt"; break;
-			case 185: s = "invalid UpdateStmt"; break;
+			case 174: s = "invalid MethodSpec"; break;
+			case 175: s = "invalid FrameExpression"; break;
+			case 176: s = "this symbol not expected in FunctionSpec"; break;
+			case 177: s = "invalid FunctionSpec"; break;
+			case 178: s = "invalid PossiblyWildFrameExpression"; break;
+			case 179: s = "invalid PossiblyWildExpression"; break;
+			case 180: s = "this symbol not expected in OneStmt"; break;
+			case 181: s = "invalid OneStmt"; break;
+			case 182: s = "this symbol not expected in OneStmt"; break;
+			case 183: s = "invalid OneStmt"; break;
+			case 184: s = "invalid AssertStmt"; break;
+			case 185: s = "invalid AssumeStmt"; break;
 			case 186: s = "invalid UpdateStmt"; break;
-			case 187: s = "this symbol not expected in VarDeclStatement"; break;
-			case 188: s = "invalid VarDeclStatement"; break;
+			case 187: s = "invalid UpdateStmt"; break;
+			case 188: s = "this symbol not expected in VarDeclStatement"; break;
 			case 189: s = "invalid VarDeclStatement"; break;
-			case 190: s = "invalid IfStmt"; break;
+			case 190: s = "invalid VarDeclStatement"; break;
 			case 191: s = "invalid IfStmt"; break;
-			case 192: s = "invalid WhileStmt"; break;
+			case 192: s = "invalid IfStmt"; break;
 			case 193: s = "invalid WhileStmt"; break;
-			case 194: s = "invalid MatchStmt"; break;
-			case 195: s = "invalid ForallStmt"; break;
+			case 194: s = "invalid WhileStmt"; break;
+			case 195: s = "invalid MatchStmt"; break;
 			case 196: s = "invalid ForallStmt"; break;
-			case 197: s = "invalid CalcStmt"; break;
-			case 198: s = "invalid ModifyStmt"; break;
-			case 199: s = "this symbol not expected in ModifyStmt"; break;
-			case 200: s = "invalid ModifyStmt"; break;
-			case 201: s = "invalid ReturnStmt"; break;
-			case 202: s = "invalid Rhs"; break;
-			case 203: s = "invalid Lhs"; break;
-			case 204: s = "invalid CasePattern"; break;
-			case 205: s = "invalid AlternativeBlock"; break;
-			case 206: s = "invalid Guard"; break;
-			case 207: s = "this symbol not expected in LoopSpec"; break;
+			case 197: s = "invalid ForallStmt"; break;
+			case 198: s = "invalid CalcStmt"; break;
+			case 199: s = "invalid ModifyStmt"; break;
+			case 200: s = "this symbol not expected in ModifyStmt"; break;
+			case 201: s = "invalid ModifyStmt"; break;
+			case 202: s = "invalid ReturnStmt"; break;
+			case 203: s = "invalid Rhs"; break;
+			case 204: s = "invalid Lhs"; break;
+			case 205: s = "invalid CasePattern"; break;
+			case 206: s = "invalid AlternativeBlock"; break;
+			case 207: s = "invalid Guard"; break;
 			case 208: s = "this symbol not expected in LoopSpec"; break;
 			case 209: s = "this symbol not expected in LoopSpec"; break;
-			case 210: s = "invalid LoopSpec"; break;
-			case 211: s = "invalid CaseStatement"; break;
-			case 212: s = "this symbol not expected in CaseStatement"; break;
+			case 210: s = "this symbol not expected in LoopSpec"; break;
+			case 211: s = "invalid LoopSpec"; break;
+			case 212: s = "invalid CaseStatement"; break;
 			case 213: s = "this symbol not expected in CaseStatement"; break;
-			case 214: s = "invalid CalcOp"; break;
-			case 215: s = "invalid EquivOp"; break;
-			case 216: s = "invalid ImpliesOp"; break;
-			case 217: s = "invalid ExpliesOp"; break;
-			case 218: s = "invalid AndOp"; break;
-			case 219: s = "invalid OrOp"; break;
-			case 220: s = "invalid NegOp"; break;
-			case 221: s = "invalid Forall"; break;
-			case 222: s = "invalid Exists"; break;
-			case 223: s = "invalid QSep"; break;
-			case 224: s = "invalid ImpliesExpliesExpression"; break;
-			case 225: s = "invalid LogicalExpression"; break;
-			case 226: s = "invalid RelOp"; break;
-			case 227: s = "invalid AddOp"; break;
-			case 228: s = "invalid UnaryExpression"; break;
-			case 229: s = "invalid MulOp"; break;
-			case 230: s = "invalid Suffix"; break;
+			case 214: s = "this symbol not expected in CaseStatement"; break;
+			case 215: s = "invalid CalcOp"; break;
+			case 216: s = "invalid EquivOp"; break;
+			case 217: s = "invalid ImpliesOp"; break;
+			case 218: s = "invalid ExpliesOp"; break;
+			case 219: s = "invalid AndOp"; break;
+			case 220: s = "invalid OrOp"; break;
+			case 221: s = "invalid NegOp"; break;
+			case 222: s = "invalid Forall"; break;
+			case 223: s = "invalid Exists"; break;
+			case 224: s = "invalid QSep"; break;
+			case 225: s = "invalid ImpliesExpliesExpression"; break;
+			case 226: s = "invalid LogicalExpression"; break;
+			case 227: s = "invalid RelOp"; break;
+			case 228: s = "invalid AddOp"; break;
+			case 229: s = "invalid UnaryExpression"; break;
+			case 230: s = "invalid MulOp"; break;
 			case 231: s = "invalid Suffix"; break;
 			case 232: s = "invalid Suffix"; break;
 			case 233: s = "invalid Suffix"; break;
 			case 234: s = "invalid Suffix"; break;
-			case 235: s = "invalid LambdaExpression"; break;
-			case 236: s = "invalid EndlessExpression"; break;
-			case 237: s = "invalid NameSegment"; break;
-			case 238: s = "invalid DisplayExpr"; break;
-			case 239: s = "invalid MultiSetExpr"; break;
-			case 240: s = "invalid ConstAtomExpression"; break;
-			case 241: s = "invalid Nat"; break;
-			case 242: s = "invalid LambdaArrow"; break;
-			case 243: s = "invalid MatchExpression"; break;
-			case 244: s = "invalid QuantifierGuts"; break;
-			case 245: s = "invalid StmtInExpr"; break;
-			case 246: s = "invalid LetExpr"; break;
-			case 247: s = "invalid CaseExpression"; break;
-			case 248: s = "invalid MemberBindingUpdate"; break;
-			case 249: s = "invalid DotSuffix"; break;
+			case 235: s = "invalid Suffix"; break;
+			case 236: s = "invalid LambdaExpression"; break;
+			case 237: s = "invalid EndlessExpression"; break;
+			case 238: s = "invalid NameSegment"; break;
+			case 239: s = "invalid DisplayExpr"; break;
+			case 240: s = "invalid MultiSetExpr"; break;
+			case 241: s = "invalid ConstAtomExpression"; break;
+			case 242: s = "invalid Nat"; break;
+			case 243: s = "invalid LambdaArrow"; break;
+			case 244: s = "invalid MatchExpression"; break;
+			case 245: s = "invalid QuantifierGuts"; break;
+			case 246: s = "invalid StmtInExpr"; break;
+			case 247: s = "invalid LetExpr"; break;
+			case 248: s = "invalid CaseExpression"; break;
+			case 249: s = "invalid MemberBindingUpdate"; break;
+			case 250: s = "invalid DotSuffix"; break;
 
 			default: s = "error " + n; break;
 		}
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index eb82df72..bddf62e2 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -324,6 +324,7 @@ namespace Microsoft.Dafny
           // set up environment
           var preResolveErrorCount = reporter.Count(ErrorLevel.Error);
           ResolveModuleDefinition(m, sig);
+          ResolveModuleExport(literalDecl, sig);
           foreach (var r in rewriters) {
             if (reporter.Count(ErrorLevel.Error) != preResolveErrorCount) {
               break;
@@ -368,7 +369,7 @@ namespace Microsoft.Dafny
                   if (refinementTransformer.CheckIsRefinement(compileSig, p)) {
                     abs.Signature.CompileSignature = compileSig;
                   } else {
-                    reporter.Error(MessageSource.Resolver, 
+                    reporter.Error(MessageSource.Resolver,
                       abs.CompilePath[0],
                       "module " + Util.Comma(".", abs.CompilePath, x => x.val) + " must be a refinement of "
                       + Util.Comma(".", abs.Path, x => x.val));
@@ -383,6 +384,11 @@ namespace Microsoft.Dafny
           } else {
             abs.Signature = new ModuleSignature(); // there was an error, give it a valid but empty signature
           }
+        } else if (decl is ModuleExportDecl) {
+          ModuleExportDecl export = (ModuleExportDecl)decl;
+          export.Signature = new ModuleSignature();
+          export.Signature.IsAbstract = false;
+          export.Signature.ModuleDef = null;
         } else { Contract.Assert(false); }
         Contract.Assert(decl.Signature != null);
       }
@@ -720,6 +726,96 @@ namespace Microsoft.Dafny
       }
     }
 
+    // Resolve the exports and detect cycles.
+    private void ResolveModuleExport(LiteralModuleDecl literalDecl, ModuleSignature sig) {
+      ModuleDefinition m = literalDecl.ModuleDef;
+      literalDecl.DefaultExport = sig;
+      Graph<ModuleExportDecl> exportDependencies = new Graph<ModuleExportDecl>();
+      foreach (TopLevelDecl toplevel in m.TopLevelDecls) {
+        if (toplevel is ModuleExportDecl) {
+          ModuleExportDecl d = (ModuleExportDecl) toplevel;
+          exportDependencies.AddVertex(d);
+          foreach (string s in d.Extends) {
+            TopLevelDecl top;
+            if (sig.TopLevels.TryGetValue(s, out top) && top is ModuleExportDecl) {
+              ModuleExportDecl extend = (ModuleExportDecl) top;
+              d.ExtendDecls.Add(extend);
+              exportDependencies.AddEdge(d, extend);
+            } else {
+              reporter.Error(MessageSource.Resolver, m.tok, s + " must be an export of" + m + " to be extended");
+            }
+          }
+          foreach (ExportSignature export in d.Exports) {
+            // check to see if it is a datatype or a member or
+            // static function or method in the enclosing module or its imports
+            TopLevelDecl decl;
+            MemberDecl member;
+            string name = export.Name;
+            if (sig.TopLevels.TryGetValue(name, out decl)) {
+              // Member of the enclosing module
+              export.Decl = decl;
+            } else if (sig.StaticMembers.TryGetValue(name, out member)) {
+              export.Decl = member;
+            } else {
+              reporter.Error(MessageSource.Resolver, d.tok, name + " must be a member of " + m + " to be exported");
+            }
+          }
+        }
+      }
+
+      // detect cycles in the extend
+      var cycle = exportDependencies.TryFindCycle();
+      if (cycle != null) {
+        var cy = Util.Comma(" -> ", cycle, c => c.Name);
+        reporter.Error(MessageSource.Resolver, cycle[0], "module export contains a cycle: {0}", cy);
+        return;
+      }
+
+      // fill in the exports for the extends.
+      List<ModuleExportDecl> sortedDecls = exportDependencies.TopologicallySortedComponents();
+      ModuleExportDecl defaultExport = null;
+      foreach (ModuleExportDecl decl in sortedDecls) {
+        if (decl.IsDefault) {
+          if (defaultExport == null) {
+            defaultExport = decl;
+          } else {
+            reporter.Error(MessageSource.Resolver, m.tok, "more than one default export declared: {0}, {1}", defaultExport, decl);
+          }
+        }
+        // fill in export signature
+        ModuleSignature signature = decl.Signature;
+        foreach (ModuleExportDecl extend in decl.ExtendDecls) {
+          ModuleSignature s = extend.Signature;
+          foreach (var kv in s.TopLevels) {
+            if (!signature.TopLevels.ContainsKey(kv.Key)) {
+              signature.TopLevels.Add(kv.Key, kv.Value);
+            }
+          }
+          foreach (var kv in s.Ctors) {
+            if (!signature.Ctors.ContainsKey(kv.Key)) {
+              signature.Ctors.Add(kv.Key, kv.Value);
+            }
+          }
+          foreach (var kv in s.StaticMembers) {
+            if (!signature.StaticMembers.ContainsKey(kv.Key)) {
+              signature.StaticMembers.Add(kv.Key, kv.Value);
+            }
+          }
+        }
+        foreach (ExportSignature export in decl.Exports) {
+          if (export.Decl is TopLevelDecl) {
+            signature.TopLevels.Add(export.Name, (TopLevelDecl)export.Decl);
+          } else if (export.Decl is MemberDecl) {
+            signature.StaticMembers.Add(export.Name, (MemberDecl)export.Decl);
+          }
+        }
+      }
+
+      // set the default export if it exists, otherwise, default is export everything     
+      if (defaultExport != null) {
+        literalDecl.DefaultExport = defaultExport.Signature;
+      }
+    }
 
     public class ModuleBindings
     {
@@ -1326,6 +1422,13 @@ namespace Microsoft.Dafny
 
 
     public static bool ResolvePath(ModuleDecl root, List<IToken> Path, out ModuleSignature p, ErrorReporter reporter) {
+      if (Path.Count == 1 && root is LiteralModuleDecl) {
+        // use the default export when the importing the root
+        LiteralModuleDecl decl = (LiteralModuleDecl)root;
+        p = decl.DefaultExport;
+        return true;
+      }
+
       p = root.Signature;
       int i = 1;
       while (i < Path.Count) {
@@ -1590,6 +1693,7 @@ namespace Microsoft.Dafny
         }
       }
 
+
       // ---------------------------------- Pass 2 ----------------------------------
       // This pass fills in various additional information.
       // ----------------------------------------------------------------------------
diff --git a/Source/Dafny/Scanner.cs b/Source/Dafny/Scanner.cs
index 784f9cd5..cb3dbe7e 100644
--- a/Source/Dafny/Scanner.cs
+++ b/Source/Dafny/Scanner.cs
@@ -211,8 +211,8 @@ public class UTF8Buffer: Buffer {
 public class Scanner {
 	const char EOL = '\n';
 	const int eofSym = 0; /* pdt */
-	const int maxT = 139;
-	const int noSym = 139;
+	const int maxT = 140;
+	const int noSym = 140;
 
 
 	[ContractInvariantMethod]
@@ -292,20 +292,20 @@ public class Scanner {
 		start[33] = 96; 
 		start[8800] = 43; 
 		start[42] = 44; 
-		start[96] = 67; 
-		start[35] = 69; 
-		start[8804] = 71; 
-		start[8805] = 72; 
-		start[8660] = 74; 
-		start[8658] = 76; 
-		start[8656] = 77; 
-		start[38] = 78; 
-		start[8743] = 80; 
-		start[8744] = 82; 
-		start[172] = 83; 
-		start[8704] = 84; 
-		start[8707] = 85; 
-		start[43] = 86; 
+		start[43] = 67; 
+		start[96] = 68; 
+		start[35] = 70; 
+		start[8804] = 72; 
+		start[8805] = 73; 
+		start[8660] = 75; 
+		start[8658] = 77; 
+		start[8656] = 78; 
+		start[38] = 79; 
+		start[8743] = 81; 
+		start[8744] = 83; 
+		start[172] = 84; 
+		start[8704] = 85; 
+		start[8707] = 86; 
 		start[47] = 87; 
 		start[37] = 88; 
 		start[Buffer.EOF] = -1;
@@ -552,45 +552,46 @@ public class Scanner {
 			case "opened": t.kind = 70; break;
 			case "as": t.kind = 72; break;
 			case "default": t.kind = 73; break;
-			case "class": t.kind = 74; break;
+			case "export": t.kind = 74; break;
 			case "extends": t.kind = 75; break;
-			case "trait": t.kind = 76; break;
-			case "datatype": t.kind = 77; break;
-			case "codatatype": t.kind = 78; break;
-			case "var": t.kind = 79; break;
-			case "newtype": t.kind = 80; break;
-			case "type": t.kind = 81; break;
-			case "iterator": t.kind = 82; break;
-			case "yields": t.kind = 83; break;
-			case "returns": t.kind = 84; break;
-			case "method": t.kind = 85; break;
-			case "colemma": t.kind = 86; break;
-			case "comethod": t.kind = 87; break;
-			case "constructor": t.kind = 88; break;
-			case "free": t.kind = 89; break;
-			case "ensures": t.kind = 90; break;
-			case "yield": t.kind = 91; break;
-			case "label": t.kind = 93; break;
-			case "break": t.kind = 94; break;
-			case "where": t.kind = 95; break;
-			case "return": t.kind = 97; break;
-			case "new": t.kind = 98; break;
-			case "if": t.kind = 99; break;
-			case "while": t.kind = 100; break;
-			case "match": t.kind = 101; break;
-			case "assert": t.kind = 102; break;
-			case "print": t.kind = 103; break;
-			case "forall": t.kind = 104; break;
-			case "parallel": t.kind = 105; break;
-			case "modify": t.kind = 106; break;
-			case "exists": t.kind = 125; break;
-			case "in": t.kind = 127; break;
-			case "false": t.kind = 132; break;
-			case "true": t.kind = 133; break;
-			case "null": t.kind = 134; break;
-			case "this": t.kind = 135; break;
-			case "fresh": t.kind = 136; break;
-			case "old": t.kind = 137; break;
+			case "class": t.kind = 77; break;
+			case "trait": t.kind = 78; break;
+			case "datatype": t.kind = 79; break;
+			case "codatatype": t.kind = 80; break;
+			case "var": t.kind = 81; break;
+			case "newtype": t.kind = 82; break;
+			case "type": t.kind = 83; break;
+			case "iterator": t.kind = 84; break;
+			case "yields": t.kind = 85; break;
+			case "returns": t.kind = 86; break;
+			case "method": t.kind = 87; break;
+			case "colemma": t.kind = 88; break;
+			case "comethod": t.kind = 89; break;
+			case "constructor": t.kind = 90; break;
+			case "free": t.kind = 91; break;
+			case "ensures": t.kind = 92; break;
+			case "yield": t.kind = 93; break;
+			case "label": t.kind = 95; break;
+			case "break": t.kind = 96; break;
+			case "where": t.kind = 97; break;
+			case "return": t.kind = 99; break;
+			case "new": t.kind = 100; break;
+			case "if": t.kind = 101; break;
+			case "while": t.kind = 102; break;
+			case "match": t.kind = 103; break;
+			case "assert": t.kind = 104; break;
+			case "print": t.kind = 105; break;
+			case "forall": t.kind = 106; break;
+			case "parallel": t.kind = 107; break;
+			case "modify": t.kind = 108; break;
+			case "exists": t.kind = 127; break;
+			case "in": t.kind = 129; break;
+			case "false": t.kind = 133; break;
+			case "true": t.kind = 134; break;
+			case "null": t.kind = 135; break;
+			case "this": t.kind = 136; break;
+			case "fresh": t.kind = 137; break;
+			case "old": t.kind = 138; break;
 			default: break;
 		}
 	}
@@ -853,59 +854,59 @@ public class Scanner {
 				else if (ch >= '0' && ch <= '9') {AddCh(); goto case 66;}
 				else {t.kind = 5; break;}
 			case 67:
-				{t.kind = 92; break;}
+				{t.kind = 76; break;}
 			case 68:
-				{t.kind = 96; break;}
+				{t.kind = 94; break;}
 			case 69:
-				{t.kind = 107; break;}
+				{t.kind = 98; break;}
 			case 70:
 				{t.kind = 109; break;}
 			case 71:
-				{t.kind = 110; break;}
-			case 72:
 				{t.kind = 111; break;}
-			case 73:
+			case 72:
 				{t.kind = 112; break;}
-			case 74:
+			case 73:
 				{t.kind = 113; break;}
-			case 75:
+			case 74:
 				{t.kind = 114; break;}
-			case 76:
+			case 75:
 				{t.kind = 115; break;}
+			case 76:
+				{t.kind = 116; break;}
 			case 77:
 				{t.kind = 117; break;}
 			case 78:
-				if (ch == '&') {AddCh(); goto case 79;}
-				else {goto case 0;}
+				{t.kind = 119; break;}
 			case 79:
-				{t.kind = 118; break;}
+				if (ch == '&') {AddCh(); goto case 80;}
+				else {goto case 0;}
 			case 80:
-				{t.kind = 119; break;}
-			case 81:
 				{t.kind = 120; break;}
-			case 82:
+			case 81:
 				{t.kind = 121; break;}
+			case 82:
+				{t.kind = 122; break;}
 			case 83:
 				{t.kind = 123; break;}
 			case 84:
-				{t.kind = 124; break;}
+				{t.kind = 125; break;}
 			case 85:
 				{t.kind = 126; break;}
 			case 86:
 				{t.kind = 128; break;}
 			case 87:
-				{t.kind = 130; break;}
-			case 88:
 				{t.kind = 131; break;}
+			case 88:
+				{t.kind = 132; break;}
 			case 89:
 				recEnd = pos; recKind = 21;
 				if (ch == ':') {AddCh(); goto case 30;}
 				else if (ch == '|') {AddCh(); goto case 31;}
-				else if (ch == '=') {AddCh(); goto case 68;}
+				else if (ch == '=') {AddCh(); goto case 69;}
 				else {t.kind = 21; break;}
 			case 90:
 				recEnd = pos; recKind = 23;
-				if (ch == '|') {AddCh(); goto case 81;}
+				if (ch == '|') {AddCh(); goto case 82;}
 				else {t.kind = 23; break;}
 			case 91:
 				recEnd = pos; recKind = 27;
@@ -917,38 +918,38 @@ public class Scanner {
 				else if (ch == '=') {AddCh(); goto case 98;}
 				else {t.kind = 71; break;}
 			case 93:
-				recEnd = pos; recKind = 129;
+				recEnd = pos; recKind = 130;
 				if (ch == '>') {AddCh(); goto case 35;}
-				else {t.kind = 129; break;}
+				else {t.kind = 130; break;}
 			case 94:
 				recEnd = pos; recKind = 52;
 				if (ch == '=') {AddCh(); goto case 99;}
 				else {t.kind = 52; break;}
 			case 95:
 				recEnd = pos; recKind = 53;
-				if (ch == '=') {AddCh(); goto case 70;}
+				if (ch == '=') {AddCh(); goto case 71;}
 				else {t.kind = 53; break;}
 			case 96:
-				recEnd = pos; recKind = 122;
+				recEnd = pos; recKind = 124;
 				if (ch == '=') {AddCh(); goto case 42;}
 				else if (ch == 'i') {AddCh(); goto case 45;}
-				else {t.kind = 122; break;}
+				else {t.kind = 124; break;}
 			case 97:
-				recEnd = pos; recKind = 138;
+				recEnd = pos; recKind = 139;
 				if (ch == '.') {AddCh(); goto case 48;}
-				else {t.kind = 138; break;}
+				else {t.kind = 139; break;}
 			case 98:
 				recEnd = pos; recKind = 54;
-				if (ch == '>') {AddCh(); goto case 75;}
+				if (ch == '>') {AddCh(); goto case 76;}
 				else {t.kind = 54; break;}
 			case 99:
-				recEnd = pos; recKind = 108;
+				recEnd = pos; recKind = 110;
 				if (ch == '=') {AddCh(); goto case 100;}
-				else {t.kind = 108; break;}
+				else {t.kind = 110; break;}
 			case 100:
-				recEnd = pos; recKind = 116;
-				if (ch == '>') {AddCh(); goto case 73;}
-				else {t.kind = 116; break;}
+				recEnd = pos; recKind = 118;
+				if (ch == '>') {AddCh(); goto case 74;}
+				else {t.kind = 118; break;}
 
 		}
 		t.val = new String(tval, 0, tlen);
diff --git a/Test/dafny0/ModuleExport.dfy b/Test/dafny0/ModuleExport.dfy
new file mode 100644
index 00000000..81fe0ed5
--- /dev/null
+++ b/Test/dafny0/ModuleExport.dfy
@@ -0,0 +1,68 @@
+// RUN: %dafny /compile:0 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+module A {
+	default export Public { f, h}
+	export E1 { f, g}
+	export E2 extends Public, E1 {T}
+  export Friend extends Public {g, T}
+	export Fruit {Data}
+
+  method h() {}
+  function f(): int { 818 }
+  function g() : int { 819 }
+	function k() : int { 820 }
+  
+	class T 
+	{
+	  static method l() {}
+	}
+
+	datatype Data = Lemon | Kiwi(int)
+
+}
+
+module B {
+  import X = A.Public
+	method m() {
+	  X.h();  // OK
+	  assert X.f() == 818; // OK
+		assert X.g() == 819; // error
+		assert X.k() == 820; // error
+		X.T.l(); // error
+	}
+}
+
+module C {
+  import X = A.Friend
+	method m() {
+	  X.h();  // OK
+	  assert X.f() == 818; // OK
+		assert X.g() == 819; // OK
+		assert X.k() == 820; // error
+		X.T.l(); // OK
+	}
+}
+
+module D {
+  import opened A
+	method m() {
+	  h();  // OK
+	  assert f() == 818; // OK
+		assert g() == 819; // error
+		assert k() == 820; // error
+	 }
+}
+
+module E {
+  import opened A.Fruit
+
+  function G(d: Data): int
+    requires d != Data.Lemon
+  {
+    match d
+    case Lemon => G(d)
+    case Kiwi(x) => 7
+		case Orang => 8  // error
+  } 
+}
\ No newline at end of file
diff --git a/Test/dafny0/ModuleExport.dfy.expect b/Test/dafny0/ModuleExport.dfy.expect
new file mode 100644
index 00000000..c7444bdb
--- /dev/null
+++ b/Test/dafny0/ModuleExport.dfy.expect
@@ -0,0 +1,9 @@
+ModuleExport.dfy(30,11): Error: unresolved identifier: g
+ModuleExport.dfy(31,11): Error: unresolved identifier: k
+ModuleExport.dfy(32,4): Error: unresolved identifier: T
+ModuleExport.dfy(32,7): Error: expected method call, found expression
+ModuleExport.dfy(42,11): Error: unresolved identifier: k
+ModuleExport.dfy(52,9): Error: unresolved identifier: g
+ModuleExport.dfy(53,9): Error: unresolved identifier: k
+ModuleExport.dfy(66,2): Error: member Orang does not exist in datatype Data
+8 resolution/type errors detected in ModuleExport.dfy
-- 
cgit v1.2.3


From 2be514ca20e1478b6df02ef2b4c2725c319ac934 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Tue, 2 Feb 2016 12:40:07 -0800
Subject: Mark old "import A as B" syntax as deprecated. The new syntax is
 "import A : B"

---
 Source/Dafny/Dafny.atg                 | 2 +-
 Source/Dafny/Parser.cs                 | 2 +-
 Test/dafny0/Compilation.dfy            | 8 ++++----
 Test/dafny0/Modules1.dfy               | 2 +-
 Test/dafny0/Modules2.dfy               | 2 +-
 Test/dafny0/OpaqueFunctions.dfy        | 4 ++--
 Test/dafny3/CachedContainer.dfy.expect | 1 +
 Test/dafny3/GenericSort.dfy            | 2 +-
 Test/dafny4/Bug110.dfy                 | 2 +-
 Test/dafny4/Bug117.dfy                 | 4 ++--
 Test/irondafny0/Queue.dfyi             | 2 +-
 Test/irondafny0/opened_workaround.dfy  | 2 +-
 Test/irondafny0/xrefine1.dfy           | 6 +++---
 Test/irondafny0/xrefine2.dfy           | 6 +++---
 Test/irondafny0/xrefine3.dfy           | 6 +++---
 15 files changed, 26 insertions(+), 25 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index e3696c5b..80792ce2 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -727,7 +727,7 @@ SubModuleDecl<DeclModifierData dmod, ModuleDefinition parent, out ModuleDecl sub
       (. submodule = new AliasModuleDecl(idPath, id, parent, opened); .)
     | "as" QualifiedModuleName<out idPath> [IF(IsDefaultImport()) "default" QualifiedModuleName<out idAssignment> ]
       (. submodule = new ModuleFacadeDecl(idPath, id, parent, idAssignment, opened); 
-         //errors.Warning(t, "\"import A as B\" has been deprecated; in the new syntax, it is \"import A:B\"");
+         errors.Warning(t, "\"import A as B\" has been deprecated; in the new syntax, it is \"import A:B\"");
       .)
     | ":" QualifiedModuleName<out idPath>
       (. submodule = new ModuleFacadeDecl(idPath, id, parent, idAssignment, opened); .)
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index c7955dc8..8a1da161 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -835,7 +835,7 @@ bool IsDefaultImport() {
 						QualifiedModuleName(out idAssignment);
 					}
 					submodule = new ModuleFacadeDecl(idPath, id, parent, idAssignment, opened); 
-					//errors.Warning(t, "\"import A as B\" has been deprecated; in the new syntax, it is \"import A:B\"");
+					errors.Warning(t, "\"import A as B\" has been deprecated; in the new syntax, it is \"import A:B\"");
 					
 				} else if (la.kind == 21) {
 					Get();
diff --git a/Test/dafny0/Compilation.dfy b/Test/dafny0/Compilation.dfy
index 965f0787..7a443e47 100644
--- a/Test/dafny0/Compilation.dfy
+++ b/Test/dafny0/Compilation.dfy
@@ -109,8 +109,8 @@ module T refines S {
   }
 }
 module A {
-   import X as S default T
-   import Y as S default T
+   import X : T
+   import Y : T
    import Z = T
    method run() {
      var x := new X.C;
@@ -128,7 +128,7 @@ method NotMain() {
 
 
 abstract module S1 {
-  import B as S default T
+  import B : T
   method do()
 }
 
@@ -138,7 +138,7 @@ module T1 refines S1 {
   }
 }
 module A1 {
-   import X as S1 default T1
+   import X : T1
    method run() {
      X.do();
      var x := new X.B.C;
diff --git a/Test/dafny0/Modules1.dfy b/Test/dafny0/Modules1.dfy
index 3ffa5a23..3025cc00 100644
--- a/Test/dafny0/Modules1.dfy
+++ b/Test/dafny0/Modules1.dfy
@@ -130,6 +130,6 @@ abstract module Regression {
 
   abstract module B
   {
-    import X as A
+    import X : A
   }
 }
diff --git a/Test/dafny0/Modules2.dfy b/Test/dafny0/Modules2.dfy
index a8dde8ce..beb80546 100644
--- a/Test/dafny0/Modules2.dfy
+++ b/Test/dafny0/Modules2.dfy
@@ -31,7 +31,7 @@ module Test {
 }
 
 module Test2 {
-  import opened B as A
+  import opened B : A
   method m() {
     var c := new C;   // fine, as A was opened
     var c' := new B.C;// also fine, as A is bound
diff --git a/Test/dafny0/OpaqueFunctions.dfy b/Test/dafny0/OpaqueFunctions.dfy
index e1c0756c..b3cde309 100644
--- a/Test/dafny0/OpaqueFunctions.dfy
+++ b/Test/dafny0/OpaqueFunctions.dfy
@@ -44,7 +44,7 @@ module A' refines A {
 }
 
 module B {
-  import X as A
+  import X : A
   method Main() {
     var c := new X.C();
     c.M();  // fine
@@ -68,7 +68,7 @@ module B {
   }
 }
 module B_direct {
-  import X as A'
+  import X : A'
   method Main() {
     var c := new X.C();
     c.M();  // fine
diff --git a/Test/dafny3/CachedContainer.dfy.expect b/Test/dafny3/CachedContainer.dfy.expect
index c6c90498..0185aacd 100644
--- a/Test/dafny3/CachedContainer.dfy.expect
+++ b/Test/dafny3/CachedContainer.dfy.expect
@@ -1,2 +1,3 @@
+CachedContainer.dfy(120,25): Warning: "import A as B" has been deprecated; in the new syntax, it is "import A:B"
 
 Dafny program verifier finished with 47 verified, 0 errors
diff --git a/Test/dafny3/GenericSort.dfy b/Test/dafny3/GenericSort.dfy
index ea75c196..7555817c 100644
--- a/Test/dafny3/GenericSort.dfy
+++ b/Test/dafny3/GenericSort.dfy
@@ -17,7 +17,7 @@ abstract module TotalOrder {
 }
 
 abstract module Sort {
-  import O as TotalOrder  // let O denote some module that has the members of TotalOrder
+  import O : TotalOrder  // let O denote some module that has the members of TotalOrder
 
   predicate Sorted(a: array<O.T>, low: int, high: int)
     requires a != null && 0 <= low <= high <= a.Length
diff --git a/Test/dafny4/Bug110.dfy b/Test/dafny4/Bug110.dfy
index 239f18d3..aa808669 100644
--- a/Test/dafny4/Bug110.dfy
+++ b/Test/dafny4/Bug110.dfy
@@ -27,5 +27,5 @@ abstract module Host {
 }
 
 abstract module Main {
-    import H as Host
+    import H : Host
 }
diff --git a/Test/dafny4/Bug117.dfy b/Test/dafny4/Bug117.dfy
index 2ae4bc70..418746cb 100644
--- a/Test/dafny4/Bug117.dfy
+++ b/Test/dafny4/Bug117.dfy
@@ -8,14 +8,14 @@ abstract module AbstractModule1
 
 abstract module AbstractModule2 
 {
-	import opened AM1 as AbstractModule1
+	import opened AM1 : AbstractModule1
 	
 	datatype AbstractType2 = AbstractType2(x:AbstractType1)
 } 
 
 abstract module AbstractModule3 
 {
-	import AM1 as AbstractModule1
+	import AM1 : AbstractModule1
 	
 	datatype AbstractType2 = AbstractType2(x:AM1.AbstractType1)
 } 
diff --git a/Test/irondafny0/Queue.dfyi b/Test/irondafny0/Queue.dfyi
index 9f7eb534..06f4b29e 100644
--- a/Test/irondafny0/Queue.dfyi
+++ b/Test/irondafny0/Queue.dfyi
@@ -17,6 +17,6 @@ abstract module Queue {
 }
 
 abstract module MainSpec {
-    import Q as Queue
+    import Q : Queue
 }
 
diff --git a/Test/irondafny0/opened_workaround.dfy b/Test/irondafny0/opened_workaround.dfy
index 7464c346..6d44ccfd 100644
--- a/Test/irondafny0/opened_workaround.dfy
+++ b/Test/irondafny0/opened_workaround.dfy
@@ -17,5 +17,5 @@ abstract module B {
 }
 
 abstract module C {
-    import Bee as B       // Works
+    import Bee : B       // Works
 }
diff --git a/Test/irondafny0/xrefine1.dfy b/Test/irondafny0/xrefine1.dfy
index 4b085e6b..1b835649 100644
--- a/Test/irondafny0/xrefine1.dfy
+++ b/Test/irondafny0/xrefine1.dfy
@@ -9,7 +9,7 @@ abstract module ProtocolSpec {
 
 abstract module HostSpec {
     type HostT
-    import P as ProtocolSpec
+    import P : ProtocolSpec
 
     function method foo(h:HostT) : P.ProtoT
 }
@@ -42,8 +42,8 @@ module HostImpl exclusively refines HostSpec {
 }
 
 abstract module MainSpec {
-    import HI as HostSpec
-    import PI as ProtocolSpec
+    import HI : HostSpec
+    import PI : ProtocolSpec
 
     method Test(h1:HI.HostT, h2:HI.HostT) 
         requires HI.foo(h1) == HI.foo(h2);
diff --git a/Test/irondafny0/xrefine2.dfy b/Test/irondafny0/xrefine2.dfy
index 1de4e201..9c33391b 100644
--- a/Test/irondafny0/xrefine2.dfy
+++ b/Test/irondafny0/xrefine2.dfy
@@ -9,7 +9,7 @@ abstract module ProtocolSpec {
 
 abstract module HostSpec {
     type HostT
-    import P as ProtocolSpec
+    import P : ProtocolSpec
 
     function method foo(h:HostT) : P.ProtoT
 }
@@ -42,8 +42,8 @@ module HostImpl exclusively refines HostSpec {
 }
 
 abstract module MainSpec {
-    import HI as HostSpec
-    import PI as ProtocolSpec
+    import HI : HostSpec
+    import PI : ProtocolSpec
 
     method Test(h1:HI.HostT, h2:HI.HostT) 
         requires HI.foo(h1) == HI.foo(h2);
diff --git a/Test/irondafny0/xrefine3.dfy b/Test/irondafny0/xrefine3.dfy
index 44add7cc..86dbd957 100644
--- a/Test/irondafny0/xrefine3.dfy
+++ b/Test/irondafny0/xrefine3.dfy
@@ -12,7 +12,7 @@ abstract module AlphaSpec {
 
 abstract module BetaSpec {
     type Beta
-    import A as AlphaSpec
+    import A : AlphaSpec
 
     predicate IsValid(b:Beta)
 
@@ -49,8 +49,8 @@ module BetaImpl exclusively refines BetaSpec {
 }
 
 abstract module MainSpec {
-    import A as AlphaSpec
-    import B as BetaSpec
+    import A : AlphaSpec
+    import B : BetaSpec
 
     method Main()
     {
-- 
cgit v1.2.3


From 0d003990dd503ceb9cc56e7fb590981e752b5cfa Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Tue, 2 Feb 2016 15:36:36 -0800
Subject: Fix issue 129. When looking for a constructor for which Dafny knows
 how to instantiate all it arguments, don't stop as soon as one instantiable
 constructor is found. Instead, figure out all instantiable constructors and
 then pick the best among these. A simple and reasonable "best" is an
 instantiable constructor that requires a minimal number of already
 constructed type arguments, and to break ties among these, pick the first one
 listed.

---
 Source/Dafny/Resolver.cs      | 23 ++++++++++++++++++-----
 Test/dafny4/Bug129.dfy        | 12 ++++++++++++
 Test/dafny4/Bug129.dfy.expect |  2 ++
 3 files changed, 32 insertions(+), 5 deletions(-)
 create mode 100644 Test/dafny4/Bug129.dfy
 create mode 100644 Test/dafny4/Bug129.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index bddf62e2..e47220d7 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -4171,23 +4171,36 @@ namespace Microsoft.Dafny
       Contract.Ensures(!Contract.Result<bool>() || dt.DefaultCtor != null);
 
       // Stated differently, check that there is some constuctor where no argument type goes to the same stratum.
+      DatatypeCtor defaultCtor = null;
+      List<TypeParameter> lastTypeParametersUsed = null;
       foreach (DatatypeCtor ctor in dt.Ctors) {
-        var typeParametersUsed = new List<TypeParameter>();
+        List<TypeParameter>  typeParametersUsed = new List<TypeParameter>();
         foreach (Formal p in ctor.Formals) {
           if (!CheckCanBeConstructed(p.Type, typeParametersUsed)) {
             // the argument type (has a component which) is not yet known to be constructable
             goto NEXT_OUTER_ITERATION;
           }
         }
-        // this constructor satisfies the requirements, so the datatype is allowed
-        dt.DefaultCtor = ctor;
+        // this constructor satisfies the requirements, check to see if it is a better fit than the 
+        // one found so far. By "better" it means fewer type arguments. Between the ones with
+        // the same number of the type arguments, pick the one shows first.
+        if (defaultCtor == null || typeParametersUsed.Count < lastTypeParametersUsed.Count)  { 
+          defaultCtor = ctor;
+          lastTypeParametersUsed = typeParametersUsed;
+        }
+
+      NEXT_OUTER_ITERATION: { }
+      }
+
+      if (defaultCtor != null) {
+        dt.DefaultCtor = defaultCtor;
         dt.TypeParametersUsedInConstructionByDefaultCtor = new bool[dt.TypeArgs.Count];
         for (int i = 0; i < dt.TypeArgs.Count; i++) {
-          dt.TypeParametersUsedInConstructionByDefaultCtor[i] = typeParametersUsed.Contains(dt.TypeArgs[i]);
+          dt.TypeParametersUsedInConstructionByDefaultCtor[i] = lastTypeParametersUsed.Contains(dt.TypeArgs[i]);
         }
         return true;
-      NEXT_OUTER_ITERATION: { }
       }
+
       // no constructor satisfied the requirements, so this is an illegal datatype declaration
       return false;
     }
diff --git a/Test/dafny4/Bug129.dfy b/Test/dafny4/Bug129.dfy
new file mode 100644
index 00000000..f6cf0fe8
--- /dev/null
+++ b/Test/dafny4/Bug129.dfy
@@ -0,0 +1,12 @@
+// RUN: %dafny /compile:0 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+datatype Maybe<T> = Some(v:T) | None
+datatype B = B(b:Maybe<B>)
+
+datatype List<T> = Nil | Cons(T, List<T>)
+datatype Tree<T> = Nodes(children: List<Tree<T>>)
+
+
+
+
diff --git a/Test/dafny4/Bug129.dfy.expect b/Test/dafny4/Bug129.dfy.expect
new file mode 100644
index 00000000..a1c1f7b9
--- /dev/null
+++ b/Test/dafny4/Bug129.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 0 verified, 0 errors
-- 
cgit v1.2.3


From 4f0b823bdc1be13c2589cc46f650ab57d29e7117 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Thu, 4 Feb 2016 12:35:46 -0800
Subject: Fix issue 128. Change the translation of CanCallAssumption for
 let-such-that expression from       // CanCall[[ var b :| RHS(b,g);
 Body(b,g,h) ]] =       //   (forall b0,b1 :: typeAntecedent ==>       //     
  CanCall[[ RHS(b,g) ]] &&       //       (RHS(b,g) ==> CanCall[[ Body(b,g,h)
 ]]) &&       //       $let$canCall(b,g)) to       // CanCall[[ var b0,b1 :|
 RHS(b0,b1,g); Body(b0,b1,g,h) ]] =       //   $let$canCall(g) &&       //  
 CanCall[[ Body($let$b0(g), $let$b1(g), h) ]]

---
 Source/Dafny/Printer.cs       |  8 +++++---
 Source/Dafny/Translator.cs    | 34 ++++++++++++++++++----------------
 Test/dafny4/Bug128.dfy        | 13 +++++++++++++
 Test/dafny4/Bug128.dfy.expect |  4 ++++
 4 files changed, 40 insertions(+), 19 deletions(-)
 create mode 100644 Test/dafny4/Bug128.dfy
 create mode 100644 Test/dafny4/Bug128.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index accdb9d3..86c493f1 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -1955,9 +1955,11 @@ namespace Microsoft.Dafny {
         var e = (BoxingCastExpr)expr;
         PrintExpr(e.E, contextBindingStrength, fragileContext, isRightmost, isFollowedBySemicolon, indent, keyword);
       } else if (expr is Translator.BoogieWrapper) {
-        wr.Write("[BoogieWrapper]");  // this is somewhat unexpected, but we can get here if the /trace switch is used, so it seems best to cover this case here
-      } else {
-        Contract.Assert(false); throw new cce.UnreachableException();  // unexpected expression
+        wr.Write("[BoogieWrapper]");  // this is somewhat unexpected, but we can get here if the /trace switch is used, so it seems best to cover this case here
+      } else if (expr is Translator.BoogieFunctionCall) {
+        wr.Write("[BoogieFunctionCall]");  // this prevents debugger watch window crash
+      } else {
+        Contract.Assert(false); throw new cce.UnreachableException();  // unexpected expression
       }
     }
 
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index a1fbe646..1208a83a 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -4413,23 +4413,25 @@ namespace Microsoft.Dafny {
           var canCallBody = CanCallAssumption(Substitute(e.Body, null, substMap), etran);
           return BplAnd(canCallRHS, canCallBody);
         } else {
-          // CanCall[[ var b :| RHS(b,g); Body(b,g,h) ]] =
-          //   (forall b :: typeAntecedent ==>
-          //       CanCall[[ RHS(b,g) ]] &&
-          //       (RHS(b,g) ==> CanCall[[ Body(b,g,h) ]]) &&
-          //       $let$canCall(b,g))
-          var bvars = new List<Variable>();
-          Bpl.Expr typeAntecedent = etran.TrBoundVariables(e.BoundVars.ToList<BoundVar>(), bvars);
-          Contract.Assert(e.RHSs.Count == 1);  // this is true of all successfully resolved let-such-that expressions
-          var canCallRHS = CanCallAssumption(e.RHSs[0], etran);
-          var canCallBody = Bpl.Expr.Imp(etran.TrExpr(e.RHSs[0]), CanCallAssumption(e.Body, etran));
-          var d = LetDesugaring(e);  // call LetDesugaring to prepare the desugaring and populate letSuchThatExprInfo with something for e
+          // CanCall[[ var b0,b1 :| RHS(b0,b1,g); Body(b0,b1,g,h) ]] =
+          //   $let$canCall(g) &&
+          //   CanCall[[ Body($let$b0(g), $let$b1(g), h) ]]
+          LetDesugaring(e);  // call LetDesugaring to prepare the desugaring and populate letSuchThatExprInfo with something for e
           var info = letSuchThatExprInfo[e];
-          var canCallFunction = info.CanCallFunctionCall(this, etran);
-          //TRIG (forall d#0: int :: true ==> _module.__default.DividesBoth#canCall($Heap, d#0, a#0, b#0) && (_module.__default.DividesBoth($Heap, d#0, a#0, b#0) ==> (forall m#1: int :: true ==> _module.__default.DividesBoth#canCall($Heap, m#1, a#0, b#0) && (_module.__default.DividesBoth($Heap, m#1, a#0, b#0) ==> true))) && (_module.__default.DividesBoth($Heap, d#0, a#0, b#0) && (forall m#1: int :: true ==> _module.__default.DividesBoth($Heap, m#1, a#0, b#0) ==> m#1 <= d#0) ==> true) && $let#0$canCall($Heap, a#0, b#0))
-          //TRIG (forall g#0: int :: true ==> (x#0 == g#0 ==> true) && $let#0$canCall($Heap, x#0))
-          //TRIGGERS: Not clear what would be good here
-          var cc = new Bpl.ForallExpr(e.tok, bvars, Bpl.Expr.Imp(typeAntecedent, BplAnd(BplAnd(canCallRHS, canCallBody), canCallFunction)));  // LL_TRIGGER
+          // $let$canCall(g)
+          //var canCall = FunctionCall(e.tok, info.CanCallFunctionName(), Bpl.Type.Bool, gExprs);
+          var canCall = info.CanCallFunctionCall(this, etran);         
+          Dictionary<IVariable, Expression> substMap = new Dictionary<IVariable, Expression>();
+          foreach (var bv in e.BoundVars) {
+            // create a call to $let$x(g)
+            //var call = FunctionCall(e.tok, info.SkolemFunctionName(bv), TrType(bv.Type), gExprs);
+            var args = info.SkolemFunctionArgs(bv, this, etran);
+            var call = new BoogieFunctionCall(bv.tok, info.SkolemFunctionName(bv), info.UsesHeap, info.UsesOldHeap, args.Item1, args.Item2);
+            call.Type = bv.Type;
+            substMap.Add(bv, call);
+          }
+          var p = Substitute(e.Body, null, substMap);
+          var cc = BplAnd(canCall, CanCallAssumption(p, etran));
           return cc;
         }
 
diff --git a/Test/dafny4/Bug128.dfy b/Test/dafny4/Bug128.dfy
new file mode 100644
index 00000000..b7220335
--- /dev/null
+++ b/Test/dafny4/Bug128.dfy
@@ -0,0 +1,13 @@
+// RUN: %dafny /noNLarith /z3opt:pi.warnings=true /proverWarnings:1 /compile:0 /autoTriggers:1 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+function GetIndexInSequence<T>(s:seq<T>, x:T) : int
+	requires x in s;
+	ensures  0 <= GetIndexInSequence(s, x) < |s|;
+	ensures  s[GetIndexInSequence(s, x)] == x; {
+		var i :| 0 <= i < |s| && s[i] == x;
+		i
+	} 
+
+
+
diff --git a/Test/dafny4/Bug128.dfy.expect b/Test/dafny4/Bug128.dfy.expect
new file mode 100644
index 00000000..700ad964
--- /dev/null
+++ b/Test/dafny4/Bug128.dfy.expect
@@ -0,0 +1,4 @@
+Prover warning: pattern does not contain all quantified variables.
+Prover warning: pattern does not contain all quantified variables.
+
+Dafny program verifier finished with 1 verified, 0 errors
-- 
cgit v1.2.3


From 74d1631a4724739dbb897c74713f54c4d060e781 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Fri, 5 Feb 2016 15:18:29 -0800
Subject: Fix issue 125. Add the missing case 2 and 3 with refinement and
 opened imports. For the following situation  module LibA {  // ...things
 declared here...  }
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

 module LibB {
 // ...things declared here...
 }

 module R {
 import opened LibA
 // ...things declared here...
 }

 module S refines R {
 import opened LibB
 // ...declared here...
 }

 1. If module R declares a TopLevelDecl “G”, then we should report an error if S
 attempts to declare an incompatible TopLevelDecl “G”. Dafny does this already.

 2. If LibA declares a TopLevelDecl “G” but R does not directly declare any
 TopLevelDecl G”, then we should also issue an error for any TopLevelDecl “G”
 in S. This behavior is missing in Dafny.

 3. If each of LibA and LibB declares some TopLevelDecl “G”, but neither R nor S
 directly declares any TopLevelDecl “G”, then no error should be issued, and
 any use of “G” in S should resolve to the “G” in LibA. This behavior is missing
 in Dafny.
---
 Source/Dafny/Cloner.cs                |   5 +-
 Source/Dafny/DafnyAst.cs              |  15 +++
 Source/Dafny/RefinementTransformer.cs | 174 +++++++++++++++++++---------------
 Source/Dafny/Reporting.cs             |   2 +-
 Source/Dafny/Resolver.cs              |  11 +++
 Test/dafny0/Modules0.dfy              |  12 +++
 Test/dafny0/Modules0.dfy.expect       |   3 +-
 Test/dafny4/Bug125.dfy                |  82 ++++++++++++++++
 Test/dafny4/Bug125.dfy.expect         |   2 +
 9 files changed, 225 insertions(+), 81 deletions(-)
 create mode 100644 Test/dafny4/Bug125.dfy
 create mode 100644 Test/dafny4/Bug125.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Cloner.cs b/Source/Dafny/Cloner.cs
index 8971d2c1..6d5e2961 100644
--- a/Source/Dafny/Cloner.cs
+++ b/Source/Dafny/Cloner.cs
@@ -23,7 +23,10 @@ namespace Microsoft.Dafny
         nw.TopLevelDecls.Add(CloneDeclaration(d, nw));
       }
       if (null != m.RefinementBase) {
-          nw.RefinementBase = m.RefinementBase;
+        nw.RefinementBase = m.RefinementBase;
+      }
+      if (null != m.RefinementBaseSig) {
+        nw.RefinementBaseSig = m.RefinementBaseSig;
       }
       nw.ClonedFrom = m;
       nw.Height = m.Height;
diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 33186a76..0e4c4751 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -1823,6 +1823,21 @@ namespace Microsoft.Dafny {
 
     public int ExclusiveRefinementCount { get; set; }
 
+    private ModuleSignature refinementBaseSig; // module signature of the refinementBase.
+    public ModuleSignature RefinementBaseSig {
+      get {
+        return refinementBaseSig;
+      }
+
+      set {
+        // the refinementBase member may only be changed once.
+        if (null != refinementBaseSig) {
+          throw new InvalidOperationException(string.Format("This module ({0}) already has a refinement base ({1}).", Name, refinementBase.Name));
+        }
+        refinementBaseSig = value;
+      }
+    }
+
     private ModuleDefinition refinementBase; // filled in during resolution via RefinementBase property (null if no refinement base yet or at all).
 
     public ModuleDefinition RefinementBase {
diff --git a/Source/Dafny/RefinementTransformer.cs b/Source/Dafny/RefinementTransformer.cs
index 6281417d..a243ad53 100644
--- a/Source/Dafny/RefinementTransformer.cs
+++ b/Source/Dafny/RefinementTransformer.cs
@@ -141,99 +141,117 @@ namespace Microsoft.Dafny
       }
 
       // Merge the declarations of prev into the declarations of m
+      List<string> processedDecl = new List<string>();
       foreach (var d in prev.TopLevelDecls) {
         int index;
+        processedDecl.Add(d.Name);
         if (!declaredNames.TryGetValue(d.Name, out index)) {
           m.TopLevelDecls.Add(refinementCloner.CloneDeclaration(d, m));
         } else {
           var nw = m.TopLevelDecls[index];
-          if (d is ModuleDecl) {
-            if (!(nw is ModuleDecl)) {
-              reporter.Error(MessageSource.RefinementTransformer, nw, "a module ({0}) must refine another module", nw.Name);
-            } else if (!(d is ModuleFacadeDecl)) {
-              reporter.Error(MessageSource.RefinementTransformer, nw, "a module ({0}) can only refine a module facade", nw.Name);
-            } else {
-              ModuleSignature original = ((ModuleFacadeDecl)d).OriginalSignature;
-              ModuleSignature derived = null;
-              if (nw is AliasModuleDecl) {
-                derived = ((AliasModuleDecl)nw).Signature;
-              } else if (nw is ModuleFacadeDecl) {
-                derived = ((ModuleFacadeDecl)nw).Signature;
-              } else {
-                reporter.Error(MessageSource.RefinementTransformer, nw, "a module ({0}) can only be refined by an alias module or a module facade", d.Name);
+          MergeTopLevelDecls(m, nw, d, index);
+        }
+      }
+
+      // Merge the imports of prev 
+      var prevTopLevelDecls = RefinedSig.TopLevels.Values;
+      foreach (var d in prevTopLevelDecls) {
+        int index;
+        if (!processedDecl.Contains(d.Name) && (declaredNames.TryGetValue(d.Name, out index))) {
+          // if it is redefined, we need to merge them.
+          var nw = m.TopLevelDecls[index];
+          MergeTopLevelDecls(m, nw, d, index);
+        }
+      }
+      m.RefinementBaseSig = RefinedSig;
+
+      Contract.Assert(moduleUnderConstruction == m);  // this should be as it was set earlier in this method
+    }
+
+    private void MergeTopLevelDecls(ModuleDefinition m, TopLevelDecl nw, TopLevelDecl d, int index) {
+      if (d is ModuleDecl) {
+        if (!(nw is ModuleDecl)) {
+          reporter.Error(MessageSource.RefinementTransformer, nw, "a module ({0}) must refine another module", nw.Name);
+        } else if (!(d is ModuleFacadeDecl)) {
+          reporter.Error(MessageSource.RefinementTransformer, nw, "a module ({0}) can only refine a module facade", nw.Name);
+        } else {
+          ModuleSignature original = ((ModuleFacadeDecl)d).OriginalSignature;
+          ModuleSignature derived = null;
+          if (nw is AliasModuleDecl) {
+            derived = ((AliasModuleDecl)nw).Signature;
+          } else if (nw is ModuleFacadeDecl) {
+            derived = ((ModuleFacadeDecl)nw).Signature;
+          } else {
+            reporter.Error(MessageSource.RefinementTransformer, nw, "a module ({0}) can only be refined by an alias module or a module facade", d.Name);
+          }
+          if (derived != null) {
+            // check that the new module refines the previous declaration
+            if (!CheckIsRefinement(derived, original))
+              reporter.Error(MessageSource.RefinementTransformer, nw.tok, "a module ({0}) can only be replaced by a refinement of the original module", d.Name);
+          }
+        }
+      } else if (d is OpaqueTypeDecl) {
+        if (nw is ModuleDecl) {
+          reporter.Error(MessageSource.RefinementTransformer, nw, "a module ({0}) must refine another module", nw.Name);
+        } else {
+          bool dDemandsEqualitySupport = ((OpaqueTypeDecl)d).MustSupportEquality;
+          if (nw is OpaqueTypeDecl) {
+            if (dDemandsEqualitySupport != ((OpaqueTypeDecl)nw).MustSupportEquality) {
+              reporter.Error(MessageSource.RefinementTransformer, nw, "type declaration '{0}' is not allowed to change the requirement of supporting equality", nw.Name);
+            }
+            if (nw.TypeArgs.Count != d.TypeArgs.Count) {
+              reporter.Error(MessageSource.RefinementTransformer, nw, "type '{0}' is not allowed to change its number of type parameters (got {1}, expected {2})", nw.Name, nw.TypeArgs.Count, d.TypeArgs.Count);
+            }
+          } else if (dDemandsEqualitySupport) {
+            if (nw is ClassDecl) {
+              // fine, as long as "nw" takes the right number of type parameters
+              if (nw.TypeArgs.Count != d.TypeArgs.Count) {
+                reporter.Error(MessageSource.RefinementTransformer, nw, "opaque type '{0}' is not allowed to be replaced by a class that takes a different number of type parameters (got {1}, expected {2})", nw.Name, nw.TypeArgs.Count, d.TypeArgs.Count);
               }
-              if (derived != null) {
-                // check that the new module refines the previous declaration
-                if (!CheckIsRefinement(derived, original))
-                  reporter.Error(MessageSource.RefinementTransformer, nw.tok, "a module ({0}) can only be replaced by a refinement of the original module", d.Name);
+            } else if (nw is NewtypeDecl) {
+              // fine, as long as "nw" does not take any type parameters
+              if (nw.TypeArgs.Count != 0) {
+                reporter.Error(MessageSource.RefinementTransformer, nw, "opaque type '{0}', which has {1} type argument{2}, is not allowed to be replaced by a newtype, which takes none", nw.Name, d.TypeArgs.Count, d.TypeArgs.Count == 1 ? "" : "s");
               }
-            }
-          } else if (d is OpaqueTypeDecl) {
-            if (nw is ModuleDecl) {
-              reporter.Error(MessageSource.RefinementTransformer, nw, "a module ({0}) must refine another module", nw.Name);
+            } else if (nw is CoDatatypeDecl) {
+              reporter.Error(MessageSource.RefinementTransformer, nw, "a type declaration that requires equality support cannot be replaced by a codatatype");
             } else {
-              bool dDemandsEqualitySupport = ((OpaqueTypeDecl)d).MustSupportEquality;
-              if (nw is OpaqueTypeDecl) {
-                if (dDemandsEqualitySupport != ((OpaqueTypeDecl)nw).MustSupportEquality) {
-                  reporter.Error(MessageSource.RefinementTransformer, nw, "type declaration '{0}' is not allowed to change the requirement of supporting equality", nw.Name);
-                }
-                if (nw.TypeArgs.Count != d.TypeArgs.Count) {
-                  reporter.Error(MessageSource.RefinementTransformer, nw, "type '{0}' is not allowed to change its number of type parameters (got {1}, expected {2})", nw.Name, nw.TypeArgs.Count, d.TypeArgs.Count);
-                }
-              } else if (dDemandsEqualitySupport) {
-                if (nw is ClassDecl) {
-                  // fine, as long as "nw" takes the right number of type parameters
-                  if (nw.TypeArgs.Count != d.TypeArgs.Count) {
-                    reporter.Error(MessageSource.RefinementTransformer, nw, "opaque type '{0}' is not allowed to be replaced by a class that takes a different number of type parameters (got {1}, expected {2})", nw.Name, nw.TypeArgs.Count, d.TypeArgs.Count);
-                  }
-                } else if (nw is NewtypeDecl) {
-                  // fine, as long as "nw" does not take any type parameters
-                  if (nw.TypeArgs.Count != 0) {
-                    reporter.Error(MessageSource.RefinementTransformer, nw, "opaque type '{0}', which has {1} type argument{2}, is not allowed to be replaced by a newtype, which takes none", nw.Name, d.TypeArgs.Count, d.TypeArgs.Count == 1 ? "" : "s");
-                  }
-                } else if (nw is CoDatatypeDecl) {
-                  reporter.Error(MessageSource.RefinementTransformer, nw, "a type declaration that requires equality support cannot be replaced by a codatatype");
-                } else {
-                  Contract.Assert(nw is IndDatatypeDecl || nw is TypeSynonymDecl);
-                  if (nw.TypeArgs.Count != d.TypeArgs.Count) {
-                    reporter.Error(MessageSource.RefinementTransformer, nw, "opaque type '{0}' is not allowed to be replaced by a type that takes a different number of type parameters (got {1}, expected {2})", nw.Name, nw.TypeArgs.Count, d.TypeArgs.Count);
-                  } else {
-                    // Here, we need to figure out if the new type supports equality.  But we won't know about that until resolution has
-                    // taken place, so we defer it until the PostResolve phase.
-                    var udt = UserDefinedType.FromTopLevelDecl(nw.tok, nw);
-                    postTasks.Enqueue(() => {
-                      if (!udt.SupportsEquality) {
-                        reporter.Error(MessageSource.RefinementTransformer, udt.tok, "type '{0}' is used to refine an opaque type with equality support, but '{0}' does not support equality", udt.Name);
-                      }
-                    });
-                  }
-                }
-              } else if (d.TypeArgs.Count != nw.TypeArgs.Count) {
+              Contract.Assert(nw is IndDatatypeDecl || nw is TypeSynonymDecl);
+              if (nw.TypeArgs.Count != d.TypeArgs.Count) {
                 reporter.Error(MessageSource.RefinementTransformer, nw, "opaque type '{0}' is not allowed to be replaced by a type that takes a different number of type parameters (got {1}, expected {2})", nw.Name, nw.TypeArgs.Count, d.TypeArgs.Count);
+              } else {
+                // Here, we need to figure out if the new type supports equality.  But we won't know about that until resolution has
+                // taken place, so we defer it until the PostResolve phase.
+                var udt = UserDefinedType.FromTopLevelDecl(nw.tok, nw);
+                postTasks.Enqueue(() => {
+                  if (!udt.SupportsEquality) {
+                    reporter.Error(MessageSource.RefinementTransformer, udt.tok, "type '{0}' is used to refine an opaque type with equality support, but '{0}' does not support equality", udt.Name);
+                  }
+                });
               }
             }
-          } else if (nw is OpaqueTypeDecl) {
-            reporter.Error(MessageSource.RefinementTransformer, nw, "an opaque type declaration ({0}) in a refining module cannot replace a more specific type declaration in the refinement base", nw.Name);
-          } else if (nw is DatatypeDecl) {
-            reporter.Error(MessageSource.RefinementTransformer, nw, "a datatype declaration ({0}) in a refinement module can only replace an opaque type declaration", nw.Name);
-          } else if (nw is IteratorDecl) {
-            if (d is IteratorDecl) {
-              m.TopLevelDecls[index] = MergeIterator((IteratorDecl)nw, (IteratorDecl)d);
-            } else {
-              reporter.Error(MessageSource.RefinementTransformer, nw, "an iterator declaration ({0}) is a refining module cannot replace a different kind of declaration in the refinement base", nw.Name);
-            }
-          } else {
-            Contract.Assert(nw is ClassDecl);
-            if (d is DatatypeDecl) {
-              reporter.Error(MessageSource.RefinementTransformer, nw, "a class declaration ({0}) in a refining module cannot replace a different kind of declaration in the refinement base", nw.Name);
-            } else {
-              m.TopLevelDecls[index] = MergeClass((ClassDecl)nw, (ClassDecl)d);
-            }
+          } else if (d.TypeArgs.Count != nw.TypeArgs.Count) {
+            reporter.Error(MessageSource.RefinementTransformer, nw, "opaque type '{0}' is not allowed to be replaced by a type that takes a different number of type parameters (got {1}, expected {2})", nw.Name, nw.TypeArgs.Count, d.TypeArgs.Count);
           }
         }
+      } else if (nw is OpaqueTypeDecl) {
+        reporter.Error(MessageSource.RefinementTransformer, nw, "an opaque type declaration ({0}) in a refining module cannot replace a more specific type declaration in the refinement base", nw.Name);
+      } else if (nw is DatatypeDecl) {
+        reporter.Error(MessageSource.RefinementTransformer, nw, "a datatype declaration ({0}) in a refinement module can only replace an opaque type declaration", nw.Name);
+      } else if (nw is IteratorDecl) {
+        if (d is IteratorDecl) {
+          m.TopLevelDecls[index] = MergeIterator((IteratorDecl)nw, (IteratorDecl)d);
+        } else {
+          reporter.Error(MessageSource.RefinementTransformer, nw, "an iterator declaration ({0}) is a refining module cannot replace a different kind of declaration in the refinement base", nw.Name);
+        }
+      } else {
+        Contract.Assert(nw is ClassDecl);
+        if (d is DatatypeDecl) {
+          reporter.Error(MessageSource.RefinementTransformer, nw, "a class declaration ({0}) in a refining module cannot replace a different kind of declaration in the refinement base", nw.Name);
+        } else {
+          m.TopLevelDecls[index] = MergeClass((ClassDecl)nw, (ClassDecl)d);
+        }
       }
-
-      Contract.Assert(moduleUnderConstruction == m);  // this should be as it was set earlier in this method
     }
 
     public bool CheckIsRefinement(ModuleSignature derived, ModuleSignature original) {
diff --git a/Source/Dafny/Reporting.cs b/Source/Dafny/Reporting.cs
index 760392ca..b36efc55 100644
--- a/Source/Dafny/Reporting.cs
+++ b/Source/Dafny/Reporting.cs
@@ -37,7 +37,7 @@ namespace Microsoft.Dafny {
     // This is the only thing that needs to be overriden
     public virtual bool Message(MessageSource source, ErrorLevel level, IToken tok, string msg) {
       bool discard = (ErrorsOnly && level != ErrorLevel.Error) || // Discard non-errors if ErrorsOnly is set
-                     (tok is TokenWrapper && !(tok is NestedToken)); // Discard wrapped tokens, except for nested ones
+                     (tok is TokenWrapper && !(tok is NestedToken) && !(tok is RefinementToken)); // Discard wrapped tokens, except for nested and refinement
       if (!discard) {
         AllMessages[level].Add(new ErrorMessage { token = tok, message = msg });
       }
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index e47220d7..99b31923 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -1103,6 +1103,17 @@ namespace Microsoft.Dafny
           }
         }
       }
+
+      // second go through and overriding anything from the opened imports with the ones from the refinementBase
+      if (useImports && moduleDef.RefinementBaseSig != null) {
+        foreach (var kv in moduleDef.RefinementBaseSig.TopLevels) {
+          sig.TopLevels[kv.Key] = kv.Value;
+        }
+        foreach (var kv in moduleDef.RefinementBaseSig.StaticMembers) {
+          sig.StaticMembers[kv.Key] = kv.Value;
+        }
+      }
+
       // This is solely used to detect duplicates amongst the various e
       Dictionary<string, TopLevelDecl> toplevels = new Dictionary<string, TopLevelDecl>();
       // Now add the things present
diff --git a/Test/dafny0/Modules0.dfy b/Test/dafny0/Modules0.dfy
index dbbffd87..4b86d848 100644
--- a/Test/dafny0/Modules0.dfy
+++ b/Test/dafny0/Modules0.dfy
@@ -335,3 +335,15 @@ module TopLevelStatics {
   static method M()  // error/warning: static keyword does not belong here
   { }
 }
+
+module Library {
+  class T { }
+}
+
+module AA {
+ import opened Library
+}
+
+module B refines AA {
+  datatype T = MakeT(int)  // illegal
+}
diff --git a/Test/dafny0/Modules0.dfy.expect b/Test/dafny0/Modules0.dfy.expect
index e4b46cce..f51e0f6c 100644
--- a/Test/dafny0/Modules0.dfy.expect
+++ b/Test/dafny0/Modules0.dfy.expect
@@ -30,5 +30,6 @@ Modules0.dfy(320,11): Error: Undeclared top-level type or type parameter: Wazzup
 Modules0.dfy(321,17): Error: module 'Q_Imp' does not declare a type 'Edon'
 Modules0.dfy(323,10): Error: new can be applied only to reference types (got Q_Imp.List<?>)
 Modules0.dfy(324,30): Error: member Create does not exist in class Klassy
+Modules0.dfy(348,11): Error: a datatype declaration (T) in a refinement module can only replace an opaque type declaration
 Modules0.dfy(101,14): Error: Undeclared top-level type or type parameter: MyClassY (did you forget to qualify a name or declare a module import 'opened?')
-31 resolution/type errors detected in Modules0.dfy
+32 resolution/type errors detected in Modules0.dfy
diff --git a/Test/dafny4/Bug125.dfy b/Test/dafny4/Bug125.dfy
new file mode 100644
index 00000000..916dd3f8
--- /dev/null
+++ b/Test/dafny4/Bug125.dfy
@@ -0,0 +1,82 @@
+// RUN: %dafny /compile:0  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+abstract module AbstractModuleA 
+{
+  type T
+} 
+
+abstract module AbstractModuleB 
+{
+  import opened AMA : AbstractModuleA
+
+  method Foo(t:T)
+} 
+
+abstract module AbstractModuleC refines AbstractModuleB 
+{
+  import opened AMA2 : AbstractModuleA
+}
+
+module LibA {
+  class G { 
+    static function f(x:int) : bool {
+      x >= 10
+    }
+  }
+
+  function g() : bool {
+     true
+  }
+}
+
+module LibB {
+  class G { 
+    static function f(x:int) : bool {
+      x < 10
+    }
+  }
+
+  function g() : bool {
+     false
+  }
+}
+
+module R {
+  import opened LibA
+}
+
+module S refines R {
+  import opened LibB
+  method m() {
+    assert g();  // should be LibA.g
+  }
+
+  method m1() {
+   assert G.f(20); // should be LibA.G.f
+  }
+} 
+
+
+module Library {
+
+  class T { }
+
+}
+
+ 
+
+module A {
+
+  import opened Library
+	class T {
+	}
+}
+
+ 
+
+module B refines A {
+
+  datatype T = MakeT(int)  // illegal for the same reason as above, but Dafny fails to issue an error
+
+}
diff --git a/Test/dafny4/Bug125.dfy.expect b/Test/dafny4/Bug125.dfy.expect
new file mode 100644
index 00000000..c87e2af2
--- /dev/null
+++ b/Test/dafny4/Bug125.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 10 verified, 0 errors
-- 
cgit v1.2.3


From e9c589851d913a6566c421c87483dc7e94519f91 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Mon, 8 Feb 2016 12:28:25 -0800
Subject: Fix issue 124. Consider math operators that later turned into
 function calls as candidates for triggers.

---
 Source/Dafny/Triggers/TriggersCollector.cs | 26 ++++++++++++++++++++++++++
 Test/dafny4/Bug124.dfy                     | 14 ++++++++++++++
 Test/dafny4/Bug124.dfy.expect              |  2 ++
 3 files changed, 42 insertions(+)
 create mode 100644 Test/dafny4/Bug124.dfy
 create mode 100644 Test/dafny4/Bug124.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Triggers/TriggersCollector.cs b/Source/Dafny/Triggers/TriggersCollector.cs
index f96d3e4c..4204cc29 100644
--- a/Source/Dafny/Triggers/TriggersCollector.cs
+++ b/Source/Dafny/Triggers/TriggersCollector.cs
@@ -198,6 +198,7 @@ namespace Microsoft.Dafny.Triggers {
           expr is OldExpr || 
           expr is ApplyExpr || 
           expr is DisplayExpression ||
+          TranslateToFunctionCall(expr) ||
           (expr is UnaryOpExpr && (((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Cardinality)) || // FIXME || ((UnaryOpExpr)expr).Op == UnaryOpExpr.Opcode.Fresh doesn't work, as fresh is a pretty tricky predicate when it's not about datatypes. See translator.cs:10944
           (expr is BinaryExpr && (((BinaryExpr)expr).Op == BinaryExpr.Opcode.NotIn || ((BinaryExpr)expr).Op == BinaryExpr.Opcode.In))) {
         annotation = AnnotatePotentialCandidate(expr);
@@ -227,6 +228,31 @@ namespace Microsoft.Dafny.Triggers {
       return annotation;
     }
 
+    // math operations can be turned into a Boogie-level function as in the 
+    // case with /noNLarith.
+    public bool TranslateToFunctionCall(Expression expr) {
+      if (!(expr is BinaryExpr)) {
+        return false;
+      }
+      BinaryExpr e = (BinaryExpr) expr;
+      bool isReal = e.E0.Type.IsNumericBased(Type.NumericPersuation.Real);
+      switch (e.ResolvedOp) {
+        case BinaryExpr.ResolvedOpcode.Lt:
+        case BinaryExpr.ResolvedOpcode.Le:
+        case BinaryExpr.ResolvedOpcode.Ge:
+        case BinaryExpr.ResolvedOpcode.Gt:
+        case BinaryExpr.ResolvedOpcode.Add:
+        case BinaryExpr.ResolvedOpcode.Sub:
+        case BinaryExpr.ResolvedOpcode.Mul:
+        case BinaryExpr.ResolvedOpcode.Div:
+        case BinaryExpr.ResolvedOpcode.Mod:
+          if (!isReal && DafnyOptions.O.DisableNLarith) {
+            return true;
+          }
+          break;
+      }
+      return false;
+    }
     private TriggerAnnotation AnnotatePotentialCandidate(Expression expr) {
       bool expr_is_killer = false;
       var new_expr = TriggerUtils.MaybeWrapInOld(TriggerUtils.PrepareExprForInclusionInTrigger(expr, out expr_is_killer), cache.exprsInOldContext.Contains(expr));
diff --git a/Test/dafny4/Bug124.dfy b/Test/dafny4/Bug124.dfy
new file mode 100644
index 00000000..60f26a00
--- /dev/null
+++ b/Test/dafny4/Bug124.dfy
@@ -0,0 +1,14 @@
+// RUN: %dafny /compile:0 /autoTriggers:1 /noNLarith  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+function power(n:nat, e:nat) : int
+
+lemma lemma_power()
+    ensures forall n:nat, e:nat :: 0 <= n * e && power(n, e) == 5;
+{
+    forall n:nat, e:nat 
+        ensures 0 <= n * e && power(n, e) == 5;
+    {
+        assume false;
+    }
+}
\ No newline at end of file
diff --git a/Test/dafny4/Bug124.dfy.expect b/Test/dafny4/Bug124.dfy.expect
new file mode 100644
index 00000000..52595bf9
--- /dev/null
+++ b/Test/dafny4/Bug124.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 3 verified, 0 errors
-- 
cgit v1.2.3


From 0d08ec191bf3f15ae89dc243877d9295b3004bc6 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Mon, 8 Feb 2016 15:22:06 -0800
Subject: Fix issue 120. Need to wrap operations that are "lit lifted" and
 turned into boogie function calls with "Lit" function.

---
 Source/Dafny/Translator.cs    | 26 +++++++++++++++++---------
 Test/dafny4/Bug120.dfy        | 11 +++++++++++
 Test/dafny4/Bug120.dfy.expect |  2 ++
 3 files changed, 30 insertions(+), 9 deletions(-)
 create mode 100644 Test/dafny4/Bug120.dfy
 create mode 100644 Test/dafny4/Bug120.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 1208a83a..cfb77d84 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -11222,7 +11222,7 @@ namespace Microsoft.Dafny {
                 bOpcode = BinaryOperator.Opcode.Lt;
                 break;
               } else {
-                return translator.FunctionCall(expr.tok, "INTERNAL_lt_boogie", Bpl.Type.Int, e0, e1);
+                return TrToFunctionCall(expr.tok, "INTERNAL_lt_boogie", Bpl.Type.Int, e0, e1, liftLit);
               }
 
             case BinaryExpr.ResolvedOpcode.Le:
@@ -11232,7 +11232,7 @@ namespace Microsoft.Dafny {
                 bOpcode = BinaryOperator.Opcode.Le;
                 break;
               } else {
-                return translator.FunctionCall(expr.tok, "INTERNAL_le_boogie", Bpl.Type.Int, e0, e1);
+                return TrToFunctionCall(expr.tok, "INTERNAL_le_boogie", Bpl.Type.Int, e0, e1, false);
               }
             case BinaryExpr.ResolvedOpcode.Ge:
               keepLits = true;
@@ -11241,7 +11241,7 @@ namespace Microsoft.Dafny {
                 bOpcode = BinaryOperator.Opcode.Ge;
                 break;
               } else {
-                return translator.FunctionCall(expr.tok, "INTERNAL_ge_boogie", Bpl.Type.Int, e0, e1);
+                return TrToFunctionCall(expr.tok, "INTERNAL_ge_boogie", Bpl.Type.Int, e0, e1, false);
               }
             case BinaryExpr.ResolvedOpcode.Gt:
               if (isReal || !DafnyOptions.O.DisableNLarith) {
@@ -11249,7 +11249,7 @@ namespace Microsoft.Dafny {
                 bOpcode = BinaryOperator.Opcode.Gt;
                 break;
               } else {
-                return translator.FunctionCall(expr.tok, "INTERNAL_gt_boogie", Bpl.Type.Int, e0, e1);
+                return TrToFunctionCall(expr.tok, "INTERNAL_gt_boogie", Bpl.Type.Int, e0, e1, liftLit);
               }
             case BinaryExpr.ResolvedOpcode.Add:
               if (!DafnyOptions.O.DisableNLarith) {
@@ -11261,7 +11261,7 @@ namespace Microsoft.Dafny {
                   bOpcode = BinaryOperator.Opcode.Add;
                   break;
                 } else {
-                  return translator.FunctionCall(expr.tok, "INTERNAL_add_boogie", Bpl.Type.Int, e0, e1);
+                  return TrToFunctionCall(expr.tok, "INTERNAL_add_boogie", Bpl.Type.Int, e0, e1, liftLit);
                 }
               }
             case BinaryExpr.ResolvedOpcode.Sub:
@@ -11274,7 +11274,7 @@ namespace Microsoft.Dafny {
                   bOpcode = BinaryOperator.Opcode.Sub;
                   break;
                 } else {
-                  return translator.FunctionCall(expr.tok, "INTERNAL_sub_boogie", Bpl.Type.Int, e0, e1);
+                  return TrToFunctionCall(expr.tok, "INTERNAL_sub_boogie", Bpl.Type.Int, e0, e1, liftLit);
                 }
               }
             case BinaryExpr.ResolvedOpcode.Mul:
@@ -11287,7 +11287,7 @@ namespace Microsoft.Dafny {
                   bOpcode = BinaryOperator.Opcode.Mul;
                   break;
                 } else {
-                  return translator.FunctionCall(expr.tok, "INTERNAL_mul_boogie", Bpl.Type.Int, e0, e1);
+                  return TrToFunctionCall(expr.tok, "INTERNAL_mul_boogie", Bpl.Type.Int, e0, e1, liftLit);
                 }
               }
 
@@ -11300,7 +11300,7 @@ namespace Microsoft.Dafny {
                   typ = Bpl.Type.Int;
                   bOpcode = BinaryOperator.Opcode.Div; break;
                 } else {
-                  return translator.FunctionCall(expr.tok, "INTERNAL_div_boogie", Bpl.Type.Int, e0, e1);
+                  return TrToFunctionCall(expr.tok, "INTERNAL_div_boogie", Bpl.Type.Int, e0, e1, liftLit);
                 }
               }
             case BinaryExpr.ResolvedOpcode.Mod:
@@ -11313,7 +11313,7 @@ namespace Microsoft.Dafny {
                   bOpcode = BinaryOperator.Opcode.Mod;
                   break;
                 } else {
-                  return translator.FunctionCall(expr.tok, "INTERNAL_mod_boogie", Bpl.Type.Int, e0, e1);
+                  return TrToFunctionCall(expr.tok, "INTERNAL_mod_boogie", Bpl.Type.Int, e0, e1, liftLit);
                 }
               }
 
@@ -11651,6 +11651,14 @@ namespace Microsoft.Dafny {
         }
       }
 
+      private Expr TrToFunctionCall(IToken tok, string function, Bpl.Type returnType, Bpl.Expr e0, Bpl.Expr e1, bool liftLit) {
+        Bpl.Expr re = translator.FunctionCall(tok, function, returnType, e0, e1);
+        if (liftLit) {
+          re = MaybeLit(re, returnType);
+        }
+        return re;
+      }
+
       private Expr TrLambdaExpr(LambdaExpr e) {
         var bvars = new List<Bpl.Variable>();
         var bargs = new List<Bpl.Expr>();
diff --git a/Test/dafny4/Bug120.dfy b/Test/dafny4/Bug120.dfy
new file mode 100644
index 00000000..73553f2a
--- /dev/null
+++ b/Test/dafny4/Bug120.dfy
@@ -0,0 +1,11 @@
+// RUN: %dafny /compile:0 /noNLarith "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+function G(n: nat): nat
+{
+  if n == 0 then 5 else G(n-1)
+}
+
+method Test() {
+  assert G(10) == 5;
+}
\ No newline at end of file
diff --git a/Test/dafny4/Bug120.dfy.expect b/Test/dafny4/Bug120.dfy.expect
new file mode 100644
index 00000000..52595bf9
--- /dev/null
+++ b/Test/dafny4/Bug120.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 3 verified, 0 errors
-- 
cgit v1.2.3


From 8ee1a3fdb07906ee3858eb602c1823f9c1343b72 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Tue, 9 Feb 2016 14:24:59 -0800
Subject: Fix issue 131. Instead of crashing, report an error when an undefined
 member of a class is referenced.

---
 Source/Dafny/Resolver.cs      |  7 ++++---
 Test/dafny4/Bug131.dfy        | 11 +++++++++++
 Test/dafny4/Bug131.dfy.expect |  2 ++
 3 files changed, 17 insertions(+), 3 deletions(-)
 create mode 100644 Test/dafny4/Bug131.dfy
 create mode 100644 Test/dafny4/Bug131.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 99b31923..fe31201a 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -7282,7 +7282,7 @@ namespace Microsoft.Dafny
       return rr.Type;
     }
 
-    MemberDecl ResolveMember(IToken tok, Type receiverType, string memberName, out NonProxyType nptype) {
+    MemberDecl ResolveMember(IToken tok, Type receiverType, string memberName, out NonProxyType nptype, bool classMembersOnly = false) {
       Contract.Requires(tok != null);
       Contract.Requires(receiverType != null);
       Contract.Requires(memberName != null);
@@ -7319,7 +7319,7 @@ namespace Microsoft.Dafny
             reporter.Error(MessageSource.Resolver, tok, "{0} {1} does not have an anonymous constructor", kind, ctype.Name);
           } else {
             // search the static members of the enclosing module or its imports
-            if (moduleInfo.StaticMembers.TryGetValue(memberName, out member)) {
+            if (!classMembersOnly && moduleInfo.StaticMembers.TryGetValue(memberName, out member)) {
               Contract.Assert(member.IsStatic); // moduleInfo.StaticMembers is supposed to contain only static members of the module's implicit class _default
               if (member is AmbiguousMemberDecl) {
                 var ambiguousMember = (AmbiguousMemberDecl)member;
@@ -9236,8 +9236,9 @@ namespace Microsoft.Dafny
         }
       } else if (lhs != null) {
         // ----- 4. Look up name in the type of the Lhs
+        bool classMemberOnly = UserDefinedType.DenotesClass(expr.Lhs.Type) == null ? false : true;
         NonProxyType nptype;
-        member = ResolveMember(expr.tok, expr.Lhs.Type, expr.SuffixName, out nptype);
+        member = ResolveMember(expr.tok, expr.Lhs.Type, expr.SuffixName, out nptype, classMemberOnly);
         if (member != null) {
           Expression receiver;
           if (!member.IsStatic) {
diff --git a/Test/dafny4/Bug131.dfy b/Test/dafny4/Bug131.dfy
new file mode 100644
index 00000000..5d01cf59
--- /dev/null
+++ b/Test/dafny4/Bug131.dfy
@@ -0,0 +1,11 @@
+// RUN: %dafny /compile:0 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+class Cell {
+  method Test(c: Cell) {
+    assert c.F();
+  }
+}
+
+predicate F()
+
diff --git a/Test/dafny4/Bug131.dfy.expect b/Test/dafny4/Bug131.dfy.expect
new file mode 100644
index 00000000..b4c98652
--- /dev/null
+++ b/Test/dafny4/Bug131.dfy.expect
@@ -0,0 +1,2 @@
+Bug131.dfy(6,13): Error: member F does not exist in class Cell
+1 resolution/type errors detected in Bug131.dfy
-- 
cgit v1.2.3


From 3edef4354012d635ac5d44b8a33078af7211d0d3 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Thu, 11 Feb 2016 14:29:37 -0800
Subject: Add /view:<view1, view2> option to filter module exports to be
 printed.

---
 Source/Dafny/DafnyMain.cs    |   8 +-
 Source/Dafny/DafnyOptions.cs | 795 ++++++++++++++++++++++---------------------
 Source/Dafny/Printer.cs      |  57 +++-
 3 files changed, 457 insertions(+), 403 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyMain.cs b/Source/Dafny/DafnyMain.cs
index 251d8656..fd2e00fb 100644
--- a/Source/Dafny/DafnyMain.cs
+++ b/Source/Dafny/DafnyMain.cs
@@ -12,7 +12,7 @@ using Bpl = Microsoft.Boogie;
 namespace Microsoft.Dafny {
   public class Main {
 
-      private static void MaybePrintProgram(Program program, string filename)
+      private static void MaybePrintProgram(Program program, string filename, bool afterResolver)
       {
           if (filename != null) {
               TextWriter tw;
@@ -22,7 +22,7 @@ namespace Microsoft.Dafny {
                   tw = new System.IO.StreamWriter(filename);
               }
               Printer pr = new Printer(tw, DafnyOptions.O.PrintMode);
-              pr.PrintProgram(program);
+              pr.PrintProgram(program, afterResolver);
           }
       }
    
@@ -62,13 +62,13 @@ namespace Microsoft.Dafny {
 
       program = new Program(programName, module, builtIns, reporter);
 
-      MaybePrintProgram(program, DafnyOptions.O.DafnyPrintFile);
+      MaybePrintProgram(program, DafnyOptions.O.DafnyPrintFile, false);
 
       if (Bpl.CommandLineOptions.Clo.NoResolve || Bpl.CommandLineOptions.Clo.NoTypecheck) { return null; }
 
       Dafny.Resolver r = new Dafny.Resolver(program);
       r.ResolveProgram(program);
-      MaybePrintProgram(program, DafnyOptions.O.DafnyPrintResolvedFile);
+      MaybePrintProgram(program, DafnyOptions.O.DafnyPrintResolvedFile, true);
 
       if (reporter.Count(ErrorLevel.Error) != 0) {
         return string.Format("{0} resolution/type errors detected in {1}", reporter.Count(ErrorLevel.Error), program.Name);
diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index b61ba555..f3b38a84 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -1,222 +1,228 @@
-using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Text;
-using System.Diagnostics.Contracts;
-using Bpl = Microsoft.Boogie;
-
-namespace Microsoft.Dafny
-{
-  public class DafnyOptions : Bpl.CommandLineOptions
-  {
-    private ErrorReporter errorReporter;
-
-    public DafnyOptions(ErrorReporter errorReporter = null)
-      : base("Dafny", "Dafny program verifier") {
-        this.errorReporter = errorReporter;
-        SetZ3ExecutableName();
-    }
-
-    public override string VersionNumber {
-      get {
-        return System.Diagnostics.FileVersionInfo.GetVersionInfo(System.Reflection.Assembly.GetExecutingAssembly().Location).FileVersion
-#if ENABLE_IRONDAFNY
-          + "[IronDafny]"
-#endif
-          ;
-      }
-    }
-    public override string VersionSuffix {
-      get {
-        return " version " + VersionNumber + ", Copyright (c) 2003-2015, Microsoft.";
-      }
-    }
-
-    private static DafnyOptions clo;
-    public static DafnyOptions O {
-      get { return clo; }
-    }
-
-    public static void Install(DafnyOptions options) {
-      Contract.Requires(options != null);
-      clo = options;
-      Bpl.CommandLineOptions.Install(options);
-    }
-
-    public bool UnicodeOutput = false;
-    public bool DisallowSoundnessCheating = false;
-    public bool Dafnycc = false;
-    public int Induction = 3;
-    public int InductionHeuristic = 6;
-    public string DafnyPrelude = null;
-    public string DafnyPrintFile = null;
-    public enum PrintModes { Everything, NoIncludes, NoGhost };
-    public PrintModes PrintMode = PrintModes.Everything;  // Default to printing everything
-    public bool DafnyVerify = true;
-    public string DafnyPrintResolvedFile = null;
-    public bool Compile = true;
-    public bool ForceCompile = false;
-    public bool RunAfterCompile = false;
-    public bool SpillTargetCode = false;
-    public bool DisallowIncludes = false;
-    public bool DisableNLarith = false;
-    public string AutoReqPrintFile = null;
-    public bool ignoreAutoReq = false;
-    public bool AllowGlobals = false;
-    public bool CountVerificationErrors = true;
-    public bool Optimize = false;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Diagnostics.Contracts;
+using Bpl = Microsoft.Boogie;
+
+namespace Microsoft.Dafny
+{
+  public class DafnyOptions : Bpl.CommandLineOptions
+  {
+    private ErrorReporter errorReporter;
+
+    public DafnyOptions(ErrorReporter errorReporter = null)
+      : base("Dafny", "Dafny program verifier") {
+        this.errorReporter = errorReporter;
+        SetZ3ExecutableName();
+    }
+
+    public override string VersionNumber {
+      get {
+        return System.Diagnostics.FileVersionInfo.GetVersionInfo(System.Reflection.Assembly.GetExecutingAssembly().Location).FileVersion
+#if ENABLE_IRONDAFNY
+          + "[IronDafny]"
+#endif
+          ;
+      }
+    }
+    public override string VersionSuffix {
+      get {
+        return " version " + VersionNumber + ", Copyright (c) 2003-2015, Microsoft.";
+      }
+    }
+
+    private static DafnyOptions clo;
+    public static DafnyOptions O {
+      get { return clo; }
+    }
+
+    public static void Install(DafnyOptions options) {
+      Contract.Requires(options != null);
+      clo = options;
+      Bpl.CommandLineOptions.Install(options);
+    }
+
+    public bool UnicodeOutput = false;
+    public bool DisallowSoundnessCheating = false;
+    public bool Dafnycc = false;
+    public int Induction = 3;
+    public int InductionHeuristic = 6;
+    public string DafnyPrelude = null;
+    public string DafnyPrintFile = null;
+    public enum PrintModes { Everything, NoIncludes, NoGhost };
+    public PrintModes PrintMode = PrintModes.Everything;  // Default to printing everything
+    public bool DafnyVerify = true;
+    public string DafnyPrintResolvedFile = null;
+    public List<string> DafnyPrintExportedViews = new List<string>();
+    public bool Compile = true;
+    public bool ForceCompile = false;
+    public bool RunAfterCompile = false;
+    public bool SpillTargetCode = false;
+    public bool DisallowIncludes = false;
+    public bool DisableNLarith = false;
+    public string AutoReqPrintFile = null;
+    public bool ignoreAutoReq = false;
+    public bool AllowGlobals = false;
+    public bool CountVerificationErrors = true;
+    public bool Optimize = false;
     public bool AutoTriggers = false;
     public bool RewriteFocalPredicates = true;
-    public bool PrintTooltips = false;
-    public bool PrintStats = false;
-    public bool PrintFunctionCallGraph = false;
+    public bool PrintTooltips = false;
+    public bool PrintStats = false;
+    public bool PrintFunctionCallGraph = false;
     public bool WarnShadowing = false;
-    public bool IronDafny = 
-#if ENABLE_IRONDAFNY 
-      true
-#else
-      false
-#endif
-    ;
-
-    protected override bool ParseOption(string name, Bpl.CommandLineOptionEngine.CommandLineParseState ps) {
-      var args = ps.args;  // convenient synonym
-
-      switch (name) {
-        case "dprelude":
-          if (ps.ConfirmArgumentCount(1)) {
-            DafnyPrelude = args[ps.i];
-          }
-          return true;
-
-        case "dprint":
-          if (ps.ConfirmArgumentCount(1)) {
-            DafnyPrintFile = args[ps.i];
-          }
-          return true;
-
-        case "printMode":
-          if (ps.ConfirmArgumentCount(1)) {
-            if (args[ps.i].Equals("Everything")) {
-              PrintMode = PrintModes.Everything;
-            }
-            else if (args[ps.i].Equals("NoIncludes"))
-            {
-                PrintMode = PrintModes.NoIncludes;
-            }
-            else if (args[ps.i].Equals("NoGhost"))
-            {
-                PrintMode = PrintModes.NoGhost;
-            }
-            else
-            {
-                throw new Exception("Invalid value for printMode");
-            }
-          }
-          return true;
-
-        case "rprint":
-          if (ps.ConfirmArgumentCount(1)) {
-            DafnyPrintResolvedFile = args[ps.i];
-          }
-          return true;
-
-        case "compile": {
-            int compile = 0;
-            if (ps.GetNumericArgument(ref compile, 4)) {
-              // convert option to two booleans
-              Compile = compile != 0;
-              ForceCompile = compile == 2;
-              RunAfterCompile = compile == 3;
-            }
-            return true;
-          }
-
-        case "dafnyVerify":
-            {
-                int verify = 0;
-                if (ps.GetNumericArgument(ref verify, 2)) {
-                    DafnyVerify = verify != 0; // convert to boolean
-                }
-                return true;
-            }
-
-        case "spillTargetCode": {
-            int spill = 0;
-            if (ps.GetNumericArgument(ref spill, 2)) {
-              SpillTargetCode = spill != 0;  // convert to a boolean
-            }
-            return true;
-          }
-
-        case "dafnycc":
-          Dafnycc = true;
-          Induction = 0;
-          Compile = false;
-          UseAbstractInterpretation = false; // /noinfer
-          return true;
-
-        case "noCheating": {
-            int cheat = 0; // 0 is default, allows cheating
-            if (ps.GetNumericArgument(ref cheat, 2)) {
-              DisallowSoundnessCheating = cheat == 1;
-            }
-            return true;
-          }
-
-        case "induction":
-          ps.GetNumericArgument(ref Induction, 4);
-          return true;
-
-        case "inductionHeuristic":
-          ps.GetNumericArgument(ref InductionHeuristic, 7);
-          return true;
-
-        case "noIncludes":
-          DisallowIncludes = true;
-          return true;
-
-        case "noNLarith":
-          DisableNLarith = true;
-          this.AddZ3Option("smt.arith.nl=false");
-          return true;
-
-        case "autoReqPrint":
-          if (ps.ConfirmArgumentCount(1)) {
-              AutoReqPrintFile = args[ps.i];
-          }
-          return true;
-
-        case "noAutoReq":
-          ignoreAutoReq = true;
-          return true;
-
-        case "allowGlobals":
-          AllowGlobals = true;
-          return true;
-        
-        case "stats":
-          PrintStats = true;
-          return true;
-
-        case "funcCallGraph":
-          PrintFunctionCallGraph = true;
-          return true;
-
-        case "warnShadowing":
-          WarnShadowing = true;
-          return true;
-
-        case "countVerificationErrors": {
-          int countErrors = 1; // defaults to reporting verification errors
-          if (ps.GetNumericArgument(ref countErrors, 2)) {
-            CountVerificationErrors = countErrors == 1;
-          }
-          return true;
-        }
-
-        case "printTooltips":
-          PrintTooltips = true;
+    public bool IronDafny = 
+#if ENABLE_IRONDAFNY 
+      true
+#else
+      false
+#endif
+    ;
+
+    protected override bool ParseOption(string name, Bpl.CommandLineOptionEngine.CommandLineParseState ps) {
+      var args = ps.args;  // convenient synonym
+
+      switch (name) {
+        case "dprelude":
+          if (ps.ConfirmArgumentCount(1)) {
+            DafnyPrelude = args[ps.i];
+          }
+          return true;
+
+        case "dprint":
+          if (ps.ConfirmArgumentCount(1)) {
+            DafnyPrintFile = args[ps.i];
+          }
+          return true;
+
+        case "printMode":
+          if (ps.ConfirmArgumentCount(1)) {
+            if (args[ps.i].Equals("Everything")) {
+              PrintMode = PrintModes.Everything;
+            }
+            else if (args[ps.i].Equals("NoIncludes"))
+            {
+                PrintMode = PrintModes.NoIncludes;
+            }
+            else if (args[ps.i].Equals("NoGhost"))
+            {
+                PrintMode = PrintModes.NoGhost;
+            }
+            else
+            {
+                throw new Exception("Invalid value for printMode");
+            }
+          }
+          return true;
+
+        case "rprint":
+          if (ps.ConfirmArgumentCount(1)) {
+            DafnyPrintResolvedFile = args[ps.i];
+          }
+          return true;
+        case "view":
+          if (ps.ConfirmArgumentCount(1)) {
+            DafnyPrintExportedViews = args[ps.i].Split(',').ToList();
+          }
+          return true;
+
+        case "compile": {
+            int compile = 0;
+            if (ps.GetNumericArgument(ref compile, 4)) {
+              // convert option to two booleans
+              Compile = compile != 0;
+              ForceCompile = compile == 2;
+              RunAfterCompile = compile == 3;
+            }
+            return true;
+          }
+
+        case "dafnyVerify":
+            {
+                int verify = 0;
+                if (ps.GetNumericArgument(ref verify, 2)) {
+                    DafnyVerify = verify != 0; // convert to boolean
+                }
+                return true;
+            }
+
+        case "spillTargetCode": {
+            int spill = 0;
+            if (ps.GetNumericArgument(ref spill, 2)) {
+              SpillTargetCode = spill != 0;  // convert to a boolean
+            }
+            return true;
+          }
+
+        case "dafnycc":
+          Dafnycc = true;
+          Induction = 0;
+          Compile = false;
+          UseAbstractInterpretation = false; // /noinfer
+          return true;
+
+        case "noCheating": {
+            int cheat = 0; // 0 is default, allows cheating
+            if (ps.GetNumericArgument(ref cheat, 2)) {
+              DisallowSoundnessCheating = cheat == 1;
+            }
+            return true;
+          }
+
+        case "induction":
+          ps.GetNumericArgument(ref Induction, 4);
+          return true;
+
+        case "inductionHeuristic":
+          ps.GetNumericArgument(ref InductionHeuristic, 7);
+          return true;
+
+        case "noIncludes":
+          DisallowIncludes = true;
+          return true;
+
+        case "noNLarith":
+          DisableNLarith = true;
+          this.AddZ3Option("smt.arith.nl=false");
+          return true;
+
+        case "autoReqPrint":
+          if (ps.ConfirmArgumentCount(1)) {
+              AutoReqPrintFile = args[ps.i];
+          }
+          return true;
+
+        case "noAutoReq":
+          ignoreAutoReq = true;
+          return true;
+
+        case "allowGlobals":
+          AllowGlobals = true;
+          return true;
+        
+        case "stats":
+          PrintStats = true;
+          return true;
+
+        case "funcCallGraph":
+          PrintFunctionCallGraph = true;
+          return true;
+
+        case "warnShadowing":
+          WarnShadowing = true;
+          return true;
+
+        case "countVerificationErrors": {
+          int countErrors = 1; // defaults to reporting verification errors
+          if (ps.GetNumericArgument(ref countErrors, 2)) {
+            CountVerificationErrors = countErrors == 1;
+          }
+          return true;
+        }
+
+        case "printTooltips":
+          PrintTooltips = true;
           return true;
 
         case "autoTriggers": {
@@ -225,182 +231,187 @@ namespace Microsoft.Dafny
               AutoTriggers = autoTriggers == 1;
             }
             return true;
-          }
-
+          }
+
         case "rewriteFocalPredicates": {
             int rewriteFocalPredicates = 0;
             if (ps.GetNumericArgument(ref rewriteFocalPredicates, 2)) {
-              RewriteFocalPredicates = rewriteFocalPredicates == 1;
-            }
-            return true;
-          }
-
-        case "optimize": {
-            Optimize = true;
-            return true;
-        }
-
-        case "noIronDafny": {
-            IronDafny = false;
-            return true;
-        }
-
-        case "ironDafny": {
-            IronDafny = true;
-            return true;
-        }
-
-        default:
-          break;
-      }
-      // not a Dafny-specific option, so defer to superclass
-      return base.ParseOption(name, ps);
-    }
-
-    public override void ApplyDefaultOptions() {
-      base.ApplyDefaultOptions();
-
-      // expand macros in filenames, now that LogPrefix is fully determined
-      ExpandFilename(ref DafnyPrelude, LogPrefix, FileTimestamp);
-      ExpandFilename(ref DafnyPrintFile, LogPrefix, FileTimestamp);
-    }
-
-    public override void AttributeUsage() {
-      // TODO: provide attribute help here
-    }
-
-    
-    /// <summary>
-    /// Dafny comes with it's own copy of z3, to save new users the trouble of having to install extra dependency. 
-    /// For this to work, Dafny makes the Z3ExecutablePath point to the path were Z3 is put by our release script.
-    /// For developers though (and people getting this from source), it's convenient to be able to run right away, 
-    /// so we vendor a Windows version.
-    /// </summary>
-    private void SetZ3ExecutableName() {
-      var platform = (int)System.Environment.OSVersion.Platform;
-
-      // http://www.mono-project.com/docs/faq/technical/
-      var isUnix = platform == 4 || platform == 128;
-      
-      var z3binName = isUnix ? "z3" : "z3.exe";
-      var dafnyBinDir = System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location);
-      var z3BinDir = System.IO.Path.Combine(dafnyBinDir, "z3", "bin");
-      var z3BinPath = System.IO.Path.Combine(z3BinDir, z3binName);
-
-      if (!System.IO.File.Exists(z3BinPath) && !isUnix) {
-        // This is most likely a Windows user running from source without downloading z3 
-        // separately; this is ok, since we vendor z3.exe.
-        z3BinPath = System.IO.Path.Combine(dafnyBinDir, z3binName);
-      }
-      
-      if (!System.IO.File.Exists(z3BinPath) && errorReporter != null) {
-        var tok = new Bpl.Token(1, 1) { filename = "*** " };
-        errorReporter.Warning(MessageSource.Other, tok, "Could not find '{0}' in '{1}'.{2}Downloading and extracting a Z3 distribution to Dafny's 'Binaries' folder would solve this issue; for now, we'll rely on Boogie to find Z3.", 
-          z3binName, z3BinDir, System.Environment.NewLine);
-      } else {
-        Z3ExecutablePath = z3BinPath;
-      }
-    }
-
-    public override void Usage() {
-      Console.WriteLine(@"  ---- Dafny options ---------------------------------------------------------
-
-  Multiple .dfy files supplied on the command line are concatenated into one
-  Dafny program.
-
-  /dprelude:<file>
-                choose Dafny prelude file
-  /dprint:<file>
-                print Dafny program after parsing it
-                (use - as <file> to print to console)
-  /printMode:<Everything|NoIncludes|NoGhost>
-                Everything is the default.
-                NoIncludes disables printing of {:verify false} methods incorporated via the
-                include mechanism, as well as datatypes and fields included from other files.
-                NoGhost disables printing of functions, ghost methods, and proof statements in
-                implementation methods.  It also disables anything NoIncludes disables.
-  /rprint:<file>
-                print Dafny program after resolving it
-                (use - as <file> to print to console)
-  /dafnyVerify:<n>
-                0 - stop after typechecking
-                1 - continue on to translation, verification, and compilation
-  /compile:<n>  0 - do not compile Dafny program
-                1 (default) - upon successful verification of the Dafny
-                    program, compile Dafny program to .NET assembly
-                    Program.exe (if the program has a Main method) or
-                    Program.dll (othewise), where Program.dfy is the name
-                    of the last .dfy file on the command line
-                2 - always attempt to compile Dafny program to C# program
-                    out.cs, regardless of verification outcome
-                3 - if there is a Main method and there are no verification
-                    errors, compiles program in memory (i.e., does not write
-                    an output file) and runs it
-  /spillTargetCode:<n>
-                0 (default) - don't write the compiled Dafny program (but
-                    still compile it, if /compile indicates to do so)
-                1 - write the compiled Dafny program as a .cs file
-  /dafnycc      Disable features not supported by DafnyCC
-  /noCheating:<n>
-                0 (default) - allow assume statements and free invariants
-                1 - treat all assumptions as asserts, and drop free.
-  /induction:<n>
-                0 - never do induction, not even when attributes request it
-                1 - only apply induction when attributes request it
-                2 - apply induction as requested (by attributes) and also
-                    for heuristically chosen quantifiers
-                3 (default) - apply induction as requested, and for
-                    heuristically chosen quantifiers and lemmas
-  /inductionHeuristic:<n>
-                0 - least discriminating induction heuristic (that is, lean
-                    toward applying induction more often)
-                1,2,3,4,5 - levels in between, ordered as follows as far as
-                    how discriminating they are:  0 < 1 < 2 < (3,4) < 5 < 6
-                6 (default) - most discriminating
-  /noIncludes   Ignore include directives
-  /noNLarith    Reduce Z3's knowledge of non-linear arithmetic (*,/,%).
-                Results in more manual work, but also produces more predictable behavior.
-  /autoReqPrint:<file>
-                Print out requirements that were automatically generated by autoReq.
-  /noAutoReq    Ignore autoReq attributes
-  /allowGlobals Allow the implicit class '_default' to contain fields, instance functions,
-                and instance methods.  These class members are declared at the module scope,
-                outside of explicit classes.  This command-line option is provided to simplify
-                a transition from the behavior in the language prior to version 1.9.3, from
-                which point onward all functions and methods declared at the module scope are
-                implicitly static and fields declarations are not allowed at the module scope.
-  /countVerificationErrors:<n>
-                0 - If preprocessing succeeds, set exit code to 0 regardless of the number
-                    of verification errors.
-                1 (default) - If preprocessing succeeds, set exit code to the number of
-                              verification errors.
-  /autoTriggers:<n>
-                0 (default) - Do not generate {:trigger} annotations for user-level quantifiers.
-                1 - Add a {:trigger} to each user-level quantifier. Existing
-                              annotations are preserved.
-  /rewriteFocalPredicates:<n>
-                0 - Don't rewrite predicates in the body of prefix lemmas.
-                1 (default) - In the body of prefix lemmas, rewrite any use of a focal predicate
-                              P to P#[_k-1].
-  /optimize     Produce optimized C# code, meaning:
-                  - selects optimized C# prelude by passing 
-                    /define:DAFNY_USE_SYSTEM_COLLECTIONS_IMMUTABLE to csc.exe (requires 
-                    System.Collections.Immutable.dll in the source directory to successfully 
-                    compile).
-                  - passes /optimize flag to csc.exe.
-  /stats        Print interesting statistics about the Dafny files supplied.
-  /funcCallGraph Print out the function call graph.  Format is: func,mod=callee*
-  /warnShadowing  Emits a warning if the name of a declared variable caused another variable
-                to be shadowed
-  /ironDafny    Enable experimental features needed to support Ironclad/Ironfleet. Use of
-                these features may cause your code to become incompatible with future
-                releases of Dafny.
-  /noIronDafny  Disable Ironclad/Ironfleet features, if enabled by default.
-  /printTooltips    
-                Dump additional positional information (displayed as mouse-over tooltips by 
-                the VS plugin) to stdout as 'Info' messages.
-");
-      base.Usage();  // also print the Boogie options
-    }
-  }
-}
+              RewriteFocalPredicates = rewriteFocalPredicates == 1;
+            }
+            return true;
+          }
+
+        case "optimize": {
+            Optimize = true;
+            return true;
+        }
+
+        case "noIronDafny": {
+            IronDafny = false;
+            return true;
+        }
+
+        case "ironDafny": {
+            IronDafny = true;
+            return true;
+        }
+
+        default:
+          break;
+      }
+      // not a Dafny-specific option, so defer to superclass
+      return base.ParseOption(name, ps);
+    }
+
+    public override void ApplyDefaultOptions() {
+      base.ApplyDefaultOptions();
+
+      // expand macros in filenames, now that LogPrefix is fully determined
+      ExpandFilename(ref DafnyPrelude, LogPrefix, FileTimestamp);
+      ExpandFilename(ref DafnyPrintFile, LogPrefix, FileTimestamp);
+    }
+
+    public override void AttributeUsage() {
+      // TODO: provide attribute help here
+    }
+
+    
+    /// <summary>
+    /// Dafny comes with it's own copy of z3, to save new users the trouble of having to install extra dependency. 
+    /// For this to work, Dafny makes the Z3ExecutablePath point to the path were Z3 is put by our release script.
+    /// For developers though (and people getting this from source), it's convenient to be able to run right away, 
+    /// so we vendor a Windows version.
+    /// </summary>
+    private void SetZ3ExecutableName() {
+      var platform = (int)System.Environment.OSVersion.Platform;
+
+      // http://www.mono-project.com/docs/faq/technical/
+      var isUnix = platform == 4 || platform == 128;
+      
+      var z3binName = isUnix ? "z3" : "z3.exe";
+      var dafnyBinDir = System.IO.Path.GetDirectoryName(System.Reflection.Assembly.GetExecutingAssembly().Location);
+      var z3BinDir = System.IO.Path.Combine(dafnyBinDir, "z3", "bin");
+      var z3BinPath = System.IO.Path.Combine(z3BinDir, z3binName);
+
+      if (!System.IO.File.Exists(z3BinPath) && !isUnix) {
+        // This is most likely a Windows user running from source without downloading z3 
+        // separately; this is ok, since we vendor z3.exe.
+        z3BinPath = System.IO.Path.Combine(dafnyBinDir, z3binName);
+      }
+      
+      if (!System.IO.File.Exists(z3BinPath) && errorReporter != null) {
+        var tok = new Bpl.Token(1, 1) { filename = "*** " };
+        errorReporter.Warning(MessageSource.Other, tok, "Could not find '{0}' in '{1}'.{2}Downloading and extracting a Z3 distribution to Dafny's 'Binaries' folder would solve this issue; for now, we'll rely on Boogie to find Z3.", 
+          z3binName, z3BinDir, System.Environment.NewLine);
+      } else {
+        Z3ExecutablePath = z3BinPath;
+      }
+    }
+
+    public override void Usage() {
+      Console.WriteLine(@"  ---- Dafny options ---------------------------------------------------------
+
+  Multiple .dfy files supplied on the command line are concatenated into one
+  Dafny program.
+
+  /dprelude:<file>
+                choose Dafny prelude file
+  /dprint:<file>
+                print Dafny program after parsing it
+                (use - as <file> to print to console)
+  /printMode:<Everything|NoIncludes|NoGhost>
+                Everything is the default.
+                NoIncludes disables printing of {:verify false} methods incorporated via the
+                include mechanism, as well as datatypes and fields included from other files.
+                NoGhost disables printing of functions, ghost methods, and proof statements in
+                implementation methods.  It also disables anything NoIncludes disables.
+  /rprint:<file>
+                print Dafny program after resolving it
+                (use - as <file> to print to console)
+  /view:<view1, view2>
+                print the filtered views of a module after it is resolved (/rprint).
+                if print before the module is resolved (/dprint), then everthing in the module is printed
+                if no view is specified, then everything in the module is printed. 
+                
+  /dafnyVerify:<n>
+                0 - stop after typechecking
+                1 - continue on to translation, verification, and compilation
+  /compile:<n>  0 - do not compile Dafny program
+                1 (default) - upon successful verification of the Dafny
+                    program, compile Dafny program to .NET assembly
+                    Program.exe (if the program has a Main method) or
+                    Program.dll (othewise), where Program.dfy is the name
+                    of the last .dfy file on the command line
+                2 - always attempt to compile Dafny program to C# program
+                    out.cs, regardless of verification outcome
+                3 - if there is a Main method and there are no verification
+                    errors, compiles program in memory (i.e., does not write
+                    an output file) and runs it
+  /spillTargetCode:<n>
+                0 (default) - don't write the compiled Dafny program (but
+                    still compile it, if /compile indicates to do so)
+                1 - write the compiled Dafny program as a .cs file
+  /dafnycc      Disable features not supported by DafnyCC
+  /noCheating:<n>
+                0 (default) - allow assume statements and free invariants
+                1 - treat all assumptions as asserts, and drop free.
+  /induction:<n>
+                0 - never do induction, not even when attributes request it
+                1 - only apply induction when attributes request it
+                2 - apply induction as requested (by attributes) and also
+                    for heuristically chosen quantifiers
+                3 (default) - apply induction as requested, and for
+                    heuristically chosen quantifiers and lemmas
+  /inductionHeuristic:<n>
+                0 - least discriminating induction heuristic (that is, lean
+                    toward applying induction more often)
+                1,2,3,4,5 - levels in between, ordered as follows as far as
+                    how discriminating they are:  0 < 1 < 2 < (3,4) < 5 < 6
+                6 (default) - most discriminating
+  /noIncludes   Ignore include directives
+  /noNLarith    Reduce Z3's knowledge of non-linear arithmetic (*,/,%).
+                Results in more manual work, but also produces more predictable behavior.
+  /autoReqPrint:<file>
+                Print out requirements that were automatically generated by autoReq.
+  /noAutoReq    Ignore autoReq attributes
+  /allowGlobals Allow the implicit class '_default' to contain fields, instance functions,
+                and instance methods.  These class members are declared at the module scope,
+                outside of explicit classes.  This command-line option is provided to simplify
+                a transition from the behavior in the language prior to version 1.9.3, from
+                which point onward all functions and methods declared at the module scope are
+                implicitly static and fields declarations are not allowed at the module scope.
+  /countVerificationErrors:<n>
+                0 - If preprocessing succeeds, set exit code to 0 regardless of the number
+                    of verification errors.
+                1 (default) - If preprocessing succeeds, set exit code to the number of
+                              verification errors.
+  /autoTriggers:<n>
+                0 (default) - Do not generate {:trigger} annotations for user-level quantifiers.
+                1 - Add a {:trigger} to each user-level quantifier. Existing
+                              annotations are preserved.
+  /rewriteFocalPredicates:<n>
+                0 - Don't rewrite predicates in the body of prefix lemmas.
+                1 (default) - In the body of prefix lemmas, rewrite any use of a focal predicate
+                              P to P#[_k-1].
+  /optimize     Produce optimized C# code, meaning:
+                  - selects optimized C# prelude by passing 
+                    /define:DAFNY_USE_SYSTEM_COLLECTIONS_IMMUTABLE to csc.exe (requires 
+                    System.Collections.Immutable.dll in the source directory to successfully 
+                    compile).
+                  - passes /optimize flag to csc.exe.
+  /stats        Print interesting statistics about the Dafny files supplied.
+  /funcCallGraph Print out the function call graph.  Format is: func,mod=callee*
+  /warnShadowing  Emits a warning if the name of a declared variable caused another variable
+                to be shadowed
+  /ironDafny    Enable experimental features needed to support Ironclad/Ironfleet. Use of
+                these features may cause your code to become incompatible with future
+                releases of Dafny.
+  /noIronDafny  Disable Ironclad/Ironfleet features, if enabled by default.
+  /printTooltips    
+                Dump additional positional information (displayed as mouse-over tooltips by 
+                the VS plugin) to stdout as 'Info' messages.
+");
+      base.Usage();  // also print the Boogie options
+    }
+  }
+}
diff --git a/Source/Dafny/Printer.cs b/Source/Dafny/Printer.cs
index 86c493f1..0ba6f439 100644
--- a/Source/Dafny/Printer.cs
+++ b/Source/Dafny/Printer.cs
@@ -14,7 +14,8 @@ using Bpl = Microsoft.Boogie;
 namespace Microsoft.Dafny {
   public class Printer {
     TextWriter wr;
-    DafnyOptions.PrintModes printMode;
+    DafnyOptions.PrintModes printMode;
+    bool afterResolver;
 
     [ContractInvariantMethod]
     void ObjectInvariant()
@@ -129,8 +130,9 @@ namespace Microsoft.Dafny {
       return sb.ToString(0, len);
     }
 
-    public void PrintProgram(Program prog) {
-      Contract.Requires(prog != null);
+    public void PrintProgram(Program prog, bool afterResolver) {
+      Contract.Requires(prog != null);
+      this.afterResolver = afterResolver;
       if (Bpl.CommandLineOptions.Clo.ShowEnv != Bpl.CommandLineOptions.ShowEnvironment.Never) {
         wr.WriteLine("// " + Bpl.CommandLineOptions.Clo.Version);
         wr.WriteLine("// " + Bpl.CommandLineOptions.Clo.Environment);
@@ -239,7 +241,7 @@ namespace Microsoft.Dafny {
             PrintMembers(cl.Members, indent, fileBeingPrinted);
           }
 
-        } else if (d is ModuleDecl) {
+        } else if (d is ModuleDecl) {
           wr.WriteLine();
           Indent(indent);
           if (d is LiteralModuleDecl) {
@@ -252,13 +254,37 @@ namespace Microsoft.Dafny {
           } else if (d is ModuleFacadeDecl) {
             wr.Write("import"); if (((ModuleFacadeDecl)d).Opened) wr.Write(" opened");
             wr.Write(" {0} ", ((ModuleFacadeDecl)d).Name);
-            wr.WriteLine("as {0}", Util.Comma(".", ((ModuleFacadeDecl)d).Path, id => id.val));
+            wr.WriteLine("as {0}", Util.Comma(".", ((ModuleFacadeDecl)d).Path, id => id.val));
+          } else if (d is ModuleExportDecl) {
+            ModuleExportDecl e = (ModuleExportDecl)d;
+            if (e.IsDefault) wr.Write("default ");
+            wr.Write("export {0}", e.Name);
+            if (e.Extends.Count > 0) wr.Write(" extends {0}", Util.Comma(e.Extends, id => id));
+            PrintModuleExportDecl(e, indent, fileBeingPrinted);
           }
 
         } else {
           Contract.Assert(false);  // unexpected TopLevelDecl
         }
       }
+    }
+
+    void PrintModuleExportDecl(ModuleExportDecl m, int indent, string fileBeingPrinted) {
+      ModuleSignature sig = m.Signature;
+      if (sig == null) {
+        wr.Write(" {");
+        // has been resolved yet, just print the strings
+        wr.Write("{0}", Util.Comma(m.Exports, id => id.Name));
+        wr.Write("}");
+      } else {
+        wr.WriteLine(" {");
+        // print the decls and members in the module
+        List<TopLevelDecl> decls = sig.TopLevels.Values.ToList();
+        List<MemberDecl> members = sig.StaticMembers.Values.ToList();
+        PrintTopLevelDecls(decls, indent + IndentAmount, fileBeingPrinted);
+        PrintMembers(members, indent + IndentAmount, fileBeingPrinted);
+        Indent(indent);  wr.WriteLine("}");
+      }
     }
 
     void PrintModuleDefinition(ModuleDefinition module, int indent, string fileBeingPrinted) {
@@ -277,11 +303,28 @@ namespace Microsoft.Dafny {
         wr.WriteLine("{ }");
       } else {
         wr.WriteLine("{");
-        PrintCallGraph(module, indent + IndentAmount);
-        PrintTopLevelDecls(module.TopLevelDecls, indent + IndentAmount, fileBeingPrinted);
+        PrintCallGraph(module, indent + IndentAmount);
+        PrintTopLevelDeclsOrExportedView(module, indent, fileBeingPrinted);
         Indent(indent);
         wr.WriteLine("}");
       }
+    }
+
+    void PrintTopLevelDeclsOrExportedView(ModuleDefinition module, int indent, string fileBeingPrinted) {
+      bool printViewsOnly = false;
+      List<TopLevelDecl> decls = new List<TopLevelDecl>();
+      // only filter based on view name after resolver. 
+      if (afterResolver) {
+        foreach (var nameOfView in DafnyOptions.O.DafnyPrintExportedViews) {
+          foreach (var decl in module.TopLevelDecls) {
+            if (decl.FullName.Equals(nameOfView)) {
+              printViewsOnly = true;
+              decls.Add(decl);
+            }
+          }
+        }
+      }
+      PrintTopLevelDecls(printViewsOnly ? decls : module.TopLevelDecls, indent + IndentAmount, fileBeingPrinted);
     }
 
     void PrintIteratorSignature(IteratorDecl iter, int indent) {
-- 
cgit v1.2.3


From abfe9c32f0b33274511014dd4f498702bbcf0d7e Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Thu, 11 Feb 2016 15:18:34 -0800
Subject: Fix issue 133. The return type for some compare operators was wrongly
 typed as int instead of bool.

---
 Source/Dafny/Translator.cs    |  8 ++++----
 Test/dafny4/Bug133.dfy        | 18 ++++++++++++++++++
 Test/dafny4/Bug133.dfy.expect |  2 ++
 3 files changed, 24 insertions(+), 4 deletions(-)
 create mode 100644 Test/dafny4/Bug133.dfy
 create mode 100644 Test/dafny4/Bug133.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index cfb77d84..0314344d 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -11222,7 +11222,7 @@ namespace Microsoft.Dafny {
                 bOpcode = BinaryOperator.Opcode.Lt;
                 break;
               } else {
-                return TrToFunctionCall(expr.tok, "INTERNAL_lt_boogie", Bpl.Type.Int, e0, e1, liftLit);
+                return TrToFunctionCall(expr.tok, "INTERNAL_lt_boogie", Bpl.Type.Bool, e0, e1, liftLit);
               }
 
             case BinaryExpr.ResolvedOpcode.Le:
@@ -11232,7 +11232,7 @@ namespace Microsoft.Dafny {
                 bOpcode = BinaryOperator.Opcode.Le;
                 break;
               } else {
-                return TrToFunctionCall(expr.tok, "INTERNAL_le_boogie", Bpl.Type.Int, e0, e1, false);
+                return TrToFunctionCall(expr.tok, "INTERNAL_le_boogie", Bpl.Type.Bool, e0, e1, false);
               }
             case BinaryExpr.ResolvedOpcode.Ge:
               keepLits = true;
@@ -11241,7 +11241,7 @@ namespace Microsoft.Dafny {
                 bOpcode = BinaryOperator.Opcode.Ge;
                 break;
               } else {
-                return TrToFunctionCall(expr.tok, "INTERNAL_ge_boogie", Bpl.Type.Int, e0, e1, false);
+                return TrToFunctionCall(expr.tok, "INTERNAL_ge_boogie", Bpl.Type.Bool, e0, e1, false);
               }
             case BinaryExpr.ResolvedOpcode.Gt:
               if (isReal || !DafnyOptions.O.DisableNLarith) {
@@ -11249,7 +11249,7 @@ namespace Microsoft.Dafny {
                 bOpcode = BinaryOperator.Opcode.Gt;
                 break;
               } else {
-                return TrToFunctionCall(expr.tok, "INTERNAL_gt_boogie", Bpl.Type.Int, e0, e1, liftLit);
+                return TrToFunctionCall(expr.tok, "INTERNAL_gt_boogie", Bpl.Type.Bool, e0, e1, liftLit);
               }
             case BinaryExpr.ResolvedOpcode.Add:
               if (!DafnyOptions.O.DisableNLarith) {
diff --git a/Test/dafny4/Bug133.dfy b/Test/dafny4/Bug133.dfy
new file mode 100644
index 00000000..f7da133e
--- /dev/null
+++ b/Test/dafny4/Bug133.dfy
@@ -0,0 +1,18 @@
+// RUN: %dafny /noNLarith /compile:0 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+module Math__div_def_i { 
+	function my_div_pos(x:int, d:int) : int
+		requires d >  0;
+		decreases if x < 0 then (d - x) else x;
+	{
+		if x < 0 then
+			-1 + my_div_pos(x+d, d)
+		else if x < d then
+			0
+		else
+			1 + my_div_pos(x-d, d)
+	} 
+} 
+
+
diff --git a/Test/dafny4/Bug133.dfy.expect b/Test/dafny4/Bug133.dfy.expect
new file mode 100644
index 00000000..c0c48e2b
--- /dev/null
+++ b/Test/dafny4/Bug133.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 1 verified, 0 errors
-- 
cgit v1.2.3


From 15755e486cfe715f15ed7e71938d07800a98a7f2 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Thu, 11 Feb 2016 16:08:27 -0800
Subject: Fix issue 134. Wrong variable was used in the loop.

---
 Source/Dafny/Resolver.cs      |  2 +-
 Test/dafny4/Bug134.dfy        | 23 +++++++++++++++++++++++
 Test/dafny4/Bug134.dfy.expect |  4 ++++
 3 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 Test/dafny4/Bug134.dfy
 create mode 100644 Test/dafny4/Bug134.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index fe31201a..5a63b4e3 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -5057,7 +5057,7 @@ namespace Microsoft.Dafny
               var dd = (NewtypeDecl)d;
               if (DafnyOptions.O.IronDafny) {
                 while (dd.ClonedFrom != null) {
-                  dd = (NewtypeDecl)d.ClonedFrom;
+                  dd = (NewtypeDecl)dd.ClonedFrom;
                 }
               }
               var caller = context as ICallable;
diff --git a/Test/dafny4/Bug134.dfy b/Test/dafny4/Bug134.dfy
new file mode 100644
index 00000000..fff6c36a
--- /dev/null
+++ b/Test/dafny4/Bug134.dfy
@@ -0,0 +1,23 @@
+// RUN: %dafny /compile:0 /ironDafny "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+module NativeTypes {
+	newtype{:nativeType "ushort"} uint16 = i:int | 0 <= i < 0x10000
+} 
+
+abstract module AbstractModuleA 
+{
+	import opened NativeTypes
+	datatype T = T(i:uint16)
+} 
+
+abstract module AbstractModuleB 
+{
+	import opened A as AbstractModuleA
+} 
+
+abstract module AbstractModuleC 
+{
+	import opened B as AbstractModuleB
+}
+
diff --git a/Test/dafny4/Bug134.dfy.expect b/Test/dafny4/Bug134.dfy.expect
new file mode 100644
index 00000000..d5d7ae53
--- /dev/null
+++ b/Test/dafny4/Bug134.dfy.expect
@@ -0,0 +1,4 @@
+Bug134.dfy(16,20): Warning: "import A as B" has been deprecated; in the new syntax, it is "import A:B"
+Bug134.dfy(21,20): Warning: "import A as B" has been deprecated; in the new syntax, it is "import A:B"
+
+Dafny program verifier finished with 4 verified, 0 errors
-- 
cgit v1.2.3


From 91a0cf94be3cdfaff29d65122c9ea031a1a4976b Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Fri, 12 Feb 2016 15:59:08 -0800
Subject: Fix issue 132. The formal argument can't be assume to be allocated
 when a function is invoked inside an "Old" expression.

---
 Source/Dafny/Translator.cs    |  7 +++++--
 Test/dafny4/Bug132.dfy        | 45 +++++++++++++++++++++++++++++++++++++++++++
 Test/dafny4/Bug132.dfy.expect | 18 +++++++++++++++++
 3 files changed, 68 insertions(+), 2 deletions(-)
 create mode 100644 Test/dafny4/Bug132.dfy
 create mode 100644 Test/dafny4/Bug132.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 0314344d..52f52abf 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -5045,8 +5045,11 @@ namespace Microsoft.Dafny {
           CheckSubrange(ee.tok, etran.TrExpr(ee), et, builder);
           Bpl.Cmd cmd = Bpl.Cmd.SimpleAssign(p.tok, lhs, CondApplyBox(p.tok, etran.TrExpr(ee), cce.NonNull(ee.Type), et));
           builder.Add(cmd);
-          builder.Add(new Bpl.CommentCmd("assume allocatedness for argument to function"));
-          builder.Add(new Bpl.AssumeCmd(e.Args[i].tok, MkIsAlloc(lhs, et, etran.HeapExpr)));
+          if (!etran.UsesOldHeap) {
+            // the argument can't be assumed to be allocated for the old heap
+            builder.Add(new Bpl.CommentCmd("assume allocatedness for argument to function"));
+            builder.Add(new Bpl.AssumeCmd(e.Args[i].tok, MkIsAlloc(lhs, et, etran.HeapExpr)));
+          }
         }
         // Check that every parameter is available in the state in which the function is invoked; this means checking that it has
         // the right type and is allocated.  These checks usually hold trivially, on account of that the Dafny language only gives
diff --git a/Test/dafny4/Bug132.dfy b/Test/dafny4/Bug132.dfy
new file mode 100644
index 00000000..b2a26876
--- /dev/null
+++ b/Test/dafny4/Bug132.dfy
@@ -0,0 +1,45 @@
+// RUN: %dafny /compile:0 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+class Cell {
+  var data: int
+
+  predicate P()
+    reads this
+  { data < 0 }
+
+  predicate Q(e: Cell)
+    reads this, e
+  { e != null ==> e.data == data }
+
+  method Test() {
+    ghost var b;
+    var c := new Cell;
+    if {
+      // In the current state, everything is allowed:
+      case true =>  b := this.P();
+      case true =>  b := c.P();
+      case true =>  b := this.Q(this);
+      case true =>  b := this.Q(c);
+      case true =>  b := c.Q(this);
+      case true =>  b := c.Q(c);
+
+      // 'this' was allocated already in the 'old' state, so all of these are fine:
+      case true =>  b := old(this.P());
+      case true =>  b := old(P());  // same as previous line, of course
+      case true =>  b := old(this.Q(this));
+
+      // 'c' is freshly allocaed in this method, so it cannot be used inside 'old'
+      case true =>  b := old(c.P());  // error: receiver argument must be allocated in the state in which the function is invoked
+      case true =>  b := old(c.Q(this));  // error: receiver argument must be allocated in the state in which the function is invoked
+
+      // The same rule should apply if 'c' is a non-receiver argument
+      case true =>  b := old(this.Q(c));  // BOGUS: this should also generate an error
+
+      // In the following, 'c' is used as both of the two arguments. It's not allowed as either argument.  However, since the error
+      // about the receiver masks the error about the other parameter, only one error (about the receiver) should be reported.
+      case true =>  b := old(c.Q(c));  // BOGUS: this should generate an error about the receiver
+    }
+  }
+}
+
diff --git a/Test/dafny4/Bug132.dfy.expect b/Test/dafny4/Bug132.dfy.expect
new file mode 100644
index 00000000..0452f42d
--- /dev/null
+++ b/Test/dafny4/Bug132.dfy.expect
@@ -0,0 +1,18 @@
+Bug132.dfy(33,29): Error: receiver argument must be allocated in the state in which the function is invoked
+Execution trace:
+    (0,0): anon0
+    (0,0): anon24_Then
+Bug132.dfy(34,29): Error: receiver argument must be allocated in the state in which the function is invoked
+Execution trace:
+    (0,0): anon0
+    (0,0): anon25_Then
+Bug132.dfy(37,36): Error: argument must be allocated in the state in which the function is invoked
+Execution trace:
+    (0,0): anon0
+    (0,0): anon26_Then
+Bug132.dfy(41,29): Error: receiver argument must be allocated in the state in which the function is invoked
+Execution trace:
+    (0,0): anon0
+    (0,0): anon27_Then
+
+Dafny program verifier finished with 3 verified, 4 errors
-- 
cgit v1.2.3


From 13a88d7263c02590f5be9bb9944c0ab43b76bccc Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Fri, 26 Feb 2016 09:56:59 -0800
Subject: Fix issue 136. Less aggressive Lit wrap for assert/assume.

---
 Source/Dafny/Translator.cs                      |  235 +--
 Test/dafny0/DTypes.dfy                          |    2 +-
 Test/dafny0/snapshots/Snapshots0.run.dfy.expect |    4 +-
 Test/dafny0/snapshots/Snapshots1.run.dfy.expect |    4 +-
 Test/dafny0/snapshots/Snapshots2.run.dfy.expect |    4 +-
 Test/dafny0/snapshots/Snapshots3.run.dfy.expect |    6 +-
 Test/dafny0/snapshots/Snapshots4.run.dfy.expect |    4 +-
 Test/dafny0/snapshots/Snapshots6.run.dfy.expect |    4 +-
 Test/dafny0/snapshots/Snapshots7.run.dfy.expect |    4 +-
 Test/dafny0/snapshots/Snapshots8.run.dfy.expect |    4 +-
 Test/dafny4/Bug136.dfy                          |   12 +
 Test/dafny4/Bug136.dfy.expect                   | 1772 +++++++++++++++++++++++
 12 files changed, 1924 insertions(+), 131 deletions(-)
 create mode 100644 Test/dafny4/Bug136.dfy
 create mode 100644 Test/dafny4/Bug136.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 52f52abf..c7552a79 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -1650,7 +1650,7 @@ namespace Microsoft.Dafny {
 
       // Next, we assume about this.* whatever we said that the iterator constructor promises
       foreach (var p in iter.Member_Init.Ens) {
-        builder.Add(new Bpl.AssumeCmd(p.E.tok, etran.TrExpr(p.E)));
+        builder.Add(TrAssumeCmd(p.E.tok, etran.TrExpr(p.E)));
       }
 
       // play havoc with the heap, except at the locations prescribed by (this._reads - this._modifies - {this})
@@ -1676,7 +1676,7 @@ namespace Microsoft.Dafny {
         validCall.TypeArgumentSubstitutions[p] = new UserDefinedType(p);
       } // resolved here.
 
-      builder.Add(new Bpl.AssumeCmd(iter.tok, etran.TrExpr(validCall)));
+      builder.Add(TrAssumeCmd(iter.tok, etran.TrExpr(validCall)));
 
       // check well-formedness of the user-defined part of the yield-requires
       foreach (var p in iter.YieldRequires) {
@@ -1703,13 +1703,13 @@ namespace Microsoft.Dafny {
       setDiff.ResolvedOp = BinaryExpr.ResolvedOpcode.SetDifference; setDiff.Type = nw.Type;  // resolve here
       Expression cond = new UnaryOpExpr(iter.tok, UnaryOpExpr.Opcode.Fresh, setDiff);
       cond.Type = Type.Bool;  // resolve here
-      builder.Add(new Bpl.AssumeCmd(iter.tok, yeEtran.TrExpr(cond)));
+      builder.Add(TrAssumeCmd(iter.tok, yeEtran.TrExpr(cond)));
 
       // check wellformedness of postconditions
       var yeBuilder = new Bpl.StmtListBuilder();
       var endBuilder = new Bpl.StmtListBuilder();
       // In the yield-ensures case:  assume this.Valid();
-      yeBuilder.Add(new Bpl.AssumeCmd(iter.tok, yeEtran.TrExpr(validCall)));
+      yeBuilder.Add(TrAssumeCmd(iter.tok, yeEtran.TrExpr(validCall)));
       Contract.Assert(iter.OutsFields.Count == iter.OutsHistoryFields.Count);
       for (int i = 0; i < iter.OutsFields.Count; i++) {
         var y = iter.OutsFields[i];
@@ -1726,9 +1726,9 @@ namespace Microsoft.Dafny {
         concat.ResolvedOp = BinaryExpr.ResolvedOpcode.Concat; concat.Type = oldThisYs.Type;  // resolve here
 
         // In the yield-ensures case:  assume this.ys == old(this.ys) + [this.y];
-        yeBuilder.Add(new Bpl.AssumeCmd(iter.tok, Bpl.Expr.Eq(yeEtran.TrExpr(thisYs), yeEtran.TrExpr(concat))));
+        yeBuilder.Add(TrAssumeCmd(iter.tok, Bpl.Expr.Eq(yeEtran.TrExpr(thisYs), yeEtran.TrExpr(concat))));
         // In the ensures case:  assume this.ys == old(this.ys);
-        endBuilder.Add(new Bpl.AssumeCmd(iter.tok, Bpl.Expr.Eq(yeEtran.TrExpr(thisYs), yeEtran.TrExpr(oldThisYs))));
+        endBuilder.Add(TrAssumeCmd(iter.tok, Bpl.Expr.Eq(yeEtran.TrExpr(thisYs), yeEtran.TrExpr(oldThisYs))));
       }
 
       foreach (var p in iter.YieldEnsures) {
@@ -1775,18 +1775,18 @@ namespace Microsoft.Dafny {
       // add locals for the yield-history variables and the extra variables
       // Assume the precondition and postconditions of the iterator constructor method
       foreach (var p in iter.Member_Init.Req) {
-        builder.Add(new Bpl.AssumeCmd(p.E.tok, etran.TrExpr(p.E)));
+        builder.Add(TrAssumeCmd(p.E.tok, etran.TrExpr(p.E)));
       }
       foreach (var p in iter.Member_Init.Ens) {
         // these postconditions are two-state predicates, but that's okay, because we haven't changed anything yet
-        builder.Add(new Bpl.AssumeCmd(p.E.tok, etran.TrExpr(p.E)));
+        builder.Add(TrAssumeCmd(p.E.tok, etran.TrExpr(p.E)));
       }
       // add the _yieldCount variable, and assume its initial value to be 0
       yieldCountVariable = new Bpl.LocalVariable(iter.tok,
         new Bpl.TypedIdent(iter.tok, iter.YieldCountVariable.AssignUniqueName(currentDeclaration.IdGenerator), TrType(iter.YieldCountVariable.Type)));
       yieldCountVariable.TypedIdent.WhereExpr = YieldCountAssumption(iter, etran);  // by doing this after setting "yieldCountVariable", the variable can be used by YieldCountAssumption
       localVariables.Add(yieldCountVariable);
-      builder.Add(new Bpl.AssumeCmd(iter.tok, Bpl.Expr.Eq(new Bpl.IdentifierExpr(iter.tok, yieldCountVariable), Bpl.Expr.Literal(0))));
+      builder.Add(TrAssumeCmd(iter.tok, Bpl.Expr.Eq(new Bpl.IdentifierExpr(iter.tok, yieldCountVariable), Bpl.Expr.Literal(0))));
       // add a variable $_OldIterHeap
       var oih = new Bpl.IdentifierExpr(iter.tok, "$_OldIterHeap", predef.HeapType);
       Bpl.Expr wh = BplAnd(
@@ -2789,7 +2789,7 @@ namespace Microsoft.Dafny {
             if (dt != null) {
               var funcID = new Bpl.FunctionCall(new Bpl.IdentifierExpr(inFormal.tok, "$IsA#" + dt.FullSanitizedName, Bpl.Type.Bool));
               var f = new Bpl.IdentifierExpr(inFormal.tok, inFormal.AssignUniqueName(m.IdGenerator), TrType(inFormal.Type));
-              builder.Add(new Bpl.AssumeCmd(inFormal.tok, new Bpl.NAryExpr(inFormal.tok, funcID, new List<Bpl.Expr> { f })));
+              builder.Add(TrAssumeCmd(inFormal.tok, new Bpl.NAryExpr(inFormal.tok, funcID, new List<Bpl.Expr> { f })));
             }
           }
 
@@ -2891,7 +2891,7 @@ namespace Microsoft.Dafny {
         foreach (BoilerplateTriple tri in GetTwoStateBoilerplate(m.tok, m.Mod.Expressions, m.IsGhost, etran.Old, etran, etran.Old))
         {
           if (tri.IsFree) {
-            builder.Add(new Bpl.AssumeCmd(m.tok, tri.Expr));
+            builder.Add(TrAssumeCmd(m.tok, tri.Expr));
           }
         }
 
@@ -3092,7 +3092,7 @@ namespace Microsoft.Dafny {
         //generating class post-conditions
         foreach (var en in f.Ens)
         {
-            builder.Add(new Bpl.AssumeCmd(f.tok, etran.TrExpr(en)));
+            builder.Add(TrAssumeCmd(f.tok, etran.TrExpr(en)));
         }
 
         //generating assume J.F(ins) == C.F(ins)
@@ -3117,7 +3117,7 @@ namespace Microsoft.Dafny {
         }
         Bpl.Expr funcExpC = new Bpl.NAryExpr(f.tok, funcIdC, argsC);
         Bpl.Expr funcExpT = new Bpl.NAryExpr(f.OverriddenFunction.tok, funcIdT, argsT);
-        builder.Add(new Bpl.AssumeCmd(f.tok, Bpl.Expr.Eq(funcExpC, funcExpT)));
+        builder.Add(TrAssumeCmd(f.tok, Bpl.Expr.Eq(funcExpC, funcExpT)));
 
         //generating trait post-conditions with class variables
         foreach (var en in f.OverriddenFunction.Ens)
@@ -3127,7 +3127,7 @@ namespace Microsoft.Dafny {
             var reqSplitedE = TrSplitExpr(postcond, etran,false, out splitHappened);
             foreach (var s in reqSplitedE)
             {
-                var assert = new Bpl.AssertCmd(f.tok, s.E);
+                var assert = TrAssertCmd(f.tok, s.E);
                 assert.ErrorData = "Error: the function must provide an equal or more detailed postcondition than in its parent trait";
                 builder.Add(assert);
             }
@@ -3143,7 +3143,7 @@ namespace Microsoft.Dafny {
         {
             if (tri.IsFree)
             {
-                builder.Add(new Bpl.AssumeCmd(f.tok, tri.Expr));
+                builder.Add(TrAssumeCmd(f.tok, tri.Expr));
             }
         }
     }
@@ -3196,7 +3196,7 @@ namespace Microsoft.Dafny {
         foreach (var req in f.OverriddenFunction.Req)
         {
             Expression precond = Substitute(req, null, substMap);
-            builder.Add(new Bpl.AssumeCmd(f.tok, etran.TrExpr(precond)));
+            builder.Add(TrAssumeCmd(f.tok, etran.TrExpr(precond)));
         }
         //generating class pre-conditions
         foreach (var req in f.Req)
@@ -3205,7 +3205,7 @@ namespace Microsoft.Dafny {
             var reqSplitedE = TrSplitExpr(req, etran,false, out splitHappened);
             foreach (var s in reqSplitedE)
             {
-                var assert = new Bpl.AssertCmd(f.tok, s.E);
+                var assert = TrAssertCmd(f.tok, s.E);
                 assert.ErrorData = "Error: the function must provide an equal or more permissive precondition than in its parent trait";
                 builder.Add(assert);
             }
@@ -3295,7 +3295,7 @@ namespace Microsoft.Dafny {
         {
             if (tri.IsFree)
             {
-                builder.Add(new Bpl.AssumeCmd(m.tok, tri.Expr));
+                builder.Add(TrAssumeCmd(m.tok, tri.Expr));
             }
         }
     }
@@ -3305,7 +3305,7 @@ namespace Microsoft.Dafny {
         //generating class post-conditions
         foreach (var en in m.Ens)
         {
-            builder.Add(new Bpl.AssumeCmd(m.tok, etran.TrExpr(en.E)));
+            builder.Add(TrAssumeCmd(m.tok, etran.TrExpr(en.E)));
         }
         //generating trait post-conditions with class variables
         foreach (var en in m.OverriddenMethod.Ens)
@@ -3315,7 +3315,7 @@ namespace Microsoft.Dafny {
             var reqSplitedE = TrSplitExpr(postcond, etran,false, out splitHappened);
             foreach (var s in reqSplitedE)
             {
-                var assert = new Bpl.AssertCmd(m.tok, s.E);
+                var assert = TrAssertCmd(m.tok, s.E);
                 assert.ErrorData = "Error: the method must provide an equal or more detailed postcondition than in its parent trait";
                 builder.Add(assert);
             }
@@ -3328,7 +3328,7 @@ namespace Microsoft.Dafny {
         foreach (var req in m.OverriddenMethod.Req)
         {
             Expression precond = Substitute(req.E, null, substMap);
-            builder.Add(new Bpl.AssumeCmd(m.tok, etran.TrExpr(precond)));
+            builder.Add(TrAssumeCmd(m.tok, etran.TrExpr(precond)));
         }
         //generating class pre-conditions
         foreach (var req in m.Req)
@@ -3337,7 +3337,7 @@ namespace Microsoft.Dafny {
             var reqSplitedE = TrSplitExpr(req.E, etran,false, out splitHappened);
             foreach (var s in reqSplitedE)
             {
-                var assert = new Bpl.AssertCmd(m.tok, s.E);
+                var assert = TrAssertCmd(m.tok, s.E);
                 assert.ErrorData = "Error: the method must provide an equal or more permissive precondition than in its parent trait";
                 builder.Add(assert);
             }
@@ -3617,7 +3617,7 @@ namespace Microsoft.Dafny {
       var col = tok.col + (isEndToken ? tok.val.Length : 0);
       string description = ErrorReporter.ErrorToString_Internal(additionalInfo == null ? "" : ": ", tok.filename, tok.line, col, additionalInfo ?? "");
       QKeyValue kv = new QKeyValue(tok, "captureState", new List<object>() { description }, null);
-      return new Bpl.AssumeCmd(tok, Bpl.Expr.True, kv);
+      return TrAssumeCmd(tok, Bpl.Expr.True, kv);
     }
     Bpl.Cmd CaptureState(Statement stmt) {
       Contract.Requires(stmt != null);
@@ -4086,7 +4086,7 @@ namespace Microsoft.Dafny {
 
         var wh = GetWhereClause(f.tok, funcAppl, f.ResultType, etran);
         if (wh != null) {
-          postCheckBuilder.Add(new Bpl.AssumeCmd(f.tok, wh));
+          postCheckBuilder.Add(TrAssumeCmd(f.tok, wh));
         }
       }
       // Now for the ensures clauses
@@ -4098,7 +4098,7 @@ namespace Microsoft.Dafny {
       StmtListBuilder bodyCheckBuilder = new StmtListBuilder();
       if (f.Body == null) {
         // don't fall through to postcondition checks
-        bodyCheckBuilder.Add(new Bpl.AssumeCmd(f.tok, Bpl.Expr.False));
+        bodyCheckBuilder.Add(TrAssumeCmd(f.tok, Bpl.Expr.False));
       } else {
         Bpl.FunctionCall funcID = new Bpl.FunctionCall(new Bpl.IdentifierExpr(f.tok, f.FullSanitizedName, TrType(f.ResultType)));
         List<Bpl.Expr> args = new List<Bpl.Expr>();
@@ -4126,7 +4126,7 @@ namespace Microsoft.Dafny {
         wfo.ProcessSavedReadsChecks(locals, builderInitializationArea, bodyCheckBuilder);
       }
       // Combine the two, letting the postcondition be checked on after the "bodyCheckBuilder" branch
-      postCheckBuilder.Add(new Bpl.AssumeCmd(f.tok, Bpl.Expr.False));
+      postCheckBuilder.Add(TrAssumeCmd(f.tok, Bpl.Expr.False));
       builder.Add(new Bpl.IfCmd(f.tok, null, postCheckBuilder.Collect(f.tok), null, bodyCheckBuilder.Collect(f.tok)));
 
       var s0 = builderInitializationArea.Collect(f.tok);
@@ -4241,7 +4241,7 @@ namespace Microsoft.Dafny {
         Type t = mc.Ctor.Formals[i].Type;
         Bpl.Expr wh = GetWhereClause(p.tok, new Bpl.IdentifierExpr(p.tok, local), p.Type, etran);
         if (wh != null) {
-          localTypeAssumptions.Add(new Bpl.AssumeCmd(p.tok, wh));
+          localTypeAssumptions.Add(TrAssumeCmd(p.tok, wh));
         }
         args.Add(CondApplyBox(mc.tok, new Bpl.IdentifierExpr(p.tok, local), cce.NonNull(p.Type), t));
       }
@@ -4555,7 +4555,7 @@ namespace Microsoft.Dafny {
           var correctConstructor = FunctionCall(pat.tok, ctor.QueryField.FullSanitizedName, Bpl.Type.Bool, rhs);
           if (ctor.EnclosingDatatype.Ctors.Count == 1) {
             // There is only one constructor, so the value must have been constructed by it; might as well assume that here.
-            builder.Add(new Bpl.AssumeCmd(pat.tok, correctConstructor));
+            builder.Add(TrAssumeCmd(pat.tok, correctConstructor));
           } else {
             builder.Add(Assert(pat.tok, correctConstructor, string.Format("RHS is not certain to look like the pattern '{0}'", ctor.Name)));
           }
@@ -4691,7 +4691,7 @@ namespace Microsoft.Dafny {
         kv = new Bpl.QKeyValue(expr.tok, "subsumption", args, null);
       }
       CheckWellformed(expr, new WFOptions(kv), locals, builder, etran);
-      builder.Add(new Bpl.AssumeCmd(expr.tok, CanCallAssumption(expr, etran)));
+      builder.Add(TrAssumeCmd(expr.tok, CanCallAssumption(expr, etran)));
     }
 
     void CheckWellformedAndAssume(Expression expr, WFOptions options, List<Variable> locals, Bpl.StmtListBuilder builder, ExpressionTranslator etran) {
@@ -4720,7 +4720,7 @@ namespace Microsoft.Dafny {
               CheckWellformedAndAssume(e.E0, options, locals, bAnd, etran);
               CheckWellformedAndAssume(e.E1, options, locals, bAnd, etran);
               var bImp = new Bpl.StmtListBuilder();
-              bImp.Add(new Bpl.AssumeCmd(expr.tok, etran.TrExpr(expr)));
+              bImp.Add(TrAssumeCmd(expr.tok, etran.TrExpr(expr)));
               builder.Add(new Bpl.IfCmd(expr.tok, null, bAnd.Collect(expr.tok), null, bImp.Collect(expr.tok)));
             }
             return;
@@ -4734,7 +4734,7 @@ namespace Microsoft.Dafny {
               var b0 = new Bpl.StmtListBuilder();
               CheckWellformedAndAssume(e.E0, options, locals, b0, etran);
               var b1 = new Bpl.StmtListBuilder();
-              b1.Add(new Bpl.AssumeCmd(expr.tok, Bpl.Expr.Not(etran.TrExpr(e.E0))));
+              b1.Add(TrAssumeCmd(expr.tok, Bpl.Expr.Not(etran.TrExpr(e.E0))));
               CheckWellformedAndAssume(e.E1, options, locals, b1, etran);
               builder.Add(new Bpl.IfCmd(expr.tok, null, b0.Collect(expr.tok), null, b1.Collect(expr.tok)));
             }
@@ -4755,7 +4755,7 @@ namespace Microsoft.Dafny {
         CheckWellformedAndAssume(e.Test, options, locals, bThn, etran);
         CheckWellformedAndAssume(e.Thn, options, locals, bThn, etran);
         var bEls = new Bpl.StmtListBuilder();
-        bEls.Add(new Bpl.AssumeCmd(expr.tok, Bpl.Expr.Not(etran.TrExpr(e.Test))));
+        bEls.Add(TrAssumeCmd(expr.tok, Bpl.Expr.Not(etran.TrExpr(e.Test))));
         CheckWellformedAndAssume(e.Els, options, locals, bEls, etran);
         builder.Add(new Bpl.IfCmd(expr.tok, null, bThn.Collect(expr.tok), null, bEls.Collect(expr.tok)));
         return;
@@ -4781,7 +4781,7 @@ namespace Microsoft.Dafny {
         if (e is ForallExpr) {
           // Although we do the WF check on the original quantifier, we assume the split one.
           // This ensures that cases like forall x :: x != null && f(x.a) do not fail to verify.
-          builder.Add(new Bpl.AssumeCmd(expr.tok, etran.TrExpr(e.SplitQuantifierExpression ?? e)));
+          builder.Add(TrAssumeCmd(expr.tok, etran.TrExpr(e.SplitQuantifierExpression ?? e)));
         }
         return;
       }
@@ -4793,7 +4793,7 @@ namespace Microsoft.Dafny {
       //       the splitting and proceeded to decompose the full quantifier as
       //       normal. This call to TrExpr, on the other hand, will indeed use the
       //       split quantifier.
-      builder.Add(new Bpl.AssumeCmd(expr.tok, etran.TrExpr(expr)));
+      builder.Add(TrAssumeCmd(expr.tok, etran.TrExpr(expr)));
     }
 
     /// <summary>
@@ -4852,7 +4852,7 @@ namespace Microsoft.Dafny {
           var correctConstructor = FunctionCall(e.tok, dtor.EnclosingCtor.QueryField.FullSanitizedName, Bpl.Type.Bool, etran.TrExpr(e.Obj));
           if (dtor.EnclosingCtor.EnclosingDatatype.Ctors.Count == 1) {
             // There is only one constructor, so the value must be been constructed by it; might as well assume that here.
-            builder.Add(new Bpl.AssumeCmd(expr.tok, correctConstructor));
+            builder.Add(TrAssumeCmd(expr.tok, correctConstructor));
           } else {
             builder.Add(Assert(expr.tok, correctConstructor,
               string.Format("destructor '{0}' can only be applied to datatype values constructed by '{1}'", dtor.Name, dtor.EnclosingCtor.Name)));
@@ -5048,7 +5048,7 @@ namespace Microsoft.Dafny {
           if (!etran.UsesOldHeap) {
             // the argument can't be assumed to be allocated for the old heap
             builder.Add(new Bpl.CommentCmd("assume allocatedness for argument to function"));
-            builder.Add(new Bpl.AssumeCmd(e.Args[i].tok, MkIsAlloc(lhs, et, etran.HeapExpr)));
+            builder.Add(TrAssumeCmd(e.Args[i].tok, MkIsAlloc(lhs, et, etran.HeapExpr)));
           }
         }
         // Check that every parameter is available in the state in which the function is invoked; this means checking that it has
@@ -5087,7 +5087,7 @@ namespace Microsoft.Dafny {
           }
           if (options.AssertKv == null) {
             // assume only if no given assert attribute is given
-            builder.Add(new Bpl.AssumeCmd(expr.tok, etran.TrExpr(precond)));
+            builder.Add(TrAssumeCmd(expr.tok, etran.TrExpr(precond)));
           }
         }
         if (options.DoReadsChecks) {
@@ -5148,7 +5148,7 @@ namespace Microsoft.Dafny {
         Bpl.IdentifierExpr canCallFuncID = new Bpl.IdentifierExpr(expr.tok, e.Function.FullSanitizedName + "#canCall", Bpl.Type.Bool);
         List<Bpl.Expr> args = etran.FunctionInvocationArguments(e, null);
         Bpl.Expr canCallFuncAppl = new Bpl.NAryExpr(expr.tok, new Bpl.FunctionCall(canCallFuncID), args);
-        builder.Add(new Bpl.AssumeCmd(expr.tok, allowance == null ? canCallFuncAppl : Bpl.Expr.Or(allowance, canCallFuncAppl)));
+        builder.Add(TrAssumeCmd(expr.tok, allowance == null ? canCallFuncAppl : Bpl.Expr.Or(allowance, canCallFuncAppl)));
 
       } else if (expr is DatatypeValue) {
         DatatypeValue dtv = (DatatypeValue)expr;
@@ -5245,7 +5245,7 @@ namespace Microsoft.Dafny {
             var rIe = new Bpl.IdentifierExpr(pat.tok, r);
             CheckWellformedWithResult(e.RHSs[i], options, rIe, pat.Expr.Type, locals, builder, etran);
             CheckCasePatternShape(pat, rIe, builder);
-            builder.Add(new Bpl.AssumeCmd(pat.tok, Bpl.Expr.Eq(etran.TrExpr(Substitute(pat.Expr, null, substMap)), rIe)));
+            builder.Add(TrAssumeCmd(pat.tok, Bpl.Expr.Eq(etran.TrExpr(Substitute(pat.Expr, null, substMap)), rIe)));
           }
           CheckWellformedWithResult(Substitute(e.Body, null, substMap), options, result, resultType, locals, builder, etran);
           result = null;
@@ -5276,7 +5276,7 @@ namespace Microsoft.Dafny {
             w = BplOr(body, w);
           }
           builder.Add(Assert(e.tok, w, "cannot establish the existence of LHS values that satisfy the such-that predicate"));
-          builder.Add(new Bpl.AssumeCmd(e.tok, etran.TrExpr(rhs)));
+          builder.Add(TrAssumeCmd(e.tok, etran.TrExpr(rhs)));
           var letBody = Substitute(e.Body, null, substMap);
           CheckWellformed(letBody, options, locals, builder, etran);
           if (e.Constraint_Bounds != null) {
@@ -5284,9 +5284,9 @@ namespace Microsoft.Dafny {
             var substMap_prime = SetupBoundVarsAsLocals(lhsVars, builder, locals, etran);
             var rhs_prime = Substitute(e.RHSs[0], null, substMap_prime);
             var letBody_prime = Substitute(e.Body, null, substMap_prime);
-            builder.Add(new Bpl.AssumeCmd(e.tok, CanCallAssumption(rhs_prime, etran)));
-            builder.Add(new Bpl.AssumeCmd(e.tok, etran.TrExpr(rhs_prime)));
-            builder.Add(new Bpl.AssumeCmd(e.tok, CanCallAssumption(letBody_prime, etran)));
+            builder.Add(TrAssumeCmd(e.tok, CanCallAssumption(rhs_prime, etran)));
+            builder.Add(TrAssumeCmd(e.tok, etran.TrExpr(rhs_prime)));
+            builder.Add(TrAssumeCmd(e.tok, CanCallAssumption(letBody_prime, etran)));
             var eq = Expression.CreateEq(letBody, letBody_prime, e.Body.Type);
             builder.Add(Assert(e.tok, etran.TrExpr(eq), "to be compilable, the value of a let-such-that expression must be uniquely determined"));
           }
@@ -5295,11 +5295,11 @@ namespace Microsoft.Dafny {
             Contract.Assert(resultType != null);
             var bResult = etran.TrExpr(letBody);
             CheckSubrange(letBody.tok, bResult, resultType, builder);
-            builder.Add(new Bpl.AssumeCmd(letBody.tok, Bpl.Expr.Eq(result, bResult)));
-            builder.Add(new Bpl.AssumeCmd(letBody.tok, CanCallAssumption(letBody, etran)));
+            builder.Add(TrAssumeCmd(letBody.tok, Bpl.Expr.Eq(result, bResult)));
+            builder.Add(TrAssumeCmd(letBody.tok, CanCallAssumption(letBody, etran)));
             builder.Add(new CommentCmd("CheckWellformedWithResult: Let expression"));
-            builder.Add(new Bpl.AssumeCmd(letBody.tok, MkIsAlloc(result, resultType, etran.HeapExpr)));
-            builder.Add(new Bpl.AssumeCmd(letBody.tok, MkIs(result, resultType)));
+            builder.Add(TrAssumeCmd(letBody.tok, MkIsAlloc(result, resultType, etran.HeapExpr)));
+            builder.Add(TrAssumeCmd(letBody.tok, MkIs(result, resultType)));
             result = null;
           }
         }
@@ -5406,7 +5406,7 @@ namespace Microsoft.Dafny {
         Bpl.Expr src = etran.TrExpr(me.Source);
         Bpl.IfCmd ifCmd = null;
         StmtListBuilder elsBldr = new StmtListBuilder();
-        elsBldr.Add(new Bpl.AssumeCmd(expr.tok, Bpl.Expr.False));
+        elsBldr.Add(TrAssumeCmd(expr.tok, Bpl.Expr.False));
         StmtList els = elsBldr.Collect(expr.tok);
         foreach (var missingCtor in me.MissingCases) {
           // havoc all bound variables
@@ -5460,11 +5460,11 @@ namespace Microsoft.Dafny {
         Contract.Assert(resultType != null);
         var bResult = etran.TrExpr(expr);
         CheckSubrange(expr.tok, bResult, resultType, builder);
-        builder.Add(new Bpl.AssumeCmd(expr.tok, Bpl.Expr.Eq(result, bResult)));
-        builder.Add(new Bpl.AssumeCmd(expr.tok, CanCallAssumption(expr, etran)));
+        builder.Add(TrAssumeCmd(expr.tok, Bpl.Expr.Eq(result, bResult)));
+        builder.Add(TrAssumeCmd(expr.tok, CanCallAssumption(expr, etran)));
         builder.Add(new CommentCmd("CheckWellformedWithResult: any expression"));
-        builder.Add(new Bpl.AssumeCmd(expr.tok, MkIsAlloc(result, resultType, etran.HeapExpr)));
-        builder.Add(new Bpl.AssumeCmd(expr.tok, MkIs(result, resultType)));
+        builder.Add(TrAssumeCmd(expr.tok, MkIsAlloc(result, resultType, etran.HeapExpr)));
+        builder.Add(TrAssumeCmd(expr.tok, MkIs(result, resultType)));
       }
     }
 
@@ -6499,7 +6499,7 @@ namespace Microsoft.Dafny {
       foreach (var p in m.Ens) {
         bool splitHappened;  // we actually don't care
         foreach (var s in TrSplitExpr(p.E, etran, true, out splitHappened)) {
-          var assert = new Bpl.AssertCmd(method.tok, s.E, ErrorMessageAttribute(s.E.tok, "This is the postcondition that may not hold."));
+          var assert = TrAssertCmd(method.tok, s.E, ErrorMessageAttribute(s.E.tok, "This is the postcondition that may not hold."));
           assert.ErrorData = "Error: A postcondition of the refined method may not hold.";
           builder.Add(assert);
         }
@@ -6984,9 +6984,9 @@ namespace Microsoft.Dafny {
 
       if (assertAsAssume || (RefinementToken.IsInherited(refinesToken, currentModule) && (codeContext == null || !codeContext.MustReverify))) {
         // produce an assume instead
-        return new Bpl.AssumeCmd(tok, condition, kv);
+        return TrAssumeCmd(tok, condition, kv);
       } else {
-        var cmd = new Bpl.AssertCmd(ForceCheckToken.Unwrap(tok), condition, kv);
+        var cmd = TrAssertCmd(ForceCheckToken.Unwrap(tok), condition, kv);
         cmd.ErrorData = "Error: " + errorMessage;
         return cmd;
       }
@@ -7003,12 +7003,12 @@ namespace Microsoft.Dafny {
 
       if (RefinementToken.IsInherited(refinesTok, currentModule) && (codeContext == null || !codeContext.MustReverify)) {
         // produce a "skip" instead
-        return new Bpl.AssumeCmd(tok, Bpl.Expr.True, kv);
+        return TrAssumeCmd(tok, Bpl.Expr.True, kv);
       } else {
         tok = ForceCheckToken.Unwrap(tok);
         var args = new List<object>();
         args.Add(Bpl.Expr.Literal(0));
-        Bpl.AssertCmd cmd = new Bpl.AssertCmd(tok, condition, new Bpl.QKeyValue(tok, "subsumption", args, kv));
+        Bpl.AssertCmd cmd = TrAssertCmd(tok, condition, new Bpl.QKeyValue(tok, "subsumption", args, kv));
         cmd.ErrorData = "Error: " + errorMessage;
         return cmd;
       }
@@ -7022,9 +7022,9 @@ namespace Microsoft.Dafny {
 
       if (assertAsAssume || (RefinementToken.IsInherited(tok, currentModule) && (codeContext == null || !codeContext.MustReverify))) {
         // produce an assume instead
-        return new Bpl.AssumeCmd(tok, condition, kv);
+        return TrAssumeCmd(tok, condition, kv);
       } else {
-        var cmd = new Bpl.AssertCmd(ForceCheckToken.Unwrap(tok), condition, kv);
+        var cmd = TrAssertCmd(ForceCheckToken.Unwrap(tok), condition, kv);
         cmd.ErrorData = "Error: " + errorMessage;
         return cmd;
       }
@@ -7097,13 +7097,13 @@ namespace Microsoft.Dafny {
                 builder.Add(AssertNS(tok, split.E, "assertion violation", stmt.Tok, etran.TrAttributes(stmt.Attributes, null)));  // attributes go on every split
               }
             }
-            builder.Add(new Bpl.AssumeCmd(stmt.Tok, etran.TrExpr(s.Expr)));
+            builder.Add(TrAssumeCmd(stmt.Tok, etran.TrExpr(s.Expr)));
           }
         } else if (stmt is AssumeStmt) {
           AddComment(builder, stmt, "assume statement");
           AssumeStmt s = (AssumeStmt)stmt;
           TrStmt_CheckWellformed(s.Expr, builder, locals, etran, false);
-          builder.Add(new Bpl.AssumeCmd(stmt.Tok, etran.TrExpr(s.Expr), etran.TrAttributes(stmt.Attributes, null)));
+          builder.Add(TrAssumeCmd(stmt.Tok, etran.TrExpr(s.Expr), etran.TrAttributes(stmt.Attributes, null)));
         }
         this.fuelContext = FuelSetting.PopFuelContext();
       } else if (stmt is PrintStmt) {
@@ -7161,7 +7161,7 @@ namespace Microsoft.Dafny {
         var yc = new Bpl.IdentifierExpr(s.Tok, yieldCountVariable);
         var incYieldCount = Bpl.Cmd.SimpleAssign(s.Tok, yc, Bpl.Expr.Binary(s.Tok, Bpl.BinaryOperator.Opcode.Add, yc, Bpl.Expr.Literal(1)));
         builder.Add(incYieldCount);
-        builder.Add(new Bpl.AssumeCmd(s.Tok, YieldCountAssumption(iter, etran)));
+        builder.Add(TrAssumeCmd(s.Tok, YieldCountAssumption(iter, etran)));
         // assume $IsGoodHeap($Heap);
         builder.Add(AssumeGoodHeap(s.Tok, etran));
         // assert YieldEnsures[subst];  // where 'subst' replaces "old(E)" with "E" being evaluated in $_OldIterHeap
@@ -7180,7 +7180,7 @@ namespace Microsoft.Dafny {
                 builder.Add(AssertNS(yieldToken, split.E, "possible violation of yield-ensures condition", stmt.Tok, null));
               }
             }
-            builder.Add(new Bpl.AssumeCmd(stmt.Tok, yeEtran.TrExpr(p.E)));
+            builder.Add(TrAssumeCmd(stmt.Tok, yeEtran.TrExpr(p.E)));
           }
         }
         YieldHavoc(iter.tok, iter, builder, etran);
@@ -7245,7 +7245,7 @@ namespace Microsoft.Dafny {
           builder.Add(Assert(s.Tok, w, "cannot establish the existence of LHS values that satisfy the such-that predicate"));
         }
         // End by doing the assume
-        builder.Add(new Bpl.AssumeCmd(s.Tok, etran.TrExpr(s.Expr)));
+        builder.Add(TrAssumeCmd(s.Tok, etran.TrExpr(s.Expr)));
         builder.Add(CaptureState(s));  // just do one capture state--here, at the very end (that is, don't do one before the assume)
 
       } else if (stmt is UpdateStmt) {
@@ -7320,7 +7320,7 @@ namespace Microsoft.Dafny {
         Bpl.IfCmd elsIf = null;
         b = new Bpl.StmtListBuilder();
         if (s.IsExistentialGuard) {
-          b.Add(new Bpl.AssumeCmd(guard.tok, Bpl.Expr.Not(etran.TrExpr(guard))));
+          b.Add(TrAssumeCmd(guard.tok, Bpl.Expr.Not(etran.TrExpr(guard))));
         }
         if (s.Els == null) {
           els = b.Collect(s.Tok);
@@ -7383,11 +7383,11 @@ namespace Microsoft.Dafny {
           // havoc $Heap;
           builder.Add(new Bpl.HavocCmd(s.Tok, new List<Bpl.IdentifierExpr> { (Bpl.IdentifierExpr/*TODO: this cast is rather dubious*/)etran.HeapExpr }));
           // assume $HeapSucc(preModifyHeap, $Heap);   OR $HeapSuccGhost
-          builder.Add(new Bpl.AssumeCmd(s.Tok, HeapSucc(preModifyHeap, etran.HeapExpr, s.IsGhost)));
+          builder.Add(TrAssumeCmd(s.Tok, HeapSucc(preModifyHeap, etran.HeapExpr, s.IsGhost)));
           // assume nothing outside the frame was changed
           var etranPreLoop = new ExpressionTranslator(this, predef, preModifyHeap);
           var updatedFrameEtran = new ExpressionTranslator(etran, modifyFrameName);
-          builder.Add(new Bpl.AssumeCmd(s.Tok, FrameConditionUsingDefinedFrame(s.Tok, etranPreLoop, etran, updatedFrameEtran)));
+          builder.Add(TrAssumeCmd(s.Tok, FrameConditionUsingDefinedFrame(s.Tok, etranPreLoop, etran, updatedFrameEtran)));
         } else {
           // do the body, but with preModifyHeapVar as the governing frame
           var updatedFrameEtran = new ExpressionTranslator(etran, modifyFrameName);
@@ -7486,7 +7486,7 @@ namespace Microsoft.Dafny {
             if (s.Steps[i] is BinaryExpr && (((BinaryExpr)s.Steps[i]).ResolvedOp == BinaryExpr.ResolvedOpcode.Imp)) {
               // assume line<i>:
               AddComment(b, stmt, "assume lhs");
-              b.Add(new Bpl.AssumeCmd(s.Tok, etran.TrExpr(CalcStmt.Lhs(s.Steps[i]))));
+              b.Add(TrAssumeCmd(s.Tok, etran.TrExpr(CalcStmt.Lhs(s.Steps[i]))));
             }
             // hint:
             AddComment(b, stmt, "Hint" + i.ToString());
@@ -7514,7 +7514,7 @@ namespace Microsoft.Dafny {
                 }
               }
             }
-            b.Add(new Bpl.AssumeCmd(s.Tok, Bpl.Expr.False));
+            b.Add(TrAssumeCmd(s.Tok, Bpl.Expr.False));
             ifCmd = new Bpl.IfCmd(s.Tok, null, b.Collect(s.Tok), ifCmd, null);
             CurrentIdGenerator.Pop();
           }
@@ -7523,12 +7523,12 @@ namespace Microsoft.Dafny {
           AddComment(b, stmt, "assert wf[initial]");
           Contract.Assert(s.Result != null); // established by the resolver
           TrStmt_CheckWellformed(CalcStmt.Lhs(s.Result), b, locals, etran, false);
-          b.Add(new Bpl.AssumeCmd(s.Tok, Bpl.Expr.False));
+          b.Add(TrAssumeCmd(s.Tok, Bpl.Expr.False));
           ifCmd = new Bpl.IfCmd(s.Tok, null, b.Collect(s.Tok), ifCmd, null);
           builder.Add(ifCmd);
           // assume result:
           if (s.Steps.Count > 1) {
-            builder.Add(new Bpl.AssumeCmd(s.Tok, etran.TrExpr(s.Result)));
+            builder.Add(TrAssumeCmd(s.Tok, etran.TrExpr(s.Result)));
           }
         }
         CurrentIdGenerator.Pop();
@@ -7539,7 +7539,7 @@ namespace Microsoft.Dafny {
         Bpl.Expr source = etran.TrExpr(s.Source);
 
         var b = new Bpl.StmtListBuilder();
-        b.Add(new Bpl.AssumeCmd(stmt.Tok, Bpl.Expr.False));
+        b.Add(TrAssumeCmd(stmt.Tok, Bpl.Expr.False));
         Bpl.StmtList els = b.Collect(stmt.Tok);
         Bpl.IfCmd ifCmd = null;
         foreach (var missingCtor in s.MissingCases) {
@@ -7617,7 +7617,7 @@ namespace Microsoft.Dafny {
           builder.Add(new Bpl.HavocCmd(bv.Tok, new List<Bpl.IdentifierExpr> { bIe }));
           Bpl.Expr wh = GetWhereClause(bv.Tok, bIe, bv.Type, etran);
           if (wh != null) {
-            builder.Add(new Bpl.AssumeCmd(bv.Tok, wh));
+            builder.Add(TrAssumeCmd(bv.Tok, wh));
           }
         }
         Contract.Assert(s.LHSs.Count == s.RHSs.Count);  // checked by resolution
@@ -7632,7 +7632,7 @@ namespace Microsoft.Dafny {
           TrStmt_CheckWellformed(s.RHSs[i], builder, locals, etran, false);
           CheckWellformedWithResult(s.RHSs[i], new WFOptions(null, false, false), rIe, pat.Expr.Type, locals, builder, etran);
           CheckCasePatternShape(pat, rIe, builder);
-          builder.Add(new Bpl.AssumeCmd(pat.tok, Bpl.Expr.Eq(etran.TrExpr(pat.Expr), rIe)));
+          builder.Add(TrAssumeCmd(pat.tok, Bpl.Expr.Eq(etran.TrExpr(pat.Expr), rIe)));
         }
       } else {
         Contract.Assert(false); throw new cce.UnreachableException();  // unexpected statement
@@ -7656,7 +7656,7 @@ namespace Microsoft.Dafny {
         iesForHavoc.Add(new Bpl.IdentifierExpr(local.tok, local));
       }
       builderOutsideIfConstruct.Add(new Bpl.HavocCmd(exists.tok, iesForHavoc));
-      builder.Add(new Bpl.AssumeCmd(exists.tok, etran.TrExpr(exists.Term)));
+      builder.Add(TrAssumeCmd(exists.tok, etran.TrExpr(exists.Term)));
     }
 
     void TrStmtList(List<Statement> stmts, Bpl.StmtListBuilder builder, List<Variable> locals, ExpressionTranslator etran) {
@@ -7738,7 +7738,7 @@ namespace Microsoft.Dafny {
         new List<Bpl.IdentifierExpr>()));
       // assume YieldRequires;
       foreach (var p in iter.YieldRequires) {
-        builder.Add(new Bpl.AssumeCmd(tok, etran.TrExpr(p.E)));
+        builder.Add(TrAssumeCmd(tok, etran.TrExpr(p.E)));
       }
       // $_OldIterHeap := Heap;
       builder.Add(Bpl.Cmd.SimpleAssign(tok, new Bpl.IdentifierExpr(tok, "$_OldIterHeap", predef.HeapType), etran.HeapExpr));
@@ -7953,7 +7953,7 @@ namespace Microsoft.Dafny {
       var substMap = SetupBoundVarsAsLocals(s.BoundVars, definedness, locals, etran);
       Expression range = Substitute(s.Range, null, substMap);
       TrStmt_CheckWellformed(range, definedness, locals, etran, false);
-      definedness.Add(new Bpl.AssumeCmd(s.Range.tok, etran.TrExpr(range)));
+      definedness.Add(TrAssumeCmd(s.Range.tok, etran.TrExpr(range)));
 
       var lhs = Substitute(s0.Lhs.Resolved, null, substMap);
       TrStmt_CheckWellformed(lhs, definedness, locals, etran, false);
@@ -7989,7 +7989,7 @@ namespace Microsoft.Dafny {
         var substMapPrime = SetupBoundVarsAsLocals(s.BoundVars, definedness, locals, etran);
         var lhsPrime = Substitute(s0.Lhs.Resolved, null, substMapPrime);
         range = Substitute(s.Range, null, substMapPrime);
-        definedness.Add(new Bpl.AssumeCmd(range.tok, etran.TrExpr(range)));
+        definedness.Add(TrAssumeCmd(range.tok, etran.TrExpr(range)));
         // assume !(x == x' && y == y');
         Bpl.Expr eqs = Bpl.Expr.True;
         foreach (var bv in s.BoundVars) {
@@ -7998,7 +7998,7 @@ namespace Microsoft.Dafny {
           // TODO: in the following line, is the term equality okay, or does it have to include things like Set#Equal sometimes too?
           eqs = BplAnd(eqs, Bpl.Expr.Eq(etran.TrExpr(x), etran.TrExpr(xPrime)));
         }
-        definedness.Add(new Bpl.AssumeCmd(s.Tok, Bpl.Expr.Not(eqs)));
+        definedness.Add(TrAssumeCmd(s.Tok, Bpl.Expr.Not(eqs)));
         Bpl.Expr objPrime, FPrime;
         GetObjFieldDetails(lhsPrime, etran, out objPrime, out FPrime);
         var Rhs = ((ExprRhs)s0.Rhs).Expr;
@@ -8011,7 +8011,7 @@ namespace Microsoft.Dafny {
           "left-hand sides for different forall-statement bound variables may refer to the same location"));
       }
 
-      definedness.Add(new Bpl.AssumeCmd(s.Tok, Bpl.Expr.False));
+      definedness.Add(TrAssumeCmd(s.Tok, Bpl.Expr.False));
 
       // Now for the translation of the update itself
 
@@ -8019,7 +8019,7 @@ namespace Microsoft.Dafny {
       var prevEtran = new ExpressionTranslator(this, predef, prevHeap);
       updater.Add(Bpl.Cmd.SimpleAssign(s.Tok, prevHeap, etran.HeapExpr));
       updater.Add(new Bpl.HavocCmd(s.Tok, new List<Bpl.IdentifierExpr> { (Bpl.IdentifierExpr/*TODO: this cast is rather dubious*/)etran.HeapExpr }));
-      updater.Add(new Bpl.AssumeCmd(s.Tok, HeapSucc(prevHeap, etran.HeapExpr)));
+      updater.Add(TrAssumeCmd(s.Tok, HeapSucc(prevHeap, etran.HeapExpr)));
 
       // Here comes:
       //   assume (forall<alpha> o: ref, f: Field alpha ::
@@ -8046,7 +8046,7 @@ namespace Microsoft.Dafny {
       Bpl.Expr body = Bpl.Expr.Or(Bpl.Expr.Eq(heapOF, oldHeapOF), xObjField);
       var tr = new Trigger(s.Tok, true, new List<Expr>() { heapOF });
       Bpl.Expr qq = new Bpl.ForallExpr(s.Tok, new List<TypeVariable> { alpha }, new List<Variable> { oVar, fVar }, null, tr, body);
-      updater.Add(new Bpl.AssumeCmd(s.Tok, qq));
+      updater.Add(TrAssumeCmd(s.Tok, qq));
 
       if (s.ForallExpressions != null) {
         foreach (ForallExpr expr in s.ForallExpressions) {
@@ -8055,7 +8055,7 @@ namespace Microsoft.Dafny {
           var e0 = Substitute(((BinaryExpr)term).E0.Resolved, null, substMap);
           var e1 = Substitute(((BinaryExpr)term).E1, null, substMap);
           qq = TrForall_NewValueAssumption(expr.tok, expr.BoundVars, expr.Range, e0, e1, expr.Attributes, etran, prevEtran);
-          updater.Add(new Bpl.AssumeCmd(s.Tok, qq));
+          updater.Add(TrAssumeCmd(s.Tok, qq));
         }
       } 
     }
@@ -8158,18 +8158,18 @@ namespace Microsoft.Dafny {
             havocIds.Add(new Bpl.IdentifierExpr(tok, bv));
           }
           definedness.Add(new Bpl.HavocCmd(tok, havocIds));
-          definedness.Add(new Bpl.AssumeCmd(tok, ante));
+          definedness.Add(TrAssumeCmd(tok, ante));
         }
         TrStmt_CheckWellformed(range, definedness, locals, etran, false);
-        definedness.Add(new Bpl.AssumeCmd(range.tok, etran.TrExpr(range)));
+        definedness.Add(TrAssumeCmd(range.tok, etran.TrExpr(range)));
         if (additionalRange != null) {
           var es = additionalRange(new Dictionary<IVariable, Expression>(), etran);
-          definedness.Add(new Bpl.AssumeCmd(es.tok, es));
+          definedness.Add(TrAssumeCmd(es.tok, es));
         }
 
         TrStmt(s0, definedness, locals, etran);
 
-        definedness.Add(new Bpl.AssumeCmd(tok, Bpl.Expr.False));
+        definedness.Add(TrAssumeCmd(tok, Bpl.Expr.False));
       }
 
       // Now for the other branch, where the postcondition of the call is exported.
@@ -8186,7 +8186,7 @@ namespace Microsoft.Dafny {
         Contract.Assert(s0.Method.Mod.Expressions.Count == 0);  // checked by the resolver
         foreach (BoilerplateTriple tri in GetTwoStateBoilerplate(tok, new List<FrameExpression>(), s0.IsGhost, initEtran, etran, initEtran)) {
           if (tri.IsFree) {
-            exporter.Add(new Bpl.AssumeCmd(tok, tri.Expr));
+            exporter.Add(TrAssumeCmd(tok, tri.Expr));
           }
         }
         if (codeContext is IteratorDecl) {
@@ -8214,7 +8214,7 @@ namespace Microsoft.Dafny {
             var receiver = new BoogieWrapper(initEtran.TrExpr(Substitute(s0.Receiver, null, substMap, s0.MethodSelect.TypeArgumentSubstitutions())), s0.Receiver.Type);
             var p = Substitute(e, receiver, argsSubstMap, s0.MethodSelect.TypeArgumentSubstitutions());  // substitute the call's actuals for the method's formals
             qq = callEtran.TrExpr(p, initEtran);
-            exporter.Add(new Bpl.AssumeCmd(tok, qq));
+            exporter.Add(TrAssumeCmd(tok, qq));
           }
         } else {
           var bvars = new List<Variable>();
@@ -8242,7 +8242,7 @@ namespace Microsoft.Dafny {
           // TRIG (forall $ih#pat0#0: Seq Box, $ih#a0#0: Seq Box :: $Is($ih#pat0#0, TSeq(_module._default.Same0$T)) && $IsAlloc($ih#pat0#0, TSeq(_module._default.Same0$T), $initHeapForallStmt#0) && $Is($ih#a0#0, TSeq(_module._default.Same0$T)) && $IsAlloc($ih#a0#0, TSeq(_module._default.Same0$T), $initHeapForallStmt#0) && Seq#Length($ih#pat0#0) <= Seq#Length($ih#a0#0) && Seq#SameUntil($ih#pat0#0, $ih#a0#0, Seq#Length($ih#pat0#0)) && (Seq#Rank($ih#pat0#0) < Seq#Rank(pat#0) || (Seq#Rank($ih#pat0#0) == Seq#Rank(pat#0) && Seq#Rank($ih#a0#0) < Seq#Rank(a#0))) ==> _module.__default.IsRelaxedPrefixAux(_module._default.Same0$T, $LS($LZ), $Heap, $ih#pat0#0, $ih#a0#0, LitInt(1)))'
           // TRIG (forall $ih#m0#0: DatatypeType, $ih#n0#0: DatatypeType :: $Is($ih#m0#0, Tclass._module.Nat()) && $IsAlloc($ih#m0#0, Tclass._module.Nat(), $initHeapForallStmt#0) && $Is($ih#n0#0, Tclass._module.Nat()) && $IsAlloc($ih#n0#0, Tclass._module.Nat(), $initHeapForallStmt#0) && Lit(true) && (DtRank($ih#m0#0) < DtRank(m#0) || (DtRank($ih#m0#0) == DtRank(m#0) && DtRank($ih#n0#0) < DtRank(n#0))) ==> _module.__default.mult($LS($LZ), $Heap, $ih#m0#0, _module.__default.plus($LS($LZ), $Heap, $ih#n0#0, $ih#n0#0)) == _module.__default.mult($LS($LZ), $Heap, _module.__default.plus($LS($LZ), $Heap, $ih#m0#0, $ih#m0#0), $ih#n0#0))
           qq = new Bpl.ForallExpr(tok, bvars, Bpl.Expr.Imp(ante, post));  // SMART_TRIGGER
-          exporter.Add(new Bpl.AssumeCmd(tok, qq));
+          exporter.Add(TrAssumeCmd(tok, qq));
         }       
       }
     }
@@ -8309,10 +8309,10 @@ namespace Microsoft.Dafny {
           havocIds.Add(new Bpl.IdentifierExpr(s.Tok, bv));
         }
         definedness.Add(new Bpl.HavocCmd(s.Tok, havocIds));
-        definedness.Add(new Bpl.AssumeCmd(s.Tok, typeAntecedent));
+        definedness.Add(TrAssumeCmd(s.Tok, typeAntecedent));
       }
       TrStmt_CheckWellformed(s.Range, definedness, locals, etran, false);
-      definedness.Add(new Bpl.AssumeCmd(s.Range.tok, etran.TrExpr(s.Range)));
+      definedness.Add(TrAssumeCmd(s.Range.tok, etran.TrExpr(s.Range)));
 
       if (s.Body != null) {
         TrStmt(s.Body, definedness, locals, etran);
@@ -8330,7 +8330,7 @@ namespace Microsoft.Dafny {
         }
       }
 
-      definedness.Add(new Bpl.AssumeCmd(s.Tok, Bpl.Expr.False));
+      definedness.Add(TrAssumeCmd(s.Tok, Bpl.Expr.False));
 
       // Now for the other branch, where the ensures clauses are exported.
 
@@ -8344,7 +8344,7 @@ namespace Microsoft.Dafny {
       exporter.Add(new Bpl.HavocCmd(s.Tok, new List<Bpl.IdentifierExpr> { (Bpl.IdentifierExpr/*TODO: this cast is rather dubious*/)etran.HeapExpr, etran.Tick() }));
       foreach (BoilerplateTriple tri in GetTwoStateBoilerplate(s.Tok, new List<FrameExpression>(), s.IsGhost, initEtran, etran, initEtran)) {
         if (tri.IsFree) {
-          exporter.Add(new Bpl.AssumeCmd(s.Tok, tri.Expr));
+          exporter.Add(TrAssumeCmd(s.Tok, tri.Expr));
         }
       }
 
@@ -8352,9 +8352,9 @@ namespace Microsoft.Dafny {
       var p = Substitute(s.ForallExpressions[0], null, substMap);
       Bpl.Expr qq = etran.TrExpr(p, initEtran);
       if (s.BoundVars.Count != 0) {
-        exporter.Add(new Bpl.AssumeCmd(s.Tok, qq));
+        exporter.Add(TrAssumeCmd(s.Tok, qq));
       } else {
-        exporter.Add(new Bpl.AssumeCmd(s.Tok, ((Bpl.ForallExpr)qq).Body));
+        exporter.Add(TrAssumeCmd(s.Tok, ((Bpl.ForallExpr)qq).Body));
       }
     }
 
@@ -8379,6 +8379,15 @@ namespace Microsoft.Dafny {
       return description;
     }
 
+    Bpl.AssumeCmd TrAssumeCmd(IToken tok, Bpl.Expr expr, Bpl.QKeyValue attributes = null) {
+      var lit = RemoveLit(expr);
+      return attributes == null ? new Bpl.AssumeCmd(tok, lit) : new Bpl.AssumeCmd(tok, lit, attributes);
+    }
+
+    Bpl.AssertCmd TrAssertCmd(IToken tok, Bpl.Expr expr, Bpl.QKeyValue attributes = null) {
+      var lit = RemoveLit(expr);
+      return attributes == null ? new Bpl.AssertCmd(tok, lit) : new Bpl.AssertCmd(tok, lit, attributes);
+    }
 
     delegate void BodyTranslator(Bpl.StmtListBuilder builder, ExpressionTranslator etran);
 
@@ -8427,11 +8436,11 @@ namespace Microsoft.Dafny {
       Bpl.StmtListBuilder invDefinednessBuilder = new Bpl.StmtListBuilder();
       foreach (MaybeFreeExpression loopInv in s.Invariants) {
         TrStmt_CheckWellformed(loopInv.E, invDefinednessBuilder, locals, etran, false);
-        invDefinednessBuilder.Add(new Bpl.AssumeCmd(loopInv.E.tok, etran.TrExpr(loopInv.E)));
+        invDefinednessBuilder.Add(TrAssumeCmd(loopInv.E.tok, etran.TrExpr(loopInv.E)));
 
-        invariants.Add(new Bpl.AssumeCmd(loopInv.E.tok, Bpl.Expr.Imp(w, CanCallAssumption(loopInv.E, etran))));
+        invariants.Add(TrAssumeCmd(loopInv.E.tok, Bpl.Expr.Imp(w, CanCallAssumption(loopInv.E, etran))));
         if (loopInv.IsFree && !DafnyOptions.O.DisallowSoundnessCheating) {
-          invariants.Add(new Bpl.AssumeCmd(loopInv.E.tok, Bpl.Expr.Imp(w, etran.TrExpr(loopInv.E))));
+          invariants.Add(TrAssumeCmd(loopInv.E.tok, Bpl.Expr.Imp(w, etran.TrExpr(loopInv.E))));
         } else {
           bool splitHappened;
           var ss = TrSplitExpr(loopInv.E, etran, false, out splitHappened);
@@ -8444,7 +8453,7 @@ namespace Microsoft.Dafny {
               if (split.IsChecked) {
                 invariants.Add(Assert(split.E.tok, wInv, "loop invariant violation"));  // TODO: it would be fine to have this use {:subsumption 0}
               } else {
-                invariants.Add(new Bpl.AssumeCmd(split.E.tok, wInv));
+                invariants.Add(TrAssumeCmd(split.E.tok, wInv));
               }
             }
           }
@@ -8460,14 +8469,14 @@ namespace Microsoft.Dafny {
         // include boilerplate invariants
         foreach (BoilerplateTriple tri in GetTwoStateBoilerplate(s.Tok, modifiesClause, s.IsGhost, etranPreLoop, etran, etran.Old)) {
           if (tri.IsFree) {
-            invariants.Add(new Bpl.AssumeCmd(s.Tok, tri.Expr));
+            invariants.Add(TrAssumeCmd(s.Tok, tri.Expr));
           } else {
             Contract.Assert(tri.ErrorMessage != null);  // follows from BoilerplateTriple invariant
             invariants.Add(Assert(s.Tok, tri.Expr, tri.ErrorMessage));
           }
         }
         // add a free invariant which says that the heap hasn't changed outside of the modifies clause.
-        invariants.Add(new Bpl.AssumeCmd(s.Tok, FrameConditionUsingDefinedFrame(s.Tok, etranPreLoop, etran, updatedFrameEtran)));
+        invariants.Add(TrAssumeCmd(s.Tok, FrameConditionUsingDefinedFrame(s.Tok, etranPreLoop, etran, updatedFrameEtran)));
       }
 
       // include a free invariant that says that all completed iterations so far have only decreased the termination metric
@@ -8481,13 +8490,13 @@ namespace Microsoft.Dafny {
           decrs.Add(etran.TrExpr(e));
         }
         Bpl.Expr decrCheck = DecreasesCheck(toks, types, types, decrs, initDecr, null, null, true, false);
-        invariants.Add(new Bpl.AssumeCmd(s.Tok, decrCheck));
+        invariants.Add(TrAssumeCmd(s.Tok, decrCheck));
       }
 
       Bpl.StmtListBuilder loopBodyBuilder = new Bpl.StmtListBuilder();
       loopBodyBuilder.Add(CaptureState(s.Tok, true, "after some loop iterations"));
       // as the first thing inside the loop, generate:  if (!w) { CheckWellformed(inv); assume false; }
-      invDefinednessBuilder.Add(new Bpl.AssumeCmd(s.Tok, Bpl.Expr.False));
+      invDefinednessBuilder.Add(TrAssumeCmd(s.Tok, Bpl.Expr.False));
       loopBodyBuilder.Add(new Bpl.IfCmd(s.Tok, Bpl.Expr.Not(w), invDefinednessBuilder.Collect(s.Tok), null, null));
       // generate:  CheckWellformed(guard); if (!guard) { break; }
       Bpl.Expr guard = null;
@@ -8528,13 +8537,13 @@ namespace Microsoft.Dafny {
           loopBodyBuilder.Add(Assert(s.Tok, decrCheck, msg));
         }
       } else {
-        loopBodyBuilder.Add(new Bpl.AssumeCmd(s.Tok, Bpl.Expr.False));
+        loopBodyBuilder.Add(TrAssumeCmd(s.Tok, Bpl.Expr.False));
         // todo(maria): havoc stuff
       }
       // Finally, assume the well-formedness of the invariant (which has been checked once and for all above), so that the check
       // of invariant-maintenance can use the appropriate canCall predicates.
       foreach (MaybeFreeExpression loopInv in s.Invariants) {
-        loopBodyBuilder.Add(new Bpl.AssumeCmd(loopInv.E.tok, CanCallAssumption(loopInv.E, etran)));
+        loopBodyBuilder.Add(TrAssumeCmd(loopInv.E.tok, CanCallAssumption(loopInv.E, etran)));
       }
       Bpl.StmtList body = loopBodyBuilder.Collect(s.Tok);
 
@@ -8569,7 +8578,7 @@ namespace Microsoft.Dafny {
 
       var b = new Bpl.StmtListBuilder();
       var elseTok = elseCase0 != null ? elseCase0.tok : elseCase1.tok;
-      b.Add(new Bpl.AssumeCmd(elseTok, noGuard));
+      b.Add(TrAssumeCmd(elseTok, noGuard));
       if (elseCase0 != null) {
         b.Add(elseCase0);
       } else {
@@ -8838,7 +8847,7 @@ namespace Microsoft.Dafny {
           // the out-parameter.
           Bpl.Cmd cmd = new Bpl.HavocCmd(bLhs.tok, new List<Bpl.IdentifierExpr> { bLhs });
           builder.Add(cmd);
-          cmd = new Bpl.AssumeCmd(bLhs.tok, Bpl.Expr.Eq(bLhs, FunctionCall(bLhs.tok, BuiltinFunction.Unbox, TrType(LhsTypes[i]), tmpVarIdE)));
+          cmd = TrAssumeCmd(bLhs.tok, Bpl.Expr.Eq(bLhs, FunctionCall(bLhs.tok, BuiltinFunction.Unbox, TrType(LhsTypes[i]), tmpVarIdE)));
           builder.Add(cmd);
         }
       }
@@ -8866,7 +8875,7 @@ namespace Microsoft.Dafny {
         builder.Add(new Bpl.HavocCmd(bv.tok, new List<Bpl.IdentifierExpr> { bIe }));
         Bpl.Expr wh = GetWhereClause(bv.tok, bIe, local.Type, etran);
         if (wh != null) {
-          builder.Add(new Bpl.AssumeCmd(bv.tok, wh));
+          builder.Add(TrAssumeCmd(bv.tok, wh));
         }
       }
       return substMap;
@@ -9792,7 +9801,7 @@ namespace Microsoft.Dafny {
       } else if (rhs is HavocRhs) {
         builder.Add(new Bpl.HavocCmd(tok, new List<Bpl.IdentifierExpr> { bLhs }));
         var isNat = CheckSubrange_Expr(tok, bLhs, rhsTypeConstraint);
-        builder.Add(new Bpl.AssumeCmd(tok, isNat));
+        builder.Add(TrAssumeCmd(tok, isNat));
         return CondApplyBox(tok, bLhs, rhsTypeConstraint, lhsType);
       } else {
         // x := new Something
@@ -9817,13 +9826,13 @@ namespace Microsoft.Dafny {
         Bpl.Expr nwNotNull = Bpl.Expr.Neq(nw, predef.Null);
         Bpl.Expr rightType;
         rightType = etran.GoodRef_(tok, nw, tRhs.Type, true);
-        builder.Add(new Bpl.AssumeCmd(tok, Bpl.Expr.And(nwNotNull, rightType)));
+        builder.Add(TrAssumeCmd(tok, Bpl.Expr.And(nwNotNull, rightType)));
         if (tRhs.ArrayDimensions != null) {
           int i = 0;
           foreach (Expression dim in tRhs.ArrayDimensions) {
             // assume Array#Length($nw, i) == arraySize;
             Bpl.Expr arrayLength = ArrayLength(tok, nw, tRhs.ArrayDimensions.Count, i);
-            builder.Add(new Bpl.AssumeCmd(tok, Bpl.Expr.Eq(arrayLength, etran.TrExpr(dim))));
+            builder.Add(TrAssumeCmd(tok, Bpl.Expr.Eq(arrayLength, etran.TrExpr(dim))));
             i++;
           }
         }
@@ -9929,7 +9938,7 @@ namespace Microsoft.Dafny {
       Contract.Requires(etran != null);
       Contract.Ensures(Contract.Result<AssumeCmd>() != null);
 
-      return new Bpl.AssumeCmd(tok, FunctionCall(tok, BuiltinFunction.IsGoodHeap, null, etran.HeapExpr));
+      return TrAssumeCmd(tok, FunctionCall(tok, BuiltinFunction.IsGoodHeap, null, etran.HeapExpr));
     }
 
     /// <summary>
diff --git a/Test/dafny0/DTypes.dfy b/Test/dafny0/DTypes.dfy
index 9e36e64c..9891c040 100644
--- a/Test/dafny0/DTypes.dfy
+++ b/Test/dafny0/DTypes.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /autoTriggers:1 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 class C {
diff --git a/Test/dafny0/snapshots/Snapshots0.run.dfy.expect b/Test/dafny0/snapshots/Snapshots0.run.dfy.expect
index d32cd9bb..bf7388cf 100644
--- a/Test/dafny0/snapshots/Snapshots0.run.dfy.expect
+++ b/Test/dafny0/snapshots/Snapshots0.run.dfy.expect
@@ -1,6 +1,6 @@
 Processing command (at Snapshots0.v0.dfy(3,6)) assert (forall<alpha> $o: ref, $f: Field alpha :: false ==> $_Frame[$o, $f]);
   >>> DoNothingToAssert
-Processing command (at Snapshots0.v0.dfy(4,10)) assert Lit(false);
+Processing command (at Snapshots0.v0.dfy(4,10)) assert false;
   >>> DoNothingToAssert
 
 Dafny program verifier finished with 3 verified, 0 errors
@@ -16,7 +16,7 @@ Processing command (at Snapshots0.v1.dfy(3,6)) assert (forall<alpha> $o: ref, $f
   >>> MarkAsFullyVerified
 Processing command (at <unknown location>) a##cached##0 := a##cached##0 && ##extracted_function##2(call0old#AT#$Heap, $Heap);
   >>> AssumeNegationOfAssumptionVariable
-Processing command (at Snapshots0.v1.dfy(4,10)) assert Lit(false);
+Processing command (at Snapshots0.v1.dfy(4,10)) assert false;
   >>> MarkAsPartiallyVerified
 Snapshots0.v1.dfy(4,9): Error: assertion violation
 Execution trace:
diff --git a/Test/dafny0/snapshots/Snapshots1.run.dfy.expect b/Test/dafny0/snapshots/Snapshots1.run.dfy.expect
index 6d5e43f8..1b5c8d24 100644
--- a/Test/dafny0/snapshots/Snapshots1.run.dfy.expect
+++ b/Test/dafny0/snapshots/Snapshots1.run.dfy.expect
@@ -1,6 +1,6 @@
 Processing command (at Snapshots1.v0.dfy(3,4)) assert (forall<alpha> $o: ref, $f: Field alpha :: false ==> $_Frame[$o, $f]);
   >>> DoNothingToAssert
-Processing command (at Snapshots1.v0.dfy(4,10)) assert Lit(false);
+Processing command (at Snapshots1.v0.dfy(4,10)) assert false;
   >>> DoNothingToAssert
 Processing command (at Snapshots1.v0.dfy(12,3)) assert true;
   >>> DoNothingToAssert
@@ -12,7 +12,7 @@ Processing command (at Snapshots1.v1.dfy(12,3)) assert true;
   >>> MarkAsFullyVerified
 Processing command (at Snapshots1.v1.dfy(3,4)) assert (forall<alpha> $o: ref, $f: Field alpha :: false ==> $_Frame[$o, $f]);
   >>> MarkAsFullyVerified
-Processing command (at Snapshots1.v1.dfy(4,10)) assert Lit(false);
+Processing command (at Snapshots1.v1.dfy(4,10)) assert false;
   >>> DoNothingToAssert
 Snapshots1.v1.dfy(4,9): Error: assertion violation
 Execution trace:
diff --git a/Test/dafny0/snapshots/Snapshots2.run.dfy.expect b/Test/dafny0/snapshots/Snapshots2.run.dfy.expect
index ee2ceecd..949ecec9 100644
--- a/Test/dafny0/snapshots/Snapshots2.run.dfy.expect
+++ b/Test/dafny0/snapshots/Snapshots2.run.dfy.expect
@@ -1,6 +1,6 @@
 Processing command (at Snapshots2.v0.dfy(3,4)) assert (forall<alpha> $o: ref, $f: Field alpha :: false ==> $_Frame[$o, $f]);
   >>> DoNothingToAssert
-Processing command (at Snapshots2.v0.dfy(4,10)) assert Lit(false);
+Processing command (at Snapshots2.v0.dfy(4,10)) assert false;
   >>> DoNothingToAssert
 Processing command (at Snapshots2.v0.dfy(11,11)) assert true;
   >>> DoNothingToAssert
@@ -24,7 +24,7 @@ Processing command (at Snapshots2.v1.dfy(18,3)) assert true;
   >>> MarkAsFullyVerified
 Processing command (at Snapshots2.v1.dfy(3,4)) assert (forall<alpha> $o: ref, $f: Field alpha :: false ==> $_Frame[$o, $f]);
   >>> MarkAsFullyVerified
-Processing command (at Snapshots2.v1.dfy(4,10)) assert Lit(false);
+Processing command (at Snapshots2.v1.dfy(4,10)) assert false;
   >>> DoNothingToAssert
 Snapshots2.v1.dfy(4,9): Error: assertion violation
 Execution trace:
diff --git a/Test/dafny0/snapshots/Snapshots3.run.dfy.expect b/Test/dafny0/snapshots/Snapshots3.run.dfy.expect
index accacd90..a7f05a68 100644
--- a/Test/dafny0/snapshots/Snapshots3.run.dfy.expect
+++ b/Test/dafny0/snapshots/Snapshots3.run.dfy.expect
@@ -1,4 +1,4 @@
-Processing command (at Snapshots3.v0.dfy(9,14)) assert Lit(0 != 0);
+Processing command (at Snapshots3.v0.dfy(9,14)) assert 0 != 0;
   >>> DoNothingToAssert
 Snapshots3.v0.dfy(9,13): Error: assertion violation
 Execution trace:
@@ -6,9 +6,9 @@ Execution trace:
     (0,0): anon3_Else
 
 Dafny program verifier finished with 1 verified, 1 error
-Processing command (at Snapshots3.v1.dfy(5,12)) assert Lit(true);
+Processing command (at Snapshots3.v1.dfy(5,12)) assert true;
   >>> DoNothingToAssert
-Processing command (at Snapshots3.v1.dfy(9,14)) assert Lit(0 != 0);
+Processing command (at Snapshots3.v1.dfy(9,14)) assert 0 != 0;
   >>> RecycleError
 Snapshots3.v0.dfy(9,13): Error: assertion violation
 Execution trace:
diff --git a/Test/dafny0/snapshots/Snapshots4.run.dfy.expect b/Test/dafny0/snapshots/Snapshots4.run.dfy.expect
index d56eb9d0..e0f07849 100644
--- a/Test/dafny0/snapshots/Snapshots4.run.dfy.expect
+++ b/Test/dafny0/snapshots/Snapshots4.run.dfy.expect
@@ -2,11 +2,11 @@ Processing command (at Snapshots4.v0.dfy(9,14)) assert LitInt(0) == LitInt(0);
   >>> DoNothingToAssert
 
 Dafny program verifier finished with 2 verified, 0 errors
-Processing command (at Snapshots4.v1.dfy(5,14)) assert Lit(1 != 1);
+Processing command (at Snapshots4.v1.dfy(5,14)) assert 1 != 1;
   >>> DoNothingToAssert
 Processing command (at Snapshots4.v1.dfy(9,14)) assert LitInt(0) == LitInt(0);
   >>> MarkAsFullyVerified
-Processing command (at Snapshots4.v1.dfy(10,14)) assert Lit(2 != 2);
+Processing command (at Snapshots4.v1.dfy(10,14)) assert 2 != 2;
   >>> DoNothingToAssert
 Snapshots4.v1.dfy(5,13): Error: assertion violation
 Execution trace:
diff --git a/Test/dafny0/snapshots/Snapshots6.run.dfy.expect b/Test/dafny0/snapshots/Snapshots6.run.dfy.expect
index bef5a87d..cdb942bb 100644
--- a/Test/dafny0/snapshots/Snapshots6.run.dfy.expect
+++ b/Test/dafny0/snapshots/Snapshots6.run.dfy.expect
@@ -1,8 +1,8 @@
-Processing command (at Snapshots6.v0.dfy(20,14)) assert Lit(false);
+Processing command (at Snapshots6.v0.dfy(20,14)) assert false;
   >>> DoNothingToAssert
 
 Dafny program verifier finished with 4 verified, 0 errors
-Processing command (at Snapshots6.v1.dfy(20,14)) assert Lit(false);
+Processing command (at Snapshots6.v1.dfy(20,14)) assert false;
   >>> DoNothingToAssert
 Snapshots6.v1.dfy(20,13): Error: assertion violation
 Execution trace:
diff --git a/Test/dafny0/snapshots/Snapshots7.run.dfy.expect b/Test/dafny0/snapshots/Snapshots7.run.dfy.expect
index b90a6034..a08b32c6 100644
--- a/Test/dafny0/snapshots/Snapshots7.run.dfy.expect
+++ b/Test/dafny0/snapshots/Snapshots7.run.dfy.expect
@@ -1,4 +1,4 @@
-Processing command (at Snapshots7.v0.dfy(19,14)) assert Lit(false);
+Processing command (at Snapshots7.v0.dfy(19,14)) assert false;
   >>> DoNothingToAssert
 
 Dafny program verifier finished with 4 verified, 0 errors
@@ -22,7 +22,7 @@ Processing command (at <unknown location>) a##cached##0 := a##cached##0 && ##ext
   >>> AssumeNegationOfAssumptionVariable
 Processing command (at <unknown location>) a##cached##0 := a##cached##0 && ##extracted_function##4();
   >>> AssumeNegationOfAssumptionVariable
-Processing command (at Snapshots7.v1.dfy(19,14)) assert Lit(false);
+Processing command (at Snapshots7.v1.dfy(19,14)) assert false;
   >>> MarkAsPartiallyVerified
 Snapshots7.v1.dfy(19,13): Error: assertion violation
 Execution trace:
diff --git a/Test/dafny0/snapshots/Snapshots8.run.dfy.expect b/Test/dafny0/snapshots/Snapshots8.run.dfy.expect
index 625b71b4..e1cbdbe0 100644
--- a/Test/dafny0/snapshots/Snapshots8.run.dfy.expect
+++ b/Test/dafny0/snapshots/Snapshots8.run.dfy.expect
@@ -20,7 +20,7 @@ Snapshots8.v0.dfy(13,12): Related location: This is the postcondition that might
 Processing command (at Snapshots8.v0.dfy(23,12)) assert u#0 != 53;
   >>> DoNothingToAssert
 Snapshots8.v0.dfy(23,11): Error: assertion violation
-Processing command (at Snapshots8.v0.dfy(28,10)) assert Lit(true);
+Processing command (at Snapshots8.v0.dfy(28,10)) assert true;
   >>> DoNothingToAssert
 
 Dafny program verifier finished with 7 verified, 4 errors
@@ -45,7 +45,7 @@ Snapshots8.v1.dfy(12,20): Related location: This is the precondition that might
 Snapshots8.v1.dfy(7,11): Error: assertion violation
 Processing command (at Snapshots8.v1.dfy(21,12)) assert true;
   >>> MarkAsFullyVerified
-Processing command (at Snapshots8.v1.dfy(23,12)) assert Lit(true);
+Processing command (at Snapshots8.v1.dfy(23,12)) assert true;
   >>> DoNothingToAssert
 Processing command (at Snapshots8.v1.dfy(19,13)) assert LitInt(2) <= z#0;
   >>> DoNothingToAssert
diff --git a/Test/dafny4/Bug136.dfy b/Test/dafny4/Bug136.dfy
new file mode 100644
index 00000000..5f3cde69
--- /dev/null
+++ b/Test/dafny4/Bug136.dfy
@@ -0,0 +1,12 @@
+// RUN: %dafny /compile:0 /print:- "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+method test()
+{
+    assume false;
+    assert true;
+}
+
+
+
+
diff --git a/Test/dafny4/Bug136.dfy.expect b/Test/dafny4/Bug136.dfy.expect
new file mode 100644
index 00000000..8b9d32a8
--- /dev/null
+++ b/Test/dafny4/Bug136.dfy.expect
@@ -0,0 +1,1772 @@
+// Dafny program verifier version 1.9.6.21116, Copyright (c) 2003-2015, Microsoft.
+// Command Line Options: -nologo -countVerificationErrors:0 -useBaseNameForFileName /compile:0 /print:- c:\dafny\Test\dafny4\Bug136.dfy
+
+const $$Language$Dafny: bool;
+
+axiom $$Language$Dafny;
+
+type Ty;
+
+const unique TBool: Ty;
+
+const unique TChar: Ty;
+
+const unique TInt: Ty;
+
+const unique TNat: Ty;
+
+const unique TReal: Ty;
+
+function TSet(Ty) : Ty;
+
+function TISet(Ty) : Ty;
+
+function TMultiSet(Ty) : Ty;
+
+function TSeq(Ty) : Ty;
+
+function TMap(Ty, Ty) : Ty;
+
+function TIMap(Ty, Ty) : Ty;
+
+function Inv0_TSet(Ty) : Ty;
+
+axiom (forall t: Ty :: { TSet(t) } Inv0_TSet(TSet(t)) == t);
+
+function Inv0_TISet(Ty) : Ty;
+
+axiom (forall t: Ty :: { TISet(t) } Inv0_TISet(TISet(t)) == t);
+
+function Inv0_TSeq(Ty) : Ty;
+
+axiom (forall t: Ty :: { TSeq(t) } Inv0_TSeq(TSeq(t)) == t);
+
+function Inv0_TMultiSet(Ty) : Ty;
+
+axiom (forall t: Ty :: { TMultiSet(t) } Inv0_TMultiSet(TMultiSet(t)) == t);
+
+function Inv0_TMap(Ty) : Ty;
+
+function Inv1_TMap(Ty) : Ty;
+
+axiom (forall t: Ty, u: Ty :: { TMap(t, u) } Inv0_TMap(TMap(t, u)) == t);
+
+axiom (forall t: Ty, u: Ty :: { TMap(t, u) } Inv1_TMap(TMap(t, u)) == u);
+
+function Inv0_TIMap(Ty) : Ty;
+
+function Inv1_TIMap(Ty) : Ty;
+
+axiom (forall t: Ty, u: Ty :: { TIMap(t, u) } Inv0_TIMap(TIMap(t, u)) == t);
+
+axiom (forall t: Ty, u: Ty :: { TIMap(t, u) } Inv1_TIMap(TIMap(t, u)) == u);
+
+type TyTag;
+
+function Tag(Ty) : TyTag;
+
+const unique TagBool: TyTag;
+
+const unique TagChar: TyTag;
+
+const unique TagInt: TyTag;
+
+const unique TagNat: TyTag;
+
+const unique TagReal: TyTag;
+
+const unique TagSet: TyTag;
+
+const unique TagISet: TyTag;
+
+const unique TagMultiSet: TyTag;
+
+const unique TagSeq: TyTag;
+
+const unique TagMap: TyTag;
+
+const unique TagIMap: TyTag;
+
+const unique TagClass: TyTag;
+
+axiom Tag(TBool) == TagBool;
+
+axiom Tag(TChar) == TagChar;
+
+axiom Tag(TInt) == TagInt;
+
+axiom Tag(TNat) == TagNat;
+
+axiom Tag(TReal) == TagReal;
+
+axiom (forall t: Ty :: { TSet(t) } Tag(TSet(t)) == TagSet);
+
+axiom (forall t: Ty :: { TISet(t) } Tag(TISet(t)) == TagISet);
+
+axiom (forall t: Ty :: { TMultiSet(t) } Tag(TMultiSet(t)) == TagMultiSet);
+
+axiom (forall t: Ty :: { TSeq(t) } Tag(TSeq(t)) == TagSeq);
+
+axiom (forall t: Ty, u: Ty :: { TMap(t, u) } Tag(TMap(t, u)) == TagMap);
+
+axiom (forall t: Ty, u: Ty :: { TIMap(t, u) } Tag(TIMap(t, u)) == TagIMap);
+
+function {:identity} LitInt(x: int) : int;
+
+axiom (forall x: int :: {:identity} { LitInt(x): int } LitInt(x): int == x);
+
+axiom (forall x: int :: { $Box(LitInt(x)) } $Box(LitInt(x)) == Lit($Box(x)));
+
+function {:identity} LitReal(x: real) : real;
+
+axiom (forall x: real :: {:identity} { LitReal(x): real } LitReal(x): real == x);
+
+axiom (forall x: real :: { $Box(LitReal(x)) } $Box(LitReal(x)) == Lit($Box(x)));
+
+function {:identity} Lit<T>(x: T) : T;
+
+axiom (forall<T> x: T :: {:identity} { Lit(x): T } Lit(x): T == x);
+
+axiom (forall<T> x: T :: { $Box(Lit(x)) } $Box(Lit(x)) == Lit($Box(x)));
+
+type char;
+
+function char#FromInt(int) : char;
+
+function char#ToInt(char) : int;
+
+axiom (forall ch: char :: { char#ToInt(ch) } char#FromInt(char#ToInt(ch)) == ch);
+
+axiom (forall n: int :: 
+  { char#FromInt(n) } 
+  0 <= n && n < 65536 ==> char#ToInt(char#FromInt(n)) == n);
+
+type ref;
+
+const null: ref;
+
+const unique NoTraitAtAll: ClassName;
+
+function TraitParent(ClassName) : ClassName;
+
+type Box;
+
+const $ArbitraryBoxValue: Box;
+
+function $Box<T>(T) : Box;
+
+function $Unbox<T>(Box) : T;
+
+axiom (forall<T> x: T :: { $Box(x) } $Unbox($Box(x)) == x);
+
+axiom (forall bx: Box :: 
+  { $IsBox(bx, TInt) } 
+  $IsBox(bx, TInt) ==> $Box($Unbox(bx): int) == bx && $Is($Unbox(bx): int, TInt));
+
+axiom (forall bx: Box :: 
+  { $IsBox(bx, TNat) } 
+  $IsBox(bx, TNat) ==> $Box($Unbox(bx): int) == bx && $Is($Unbox(bx): int, TNat));
+
+axiom (forall bx: Box :: 
+  { $IsBox(bx, TReal) } 
+  $IsBox(bx, TReal)
+     ==> $Box($Unbox(bx): real) == bx && $Is($Unbox(bx): real, TReal));
+
+axiom (forall bx: Box :: 
+  { $IsBox(bx, TBool) } 
+  $IsBox(bx, TBool)
+     ==> $Box($Unbox(bx): bool) == bx && $Is($Unbox(bx): bool, TBool));
+
+axiom (forall bx: Box :: 
+  { $IsBox(bx, TChar) } 
+  $IsBox(bx, TChar)
+     ==> $Box($Unbox(bx): char) == bx && $Is($Unbox(bx): char, TChar));
+
+axiom (forall bx: Box, t: Ty :: 
+  { $IsBox(bx, TSet(t)) } 
+  $IsBox(bx, TSet(t))
+     ==> $Box($Unbox(bx): Set Box) == bx && $Is($Unbox(bx): Set Box, TSet(t)));
+
+axiom (forall bx: Box, t: Ty :: 
+  { $IsBox(bx, TISet(t)) } 
+  $IsBox(bx, TISet(t))
+     ==> $Box($Unbox(bx): ISet Box) == bx && $Is($Unbox(bx): ISet Box, TISet(t)));
+
+axiom (forall bx: Box, t: Ty :: 
+  { $IsBox(bx, TMultiSet(t)) } 
+  $IsBox(bx, TMultiSet(t))
+     ==> $Box($Unbox(bx): MultiSet Box) == bx
+       && $Is($Unbox(bx): MultiSet Box, TMultiSet(t)));
+
+axiom (forall bx: Box, t: Ty :: 
+  { $IsBox(bx, TSeq(t)) } 
+  $IsBox(bx, TSeq(t))
+     ==> $Box($Unbox(bx): Seq Box) == bx && $Is($Unbox(bx): Seq Box, TSeq(t)));
+
+axiom (forall bx: Box, s: Ty, t: Ty :: 
+  { $IsBox(bx, TMap(s, t)) } 
+  $IsBox(bx, TMap(s, t))
+     ==> $Box($Unbox(bx): Map Box Box) == bx && $Is($Unbox(bx): Map Box Box, TMap(s, t)));
+
+axiom (forall bx: Box, s: Ty, t: Ty :: 
+  { $IsBox(bx, TIMap(s, t)) } 
+  $IsBox(bx, TIMap(s, t))
+     ==> $Box($Unbox(bx): IMap Box Box) == bx
+       && $Is($Unbox(bx): IMap Box Box, TIMap(s, t)));
+
+axiom (forall<T> v: T, t: Ty :: 
+  { $IsBox($Box(v), t) } 
+  $IsBox($Box(v), t) <==> $Is(v, t));
+
+axiom (forall<T> v: T, t: Ty, h: Heap :: 
+  { $IsAllocBox($Box(v), t, h) } 
+  $IsAllocBox($Box(v), t, h) <==> $IsAlloc(v, t, h));
+
+function $Is<T>(T, Ty) : bool;
+
+function $IsAlloc<T>(T, Ty, Heap) : bool;
+
+function $IsBox<T>(T, Ty) : bool;
+
+function $IsAllocBox<T>(T, Ty, Heap) : bool;
+
+axiom (forall v: int :: { $Is(v, TInt) } $Is(v, TInt));
+
+axiom (forall v: int :: { $Is(v, TNat) } $Is(v, TNat) <==> v >= 0);
+
+axiom (forall v: real :: { $Is(v, TReal) } $Is(v, TReal));
+
+axiom (forall v: bool :: { $Is(v, TBool) } $Is(v, TBool));
+
+axiom (forall v: char :: { $Is(v, TChar) } $Is(v, TChar));
+
+axiom (forall h: Heap, v: int :: { $IsAlloc(v, TInt, h) } $IsAlloc(v, TInt, h));
+
+axiom (forall h: Heap, v: int :: { $IsAlloc(v, TNat, h) } $IsAlloc(v, TNat, h));
+
+axiom (forall h: Heap, v: real :: { $IsAlloc(v, TReal, h) } $IsAlloc(v, TReal, h));
+
+axiom (forall h: Heap, v: bool :: { $IsAlloc(v, TBool, h) } $IsAlloc(v, TBool, h));
+
+axiom (forall h: Heap, v: char :: { $IsAlloc(v, TChar, h) } $IsAlloc(v, TChar, h));
+
+axiom (forall v: Set Box, t0: Ty :: 
+  { $Is(v, TSet(t0)) } 
+  $Is(v, TSet(t0)) <==> (forall bx: Box :: { v[bx] } v[bx] ==> $IsBox(bx, t0)));
+
+axiom (forall v: ISet Box, t0: Ty :: 
+  { $Is(v, TISet(t0)) } 
+  $Is(v, TISet(t0)) <==> (forall bx: Box :: { v[bx] } v[bx] ==> $IsBox(bx, t0)));
+
+axiom (forall v: MultiSet Box, t0: Ty :: 
+  { $Is(v, TMultiSet(t0)) } 
+  $Is(v, TMultiSet(t0))
+     <==> (forall bx: Box :: { v[bx] } 0 < v[bx] ==> $IsBox(bx, t0)));
+
+axiom (forall v: MultiSet Box, t0: Ty :: 
+  { $Is(v, TMultiSet(t0)) } 
+  $Is(v, TMultiSet(t0)) ==> $IsGoodMultiSet(v));
+
+axiom (forall v: Seq Box, t0: Ty :: 
+  { $Is(v, TSeq(t0)) } 
+  $Is(v, TSeq(t0))
+     <==> (forall i: int :: 
+      { Seq#Index(v, i) } 
+      0 <= i && i < Seq#Length(v) ==> $IsBox(Seq#Index(v, i), t0)));
+
+axiom (forall v: Set Box, t0: Ty, h: Heap :: 
+  { $IsAlloc(v, TSet(t0), h) } 
+  $IsAlloc(v, TSet(t0), h)
+     <==> (forall bx: Box :: { v[bx] } v[bx] ==> $IsAllocBox(bx, t0, h)));
+
+axiom (forall v: ISet Box, t0: Ty, h: Heap :: 
+  { $IsAlloc(v, TISet(t0), h) } 
+  $IsAlloc(v, TISet(t0), h)
+     <==> (forall bx: Box :: { v[bx] } v[bx] ==> $IsAllocBox(bx, t0, h)));
+
+axiom (forall v: MultiSet Box, t0: Ty, h: Heap :: 
+  { $IsAlloc(v, TMultiSet(t0), h) } 
+  $IsAlloc(v, TMultiSet(t0), h)
+     <==> (forall bx: Box :: { v[bx] } 0 < v[bx] ==> $IsAllocBox(bx, t0, h)));
+
+axiom (forall v: Seq Box, t0: Ty, h: Heap :: 
+  { $IsAlloc(v, TSeq(t0), h) } 
+  $IsAlloc(v, TSeq(t0), h)
+     <==> (forall i: int :: 
+      { Seq#Index(v, i) } 
+      0 <= i && i < Seq#Length(v) ==> $IsAllocBox(Seq#Index(v, i), t0, h)));
+
+axiom (forall v: Map Box Box, t0: Ty, t1: Ty :: 
+  { $Is(v, TMap(t0, t1)) } 
+  $Is(v, TMap(t0, t1))
+     <==> (forall bx: Box :: 
+      { Map#Elements(v)[bx] } { Map#Domain(v)[bx] } 
+      Map#Domain(v)[bx] ==> $IsBox(Map#Elements(v)[bx], t1) && $IsBox(bx, t0)));
+
+axiom (forall v: Map Box Box, t0: Ty, t1: Ty, h: Heap :: 
+  { $IsAlloc(v, TMap(t0, t1), h) } 
+  $IsAlloc(v, TMap(t0, t1), h)
+     <==> (forall bx: Box :: 
+      { Map#Elements(v)[bx] } { Map#Domain(v)[bx] } 
+      Map#Domain(v)[bx]
+         ==> $IsAllocBox(Map#Elements(v)[bx], t1, h) && $IsAllocBox(bx, t0, h)));
+
+axiom (forall v: IMap Box Box, t0: Ty, t1: Ty :: 
+  { $Is(v, TIMap(t0, t1)) } 
+  $Is(v, TIMap(t0, t1))
+     <==> (forall bx: Box :: 
+      { IMap#Elements(v)[bx] } { IMap#Domain(v)[bx] } 
+      IMap#Domain(v)[bx] ==> $IsBox(IMap#Elements(v)[bx], t1) && $IsBox(bx, t0)));
+
+axiom (forall v: IMap Box Box, t0: Ty, t1: Ty, h: Heap :: 
+  { $IsAlloc(v, TIMap(t0, t1), h) } 
+  $IsAlloc(v, TIMap(t0, t1), h)
+     <==> (forall bx: Box :: 
+      { IMap#Elements(v)[bx] } { IMap#Domain(v)[bx] } 
+      IMap#Domain(v)[bx]
+         ==> $IsAllocBox(IMap#Elements(v)[bx], t1, h) && $IsAllocBox(bx, t0, h)));
+
+type ClassName;
+
+const unique class._System.int: ClassName;
+
+const unique class._System.bool: ClassName;
+
+const unique class._System.set: ClassName;
+
+const unique class._System.seq: ClassName;
+
+const unique class._System.multiset: ClassName;
+
+function Tclass._System.object() : Ty;
+
+function dtype(ref) : Ty;
+
+function TypeTuple(a: ClassName, b: ClassName) : ClassName;
+
+function TypeTupleCar(ClassName) : ClassName;
+
+function TypeTupleCdr(ClassName) : ClassName;
+
+axiom (forall a: ClassName, b: ClassName :: 
+  { TypeTuple(a, b) } 
+  TypeTupleCar(TypeTuple(a, b)) == a && TypeTupleCdr(TypeTuple(a, b)) == b);
+
+type HandleType;
+
+function SetRef_to_SetBox(s: [ref]bool) : Set Box;
+
+axiom (forall s: [ref]bool, bx: Box :: 
+  { SetRef_to_SetBox(s)[bx] } 
+  SetRef_to_SetBox(s)[bx] == s[$Unbox(bx): ref]);
+
+axiom (forall s: [ref]bool :: 
+  { SetRef_to_SetBox(s) } 
+  $Is(SetRef_to_SetBox(s), TSet(Tclass._System.object())));
+
+type DatatypeType;
+
+type DtCtorId;
+
+function DatatypeCtorId(DatatypeType) : DtCtorId;
+
+function DtRank(DatatypeType) : int;
+
+function BoxRank(Box) : int;
+
+axiom (forall d: DatatypeType :: { BoxRank($Box(d)) } BoxRank($Box(d)) == DtRank(d));
+
+const $ModuleContextHeight: int;
+
+const $FunctionContextHeight: int;
+
+type LayerType;
+
+const $LZ: LayerType;
+
+function $LS(LayerType) : LayerType;
+
+function AtLayer<A>([LayerType]A, LayerType) : A;
+
+axiom (forall<A> f: [LayerType]A, ly: LayerType :: 
+  { AtLayer(f, ly) } 
+  AtLayer(f, ly) == f[ly]);
+
+axiom (forall<A> f: [LayerType]A, ly: LayerType :: 
+  { AtLayer(f, $LS(ly)) } 
+  AtLayer(f, $LS(ly)) == AtLayer(f, ly));
+
+type Field _;
+
+function FDim<T>(Field T) : int;
+
+function IndexField(int) : Field Box;
+
+axiom (forall i: int :: { IndexField(i) } FDim(IndexField(i)) == 1);
+
+function IndexField_Inverse<T>(Field T) : int;
+
+axiom (forall i: int :: { IndexField(i) } IndexField_Inverse(IndexField(i)) == i);
+
+function MultiIndexField(Field Box, int) : Field Box;
+
+axiom (forall f: Field Box, i: int :: 
+  { MultiIndexField(f, i) } 
+  FDim(MultiIndexField(f, i)) == FDim(f) + 1);
+
+function MultiIndexField_Inverse0<T>(Field T) : Field T;
+
+function MultiIndexField_Inverse1<T>(Field T) : int;
+
+axiom (forall f: Field Box, i: int :: 
+  { MultiIndexField(f, i) } 
+  MultiIndexField_Inverse0(MultiIndexField(f, i)) == f
+     && MultiIndexField_Inverse1(MultiIndexField(f, i)) == i);
+
+function DeclType<T>(Field T) : ClassName;
+
+type NameFamily;
+
+function DeclName<T>(Field T) : NameFamily;
+
+function FieldOfDecl<alpha>(ClassName, NameFamily) : Field alpha;
+
+axiom (forall<T> cl: ClassName, nm: NameFamily :: 
+  { FieldOfDecl(cl, nm): Field T } 
+  DeclType(FieldOfDecl(cl, nm): Field T) == cl
+     && DeclName(FieldOfDecl(cl, nm): Field T) == nm);
+
+function $IsGhostField<T>(Field T) : bool;
+
+axiom (forall<T> h: Heap, k: Heap, v: T, t: Ty :: 
+  { $HeapSucc(h, k), $IsAlloc(v, t, h) } 
+  $HeapSucc(h, k) ==> $IsAlloc(v, t, h) ==> $IsAlloc(v, t, k));
+
+axiom (forall h: Heap, k: Heap, bx: Box, t: Ty :: 
+  { $HeapSucc(h, k), $IsAllocBox(bx, t, h) } 
+  $HeapSucc(h, k) ==> $IsAllocBox(bx, t, h) ==> $IsAllocBox(bx, t, k));
+
+const unique alloc: Field bool;
+
+axiom FDim(alloc) == 0 && !$IsGhostField(alloc);
+
+function _System.array.Length(a: ref) : int;
+
+axiom (forall o: ref :: 0 <= _System.array.Length(o));
+
+function Int(x: real) : int;
+
+axiom (forall x: real :: { Int(x): int } Int(x): int == int(x));
+
+function Real(x: int) : real;
+
+axiom (forall x: int :: { Real(x): real } Real(x): real == real(x));
+
+axiom (forall i: int :: { Int(Real(i)) } Int(Real(i)) == i);
+
+function {:inline true} _System.real.Trunc(x: real) : int
+{
+  Int(x)
+}
+
+type Heap = <alpha>[ref,Field alpha]alpha;
+
+function {:inline true} read<alpha>(H: Heap, r: ref, f: Field alpha) : alpha
+{
+  H[r, f]
+}
+
+function {:inline true} update<alpha>(H: Heap, r: ref, f: Field alpha, v: alpha) : Heap
+{
+  H[r, f := v]
+}
+
+function $IsGoodHeap(Heap) : bool;
+
+function $IsHeapAnchor(Heap) : bool;
+
+var $Heap: Heap where $IsGoodHeap($Heap) && $IsHeapAnchor($Heap);
+
+function $HeapSucc(Heap, Heap) : bool;
+
+axiom (forall<alpha> h: Heap, r: ref, f: Field alpha, x: alpha :: 
+  { update(h, r, f, x) } 
+  $IsGoodHeap(update(h, r, f, x)) ==> $HeapSucc(h, update(h, r, f, x)));
+
+axiom (forall a: Heap, b: Heap, c: Heap :: 
+  { $HeapSucc(a, b), $HeapSucc(b, c) } 
+  $HeapSucc(a, b) && $HeapSucc(b, c) ==> $HeapSucc(a, c));
+
+axiom (forall h: Heap, k: Heap :: 
+  { $HeapSucc(h, k) } 
+  $HeapSucc(h, k)
+     ==> (forall o: ref :: { read(k, o, alloc) } read(h, o, alloc) ==> read(k, o, alloc)));
+
+function $HeapSuccGhost(Heap, Heap) : bool;
+
+axiom (forall h: Heap, k: Heap :: 
+  { $HeapSuccGhost(h, k) } 
+  $HeapSuccGhost(h, k)
+     ==> $HeapSucc(h, k)
+       && (forall<alpha> o: ref, f: Field alpha :: 
+        { read(k, o, f) } 
+        !$IsGhostField(f) ==> read(h, o, f) == read(k, o, f)));
+
+type TickType;
+
+var $Tick: TickType;
+
+procedure $YieldHavoc(this: ref, rds: Set Box, nw: Set Box);
+  modifies $Heap;
+  ensures (forall<alpha> $o: ref, $f: Field alpha :: 
+  { read($Heap, $o, $f) } 
+  $o != null && read(old($Heap), $o, alloc)
+     ==> 
+    $o == this || rds[$Box($o)] || nw[$Box($o)]
+     ==> read($Heap, $o, $f) == read(old($Heap), $o, $f));
+  ensures $HeapSucc(old($Heap), $Heap);
+
+
+
+procedure $IterHavoc0(this: ref, rds: Set Box, modi: Set Box);
+  modifies $Heap;
+  ensures (forall<alpha> $o: ref, $f: Field alpha :: 
+  { read($Heap, $o, $f) } 
+  $o != null && read(old($Heap), $o, alloc)
+     ==> 
+    rds[$Box($o)] && !modi[$Box($o)] && $o != this
+     ==> read($Heap, $o, $f) == read(old($Heap), $o, $f));
+  ensures $HeapSucc(old($Heap), $Heap);
+
+
+
+procedure $IterHavoc1(this: ref, modi: Set Box, nw: Set Box);
+  modifies $Heap;
+  ensures (forall<alpha> $o: ref, $f: Field alpha :: 
+  { read($Heap, $o, $f) } 
+  $o != null && read(old($Heap), $o, alloc)
+     ==> read($Heap, $o, $f) == read(old($Heap), $o, $f)
+       || $o == this
+       || modi[$Box($o)]
+       || nw[$Box($o)]);
+  ensures $HeapSucc(old($Heap), $Heap);
+
+
+
+procedure $IterCollectNewObjects(prevHeap: Heap, newHeap: Heap, this: ref, NW: Field (Set Box))
+   returns (s: Set Box);
+  ensures (forall bx: Box :: 
+  { s[bx] } 
+  s[bx]
+     <==> read(newHeap, this, NW)[bx]
+       || (
+        $Unbox(bx) != null
+         && !read(prevHeap, $Unbox(bx): ref, alloc)
+         && read(newHeap, $Unbox(bx): ref, alloc)));
+
+
+
+type Set T = [T]bool;
+
+function Set#Card<T>(Set T) : int;
+
+axiom (forall<T> s: Set T :: { Set#Card(s) } 0 <= Set#Card(s));
+
+function Set#Empty<T>() : Set T;
+
+axiom (forall<T> o: T :: { Set#Empty()[o] } !Set#Empty()[o]);
+
+axiom (forall<T> s: Set T :: 
+  { Set#Card(s) } 
+  (Set#Card(s) == 0 <==> s == Set#Empty())
+     && (Set#Card(s) != 0 ==> (exists x: T :: s[x])));
+
+function Set#Singleton<T>(T) : Set T;
+
+axiom (forall<T> r: T :: { Set#Singleton(r) } Set#Singleton(r)[r]);
+
+axiom (forall<T> r: T, o: T :: 
+  { Set#Singleton(r)[o] } 
+  Set#Singleton(r)[o] <==> r == o);
+
+axiom (forall<T> r: T :: 
+  { Set#Card(Set#Singleton(r)) } 
+  Set#Card(Set#Singleton(r)) == 1);
+
+function Set#UnionOne<T>(Set T, T) : Set T;
+
+axiom (forall<T> a: Set T, x: T, o: T :: 
+  { Set#UnionOne(a, x)[o] } 
+  Set#UnionOne(a, x)[o] <==> o == x || a[o]);
+
+axiom (forall<T> a: Set T, x: T :: { Set#UnionOne(a, x) } Set#UnionOne(a, x)[x]);
+
+axiom (forall<T> a: Set T, x: T, y: T :: 
+  { Set#UnionOne(a, x), a[y] } 
+  a[y] ==> Set#UnionOne(a, x)[y]);
+
+axiom (forall<T> a: Set T, x: T :: 
+  { Set#Card(Set#UnionOne(a, x)) } 
+  a[x] ==> Set#Card(Set#UnionOne(a, x)) == Set#Card(a));
+
+axiom (forall<T> a: Set T, x: T :: 
+  { Set#Card(Set#UnionOne(a, x)) } 
+  !a[x] ==> Set#Card(Set#UnionOne(a, x)) == Set#Card(a) + 1);
+
+function Set#Union<T>(Set T, Set T) : Set T;
+
+axiom (forall<T> a: Set T, b: Set T, o: T :: 
+  { Set#Union(a, b)[o] } 
+  Set#Union(a, b)[o] <==> a[o] || b[o]);
+
+axiom (forall<T> a: Set T, b: Set T, y: T :: 
+  { Set#Union(a, b), a[y] } 
+  a[y] ==> Set#Union(a, b)[y]);
+
+axiom (forall<T> a: Set T, b: Set T, y: T :: 
+  { Set#Union(a, b), b[y] } 
+  b[y] ==> Set#Union(a, b)[y]);
+
+axiom (forall<T> a: Set T, b: Set T :: 
+  { Set#Union(a, b) } 
+  Set#Disjoint(a, b)
+     ==> Set#Difference(Set#Union(a, b), a) == b
+       && Set#Difference(Set#Union(a, b), b) == a);
+
+function Set#Intersection<T>(Set T, Set T) : Set T;
+
+axiom (forall<T> a: Set T, b: Set T, o: T :: 
+  { Set#Intersection(a, b)[o] } 
+  Set#Intersection(a, b)[o] <==> a[o] && b[o]);
+
+axiom (forall<T> a: Set T, b: Set T :: 
+  { Set#Union(Set#Union(a, b), b) } 
+  Set#Union(Set#Union(a, b), b) == Set#Union(a, b));
+
+axiom (forall<T> a: Set T, b: Set T :: 
+  { Set#Union(a, Set#Union(a, b)) } 
+  Set#Union(a, Set#Union(a, b)) == Set#Union(a, b));
+
+axiom (forall<T> a: Set T, b: Set T :: 
+  { Set#Intersection(Set#Intersection(a, b), b) } 
+  Set#Intersection(Set#Intersection(a, b), b) == Set#Intersection(a, b));
+
+axiom (forall<T> a: Set T, b: Set T :: 
+  { Set#Intersection(a, Set#Intersection(a, b)) } 
+  Set#Intersection(a, Set#Intersection(a, b)) == Set#Intersection(a, b));
+
+axiom (forall<T> a: Set T, b: Set T :: 
+  { Set#Card(Set#Union(a, b)) } { Set#Card(Set#Intersection(a, b)) } 
+  Set#Card(Set#Union(a, b)) + Set#Card(Set#Intersection(a, b))
+     == Set#Card(a) + Set#Card(b));
+
+function Set#Difference<T>(Set T, Set T) : Set T;
+
+axiom (forall<T> a: Set T, b: Set T, o: T :: 
+  { Set#Difference(a, b)[o] } 
+  Set#Difference(a, b)[o] <==> a[o] && !b[o]);
+
+axiom (forall<T> a: Set T, b: Set T, y: T :: 
+  { Set#Difference(a, b), b[y] } 
+  b[y] ==> !Set#Difference(a, b)[y]);
+
+axiom (forall<T> a: Set T, b: Set T :: 
+  { Set#Card(Set#Difference(a, b)) } 
+  Set#Card(Set#Difference(a, b))
+         + Set#Card(Set#Difference(b, a))
+         + Set#Card(Set#Intersection(a, b))
+       == Set#Card(Set#Union(a, b))
+     && Set#Card(Set#Difference(a, b)) == Set#Card(a) - Set#Card(Set#Intersection(a, b)));
+
+function Set#Subset<T>(Set T, Set T) : bool;
+
+axiom (forall<T> a: Set T, b: Set T :: 
+  { Set#Subset(a, b) } 
+  Set#Subset(a, b) <==> (forall o: T :: { a[o] } { b[o] } a[o] ==> b[o]));
+
+function Set#Equal<T>(Set T, Set T) : bool;
+
+axiom (forall<T> a: Set T, b: Set T :: 
+  { Set#Equal(a, b) } 
+  Set#Equal(a, b) <==> (forall o: T :: { a[o] } { b[o] } a[o] <==> b[o]));
+
+axiom (forall<T> a: Set T, b: Set T :: { Set#Equal(a, b) } Set#Equal(a, b) ==> a == b);
+
+function Set#Disjoint<T>(Set T, Set T) : bool;
+
+axiom (forall<T> a: Set T, b: Set T :: 
+  { Set#Disjoint(a, b) } 
+  Set#Disjoint(a, b) <==> (forall o: T :: { a[o] } { b[o] } !a[o] || !b[o]));
+
+type ISet T = [T]bool;
+
+function ISet#Empty<T>() : Set T;
+
+axiom (forall<T> o: T :: { ISet#Empty()[o] } !ISet#Empty()[o]);
+
+function ISet#UnionOne<T>(ISet T, T) : ISet T;
+
+axiom (forall<T> a: ISet T, x: T, o: T :: 
+  { ISet#UnionOne(a, x)[o] } 
+  ISet#UnionOne(a, x)[o] <==> o == x || a[o]);
+
+axiom (forall<T> a: ISet T, x: T :: { ISet#UnionOne(a, x) } ISet#UnionOne(a, x)[x]);
+
+axiom (forall<T> a: ISet T, x: T, y: T :: 
+  { ISet#UnionOne(a, x), a[y] } 
+  a[y] ==> ISet#UnionOne(a, x)[y]);
+
+function ISet#Union<T>(ISet T, ISet T) : ISet T;
+
+axiom (forall<T> a: ISet T, b: ISet T, o: T :: 
+  { ISet#Union(a, b)[o] } 
+  ISet#Union(a, b)[o] <==> a[o] || b[o]);
+
+axiom (forall<T> a: ISet T, b: ISet T, y: T :: 
+  { ISet#Union(a, b), a[y] } 
+  a[y] ==> ISet#Union(a, b)[y]);
+
+axiom (forall<T> a: Set T, b: Set T, y: T :: 
+  { ISet#Union(a, b), b[y] } 
+  b[y] ==> ISet#Union(a, b)[y]);
+
+axiom (forall<T> a: ISet T, b: ISet T :: 
+  { ISet#Union(a, b) } 
+  ISet#Disjoint(a, b)
+     ==> ISet#Difference(ISet#Union(a, b), a) == b
+       && ISet#Difference(ISet#Union(a, b), b) == a);
+
+function ISet#Intersection<T>(ISet T, ISet T) : ISet T;
+
+axiom (forall<T> a: ISet T, b: ISet T, o: T :: 
+  { ISet#Intersection(a, b)[o] } 
+  ISet#Intersection(a, b)[o] <==> a[o] && b[o]);
+
+axiom (forall<T> a: ISet T, b: ISet T :: 
+  { ISet#Union(ISet#Union(a, b), b) } 
+  ISet#Union(ISet#Union(a, b), b) == ISet#Union(a, b));
+
+axiom (forall<T> a: Set T, b: Set T :: 
+  { ISet#Union(a, ISet#Union(a, b)) } 
+  ISet#Union(a, ISet#Union(a, b)) == ISet#Union(a, b));
+
+axiom (forall<T> a: ISet T, b: ISet T :: 
+  { ISet#Intersection(ISet#Intersection(a, b), b) } 
+  ISet#Intersection(ISet#Intersection(a, b), b) == ISet#Intersection(a, b));
+
+axiom (forall<T> a: ISet T, b: ISet T :: 
+  { ISet#Intersection(a, ISet#Intersection(a, b)) } 
+  ISet#Intersection(a, ISet#Intersection(a, b)) == ISet#Intersection(a, b));
+
+function ISet#Difference<T>(ISet T, ISet T) : ISet T;
+
+axiom (forall<T> a: ISet T, b: ISet T, o: T :: 
+  { ISet#Difference(a, b)[o] } 
+  ISet#Difference(a, b)[o] <==> a[o] && !b[o]);
+
+axiom (forall<T> a: ISet T, b: ISet T, y: T :: 
+  { ISet#Difference(a, b), b[y] } 
+  b[y] ==> !ISet#Difference(a, b)[y]);
+
+function ISet#Subset<T>(ISet T, ISet T) : bool;
+
+axiom (forall<T> a: ISet T, b: ISet T :: 
+  { ISet#Subset(a, b) } 
+  ISet#Subset(a, b) <==> (forall o: T :: { a[o] } { b[o] } a[o] ==> b[o]));
+
+function ISet#Equal<T>(ISet T, ISet T) : bool;
+
+axiom (forall<T> a: ISet T, b: ISet T :: 
+  { ISet#Equal(a, b) } 
+  ISet#Equal(a, b) <==> (forall o: T :: { a[o] } { b[o] } a[o] <==> b[o]));
+
+axiom (forall<T> a: ISet T, b: ISet T :: 
+  { ISet#Equal(a, b) } 
+  ISet#Equal(a, b) ==> a == b);
+
+function ISet#Disjoint<T>(ISet T, ISet T) : bool;
+
+axiom (forall<T> a: ISet T, b: ISet T :: 
+  { ISet#Disjoint(a, b) } 
+  ISet#Disjoint(a, b) <==> (forall o: T :: { a[o] } { b[o] } !a[o] || !b[o]));
+
+function Math#min(a: int, b: int) : int;
+
+axiom (forall a: int, b: int :: { Math#min(a, b) } a <= b <==> Math#min(a, b) == a);
+
+axiom (forall a: int, b: int :: { Math#min(a, b) } b <= a <==> Math#min(a, b) == b);
+
+axiom (forall a: int, b: int :: 
+  { Math#min(a, b) } 
+  Math#min(a, b) == a || Math#min(a, b) == b);
+
+function Math#clip(a: int) : int;
+
+axiom (forall a: int :: { Math#clip(a) } 0 <= a ==> Math#clip(a) == a);
+
+axiom (forall a: int :: { Math#clip(a) } a < 0 ==> Math#clip(a) == 0);
+
+type MultiSet T = [T]int;
+
+function $IsGoodMultiSet<T>(ms: MultiSet T) : bool;
+
+axiom (forall<T> ms: MultiSet T :: 
+  { $IsGoodMultiSet(ms) } 
+  $IsGoodMultiSet(ms)
+     <==> (forall bx: T :: { ms[bx] } 0 <= ms[bx] && ms[bx] <= MultiSet#Card(ms)));
+
+function MultiSet#Card<T>(MultiSet T) : int;
+
+axiom (forall<T> s: MultiSet T :: { MultiSet#Card(s) } 0 <= MultiSet#Card(s));
+
+axiom (forall<T> s: MultiSet T, x: T, n: int :: 
+  { MultiSet#Card(s[x := n]) } 
+  0 <= n ==> MultiSet#Card(s[x := n]) == MultiSet#Card(s) - s[x] + n);
+
+function MultiSet#Empty<T>() : MultiSet T;
+
+axiom (forall<T> o: T :: { MultiSet#Empty()[o] } MultiSet#Empty()[o] == 0);
+
+axiom (forall<T> s: MultiSet T :: 
+  { MultiSet#Card(s) } 
+  (MultiSet#Card(s) == 0 <==> s == MultiSet#Empty())
+     && (MultiSet#Card(s) != 0 ==> (exists x: T :: 0 < s[x])));
+
+function MultiSet#Singleton<T>(T) : MultiSet T;
+
+axiom (forall<T> r: T, o: T :: 
+  { MultiSet#Singleton(r)[o] } 
+  (MultiSet#Singleton(r)[o] == 1 <==> r == o)
+     && (MultiSet#Singleton(r)[o] == 0 <==> r != o));
+
+axiom (forall<T> r: T :: 
+  { MultiSet#Singleton(r) } 
+  MultiSet#Singleton(r) == MultiSet#UnionOne(MultiSet#Empty(), r));
+
+function MultiSet#UnionOne<T>(MultiSet T, T) : MultiSet T;
+
+axiom (forall<T> a: MultiSet T, x: T, o: T :: 
+  { MultiSet#UnionOne(a, x)[o] } 
+  0 < MultiSet#UnionOne(a, x)[o] <==> o == x || 0 < a[o]);
+
+axiom (forall<T> a: MultiSet T, x: T :: 
+  { MultiSet#UnionOne(a, x) } 
+  MultiSet#UnionOne(a, x)[x] == a[x] + 1);
+
+axiom (forall<T> a: MultiSet T, x: T, y: T :: 
+  { MultiSet#UnionOne(a, x), a[y] } 
+  0 < a[y] ==> 0 < MultiSet#UnionOne(a, x)[y]);
+
+axiom (forall<T> a: MultiSet T, x: T, y: T :: 
+  { MultiSet#UnionOne(a, x), a[y] } 
+  x != y ==> a[y] == MultiSet#UnionOne(a, x)[y]);
+
+axiom (forall<T> a: MultiSet T, x: T :: 
+  { MultiSet#Card(MultiSet#UnionOne(a, x)) } 
+  MultiSet#Card(MultiSet#UnionOne(a, x)) == MultiSet#Card(a) + 1);
+
+function MultiSet#Union<T>(MultiSet T, MultiSet T) : MultiSet T;
+
+axiom (forall<T> a: MultiSet T, b: MultiSet T, o: T :: 
+  { MultiSet#Union(a, b)[o] } 
+  MultiSet#Union(a, b)[o] == a[o] + b[o]);
+
+axiom (forall<T> a: MultiSet T, b: MultiSet T :: 
+  { MultiSet#Card(MultiSet#Union(a, b)) } 
+  MultiSet#Card(MultiSet#Union(a, b)) == MultiSet#Card(a) + MultiSet#Card(b));
+
+function MultiSet#Intersection<T>(MultiSet T, MultiSet T) : MultiSet T;
+
+axiom (forall<T> a: MultiSet T, b: MultiSet T, o: T :: 
+  { MultiSet#Intersection(a, b)[o] } 
+  MultiSet#Intersection(a, b)[o] == Math#min(a[o], b[o]));
+
+axiom (forall<T> a: MultiSet T, b: MultiSet T :: 
+  { MultiSet#Intersection(MultiSet#Intersection(a, b), b) } 
+  MultiSet#Intersection(MultiSet#Intersection(a, b), b)
+     == MultiSet#Intersection(a, b));
+
+axiom (forall<T> a: MultiSet T, b: MultiSet T :: 
+  { MultiSet#Intersection(a, MultiSet#Intersection(a, b)) } 
+  MultiSet#Intersection(a, MultiSet#Intersection(a, b))
+     == MultiSet#Intersection(a, b));
+
+function MultiSet#Difference<T>(MultiSet T, MultiSet T) : MultiSet T;
+
+axiom (forall<T> a: MultiSet T, b: MultiSet T, o: T :: 
+  { MultiSet#Difference(a, b)[o] } 
+  MultiSet#Difference(a, b)[o] == Math#clip(a[o] - b[o]));
+
+axiom (forall<T> a: MultiSet T, b: MultiSet T, y: T :: 
+  { MultiSet#Difference(a, b), b[y], a[y] } 
+  a[y] <= b[y] ==> MultiSet#Difference(a, b)[y] == 0);
+
+axiom (forall<T> a: MultiSet T, b: MultiSet T :: 
+  { MultiSet#Card(MultiSet#Difference(a, b)) } 
+  MultiSet#Card(MultiSet#Difference(a, b))
+         + MultiSet#Card(MultiSet#Difference(b, a))
+         + 2 * MultiSet#Card(MultiSet#Intersection(a, b))
+       == MultiSet#Card(MultiSet#Union(a, b))
+     && MultiSet#Card(MultiSet#Difference(a, b))
+       == MultiSet#Card(a) - MultiSet#Card(MultiSet#Intersection(a, b)));
+
+function MultiSet#Subset<T>(MultiSet T, MultiSet T) : bool;
+
+axiom (forall<T> a: MultiSet T, b: MultiSet T :: 
+  { MultiSet#Subset(a, b) } 
+  MultiSet#Subset(a, b) <==> (forall o: T :: { a[o] } { b[o] } a[o] <= b[o]));
+
+function MultiSet#Equal<T>(MultiSet T, MultiSet T) : bool;
+
+axiom (forall<T> a: MultiSet T, b: MultiSet T :: 
+  { MultiSet#Equal(a, b) } 
+  MultiSet#Equal(a, b) <==> (forall o: T :: { a[o] } { b[o] } a[o] == b[o]));
+
+axiom (forall<T> a: MultiSet T, b: MultiSet T :: 
+  { MultiSet#Equal(a, b) } 
+  MultiSet#Equal(a, b) ==> a == b);
+
+function MultiSet#Disjoint<T>(MultiSet T, MultiSet T) : bool;
+
+axiom (forall<T> a: MultiSet T, b: MultiSet T :: 
+  { MultiSet#Disjoint(a, b) } 
+  MultiSet#Disjoint(a, b)
+     <==> (forall o: T :: { a[o] } { b[o] } a[o] == 0 || b[o] == 0));
+
+function MultiSet#FromSet<T>(Set T) : MultiSet T;
+
+axiom (forall<T> s: Set T, a: T :: 
+  { MultiSet#FromSet(s)[a] } 
+  (MultiSet#FromSet(s)[a] == 0 <==> !s[a])
+     && (MultiSet#FromSet(s)[a] == 1 <==> s[a]));
+
+axiom (forall<T> s: Set T :: 
+  { MultiSet#Card(MultiSet#FromSet(s)) } 
+  MultiSet#Card(MultiSet#FromSet(s)) == Set#Card(s));
+
+function MultiSet#FromSeq<T>(Seq T) : MultiSet T;
+
+axiom (forall<T> s: Seq T :: 
+  { MultiSet#FromSeq(s) } 
+  $IsGoodMultiSet(MultiSet#FromSeq(s)));
+
+axiom (forall<T> s: Seq T :: 
+  { MultiSet#Card(MultiSet#FromSeq(s)) } 
+  MultiSet#Card(MultiSet#FromSeq(s)) == Seq#Length(s));
+
+axiom (forall<T> s: Seq T, v: T :: 
+  { MultiSet#FromSeq(Seq#Build(s, v)) } 
+  MultiSet#FromSeq(Seq#Build(s, v)) == MultiSet#UnionOne(MultiSet#FromSeq(s), v));
+
+axiom (forall<T>  :: 
+  MultiSet#FromSeq(Seq#Empty(): Seq T) == MultiSet#Empty(): MultiSet T);
+
+axiom (forall<T> a: Seq T, b: Seq T :: 
+  { MultiSet#FromSeq(Seq#Append(a, b)) } 
+  MultiSet#FromSeq(Seq#Append(a, b))
+     == MultiSet#Union(MultiSet#FromSeq(a), MultiSet#FromSeq(b)));
+
+axiom (forall<T> s: Seq T, i: int, v: T, x: T :: 
+  { MultiSet#FromSeq(Seq#Update(s, i, v))[x] } 
+  0 <= i && i < Seq#Length(s)
+     ==> MultiSet#FromSeq(Seq#Update(s, i, v))[x]
+       == MultiSet#Union(MultiSet#Difference(MultiSet#FromSeq(s), MultiSet#Singleton(Seq#Index(s, i))), 
+        MultiSet#Singleton(v))[x]);
+
+axiom (forall<T> s: Seq T, x: T :: 
+  { MultiSet#FromSeq(s)[x] } 
+  (exists i: int :: 
+      { Seq#Index(s, i) } 
+      0 <= i && i < Seq#Length(s) && x == Seq#Index(s, i))
+     <==> 0 < MultiSet#FromSeq(s)[x]);
+
+type Seq _;
+
+function Seq#Length<T>(Seq T) : int;
+
+axiom (forall<T> s: Seq T :: { Seq#Length(s) } 0 <= Seq#Length(s));
+
+function Seq#Empty<T>() : Seq T;
+
+axiom (forall<T>  :: Seq#Length(Seq#Empty(): Seq T) == 0);
+
+axiom (forall<T> s: Seq T :: 
+  { Seq#Length(s) } 
+  Seq#Length(s) == 0 ==> s == Seq#Empty());
+
+axiom (forall<T> t: Ty :: { $Is(Seq#Empty(): Seq T, t) } $Is(Seq#Empty(): Seq T, t));
+
+function Seq#Singleton<T>(T) : Seq T;
+
+axiom (forall<T> t: T :: 
+  { Seq#Length(Seq#Singleton(t)) } 
+  Seq#Length(Seq#Singleton(t)) == 1);
+
+function Seq#Build<T>(s: Seq T, val: T) : Seq T;
+
+axiom (forall<T> s: Seq T, v: T :: 
+  { Seq#Length(Seq#Build(s, v)) } 
+  Seq#Length(Seq#Build(s, v)) == 1 + Seq#Length(s));
+
+axiom (forall<T> s: Seq T, i: int, v: T :: 
+  { Seq#Index(Seq#Build(s, v), i) } 
+  (i == Seq#Length(s) ==> Seq#Index(Seq#Build(s, v), i) == v)
+     && (i != Seq#Length(s) ==> Seq#Index(Seq#Build(s, v), i) == Seq#Index(s, i)));
+
+axiom (forall s: Seq Box, bx: Box, t: Ty :: 
+  { $Is(Seq#Build(s, bx), TSeq(t)) } 
+  $Is(s, TSeq(t)) && $IsBox(bx, t) ==> $Is(Seq#Build(s, bx), TSeq(t)));
+
+function Seq#Append<T>(Seq T, Seq T) : Seq T;
+
+axiom (forall<T> s0: Seq T, s1: Seq T :: 
+  { Seq#Length(Seq#Append(s0, s1)) } 
+  Seq#Length(Seq#Append(s0, s1)) == Seq#Length(s0) + Seq#Length(s1));
+
+axiom (forall s0: Seq Box, s1: Seq Box, t: Ty :: 
+  { $Is(Seq#Append(s0, s1), t) } 
+  $Is(s0, t) && $Is(s1, t) ==> $Is(Seq#Append(s0, s1), t));
+
+function Seq#Index<T>(Seq T, int) : T;
+
+axiom (forall<T> t: T :: 
+  { Seq#Index(Seq#Singleton(t), 0) } 
+  Seq#Index(Seq#Singleton(t), 0) == t);
+
+axiom (forall<T> s0: Seq T, s1: Seq T, n: int :: 
+  { Seq#Index(Seq#Append(s0, s1), n) } 
+  (n < Seq#Length(s0) ==> Seq#Index(Seq#Append(s0, s1), n) == Seq#Index(s0, n))
+     && (Seq#Length(s0) <= n
+       ==> Seq#Index(Seq#Append(s0, s1), n) == Seq#Index(s1, n - Seq#Length(s0))));
+
+function Seq#Update<T>(Seq T, int, T) : Seq T;
+
+axiom (forall<T> s: Seq T, i: int, v: T :: 
+  { Seq#Length(Seq#Update(s, i, v)) } 
+  0 <= i && i < Seq#Length(s) ==> Seq#Length(Seq#Update(s, i, v)) == Seq#Length(s));
+
+axiom (forall<T> s: Seq T, i: int, v: T, n: int :: 
+  { Seq#Index(Seq#Update(s, i, v), n) } 
+  0 <= n && n < Seq#Length(s)
+     ==> (i == n ==> Seq#Index(Seq#Update(s, i, v), n) == v)
+       && (i != n ==> Seq#Index(Seq#Update(s, i, v), n) == Seq#Index(s, n)));
+
+function Seq#Contains<T>(Seq T, T) : bool;
+
+axiom (forall<T> s: Seq T, x: T :: 
+  { Seq#Contains(s, x) } 
+  Seq#Contains(s, x)
+     <==> (exists i: int :: 
+      { Seq#Index(s, i) } 
+      0 <= i && i < Seq#Length(s) && Seq#Index(s, i) == x));
+
+axiom (forall<T> x: T :: 
+  { Seq#Contains(Seq#Empty(), x) } 
+  !Seq#Contains(Seq#Empty(), x));
+
+axiom (forall<T> s0: Seq T, s1: Seq T, x: T :: 
+  { Seq#Contains(Seq#Append(s0, s1), x) } 
+  Seq#Contains(Seq#Append(s0, s1), x)
+     <==> Seq#Contains(s0, x) || Seq#Contains(s1, x));
+
+axiom (forall<T> s: Seq T, v: T, x: T :: 
+  { Seq#Contains(Seq#Build(s, v), x) } 
+  Seq#Contains(Seq#Build(s, v), x) <==> v == x || Seq#Contains(s, x));
+
+axiom (forall<T> s: Seq T, n: int, x: T :: 
+  { Seq#Contains(Seq#Take(s, n), x) } 
+  Seq#Contains(Seq#Take(s, n), x)
+     <==> (exists i: int :: 
+      { Seq#Index(s, i) } 
+      0 <= i && i < n && i < Seq#Length(s) && Seq#Index(s, i) == x));
+
+axiom (forall<T> s: Seq T, n: int, x: T :: 
+  { Seq#Contains(Seq#Drop(s, n), x) } 
+  Seq#Contains(Seq#Drop(s, n), x)
+     <==> (exists i: int :: 
+      { Seq#Index(s, i) } 
+      0 <= n && n <= i && i < Seq#Length(s) && Seq#Index(s, i) == x));
+
+function Seq#Equal<T>(Seq T, Seq T) : bool;
+
+axiom (forall<T> s0: Seq T, s1: Seq T :: 
+  { Seq#Equal(s0, s1) } 
+  Seq#Equal(s0, s1)
+     <==> Seq#Length(s0) == Seq#Length(s1)
+       && (forall j: int :: 
+        { Seq#Index(s0, j) } { Seq#Index(s1, j) } 
+        0 <= j && j < Seq#Length(s0) ==> Seq#Index(s0, j) == Seq#Index(s1, j)));
+
+axiom (forall<T> a: Seq T, b: Seq T :: { Seq#Equal(a, b) } Seq#Equal(a, b) ==> a == b);
+
+function Seq#SameUntil<T>(Seq T, Seq T, int) : bool;
+
+axiom (forall<T> s0: Seq T, s1: Seq T, n: int :: 
+  { Seq#SameUntil(s0, s1, n) } 
+  Seq#SameUntil(s0, s1, n)
+     <==> (forall j: int :: 
+      { Seq#Index(s0, j) } { Seq#Index(s1, j) } 
+      0 <= j && j < n ==> Seq#Index(s0, j) == Seq#Index(s1, j)));
+
+function Seq#Take<T>(s: Seq T, howMany: int) : Seq T;
+
+axiom (forall<T> s: Seq T, n: int :: 
+  { Seq#Length(Seq#Take(s, n)) } 
+  0 <= n && n <= Seq#Length(s) ==> Seq#Length(Seq#Take(s, n)) == n);
+
+axiom (forall<T> s: Seq T, n: int, j: int :: 
+  {:weight 25} { Seq#Index(Seq#Take(s, n), j) } { Seq#Index(s, j), Seq#Take(s, n) } 
+  0 <= j && j < n && j < Seq#Length(s)
+     ==> Seq#Index(Seq#Take(s, n), j) == Seq#Index(s, j));
+
+function Seq#Drop<T>(s: Seq T, howMany: int) : Seq T;
+
+axiom (forall<T> s: Seq T, n: int :: 
+  { Seq#Length(Seq#Drop(s, n)) } 
+  0 <= n && n <= Seq#Length(s) ==> Seq#Length(Seq#Drop(s, n)) == Seq#Length(s) - n);
+
+axiom (forall<T> s: Seq T, n: int, j: int :: 
+  {:weight 25} { Seq#Index(Seq#Drop(s, n), j) } 
+  0 <= n && 0 <= j && j < Seq#Length(s) - n
+     ==> Seq#Index(Seq#Drop(s, n), j) == Seq#Index(s, j + n));
+
+axiom (forall<T> s: Seq T, n: int, k: int :: 
+  {:weight 25} { Seq#Index(s, k), Seq#Drop(s, n) } 
+  0 <= n && n <= k && k < Seq#Length(s)
+     ==> Seq#Index(Seq#Drop(s, n), k - n) == Seq#Index(s, k));
+
+axiom (forall<T> s: Seq T, t: Seq T :: 
+  { Seq#Append(s, t) } 
+  Seq#Take(Seq#Append(s, t), Seq#Length(s)) == s
+     && Seq#Drop(Seq#Append(s, t), Seq#Length(s)) == t);
+
+function Seq#FromArray(h: Heap, a: ref) : Seq Box;
+
+axiom (forall h: Heap, a: ref :: 
+  { Seq#Length(Seq#FromArray(h, a)) } 
+  Seq#Length(Seq#FromArray(h, a)) == _System.array.Length(a));
+
+axiom (forall h: Heap, a: ref :: 
+  { Seq#FromArray(h, a) } 
+  (forall i: int :: 
+    { read(h, a, IndexField(i)) } { Seq#Index(Seq#FromArray(h, a): Seq Box, i) } 
+    0 <= i && i < Seq#Length(Seq#FromArray(h, a))
+       ==> Seq#Index(Seq#FromArray(h, a), i) == read(h, a, IndexField(i))));
+
+axiom (forall h0: Heap, h1: Heap, a: ref :: 
+  { Seq#FromArray(h1, a), $HeapSucc(h0, h1) } 
+  $IsGoodHeap(h0)
+       && $IsGoodHeap(h1)
+       && $HeapSucc(h0, h1)
+       && (forall i: int :: 
+        0 <= i && i < _System.array.Length(a)
+           ==> read(h0, a, IndexField(i)) == read(h1, a, IndexField(i)))
+     ==> Seq#FromArray(h0, a) == Seq#FromArray(h1, a));
+
+axiom (forall h: Heap, i: int, v: Box, a: ref :: 
+  { Seq#FromArray(update(h, a, IndexField(i), v), a) } 
+  0 <= i && i < _System.array.Length(a)
+     ==> Seq#FromArray(update(h, a, IndexField(i), v), a)
+       == Seq#Update(Seq#FromArray(h, a), i, v));
+
+axiom (forall<T> s: Seq T, i: int, v: T, n: int :: 
+  { Seq#Take(Seq#Update(s, i, v), n) } 
+  0 <= i && i < n && n <= Seq#Length(s)
+     ==> Seq#Take(Seq#Update(s, i, v), n) == Seq#Update(Seq#Take(s, n), i, v));
+
+axiom (forall<T> s: Seq T, i: int, v: T, n: int :: 
+  { Seq#Take(Seq#Update(s, i, v), n) } 
+  n <= i && i < Seq#Length(s)
+     ==> Seq#Take(Seq#Update(s, i, v), n) == Seq#Take(s, n));
+
+axiom (forall<T> s: Seq T, i: int, v: T, n: int :: 
+  { Seq#Drop(Seq#Update(s, i, v), n) } 
+  0 <= n && n <= i && i < Seq#Length(s)
+     ==> Seq#Drop(Seq#Update(s, i, v), n) == Seq#Update(Seq#Drop(s, n), i - n, v));
+
+axiom (forall<T> s: Seq T, i: int, v: T, n: int :: 
+  { Seq#Drop(Seq#Update(s, i, v), n) } 
+  0 <= i && i < n && n < Seq#Length(s)
+     ==> Seq#Drop(Seq#Update(s, i, v), n) == Seq#Drop(s, n));
+
+axiom (forall h: Heap, a: ref, n0: int, n1: int :: 
+  { Seq#Take(Seq#FromArray(h, a), n0), Seq#Take(Seq#FromArray(h, a), n1) } 
+  n0 + 1 == n1 && 0 <= n0 && n1 <= _System.array.Length(a)
+     ==> Seq#Take(Seq#FromArray(h, a), n1)
+       == Seq#Build(Seq#Take(Seq#FromArray(h, a), n0), read(h, a, IndexField(n0): Field Box)));
+
+axiom (forall<T> s: Seq T, v: T, n: int :: 
+  { Seq#Drop(Seq#Build(s, v), n) } 
+  0 <= n && n <= Seq#Length(s)
+     ==> Seq#Drop(Seq#Build(s, v), n) == Seq#Build(Seq#Drop(s, n), v));
+
+function Seq#Rank<T>(Seq T) : int;
+
+axiom (forall s: Seq Box, i: int :: 
+  { DtRank($Unbox(Seq#Index(s, i)): DatatypeType) } 
+  0 <= i && i < Seq#Length(s)
+     ==> DtRank($Unbox(Seq#Index(s, i)): DatatypeType) < Seq#Rank(s));
+
+axiom (forall<T> s: Seq T, i: int :: 
+  { Seq#Rank(Seq#Drop(s, i)) } 
+  0 < i && i <= Seq#Length(s) ==> Seq#Rank(Seq#Drop(s, i)) < Seq#Rank(s));
+
+axiom (forall<T> s: Seq T, i: int :: 
+  { Seq#Rank(Seq#Take(s, i)) } 
+  0 <= i && i < Seq#Length(s) ==> Seq#Rank(Seq#Take(s, i)) < Seq#Rank(s));
+
+axiom (forall<T> s: Seq T, i: int, j: int :: 
+  { Seq#Rank(Seq#Append(Seq#Take(s, i), Seq#Drop(s, j))) } 
+  0 <= i && i < j && j <= Seq#Length(s)
+     ==> Seq#Rank(Seq#Append(Seq#Take(s, i), Seq#Drop(s, j))) < Seq#Rank(s));
+
+axiom (forall<T> s: Seq T, n: int :: 
+  { Seq#Drop(s, n) } 
+  n == 0 ==> Seq#Drop(s, n) == s);
+
+axiom (forall<T> s: Seq T, n: int :: 
+  { Seq#Take(s, n) } 
+  n == 0 ==> Seq#Take(s, n) == Seq#Empty());
+
+axiom (forall<T> s: Seq T, m: int, n: int :: 
+  { Seq#Drop(Seq#Drop(s, m), n) } 
+  0 <= m && 0 <= n && m + n <= Seq#Length(s)
+     ==> Seq#Drop(Seq#Drop(s, m), n) == Seq#Drop(s, m + n));
+
+type Map _ _;
+
+function Map#Domain<U,V>(Map U V) : [U]bool;
+
+function Map#Elements<U,V>(Map U V) : [U]V;
+
+function Map#Card<U,V>(Map U V) : int;
+
+axiom (forall<U,V> m: Map U V :: { Map#Card(m) } 0 <= Map#Card(m));
+
+function Map#Empty<U,V>() : Map U V;
+
+axiom (forall<U,V> u: U :: 
+  { Map#Domain(Map#Empty(): Map U V)[u] } 
+  !Map#Domain(Map#Empty(): Map U V)[u]);
+
+axiom (forall<U,V> m: Map U V :: 
+  { Map#Card(m) } 
+  (Map#Card(m) == 0 <==> m == Map#Empty())
+     && (Map#Card(m) != 0 ==> (exists x: U :: Map#Domain(m)[x])));
+
+function Map#Glue<U,V>([U]bool, [U]V, Ty) : Map U V;
+
+axiom (forall<U,V> a: [U]bool, b: [U]V, t: Ty :: 
+  { Map#Domain(Map#Glue(a, b, t)) } 
+  Map#Domain(Map#Glue(a, b, t)) == a);
+
+axiom (forall<U,V> a: [U]bool, b: [U]V, t: Ty :: 
+  { Map#Elements(Map#Glue(a, b, t)) } 
+  Map#Elements(Map#Glue(a, b, t)) == b);
+
+axiom (forall<U,V> a: [U]bool, b: [U]V, t: Ty :: 
+  { $Is(Map#Glue(a, b, t), t) } 
+  $Is(Map#Glue(a, b, t), t));
+
+function Map#Build<U,V>(Map U V, U, V) : Map U V;
+
+axiom (forall<U,V> m: Map U V, u: U, u': U, v: V :: 
+  { Map#Domain(Map#Build(m, u, v))[u'] } { Map#Elements(Map#Build(m, u, v))[u'] } 
+  (u' == u
+       ==> Map#Domain(Map#Build(m, u, v))[u'] && Map#Elements(Map#Build(m, u, v))[u'] == v)
+     && (u' != u
+       ==> Map#Domain(Map#Build(m, u, v))[u'] == Map#Domain(m)[u']
+         && Map#Elements(Map#Build(m, u, v))[u'] == Map#Elements(m)[u']));
+
+axiom (forall<U,V> m: Map U V, u: U, v: V :: 
+  { Map#Card(Map#Build(m, u, v)) } 
+  Map#Domain(m)[u] ==> Map#Card(Map#Build(m, u, v)) == Map#Card(m));
+
+axiom (forall<U,V> m: Map U V, u: U, v: V :: 
+  { Map#Card(Map#Build(m, u, v)) } 
+  !Map#Domain(m)[u] ==> Map#Card(Map#Build(m, u, v)) == Map#Card(m) + 1);
+
+function Map#Equal<U,V>(Map U V, Map U V) : bool;
+
+axiom (forall<U,V> m: Map U V, m': Map U V :: 
+  { Map#Equal(m, m') } 
+  Map#Equal(m, m')
+     <==> (forall u: U :: Map#Domain(m)[u] == Map#Domain(m')[u])
+       && (forall u: U :: Map#Domain(m)[u] ==> Map#Elements(m)[u] == Map#Elements(m')[u]));
+
+axiom (forall<U,V> m: Map U V, m': Map U V :: 
+  { Map#Equal(m, m') } 
+  Map#Equal(m, m') ==> m == m');
+
+function Map#Disjoint<U,V>(Map U V, Map U V) : bool;
+
+axiom (forall<U,V> m: Map U V, m': Map U V :: 
+  { Map#Disjoint(m, m') } 
+  Map#Disjoint(m, m')
+     <==> (forall o: U :: 
+      { Map#Domain(m)[o] } { Map#Domain(m')[o] } 
+      !Map#Domain(m)[o] || !Map#Domain(m')[o]));
+
+type IMap _ _;
+
+function IMap#Domain<U,V>(IMap U V) : [U]bool;
+
+function IMap#Elements<U,V>(IMap U V) : [U]V;
+
+function IMap#Empty<U,V>() : IMap U V;
+
+axiom (forall<U,V> u: U :: 
+  { IMap#Domain(IMap#Empty(): IMap U V)[u] } 
+  !IMap#Domain(IMap#Empty(): IMap U V)[u]);
+
+function IMap#Glue<U,V>([U]bool, [U]V, Ty) : IMap U V;
+
+axiom (forall<U,V> a: [U]bool, b: [U]V, t: Ty :: 
+  { IMap#Domain(IMap#Glue(a, b, t)) } 
+  IMap#Domain(IMap#Glue(a, b, t)) == a);
+
+axiom (forall<U,V> a: [U]bool, b: [U]V, t: Ty :: 
+  { IMap#Elements(IMap#Glue(a, b, t)) } 
+  IMap#Elements(IMap#Glue(a, b, t)) == b);
+
+axiom (forall<U,V> a: [U]bool, b: [U]V, t: Ty :: 
+  { $Is(IMap#Glue(a, b, t), t) } 
+  $Is(IMap#Glue(a, b, t), t));
+
+function IMap#Build<U,V>(IMap U V, U, V) : IMap U V;
+
+axiom (forall<U,V> m: IMap U V, u: U, u': U, v: V :: 
+  { IMap#Domain(IMap#Build(m, u, v))[u'] } 
+    { IMap#Elements(IMap#Build(m, u, v))[u'] } 
+  (u' == u
+       ==> IMap#Domain(IMap#Build(m, u, v))[u']
+         && IMap#Elements(IMap#Build(m, u, v))[u'] == v)
+     && (u' != u
+       ==> IMap#Domain(IMap#Build(m, u, v))[u'] == IMap#Domain(m)[u']
+         && IMap#Elements(IMap#Build(m, u, v))[u'] == IMap#Elements(m)[u']));
+
+function IMap#Equal<U,V>(IMap U V, IMap U V) : bool;
+
+axiom (forall<U,V> m: IMap U V, m': IMap U V :: 
+  { IMap#Equal(m, m') } 
+  IMap#Equal(m, m')
+     <==> (forall u: U :: IMap#Domain(m)[u] == IMap#Domain(m')[u])
+       && (forall u: U :: 
+        IMap#Domain(m)[u] ==> IMap#Elements(m)[u] == IMap#Elements(m')[u]));
+
+axiom (forall<U,V> m: IMap U V, m': IMap U V :: 
+  { IMap#Equal(m, m') } 
+  IMap#Equal(m, m') ==> m == m');
+
+function INTERNAL_add_boogie(x: int, y: int) : int;
+
+axiom (forall x: int, y: int :: 
+  { INTERNAL_add_boogie(x, y): int } 
+  INTERNAL_add_boogie(x, y): int == x + y);
+
+function INTERNAL_sub_boogie(x: int, y: int) : int;
+
+axiom (forall x: int, y: int :: 
+  { INTERNAL_sub_boogie(x, y): int } 
+  INTERNAL_sub_boogie(x, y): int == x - y);
+
+function INTERNAL_mul_boogie(x: int, y: int) : int;
+
+axiom (forall x: int, y: int :: 
+  { INTERNAL_mul_boogie(x, y): int } 
+  INTERNAL_mul_boogie(x, y): int == x * y);
+
+function INTERNAL_div_boogie(x: int, y: int) : int;
+
+axiom (forall x: int, y: int :: 
+  { INTERNAL_div_boogie(x, y): int } 
+  INTERNAL_div_boogie(x, y): int == x div y);
+
+function INTERNAL_mod_boogie(x: int, y: int) : int;
+
+axiom (forall x: int, y: int :: 
+  { INTERNAL_mod_boogie(x, y): int } 
+  INTERNAL_mod_boogie(x, y): int == x mod y);
+
+function {:never_pattern true} INTERNAL_lt_boogie(x: int, y: int) : bool;
+
+axiom (forall x: int, y: int :: 
+  {:never_pattern true} { INTERNAL_lt_boogie(x, y): bool } 
+  INTERNAL_lt_boogie(x, y): bool == (x < y));
+
+function {:never_pattern true} INTERNAL_le_boogie(x: int, y: int) : bool;
+
+axiom (forall x: int, y: int :: 
+  {:never_pattern true} { INTERNAL_le_boogie(x, y): bool } 
+  INTERNAL_le_boogie(x, y): bool == (x <= y));
+
+function {:never_pattern true} INTERNAL_gt_boogie(x: int, y: int) : bool;
+
+axiom (forall x: int, y: int :: 
+  {:never_pattern true} { INTERNAL_gt_boogie(x, y): bool } 
+  INTERNAL_gt_boogie(x, y): bool == (x > y));
+
+function {:never_pattern true} INTERNAL_ge_boogie(x: int, y: int) : bool;
+
+axiom (forall x: int, y: int :: 
+  {:never_pattern true} { INTERNAL_ge_boogie(x, y): bool } 
+  INTERNAL_ge_boogie(x, y): bool == (x >= y));
+
+const unique class._System.object: ClassName;
+
+// Tclass._System.object Tag
+axiom Tag(Tclass._System.object()) == Tagclass._System.object;
+
+const unique Tagclass._System.object: TyTag;
+
+// Box/unbox axiom for Tclass._System.object
+axiom (forall bx: Box :: 
+  { $IsBox(bx, Tclass._System.object()) } 
+  $IsBox(bx, Tclass._System.object())
+     ==> $Box($Unbox(bx): ref) == bx && $Is($Unbox(bx): ref, Tclass._System.object()));
+
+// object: Class $Is
+axiom (forall $o: ref :: 
+  { $Is($o, Tclass._System.object()) } 
+  $Is($o, Tclass._System.object()));
+
+// object: Class $IsAlloc
+axiom (forall $o: ref, $h: Heap :: 
+  { $IsAlloc($o, Tclass._System.object(), $h) } 
+  $IsAlloc($o, Tclass._System.object(), $h) <==> $o == null || read($h, $o, alloc));
+
+const unique class._System.array: ClassName;
+
+function Tclass._System.array(Ty) : Ty;
+
+// Tclass._System.array Tag
+axiom (forall #$arg: Ty :: 
+  { Tclass._System.array(#$arg) } 
+  Tag(Tclass._System.array(#$arg)) == Tagclass._System.array);
+
+const unique Tagclass._System.array: TyTag;
+
+// Tclass._System.array injectivity 0
+axiom (forall #$arg: Ty :: 
+  { Tclass._System.array(#$arg) } 
+  Tclass._System.array_0(Tclass._System.array(#$arg)) == #$arg);
+
+function Tclass._System.array_0(Ty) : Ty;
+
+// Box/unbox axiom for Tclass._System.array
+axiom (forall #$arg: Ty, bx: Box :: 
+  { $IsBox(bx, Tclass._System.array(#$arg)) } 
+  $IsBox(bx, Tclass._System.array(#$arg))
+     ==> $Box($Unbox(bx): ref) == bx && $Is($Unbox(bx): ref, Tclass._System.array(#$arg)));
+
+// array.: Allocation axiom
+axiom (forall #$arg: Ty, $i0: int, $h: Heap, $o: ref :: 
+  { read($h, $o, IndexField($i0)), Tclass._System.array(#$arg) } 
+  $IsGoodHeap($h)
+       && $o != null
+       && dtype($o) == Tclass._System.array(#$arg)
+       && 
+      0 <= $i0
+       && $i0 < _System.array.Length($o)
+     ==> $IsBox(read($h, $o, IndexField($i0)), #$arg)
+       && (read($h, $o, alloc) ==> $IsAllocBox(read($h, $o, IndexField($i0)), #$arg, $h)));
+
+// array: Class $Is
+axiom (forall #$arg: Ty, $o: ref :: 
+  { $Is($o, Tclass._System.array(#$arg)) } 
+  $Is($o, Tclass._System.array(#$arg))
+     <==> $o == null || dtype($o) == Tclass._System.array(#$arg));
+
+// array: Class $IsAlloc
+axiom (forall #$arg: Ty, $o: ref, $h: Heap :: 
+  { $IsAlloc($o, Tclass._System.array(#$arg), $h) } 
+  $IsAlloc($o, Tclass._System.array(#$arg), $h)
+     <==> $o == null || read($h, $o, alloc));
+
+// array.Length: Allocation axiom
+axiom (forall #$arg: Ty, $h: Heap, $o: ref :: 
+  $IsGoodHeap($h) && $o != null && dtype($o) == Tclass._System.array(#$arg)
+     ==> $Is(_System.array.Length($o), TInt)
+       && (read($h, $o, alloc) ==> $IsAlloc(_System.array.Length($o), TInt, $h)));
+
+function Tclass._System.___hFunc0(Ty) : Ty;
+
+// Tclass._System.___hFunc0 Tag
+axiom (forall #$T0: Ty :: 
+  { Tclass._System.___hFunc0(#$T0) } 
+  Tag(Tclass._System.___hFunc0(#$T0)) == Tagclass._System.___hFunc0);
+
+const unique Tagclass._System.___hFunc0: TyTag;
+
+// Tclass._System.___hFunc0 injectivity 0
+axiom (forall #$T0: Ty :: 
+  { Tclass._System.___hFunc0(#$T0) } 
+  Tclass._System.___hFunc0_0(Tclass._System.___hFunc0(#$T0)) == #$T0);
+
+function Tclass._System.___hFunc0_0(Ty) : Ty;
+
+// Box/unbox axiom for Tclass._System.___hFunc0
+axiom (forall #$T0: Ty, bx: Box :: 
+  { $IsBox(bx, Tclass._System.___hFunc0(#$T0)) } 
+  $IsBox(bx, Tclass._System.___hFunc0(#$T0))
+     ==> $Box($Unbox(bx): HandleType) == bx
+       && $Is($Unbox(bx): HandleType, Tclass._System.___hFunc0(#$T0)));
+
+function Handle0([Heap]Box, [Heap]bool, [Heap]Set Box) : HandleType;
+
+function Apply0(Ty, HandleType, Heap) : Box;
+
+function Requires0(Ty, HandleType, Heap) : bool;
+
+function Reads0(Ty, HandleType, Heap) : Set Box;
+
+axiom (forall t0: Ty, heap: Heap, h: [Heap]Box, r: [Heap]bool, rd: [Heap]Set Box :: 
+  { Apply0(t0, Handle0(h, r, rd), heap) } 
+  Apply0(t0, Handle0(h, r, rd), heap) == h[heap]);
+
+axiom (forall t0: Ty, heap: Heap, h: [Heap]Box, r: [Heap]bool, rd: [Heap]Set Box :: 
+  { Requires0(t0, Handle0(h, r, rd), heap) } 
+  r[heap] ==> Requires0(t0, Handle0(h, r, rd), heap));
+
+axiom (forall t0: Ty, heap: Heap, h: [Heap]Box, r: [Heap]bool, rd: [Heap]Set Box, bx: Box :: 
+  { Reads0(t0, Handle0(h, r, rd), heap)[bx] } 
+  Reads0(t0, Handle0(h, r, rd), heap)[bx] == rd[heap][bx]);
+
+function {:inline true} _System.___hFunc0.requires(t0: Ty, heap: Heap, f: HandleType) : bool
+{
+  Requires0(t0, f, heap)
+}
+
+function {:inline true} _System.___hFunc0.requires#canCall(t0: Ty, heap: Heap, f: HandleType) : bool
+{
+  true
+}
+
+function {:inline true} _System.___hFunc0.reads(t0: Ty, heap: Heap, f: HandleType) : Set Box
+{
+  Reads0(t0, f, heap)
+}
+
+function {:inline true} _System.___hFunc0.reads#canCall(t0: Ty, heap: Heap, f: HandleType) : bool
+{
+  true
+}
+
+axiom (forall t0: Ty, h0: Heap, h1: Heap, f: HandleType :: 
+  { $HeapSucc(h0, h1), Reads0(t0, f, h1) } 
+  $HeapSucc(h0, h1)
+       && 
+      $IsGoodHeap(h0)
+       && $IsGoodHeap(h1)
+       && 
+      $Is(f, Tclass._System.___hFunc0(t0))
+       && $IsAlloc(f, Tclass._System.___hFunc0(t0), h0)
+       && (forall<a> o: ref, fld: Field a :: 
+        o != null
+             && read(h0, o, alloc)
+             && read(h1, o, alloc)
+             && Reads0(t0, f, h0)[$Box(o)]
+           ==> read(h0, o, fld) == read(h1, o, fld))
+     ==> Reads0(t0, f, h0) == Reads0(t0, f, h1));
+
+axiom (forall t0: Ty, h0: Heap, h1: Heap, f: HandleType :: 
+  { $HeapSucc(h0, h1), Reads0(t0, f, h1) } 
+  $HeapSucc(h0, h1)
+       && 
+      $IsGoodHeap(h0)
+       && $IsGoodHeap(h1)
+       && 
+      $Is(f, Tclass._System.___hFunc0(t0))
+       && $IsAlloc(f, Tclass._System.___hFunc0(t0), h0)
+       && (forall<a> o: ref, fld: Field a :: 
+        o != null
+             && read(h0, o, alloc)
+             && read(h1, o, alloc)
+             && Reads0(t0, f, h1)[$Box(o)]
+           ==> read(h0, o, fld) == read(h1, o, fld))
+     ==> Reads0(t0, f, h0) == Reads0(t0, f, h1));
+
+axiom (forall t0: Ty, h0: Heap, h1: Heap, f: HandleType :: 
+  { $HeapSucc(h0, h1), Requires0(t0, f, h1) } 
+  $HeapSucc(h0, h1)
+       && 
+      $IsGoodHeap(h0)
+       && $IsGoodHeap(h1)
+       && 
+      $Is(f, Tclass._System.___hFunc0(t0))
+       && $IsAlloc(f, Tclass._System.___hFunc0(t0), h0)
+       && (forall<a> o: ref, fld: Field a :: 
+        o != null
+             && read(h0, o, alloc)
+             && read(h1, o, alloc)
+             && Reads0(t0, f, h0)[$Box(o)]
+           ==> read(h0, o, fld) == read(h1, o, fld))
+     ==> Requires0(t0, f, h0) == Requires0(t0, f, h1));
+
+axiom (forall t0: Ty, h0: Heap, h1: Heap, f: HandleType :: 
+  { $HeapSucc(h0, h1), Requires0(t0, f, h1) } 
+  $HeapSucc(h0, h1)
+       && 
+      $IsGoodHeap(h0)
+       && $IsGoodHeap(h1)
+       && 
+      $Is(f, Tclass._System.___hFunc0(t0))
+       && $IsAlloc(f, Tclass._System.___hFunc0(t0), h0)
+       && (forall<a> o: ref, fld: Field a :: 
+        o != null
+             && read(h0, o, alloc)
+             && read(h1, o, alloc)
+             && Reads0(t0, f, h1)[$Box(o)]
+           ==> read(h0, o, fld) == read(h1, o, fld))
+     ==> Requires0(t0, f, h0) == Requires0(t0, f, h1));
+
+axiom (forall t0: Ty, h0: Heap, h1: Heap, f: HandleType :: 
+  { $HeapSucc(h0, h1), Apply0(t0, f, h1) } 
+  $HeapSucc(h0, h1)
+       && 
+      $IsGoodHeap(h0)
+       && $IsGoodHeap(h1)
+       && 
+      $Is(f, Tclass._System.___hFunc0(t0))
+       && $IsAlloc(f, Tclass._System.___hFunc0(t0), h0)
+       && (forall<a> o: ref, fld: Field a :: 
+        o != null
+             && read(h0, o, alloc)
+             && read(h1, o, alloc)
+             && Reads0(t0, f, h0)[$Box(o)]
+           ==> read(h0, o, fld) == read(h1, o, fld))
+     ==> Apply0(t0, f, h0) == Apply0(t0, f, h1));
+
+axiom (forall t0: Ty, h0: Heap, h1: Heap, f: HandleType :: 
+  { $HeapSucc(h0, h1), Apply0(t0, f, h1) } 
+  $HeapSucc(h0, h1)
+       && 
+      $IsGoodHeap(h0)
+       && $IsGoodHeap(h1)
+       && 
+      $Is(f, Tclass._System.___hFunc0(t0))
+       && $IsAlloc(f, Tclass._System.___hFunc0(t0), h0)
+       && (forall<a> o: ref, fld: Field a :: 
+        o != null
+             && read(h0, o, alloc)
+             && read(h1, o, alloc)
+             && Reads0(t0, f, h1)[$Box(o)]
+           ==> read(h0, o, fld) == read(h1, o, fld))
+     ==> Apply0(t0, f, h0) == Apply0(t0, f, h1));
+
+axiom (forall t0: Ty, h: Heap, f: HandleType :: 
+  { Apply0(t0, f, h) } 
+  $IsGoodHeap(h)
+       && 
+      $Is(f, Tclass._System.___hFunc0(t0))
+       && $IsAlloc(f, Tclass._System.___hFunc0(t0), h)
+     ==> $IsBox(Apply0(t0, f, h), t0) && $IsAllocBox(Apply0(t0, f, h), t0, h));
+
+const unique class._module.__default: ClassName;
+
+function Tclass._module.__default() : Ty;
+
+// Tclass._module.__default Tag
+axiom Tag(Tclass._module.__default()) == Tagclass._module.__default;
+
+const unique Tagclass._module.__default: TyTag;
+
+// Box/unbox axiom for Tclass._module.__default
+axiom (forall bx: Box :: 
+  { $IsBox(bx, Tclass._module.__default()) } 
+  $IsBox(bx, Tclass._module.__default())
+     ==> $Box($Unbox(bx): ref) == bx && $Is($Unbox(bx): ref, Tclass._module.__default()));
+
+// _default: Class $Is
+axiom (forall $o: ref :: 
+  { $Is($o, Tclass._module.__default()) } 
+  $Is($o, Tclass._module.__default())
+     <==> $o == null || dtype($o) == Tclass._module.__default());
+
+// _default: Class $IsAlloc
+axiom (forall $o: ref, $h: Heap :: 
+  { $IsAlloc($o, Tclass._module.__default(), $h) } 
+  $IsAlloc($o, Tclass._module.__default(), $h)
+     <==> $o == null || read($h, $o, alloc));
+
+procedure CheckWellformed$$_module.__default.test();
+  free requires 0 == $ModuleContextHeight && 0 == $FunctionContextHeight;
+  modifies $Heap, $Tick;
+
+
+
+implementation CheckWellformed$$_module.__default.test()
+{
+  var $_Frame: <beta>[ref,Field beta]bool;
+
+    // AddMethodImpl: test, CheckWellformed$$_module.__default.test
+    $_Frame := (lambda<alpha> $o: ref, $f: Field alpha :: 
+  $o != null && read($Heap, $o, alloc) ==> false);
+    assume {:captureState "Bug136.dfy(4,7): initial state"} true;
+    havoc $Heap;
+    assume (forall<alpha> $o: ref, $f: Field alpha :: 
+  { read($Heap, $o, $f) } 
+  $o != null && read(old($Heap), $o, alloc)
+     ==> read($Heap, $o, $f) == read(old($Heap), $o, $f));
+    assume $HeapSucc(old($Heap), $Heap);
+}
+
+
+
+procedure InterModuleCall$$_module.__default.test();
+  modifies $Heap, $Tick;
+  // frame condition
+  free ensures (forall<alpha> $o: ref, $f: Field alpha :: 
+  { read($Heap, $o, $f) } 
+  $o != null && read(old($Heap), $o, alloc)
+     ==> read($Heap, $o, $f) == read(old($Heap), $o, $f));
+  // boilerplate
+  free ensures $HeapSucc(old($Heap), $Heap);
+
+
+
+procedure IntraModuleCall$$_module.__default.test();
+  modifies $Heap, $Tick;
+  // frame condition
+  free ensures (forall<alpha> $o: ref, $f: Field alpha :: 
+  { read($Heap, $o, $f) } 
+  $o != null && read(old($Heap), $o, alloc)
+     ==> read($Heap, $o, $f) == read(old($Heap), $o, $f));
+  // boilerplate
+  free ensures $HeapSucc(old($Heap), $Heap);
+
+
+
+procedure Impl$$_module.__default.test() returns ($_reverifyPost: bool);
+  free requires 0 == $ModuleContextHeight && 0 == $FunctionContextHeight;
+  modifies $Heap, $Tick;
+  // frame condition
+  free ensures (forall<alpha> $o: ref, $f: Field alpha :: 
+  { read($Heap, $o, $f) } 
+  $o != null && read(old($Heap), $o, alloc)
+     ==> read($Heap, $o, $f) == read(old($Heap), $o, $f));
+  // boilerplate
+  free ensures $HeapSucc(old($Heap), $Heap);
+
+
+
+implementation Impl$$_module.__default.test() returns ($_reverifyPost: bool)
+{
+  var $_Frame: <beta>[ref,Field beta]bool;
+
+    // AddMethodImpl: test, Impl$$_module.__default.test
+    $_Frame := (lambda<alpha> $o: ref, $f: Field alpha :: 
+  $o != null && read($Heap, $o, alloc) ==> false);
+    assume {:captureState "Bug136.dfy(5,1): initial state"} true;
+    $_reverifyPost := false;
+    // ----- assume statement ----- Bug136.dfy(6,5)
+    assume true;
+    assume false;
+    // ----- assert statement ----- Bug136.dfy(7,5)
+    assume true;
+    assert true;
+}
+
+
+
+Dafny program verifier finished with 2 verified, 0 errors
-- 
cgit v1.2.3


From 273a5368fb5b7e919011c3774317c302d1bad87d Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Fri, 26 Feb 2016 10:37:53 -0800
Subject: Fix issue 140. Move the initializion of _this before the
 TAIL_CALL_START label.

---
 Source/Dafny/Compiler.cs      |  2 +-
 Test/dafny4/Bug140.dfy        | 67 +++++++++++++++++++++++++++++++++++++++++++
 Test/dafny4/Bug140.dfy.expect |  6 ++++
 3 files changed, 74 insertions(+), 1 deletion(-)
 create mode 100644 Test/dafny4/Bug140.dfy
 create mode 100644 Test/dafny4/Bug140.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index f5f95bd2..d6b2d9ba 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -937,10 +937,10 @@ namespace Microsoft.Dafny {
         Error("Method {0} has no body", wr, m.FullName);
       } else {
         if (m.IsTailRecursive) {
-          Indent(indent, wr); wr.WriteLine("TAIL_CALL_START: ;");
           if (!m.IsStatic) {
             Indent(indent + IndentAmount, wr); wr.WriteLine("var _this = this;");
           }
+          Indent(indent, wr); wr.WriteLine("TAIL_CALL_START: ;");
         }
         Contract.Assert(enclosingMethod == null);
         enclosingMethod = m;
diff --git a/Test/dafny4/Bug140.dfy b/Test/dafny4/Bug140.dfy
new file mode 100644
index 00000000..9a85e36c
--- /dev/null
+++ b/Test/dafny4/Bug140.dfy
@@ -0,0 +1,67 @@
+// RUN: %dafny /compile:3 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+class Node<T> {
+  ghost var List: seq<T>;
+  ghost var Repr: set<Node<T>>;
+
+  var data: T;
+  var next: Node<T>;
+
+  predicate Valid()
+    reads this, Repr
+  {
+    this in Repr && null !in Repr &&
+    (next == null ==> List == [data]) &&
+    (next != null ==>
+        next in Repr && next.Repr <= Repr &&
+        this !in next.Repr &&
+        List == [data] + next.List &&
+        next.Valid())
+  }
+
+  constructor (d: T)
+    modifies this
+    ensures Valid() && fresh(Repr - {this})
+    ensures List == [d]
+  {
+    data, next := d, null;
+    List, Repr := [d], {this};
+  }
+
+  constructor InitAsPredecessor(d: T, succ: Node<T>)
+    requires succ != null && succ.Valid() && this !in succ.Repr;
+    modifies this;
+    ensures Valid() && fresh(Repr - {this} - succ.Repr);
+    ensures List == [d] + succ.List;
+  {
+    data, next := d, succ;
+    List := [d] + succ.List;
+    Repr := {this} + succ.Repr;
+  }
+
+  method Prepend(d: T) returns (r: Node<T>)
+    requires Valid()
+    ensures r != null && r.Valid() && fresh(r.Repr - old(Repr))
+    ensures r.List == [d] + List
+  {
+    r := new Node.InitAsPredecessor(d, this);
+  }
+  
+	method Print()
+		requires Valid()
+		decreases |List|
+	{
+		print data;
+		if (next != null) {
+			next.Print();
+		}
+	}
+}
+
+method Main() 
+{
+	var l2 := new Node(2);
+  var l1 := l2.Prepend(1);
+	l1.Print();
+}
diff --git a/Test/dafny4/Bug140.dfy.expect b/Test/dafny4/Bug140.dfy.expect
new file mode 100644
index 00000000..00c7d129
--- /dev/null
+++ b/Test/dafny4/Bug140.dfy.expect
@@ -0,0 +1,6 @@
+
+Dafny program verifier finished with 11 verified, 0 errors
+Program compiled successfully
+Running...
+
+12
\ No newline at end of file
-- 
cgit v1.2.3


From b3d6306759e450a5d004b6581e0bf3b891b93fa5 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Fri, 26 Feb 2016 12:37:46 -0800
Subject: Fix issue 138. Allow parenthese with the nullary constructor in
 "case" of a match statement and match expression.

---
 Source/Dafny/Dafny.atg        | 14 ++++++++------
 Source/Dafny/Parser.cs        | 20 ++++++++++++--------
 Test/dafny4/Bug138.dfy        | 22 ++++++++++++++++++++++
 Test/dafny4/Bug138.dfy.expect |  2 ++
 4 files changed, 44 insertions(+), 14 deletions(-)
 create mode 100644 Test/dafny4/Bug138.dfy
 create mode 100644 Test/dafny4/Bug138.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Dafny.atg b/Source/Dafny/Dafny.atg
index 80792ce2..af7082a4 100644
--- a/Source/Dafny/Dafny.atg
+++ b/Source/Dafny/Dafny.atg
@@ -2064,9 +2064,10 @@ CaseStatement<out MatchCaseStmt/*!*/ c>
   "case"                      (. x = t; .)
   ( Ident<out id>             (. name = id.val; .)
     [ "("
-      CasePattern<out pat>        (. arguments.Add(pat); .)
-      { "," CasePattern<out pat>  (. arguments.Add(pat); .)
-      }
+       [ CasePattern<out pat>        (. arguments.Add(pat); .)
+         { "," CasePattern<out pat>  (. arguments.Add(pat); .)
+         }
+       ]
     ")" ]
   | "("
       CasePattern<out pat>        (. arguments.Add(pat); .)
@@ -2881,9 +2882,10 @@ CaseExpression<out MatchCaseExpr c, bool allowSemi, bool allowLambda>
   "case"                      (. x = t; .)
   ( Ident<out id>             (. name = id.val; .)
     [ "("
-      CasePattern<out pat>        (. arguments.Add(pat); .)
-      { "," CasePattern<out pat>  (. arguments.Add(pat); .)
-      }
+       [ CasePattern<out pat>        (. arguments.Add(pat); .)
+         { "," CasePattern<out pat>  (. arguments.Add(pat); .)
+         }
+       ]
     ")" ]
   | "("
       CasePattern<out pat>        (. arguments.Add(pat); .)
diff --git a/Source/Dafny/Parser.cs b/Source/Dafny/Parser.cs
index 8a1da161..f64ba7fa 100644
--- a/Source/Dafny/Parser.cs
+++ b/Source/Dafny/Parser.cs
@@ -3244,12 +3244,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			name = id.val; 
 			if (la.kind == 50) {
 				Get();
-				CasePattern(out pat);
-				arguments.Add(pat); 
-				while (la.kind == 22) {
-					Get();
+				if (la.kind == 1 || la.kind == 50) {
 					CasePattern(out pat);
 					arguments.Add(pat); 
+					while (la.kind == 22) {
+						Get();
+						CasePattern(out pat);
+						arguments.Add(pat); 
+					}
 				}
 				Expect(51);
 			}
@@ -4562,12 +4564,14 @@ List<Expression/*!*/>/*!*/ decreases, ref Attributes decAttrs, ref Attributes mo
 			name = id.val; 
 			if (la.kind == 50) {
 				Get();
-				CasePattern(out pat);
-				arguments.Add(pat); 
-				while (la.kind == 22) {
-					Get();
+				if (la.kind == 1 || la.kind == 50) {
 					CasePattern(out pat);
 					arguments.Add(pat); 
+					while (la.kind == 22) {
+						Get();
+						CasePattern(out pat);
+						arguments.Add(pat); 
+					}
 				}
 				Expect(51);
 			}
diff --git a/Test/dafny4/Bug138.dfy b/Test/dafny4/Bug138.dfy
new file mode 100644
index 00000000..db0e54ef
--- /dev/null
+++ b/Test/dafny4/Bug138.dfy
@@ -0,0 +1,22 @@
+// RUN: %dafny /compile:0  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+datatype List = Nil | Cons(int, List)
+
+method R(xs: List)
+{
+  match xs
+  case Nil() =>    // currently produces a parsing error, but shouldn't
+  case Cons(x, Nil()) =>  // currently allowed
+  case Cons(x, Cons(y, tail)) =>
+}
+
+function F(xs: List) : int
+{
+  match xs
+  case Nil() =>  0  // currently produces a parsing error, but shouldn't
+  case Cons(x, Nil()) => 1 // currently allowed
+  case Cons(x, Cons(y, tail)) => 2
+}
+
+
diff --git a/Test/dafny4/Bug138.dfy.expect b/Test/dafny4/Bug138.dfy.expect
new file mode 100644
index 00000000..52595bf9
--- /dev/null
+++ b/Test/dafny4/Bug138.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 3 verified, 0 errors
-- 
cgit v1.2.3


From ad063dfd62db2b7f147e4f8abbcd7b8a7f575dae Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Fri, 26 Feb 2016 13:45:53 -0800
Subject: Changes to CanCall assumptions: - various peephole optimizations of
 formulas, to generate fewer tautologies - removed unused bound variables in
 CanCall quantifications (this addresses Issue #135) - added type- and
 precondition-antecedent in quantified CanCall assumption for lambda
 expressions, thus fixing an unsoundness

---
 Source/Dafny/Translator.cs | 164 ++++++++++++++++++++++++++++++++-------------
 1 file changed, 117 insertions(+), 47 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 52f52abf..e164d8ee 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -4293,12 +4293,7 @@ namespace Microsoft.Dafny {
         return CanCallAssumption(l, etran);
       } else if (expr is MemberSelectExpr) {
         MemberSelectExpr e = (MemberSelectExpr)expr;
-        Bpl.Expr r;
-        if (e.Obj is ThisExpr) {
-          r = Bpl.Expr.True;
-        } else {
-          r = CanCallAssumption(e.Obj, etran);
-        }
+        var r = CanCallAssumption(e.Obj, etran);
         if (e.Member is DatatypeDestructor) {
           var dtor = (DatatypeDestructor)e.Member;
           if (dtor.EnclosingCtor.EnclosingDatatype.Ctors.Count == 1) {
@@ -4311,10 +4306,7 @@ namespace Microsoft.Dafny {
       } else if (expr is SeqSelectExpr) {
         SeqSelectExpr e = (SeqSelectExpr)expr;
         Bpl.Expr total = CanCallAssumption(e.Seq, etran);
-        Bpl.Expr seq = etran.TrExpr(e.Seq);
-        Bpl.Expr e0 = null;
         if (e.E0 != null) {
-          e0 = etran.TrExpr(e.E0);
           total = BplAnd(total, CanCallAssumption(e.E0, etran));
         }
         if (e.E1 != null) {
@@ -4335,8 +4327,6 @@ namespace Microsoft.Dafny {
           return CanCallAssumption(e.ResolvedUpdateExpr, etran);
         }
         Bpl.Expr total = CanCallAssumption(e.Seq, etran);
-        Bpl.Expr seq = etran.TrExpr(e.Seq);
-        Bpl.Expr index = etran.TrExpr(e.Index);
         total = BplAnd(total, CanCallAssumption(e.Index, etran));
         total = BplAnd(total, CanCallAssumption(e.Value, etran));
         return total;
@@ -4347,18 +4337,13 @@ namespace Microsoft.Dafny {
           e.Args.ConvertAll(ee => CanCallAssumption(ee, etran))));
       } else if (expr is FunctionCallExpr) {
         FunctionCallExpr e = (FunctionCallExpr)expr;
-        // check well-formedness of receiver
         Bpl.Expr r = CanCallAssumption(e.Receiver, etran);
-        // check well-formedness of the other parameters
         r = BplAnd(r, CanCallAssumption(e.Args, etran));
- //       if (e.Name != "requires" && e.Name != "reads") {
-          Contract.Assert(e.Function != null);  // follows from the fact that expr has been successfully resolved
-          // get to assume canCall
-          Bpl.IdentifierExpr canCallFuncID = new Bpl.IdentifierExpr(expr.tok, e.Function.FullSanitizedName + "#canCall", Bpl.Type.Bool);
-          List<Bpl.Expr> args = etran.FunctionInvocationArguments(e, null);
-          Bpl.Expr canCallFuncAppl = new Bpl.NAryExpr(expr.tok, new Bpl.FunctionCall(canCallFuncID), args);
-          r = BplAnd(r, canCallFuncAppl);
-  //      }
+        // get to assume canCall
+        Bpl.IdentifierExpr canCallFuncID = new Bpl.IdentifierExpr(expr.tok, e.Function.FullSanitizedName + "#canCall", Bpl.Type.Bool);
+        List<Bpl.Expr> args = etran.FunctionInvocationArguments(e, null);
+        Bpl.Expr canCallFuncAppl = new Bpl.NAryExpr(expr.tok, new Bpl.FunctionCall(canCallFuncID), args);
+        r = BplAnd(r, canCallFuncAppl);
         return r;
       } else if (expr is DatatypeValue) {
         DatatypeValue dtv = (DatatypeValue)expr;
@@ -4379,10 +4364,10 @@ namespace Microsoft.Dafny {
         switch (e.ResolvedOp) {
           case BinaryExpr.ResolvedOpcode.And:
           case BinaryExpr.ResolvedOpcode.Imp:
-            t1 = Bpl.Expr.Imp(etran.TrExpr(e.E0), t1);
+            t1 = BplImp(etran.TrExpr(e.E0), t1);
             break;
           case BinaryExpr.ResolvedOpcode.Or:
-            t1 = Bpl.Expr.Imp(Bpl.Expr.Not(etran.TrExpr(e.E0)), t1);
+            t1 = BplImp(Bpl.Expr.Not(etran.TrExpr(e.E0)), t1);
             break;
           default:
             break;
@@ -4419,12 +4404,10 @@ namespace Microsoft.Dafny {
           LetDesugaring(e);  // call LetDesugaring to prepare the desugaring and populate letSuchThatExprInfo with something for e
           var info = letSuchThatExprInfo[e];
           // $let$canCall(g)
-          //var canCall = FunctionCall(e.tok, info.CanCallFunctionName(), Bpl.Type.Bool, gExprs);
           var canCall = info.CanCallFunctionCall(this, etran);         
           Dictionary<IVariable, Expression> substMap = new Dictionary<IVariable, Expression>();
           foreach (var bv in e.BoundVars) {
             // create a call to $let$x(g)
-            //var call = FunctionCall(e.tok, info.SkolemFunctionName(bv), TrType(bv.Type), gExprs);
             var args = info.SkolemFunctionArgs(bv, this, etran);
             var call = new BoogieFunctionCall(bv.tok, info.SkolemFunctionName(bv), info.UsesHeap, info.UsesOldHeap, args.Item1, args.Item2);
             call.Type = bv.Type;
@@ -4441,54 +4424,64 @@ namespace Microsoft.Dafny {
         if (e.Contract != null)
           return BplAnd(canCall, CanCallAssumption(e.Contract, etran));
         else return canCall;
+
       } else if (expr is LambdaExpr) {
         var e = (LambdaExpr)expr;
 
-        List<Bpl.Variable> bvars = new List<Bpl.Variable>();
-        
+        var bvarsAndAntecedents = new List<Tuple<Bpl.Variable, Bpl.Expr>>();
         var varNameGen = CurrentIdGenerator.NestedFreshIdGenerator("$l#");
 
         Bpl.Expr heap; var hVar = BplBoundVar(varNameGen.FreshId("#heap#"), predef.HeapType, out heap);
-        bvars.Add(hVar);
+        var et = new ExpressionTranslator(etran, heap);
 
         Dictionary<IVariable, Expression> subst = new Dictionary<IVariable,Expression>();
         foreach (var bv in e.BoundVars) {
           Bpl.Expr ve; var yVar = BplBoundVar(varNameGen.FreshId(string.Format("#{0}#", bv.Name)), TrType(bv.Type), out ve);
-          bvars.Add(yVar);
+          var wh = GetWhereClause(bv.tok, new Bpl.IdentifierExpr(bv.tok, yVar), bv.Type, et);
+          bvarsAndAntecedents.Add(Tuple.Create<Bpl.Variable, Bpl.Expr>(yVar, wh));
           subst[bv] = new BoogieWrapper(ve, bv.Type);
         }
 
-        ExpressionTranslator et = new ExpressionTranslator(etran, heap);
-        var ebody = CanCallAssumption(Substitute(e.Body, null, subst), et);
+        var canCall = CanCallAssumption(Substitute(e.Body, null, subst), et);
+        if (e.Range != null) {
+          var range = Substitute(e.Range, null, subst);
+          canCall = BplAnd(CanCallAssumption(range, etran), BplImp(etran.TrExpr(range), canCall));
+        }
+
+        // It's important to add the heap last to "bvarsAndAntecedents", because the heap may occur in the antecedents of
+        // the other variables and BplForallTrim processes the given tuples in order.
+        var goodHeap = FunctionCall(e.tok, BuiltinFunction.IsGoodHeap, null, heap);
+        bvarsAndAntecedents.Add(Tuple.Create<Bpl.Variable, Bpl.Expr>(hVar, goodHeap));
 
         //TRIG (forall $l#0#heap#0: Heap, $l#0#x#0: int :: true)
         //TRIG (forall $l#0#heap#0: Heap, $l#0#t#0: DatatypeType :: _module.__default.TMap#canCall(_module._default.TMap$A, _module._default.TMap$B, $l#0#heap#0, $l#0#t#0, f#0))
         //TRIG (forall $l#4#heap#0: Heap, $l#4#x#0: Box :: _0_Monad.__default.Bind#canCall(Monad._default.Associativity$B, Monad._default.Associativity$C, $l#4#heap#0, Apply1(Monad._default.Associativity$A, #$M$B, f#0, $l#4#heap#0, $l#4#x#0), g#0))
-        return BplForall(bvars, ebody); // L_TRIGGER
+        return BplForallTrim(bvarsAndAntecedents, null, canCall); // L_TRIGGER
+
       } else if (expr is ComprehensionExpr) {
         var e = (ComprehensionExpr)expr;
-        var canCall = CanCallAssumption(e.Term, etran);
         var q = e as QuantifierExpr;
-        
         if (q != null && q.SplitQuantifier != null) {
           return CanCallAssumption(q.SplitQuantifierExpression, etran);
         }
 
-        var tyvars = MkTyParamBinders(q != null ? q.TypeArgs : new List<TypeParameter>());
+        // Determine the CanCall's for the range and term
+        var canCall = CanCallAssumption(e.Term, etran);
         if (e.Range != null) {
           canCall = BplAnd(CanCallAssumption(e.Range, etran), BplImp(etran.TrExpr(e.Range), canCall));
         }
-        if (canCall != Bpl.Expr.True) {
-          List<Variable> bvars = new List<Variable>();
-          Bpl.Expr typeAntecedent = etran.TrBoundVariables(e.BoundVars, bvars);
-          if (Attributes.Contains(e.Attributes, "trigger")) {
-            Bpl.Trigger tr = TrTrigger(etran, e.Attributes, expr.tok);
-            canCall = new Bpl.ForallExpr(expr.tok, Concat(tyvars, bvars), tr, Bpl.Expr.Imp(typeAntecedent, canCall));
-          } else {
-            canCall = new Bpl.ForallExpr(expr.tok, Concat(tyvars, bvars), Bpl.Expr.Imp(typeAntecedent, canCall));  // SMART_TRIGGER
+        // Create a list of all possible bound variables
+        var bvarsAndAntecedents = etran.TrBoundVariables_SeparateWhereClauses(e.BoundVars);
+        if (q != null) {
+          var tyvars = MkTyParamBinders(q.TypeArgs);
+          foreach (var tv in tyvars) {
+            bvarsAndAntecedents.Add(Tuple.Create<Bpl.Variable, Bpl.Expr>(tv, null));
           }
         }
-        return canCall;
+        // Produce the quantified CanCall expression, with a suitably reduced set of bound variables
+        var tr = TrTrigger(etran, e.Attributes, expr.tok);
+        return BplForallTrim(bvarsAndAntecedents, tr, canCall);
+
       } else if (expr is StmtExpr) {
         var e = (StmtExpr)expr;
         return CanCallAssumption(e.E, etran);
@@ -4496,8 +4489,8 @@ namespace Microsoft.Dafny {
         ITEExpr e = (ITEExpr)expr;
         Bpl.Expr total = CanCallAssumption(e.Test, etran);
         Bpl.Expr test = etran.TrExpr(e.Test);
-        total = BplAnd(total, Bpl.Expr.Imp(test, CanCallAssumption(e.Thn, etran)));
-        total = BplAnd(total, Bpl.Expr.Imp(Bpl.Expr.Not(test), CanCallAssumption(e.Els, etran)));
+        total = BplAnd(total, BplImp(test, CanCallAssumption(e.Thn, etran)));
+        total = BplAnd(total, BplImp(Bpl.Expr.Not(test), CanCallAssumption(e.Els, etran)));
         return total;
       } else if (expr is ConcreteSyntaxExpression) {
         var e = (ConcreteSyntaxExpression)expr;
@@ -4909,7 +4902,7 @@ namespace Microsoft.Dafny {
             var fieldName = FunctionCall(e.tok, BuiltinFunction.IndexField, null, i);
             var allowedToRead = Bpl.Expr.SelectTok(e.tok, etran.TheFrame(e.tok), seq, fieldName);
             var trigger = BplTrigger(allowedToRead); // Note, the assertion we're about to produce only seems useful in the check-only mode (that is, with subsumption 0), but if it were to be assumed, we'll use this entire RHS as the trigger
-            var qq = new Bpl.ForallExpr(e.tok, new List<Variable> { iVar }, trigger, Bpl.Expr.Imp(range, allowedToRead));
+            var qq = new Bpl.ForallExpr(e.tok, new List<Variable> { iVar }, trigger, BplImp(range, allowedToRead));
             options.AssertSink(this, builder)(expr.tok, qq, "insufficient reads clause to read the indicated range of array elements", options.AssertKv);
           }
         }
@@ -11789,6 +11782,20 @@ namespace Microsoft.Dafny {
         return typeAntecedent;
       }
 
+      public List<Tuple<Bpl.Variable, Bpl.Expr>> TrBoundVariables_SeparateWhereClauses(List<BoundVar/*!*/> boundVars) {
+        Contract.Requires(boundVars != null);
+        Contract.Ensures(Contract.Result<List<Tuple<Bpl.Variable, Bpl.Expr>>>() != null);
+
+        var varsAndAntecedents = new List<Tuple<Bpl.Variable, Bpl.Expr>>();
+        foreach (BoundVar bv in boundVars) {
+          var tid = new Bpl.TypedIdent(bv.tok, bv.AssignUniqueName(translator.currentDeclaration.IdGenerator), translator.TrType(bv.Type));
+          var bvar = new Bpl.BoundVariable(bv.tok, tid);
+          var wh = translator.GetWhereClause(bv.tok, new Bpl.IdentifierExpr(bv.tok, bvar), bv.Type, this);
+          varsAndAntecedents.Add(Tuple.Create<Bpl.Variable, Bpl.Expr>(bvar, wh));
+        }
+        return varsAndAntecedents;
+      }
+
       public Bpl.Expr TrBoundVariablesRename(List<BoundVar> boundVars, List<Variable> bvars, out Dictionary<IVariable, Expression> substMap) {
         Contract.Requires(boundVars != null);
         Contract.Requires(bvars != null);
@@ -14205,6 +14212,69 @@ namespace Microsoft.Dafny {
 
     // Bpl-making-utilities
 
+    /// <summary>
+    /// Create a Boogie quantifier with body "A ==> body" and triggers "trg", but use only the subset of bound
+    /// variables from "varsAndAntecedents" that actually occur free in "body" or "trg", and "A" is the conjunction of
+    /// antecedents for those corresponding bound variables.  If none of the bound variables is used, "body"
+    /// is returned.
+    /// The order of the contents of "varsAndAntecedents" matters: For any index "i" into "varsAndAntecedents", the
+    /// antecedent varsAndAntecedents[i].Item2 may depend on a variable varsAndAntecedents[j].Item1 if "j GREATER-OR-EQUAL i"
+    /// but not if "j LESS i".
+    /// Caution: if "trg" is null, makes a forall without any triggers.
+    /// </summary>
+    static Bpl.Expr BplForallTrim(IEnumerable<Tuple<Bpl.Variable, Bpl.Expr/*?*/>> varsAndAntecedents, Bpl.Trigger trg, Bpl.Expr body) {
+      Contract.Requires(varsAndAntecedents != null);
+      Contract.Requires(body != null);
+
+      // We'd like to compute the free variables if "body" and "trg". It would be nice to use the Boogie
+      // routine Bpl.Expr.ComputeFreeVariables for this purpose. However, calling it requires the Boogie
+      // expression to be resolved. Instead, we do the cheesy thing of computing the set of names of
+      // free variables in "body" and "trg".
+      var vis = new VariableNameVisitor();
+      vis.Visit(body);
+      for (var tt = trg; tt != null; tt = tt.Next) {
+        tt.Tr.Iter(ee => vis.Visit(ee));
+      }
+
+      var args = new List<Bpl.Variable>();
+      Bpl.Expr typeAntecedent = Bpl.Expr.True;
+      foreach (var pair in varsAndAntecedents) {
+        var bv = pair.Item1;
+        var wh = pair.Item2;
+        if (vis.Names.Contains(bv.Name)) {
+          args.Add(bv);
+          if (wh != null) {
+            typeAntecedent = BplAnd(typeAntecedent, wh);
+            vis.Visit(wh);  // this adds to "vis.Names" the free variables of "wh"
+          }
+        }
+      }
+      if (args.Count == 0) {
+        return body;
+      } else {
+        return new Bpl.ForallExpr(body.tok, args, trg, BplImp(typeAntecedent, body));
+      }
+    }
+    class VariableNameVisitor : Boogie.StandardVisitor
+    {
+      public readonly HashSet<string> Names = new HashSet<string>();
+      public override Expr VisitIdentifierExpr(Bpl.IdentifierExpr node) {
+        Names.Add(node.Name);
+        return base.VisitIdentifierExpr(node);
+      }
+      public override BinderExpr VisitBinderExpr(BinderExpr node) {
+        var vis = new VariableNameVisitor();
+        vis.Visit(node.Body);
+        var dummyNames = new HashSet<string>(node.Dummies.Select(v => v.Name));
+        foreach (var nm in vis.Names) {
+          if (!dummyNames.Contains(nm)) {
+            Names.Add(nm);
+          }
+        }
+        return base.VisitBinderExpr(node);
+      }
+    }
+
     static Bpl.Expr BplForall(IEnumerable<Bpl.Variable> args_in, Bpl.Expr body) {
       Contract.Requires(args_in != null);
       Contract.Requires(body != null);
-- 
cgit v1.2.3


From c558eecdcd6444919c0314043c0f328c85ca3b22 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Fri, 26 Feb 2016 16:50:38 -0800
Subject: Fix issue 139. Allow bound variables in nested case patterns to
 shadow variables declared outside the enclosing match.

---
 Source/Dafny/Resolver.cs      | 12 +++++++++++-
 Test/dafny4/Bug139.dfy        | 25 +++++++++++++++++++++++++
 Test/dafny4/Bug139.dfy.expect |  2 ++
 3 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 Test/dafny4/Bug139.dfy
 create mode 100644 Test/dafny4/Bug139.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index 5a63b4e3..d3b59b51 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -6376,7 +6376,12 @@ namespace Microsoft.Dafny
         if (topLevel) {
           ScopePushAndReport(scope, v, "parameter");
         } else {
-          if (scope.Find(v.Name) != null) {
+          // For cons(a, const(b, c)):
+          // this handles check to see if 'b' or 'c' is duplicate with 'a',
+          // the duplication check between 'b' and 'c' is handled in the desugared
+          // form (to avoid reporting the same error twice), that is why we don't 
+          // push 'b' and 'c' onto the scope, only find.
+          if (scope.FindInCurrentScope(v.Name) != null) {
             reporter.Error(MessageSource.Resolver, v, "Duplicate parameter name: {0}", v.Name);
           }
         }
@@ -11069,6 +11074,11 @@ namespace Microsoft.Dafny
       return Find(name, false);
     }
 
+    public Thing FindInCurrentScope(string name) {
+      Contract.Requires(name != null);
+      return Find(name, true);
+    }
+
     public bool ContainsDecl(Thing t) {
       return things.Exists(thing => thing == t);
     }
diff --git a/Test/dafny4/Bug139.dfy b/Test/dafny4/Bug139.dfy
new file mode 100644
index 00000000..bd4ded73
--- /dev/null
+++ b/Test/dafny4/Bug139.dfy
@@ -0,0 +1,25 @@
+// RUN: %dafny /compile:0  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+datatype List = Nil | Cons(int, List)
+
+method R(xs: List)
+{
+  var a: int;
+  var b: int;
+  match xs
+  case Nil =>
+  case Cons(a, Nil()) =>  // this 'a' is allowed
+  case Cons(x, Cons(b, tail)) =>  // this 'b' (which is in a nested position) generates an error
+}
+
+function F(xs: List): int
+{
+  var a := 4;
+  var b := 7;
+  match xs
+  case Nil => 0
+  case Cons(a, Nil()) => 1
+  case Cons(x, Cons(b, tail)) => 2
+}
+
diff --git a/Test/dafny4/Bug139.dfy.expect b/Test/dafny4/Bug139.dfy.expect
new file mode 100644
index 00000000..52595bf9
--- /dev/null
+++ b/Test/dafny4/Bug139.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 3 verified, 0 errors
-- 
cgit v1.2.3


From 45e7bb72d4a8676796cb71cd8d11787dd6f91e17 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Mon, 29 Feb 2016 12:44:54 -0800
Subject: Revert change 1997 (bfe7c149bef1). IDE performance. Don't delay the
 resolver until the editor is idle for 5 second.

---
 Source/DafnyExtension/ResolverTagger.cs | 38 +++++----------------------------
 1 file changed, 5 insertions(+), 33 deletions(-)

(limited to 'Source')

diff --git a/Source/DafnyExtension/ResolverTagger.cs b/Source/DafnyExtension/ResolverTagger.cs
index b711c276..4a50a4e8 100644
--- a/Source/DafnyExtension/ResolverTagger.cs
+++ b/Source/DafnyExtension/ResolverTagger.cs
@@ -15,7 +15,6 @@ using System.Linq;
 using System.Text.RegularExpressions;
 using System.Windows.Shapes;
 using Microsoft.VisualStudio;
-using System.Windows.Threading;
 using Microsoft.VisualStudio.Shell;
 using Microsoft.VisualStudio.Shell.Interop;
 using Microsoft.VisualStudio.Text;
@@ -130,8 +129,6 @@ namespace DafnyLanguage
     ErrorListProvider _errorProvider;
     private bool m_disposed;
 
-    readonly DispatcherTimer timer;
-
     // The 'Snapshot' and 'Program' fields should be updated and read together, so they are protected by "this"
     public ITextSnapshot Snapshot;  // may be null
     public Dafny.Program Program;  // non-null only if the snapshot contains a Dafny program that type checks
@@ -230,13 +227,7 @@ namespace DafnyLanguage
       Snapshot = null;  // this makes sure the next snapshot will look different
       _errorProvider = new ErrorListProvider(serviceProvider);
 
-      BufferIdleEventUtil.AddBufferIdleEventListener(_buffer, UponIdle);
-
-      // keep track idle time after BufferIdleEvent has been handled.
-      timer = new DispatcherTimer(DispatcherPriority.ApplicationIdle);
-      timer.Interval = TimeSpan.FromMilliseconds(5000);
-      timer.Tick += new EventHandler(ResolveBuffer);
-      buffer.Changed += BufferChanged;
+      BufferIdleEventUtil.AddBufferIdleEventListener(_buffer, ResolveBuffer);
     }
 
     public void Dispose()
@@ -266,9 +257,7 @@ namespace DafnyLanguage
               _errorProvider.Dispose();
               _errorProvider = null;
             }
-            BufferIdleEventUtil.RemoveBufferIdleEventListener(_buffer, UponIdle);
-            timer.Tick -= ResolveBuffer;
-            _buffer.Changed -= BufferChanged;
+            BufferIdleEventUtil.RemoveBufferIdleEventListener(_buffer, ResolveBuffer);
             if (_document != null && _document.TextBuffer != null)
             {
               ResolverTaggers.Remove(_document.TextBuffer);
@@ -328,21 +317,9 @@ namespace DafnyLanguage
     /// <summary>
     /// Calls the Dafny parser/resolver/type checker on the contents of the buffer, updates the Error List accordingly.
     /// </summary>
-    void ResolveBuffer(object sender, EventArgs args)
-    {
-      timer.Stop();
-      ParseAndResolveBuffer(sender, args, true);
-    }
-
-    void UponIdle(object sender, EventArgs args) {
-      timer.Stop();
-      ParseAndResolveBuffer(sender, args, false);
-      timer.Start();
-    }
-
-    void ParseAndResolveBuffer(object sender, EventArgs args, bool runResolver) {
+    void ResolveBuffer(object sender, EventArgs args) {
       ITextSnapshot snapshot = _buffer.CurrentSnapshot;
-      if (snapshot == Snapshot && !runResolver)
+      if (snapshot == Snapshot)
         return;  // we've already done this snapshot
 
       string filename = _document != null ? _document.FilePath : "<program>";
@@ -351,7 +328,7 @@ namespace DafnyLanguage
       Dafny.Program program;
       try
       {
-        program = driver.ProcessResolution(runResolver);
+        program = driver.ProcessResolution(true);
         newErrors = driver.Errors;
       }
       catch (Exception e)
@@ -380,11 +357,6 @@ namespace DafnyLanguage
       UpdateErrorList(snapshot);
     }
 
-    void BufferChanged(object sender, TextContentChangedEventArgs e) {
-      timer.Stop();
-      timer.Start();
-    }
-
     public void UpdateErrorList(ITextSnapshot snapshot)
     {
       if (_errorProvider != null && !m_disposed)
-- 
cgit v1.2.3


From 9f4d81cb7056501547a5116796a3112da8054433 Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Mon, 29 Feb 2016 15:31:30 -0800
Subject: Added a return-value contract

---
 Source/Dafny/Translator.cs | 1 +
 1 file changed, 1 insertion(+)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 940bb328..1700198f 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -7040,6 +7040,7 @@ namespace Microsoft.Dafny {
     {
       Contract.Requires(tok != null);
       Contract.Requires(condition != null);
+      Contract.Ensures(Contract.Result<Bpl.Requires>() != null);
       Bpl.Requires req = new Bpl.Requires(ForceCheckToken.Unwrap(tok), free, condition, comment);
       if (errorMessage != null) {
         req.ErrorData = errorMessage;
-- 
cgit v1.2.3


From 1f38d2d252aaac3d55191e6c3dad46ecffdfee2c Mon Sep 17 00:00:00 2001
From: Rustan Leino <unknown>
Date: Tue, 1 Mar 2016 15:37:54 -0800
Subject: Revised the $Is and $IsAlloc axioms for arrow terms.  It is now
 possible to derived these predicates.  More things can now be verified
 (including the problem reported in Issue #49).

---
 Source/Dafny/Translator.cs | 105 ++++++++++++++++++++++++++++++++-------------
 Test/hofs/OneShot.dfy      |   9 ++--
 Test/hofs/VectorUpdate.dfy |   2 +-
 3 files changed, 79 insertions(+), 37 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 1700198f..28077842 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -5893,15 +5893,14 @@ namespace Microsoft.Dafny {
             var fld = BplBoundVar("fld", predef.FieldName(tok, a), ivars);
 
             var inner_forall = new Bpl.ForallExpr(tok, Singleton(a), ivars, BplImp(
-              BplAnd(new List<Expr> {
+              BplAnd(
                 Bpl.Expr.Neq(o, predef.Null),
-                IsAlloced(tok, h0, o),
-                IsAlloced(tok, h1, o),
+                // Note, the MkIsAlloc conjunct of "isness" implies that everything in the reads frame is allocated in "h0", which by HeapSucc(h0,h1) also implies the frame is allocated in "h1"
                 new Bpl.NAryExpr(tok, new Bpl.MapSelect(tok, 1), new List<Bpl.Expr> {
                   FunctionCall(tok, Reads(ad.Arity), objset_ty, Concat(types, Cons(f, Cons(hN, boxes)))),
                   FunctionCall(tok, BuiltinFunction.Box, null, o)
                 })
-              }),
+              ),
               Bpl.Expr.Eq(ReadHeap(tok, h0, o, fld), ReadHeap(tok, h1, o, fld))));
 
             Func<Bpl.Expr, Bpl.Expr> fn = h => FunctionCall(tok, fname, Bpl.Type.Bool, Concat(types, Cons(f, Cons<Bpl.Expr>(h, boxes))));
@@ -5922,42 +5921,86 @@ namespace Microsoft.Dafny {
           AddFrameForFunction(h1, Apply(ad.Arity));
         }
 
-        // consequence axiom
+        // $Is and $IsAlloc axioms
         /*
-
-          forall t0..tN+1 : Ty, h : Heap, f : Handle, bx1 .. bxN : Box,
-            GoodHeap(h)
-            && Is&IsAllocBox(bxI, tI, h)
-            && Is&IsAlloc(f, Func(t1,..,tN, tN+1), h)
-          ==> Is&IsAllocBox(Apply(f,h0,bxs)))
-
-         */
+          axiom (forall f: HandleType, t0: Ty, t1: Ty ::
+            { $Is(f, Tclass._System.___hFunc1(t0, t1)) }
+            $Is(f, Tclass._System.___hFunc1(t0, t1))
+               <==> (forall h: Heap, bx0: Box ::
+                 { Apply1(t0, t1, f, h, bx0) }
+                 $IsGoodHeap(h) && $IsBox(bx0, t0)
+                 && precondition of f(bx0) holds in h
+                 ==> $IsBox(Apply1(t0, t1, f, h, bx0), t1)));
+        */
         {
-          var bvars = new List<Bpl.Variable>();
-
-          var types = Map(Enumerable.Range(0, arity + 1), i => BplBoundVar("t" + i, predef.Ty, bvars));
-
-          var h = BplBoundVar("h", predef.HeapType, bvars);
+          var bvarsOuter = new List<Bpl.Variable>();
+          var f = BplBoundVar("f", predef.HandleType, bvarsOuter);
+          var types = Map(Enumerable.Range(0, arity + 1), i => BplBoundVar("t" + i, predef.Ty, bvarsOuter));
+          var Is = MkIs(f, ClassTyCon(ad, types));
+
+          var bvarsInner = new List<Bpl.Variable>();
+          var h = BplBoundVar("h", predef.HeapType, bvarsInner);
+          var boxes = Map(Enumerable.Range(0, arity), i => BplBoundVar("bx" + i, predef.BoxType, bvarsInner));
           var goodHeap = FunctionCall(tok, BuiltinFunction.IsGoodHeap, null, h);
+          var isBoxes = BplAnd(Map(Enumerable.Range(0, arity), i => MkIs(boxes[i], types[i], true)));
+          var pre = FunctionCall(tok, Requires(ad.Arity), predef.BoxType, Concat(types, Cons(f, Cons<Bpl.Expr>(h, boxes))));
+          var applied = FunctionCall(tok, Apply(ad.Arity), predef.BoxType, Concat(types, Cons(f, Cons<Bpl.Expr>(h, boxes))));
+          var applied_is = MkIs(applied, types[ad.Arity], true);
 
-          var f = BplBoundVar("f", predef.HandleType, bvars);
-          var boxes = Map(Enumerable.Range(0, arity), i => BplBoundVar("bx" + i, predef.BoxType, bvars));
-
-          var isness = BplAnd(
-            Snoc(Map(Enumerable.Range(0, arity), i =>
-              BplAnd(MkIs(boxes[i], types[i], true),
-                     MkIsAlloc(boxes[i], types[i], h, true))),
-            BplAnd(MkIs(f, ClassTyCon(ad, types)),
-                   MkIsAlloc(f, ClassTyCon(ad, types), h))));
+          sink.AddTopLevelDeclaration(new Axiom(tok,
+            BplForall(bvarsOuter, BplTrigger(Is),
+              BplIff(Is,
+                BplForall(bvarsInner, BplTrigger(applied),
+                  BplImp(BplAnd(BplAnd(goodHeap, isBoxes), pre), applied_is))))));
+        }
+        /*
+          axiom (forall f: HandleType, t0: Ty, t1: Ty, h: Heap ::
+            { $IsAlloc(f, Tclass._System.___hFunc1(t0, t1), h) }
+            $IsGoodHeap(h)
+            ==>
+            (
+              $IsAlloc(f, Tclass._System.___hFunc1(t0, t1), h)
+                <==>
+                (forall bx0: Box ::
+                  { Apply1(t0, t1, f, h, bx0) } { Reads1(t0, t1, f, h, bx0) }
+                  $IsAllocBox(bx0, t0, h)
+                  && precondition of f(bx0) holds in h
+                  ==>
+                    (everything in reads set of f(bx0) is allocated in h) &&
+                    $IsAllocBox(Apply1(t0, t1, f, h, bx0), t1, h))
+            ));
+        */
+        {
+          var bvarsOuter = new List<Bpl.Variable>();
+          var f = BplBoundVar("f", predef.HandleType, bvarsOuter);
+          var types = Map(Enumerable.Range(0, arity + 1), i => BplBoundVar("t" + i, predef.Ty, bvarsOuter));
+          var h = BplBoundVar("h", predef.HeapType, bvarsOuter);
+          var goodHeap = FunctionCall(tok, BuiltinFunction.IsGoodHeap, null, h);
+          var isAlloc = MkIsAlloc(f, ClassTyCon(ad, types), h);
 
+          var bvarsInner = new List<Bpl.Variable>();
+          var boxes = Map(Enumerable.Range(0, arity), i => BplBoundVar("bx" + i, predef.BoxType, bvarsInner));
+          var isAllocBoxes = BplAnd(Map(Enumerable.Range(0, arity), i => MkIsAlloc(boxes[i], types[i], h, true)));
+          var pre = FunctionCall(tok, Requires(ad.Arity), predef.BoxType, Concat(types, Cons(f, Cons<Bpl.Expr>(h, boxes))));
           var applied = FunctionCall(tok, Apply(ad.Arity), predef.BoxType, Concat(types, Cons(f, Cons<Bpl.Expr>(h, boxes))));
+          var applied_isAlloc = MkIsAlloc(applied, types[ad.Arity], h, true);
 
-          var applied_is = BplAnd(MkIs(applied, types[ad.Arity], true), MkIsAlloc(applied, types[ad.Arity], h, true));
+          // (forall r: ref :: {Reads1(t0, t1, f, h, bx0)[$Box(r)]}  r != null && Reads1(t0, t1, f, h, bx0)[$Box(r)] ==> h[r, alloc])
+          var bvarsR = new List<Bpl.Variable>();
+          var r = BplBoundVar("r", predef.RefType, bvarsR);
+          var rNonNull = Bpl.Expr.Neq(r, predef.Null);
+          var reads = FunctionCall(tok, Reads(ad.Arity), predef.BoxType, Concat(types, Cons(f, Cons<Bpl.Expr>(h, boxes))));
+          var rInReads = Bpl.Expr.Select(reads, FunctionCall(tok, BuiltinFunction.Box, null, r));
+          var rAlloc = IsAlloced(tok, h, r);
+          var isAllocReads = BplForall(bvarsR, BplTrigger(rInReads), BplImp(BplAnd(rNonNull, rInReads), rAlloc));
 
           sink.AddTopLevelDeclaration(new Axiom(tok,
-            BplForall(bvars,
-              new Bpl.Trigger(tok, true, new List<Bpl.Expr> {applied}),
-              BplImp(BplAnd(goodHeap, isness), applied_is))));
+            BplForall(bvarsOuter, BplTrigger(isAlloc),
+              BplImp(goodHeap,
+                BplIff(isAlloc,
+                  BplForall(bvarsInner,
+                    new Bpl.Trigger(tok, true, new List<Bpl.Expr> { applied }, BplTrigger(reads)),
+                    BplImp(BplAnd(isAllocBoxes, pre), BplAnd(isAllocReads, applied_isAlloc))))))));
         }
       }
     }
diff --git a/Test/hofs/OneShot.dfy b/Test/hofs/OneShot.dfy
index 286be898..e920530a 100644
--- a/Test/hofs/OneShot.dfy
+++ b/Test/hofs/OneShot.dfy
@@ -10,16 +10,15 @@ method OneShot() {
   var i : Ref<int>;
   i := new Ref;
 
-  g := () -> true;
-
+  g := () reads i -> true;  // using a (deprecated) one-shot arrow here means "g" acquires
+                           // a precondition that says it can only be applied in this heap
   assert g();
 
   i.val := i.val + 1; // heap changes
 
   if * {
-    assert g();         // should fail
+    assert g();         // error: precondition violation
   } else {
-    assert !g();        // should fail
+    assert !g();        // error: precondition violation
   }
 }
-
diff --git a/Test/hofs/VectorUpdate.dfy b/Test/hofs/VectorUpdate.dfy
index ca6b20b3..6fb25a87 100644
--- a/Test/hofs/VectorUpdate.dfy
+++ b/Test/hofs/VectorUpdate.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:3 "%s" > "%t"
+// RUN: %dafny /compile:3 /autoTriggers:1 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // this is a rather verbose version of the VectorUpdate method
-- 
cgit v1.2.3


From acbc126c01fee3ab71647a7b16f4dcfc80eee2ea Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Fri, 18 Mar 2016 09:48:26 -0700
Subject: Fix issue 93. Add per-function fuel setting that can be adjusted
 locally based on context.

---
 Source/Dafny/Translator.cs   | 224 +++++++++++++++++++++++++++++++++++++------
 Test/dafny0/Fuel.dfy         |   4 +-
 Test/dafny0/Fuel.dfy.expect  |  10 +-
 Test/dafny4/Bug93.dfy        |  37 +++++++
 Test/dafny4/Bug93.dfy.expect |   8 ++
 5 files changed, 249 insertions(+), 34 deletions(-)
 create mode 100644 Test/dafny4/Bug93.dfy
 create mode 100644 Test/dafny4/Bug93.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 28077842..9466f18a 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -113,6 +113,7 @@ namespace Microsoft.Dafny {
     readonly Dictionary<TopLevelDecl, string>/*!*/ classConstants = new Dictionary<TopLevelDecl, string>();
     readonly Dictionary<int, string> functionConstants = new Dictionary<int, string>();
     readonly Dictionary<Function, string> functionHandles = new Dictionary<Function, string>();
+    readonly static List<FuelConstant> FunctionFuel = new List<FuelConstant>();
     readonly Dictionary<Field/*!*/,Bpl.Constant/*!*/>/*!*/ fields = new Dictionary<Field/*!*/,Bpl.Constant/*!*/>();
     readonly Dictionary<Field/*!*/, Bpl.Function/*!*/>/*!*/ fieldFunctions = new Dictionary<Field/*!*/, Bpl.Function/*!*/>();
     readonly Dictionary<string, Bpl.Constant> fieldConstants = new Dictionary<string,Constant>();
@@ -488,6 +489,9 @@ namespace Microsoft.Dafny {
         return new Bpl.Program();
       }
 
+      // compute which function needs fuel constants.
+      ComputeFunctionFuel();
+
       foreach (TopLevelDecl d in program.BuiltIns.SystemModule.TopLevelDecls) {
         currentDeclaration = d;
         if (d is OpaqueTypeDecl) {
@@ -577,6 +581,37 @@ namespace Microsoft.Dafny {
       return sink;
     }
 
+    private void ComputeFunctionFuel() {
+      foreach (ModuleDefinition m in program.Modules) {
+        foreach (TopLevelDecl d in m.TopLevelDecls) {
+          if (d is ClassDecl) {
+            ClassDecl c = (ClassDecl)d;
+            foreach (MemberDecl member in c.Members) {
+              if (member is Function) {
+                Function f = (Function)member;
+                // declare the fuel constant
+                if (f.IsFueled) {
+                  // const BaseFuel_FunctionA : LayerType
+                  Bpl.Constant baseFuel = new Bpl.Constant(f.tok, new Bpl.TypedIdent(f.tok, "BaseFuel_" + f.FullName, predef.LayerType), false);
+                  sink.AddTopLevelDeclaration(baseFuel);
+                  Bpl.Expr baseFuel_expr = new Bpl.IdentifierExpr(f.tok, baseFuel);
+                  // const StartFuel_FunctionA : LayerType
+                  Bpl.Constant startFuel = new Bpl.Constant(f.tok, new Bpl.TypedIdent(f.tok, "StartFuel_" + f.FullName, predef.LayerType), false);
+                  sink.AddTopLevelDeclaration(startFuel);
+                  Bpl.Expr startFuel_expr = new Bpl.IdentifierExpr(f.tok, startFuel);
+                  // const StartFuelAssert_FunctionA : LayerType
+                  Bpl.Constant startFuelAssert = new Bpl.Constant(f.tok, new Bpl.TypedIdent(f.tok, "StartFuelAssert_" + f.FullName, predef.LayerType), false);
+                  sink.AddTopLevelDeclaration(startFuelAssert);
+                  Bpl.Expr startFuelAssert_expr = new Bpl.IdentifierExpr(f.tok, startFuelAssert);
+                  Translator.FunctionFuel.Add(new FuelConstant(f, baseFuel_expr, startFuel_expr, startFuelAssert_expr));
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+
     /// <summary>
     /// adding TraitParent axioms
     /// if a class A extends trait J and B does not extend anything, then this method adds the followings to the sink:
@@ -2755,6 +2790,7 @@ namespace Microsoft.Dafny {
       Bpl.StmtListBuilder builder = new Bpl.StmtListBuilder();
       builder.Add(new CommentCmd("AddMethodImpl: " + m + ", " + proc));
       ExpressionTranslator etran = new ExpressionTranslator(this, predef, m.tok);
+      InitializeFuelConstant(m.tok, builder, etran);
       List<Variable> localVariables = new List<Variable>();
       GenerateImplPrelude(m, wellformednessProc, inParams, outParams, builder, localVariables);
 
@@ -2934,6 +2970,52 @@ namespace Microsoft.Dafny {
       Reset();
     }
 
+    void InitializeFuelConstant(IToken tok, Bpl.StmtListBuilder builder, ExpressionTranslator etran) {
+      builder.Add(new CommentCmd("initialize fuel constant"));
+      FuelContext fuelContext = this.fuelContext;
+      foreach (FuelConstant fuelConstant in Translator.FunctionFuel) {
+        Function f = fuelConstant.f;
+        Bpl.Expr baseFuel = fuelConstant.baseFuel;
+        Bpl.Expr startFuel = fuelConstant.startFuel;
+        Bpl.Expr startFuelAssert = fuelConstant.startFuelAssert;
+        // find out what the initial value should be
+        FuelSettingPair settings;
+        var found = fuelContext.TryGetValue(f, out settings);
+        if (!found) {
+          // If the context doesn't define fuel for this function, check for a fuel attribute (which supplies a default value if none is found)
+          settings = FuelSetting.FuelAttrib(f, out found); 
+        }
+        
+        Bpl.Expr layer = etran.layerInterCluster.LayerN(settings.low, baseFuel);
+        Bpl.Expr layerAssert = etran.layerInterCluster.LayerN(settings.high, baseFuel);
+        builder.Add(TrAssumeCmd(tok, Bpl.Expr.Eq(startFuel, layer)));
+        builder.Add(TrAssumeCmd(tok, Bpl.Expr.Eq(startFuelAssert, layerAssert)));
+      }
+    }
+
+    bool DefineFuelConstant(IToken tok, Attributes attribs, Bpl.StmtListBuilder builder, ExpressionTranslator etran) {
+      bool defineFuel = false;
+      builder.Add(new CommentCmd("Assume Fuel Constant"));
+      FuelContext fuelContext  = new FuelContext();
+      FuelSetting.FindFuelAttributes(attribs, fuelContext);
+      foreach (KeyValuePair<Function, FuelSettingPair> fuel in fuelContext) {
+        Function f = fuel.Key;
+        FuelSettingPair settings = fuel.Value;
+        FuelConstant fuelConstant = Translator.FunctionFuel.Find(x => x.f == f);
+        if (fuelConstant != null) {
+          Bpl.Expr startFuel = fuelConstant.startFuel;
+          Bpl.Expr startFuelAssert = fuelConstant.startFuelAssert;
+          Bpl.Expr moreFuel_expr = fuelConstant.MoreFuel(sink, predef, f.IdGenerator);
+          Bpl.Expr layer = etran.layerInterCluster.LayerN(settings.low, moreFuel_expr);
+          Bpl.Expr layerAssert = etran.layerInterCluster.LayerN(settings.high, moreFuel_expr);
+          builder.Add(TrAssumeCmd(tok, Bpl.Expr.Eq(startFuel, layer)));
+          builder.Add(TrAssumeCmd(tok, Bpl.Expr.Eq(startFuelAssert, layerAssert)));
+          defineFuel = true;
+        }
+      }
+      return defineFuel;
+    }
+    
     internal static AssumeCmd optimizeExpr(bool minimize, Expression expr, IToken tok, ExpressionTranslator etran)
     {
       Contract.Requires(expr != null);
@@ -4032,7 +4114,7 @@ namespace Microsoft.Dafny {
       builder.Add(CaptureState(f.tok, false, "initial state"));
 
       DefineFrame(f.tok, f.Reads, builder, locals, null);
-
+      InitializeFuelConstant(f.tok, builder, etran);
       // Check well-formedness of the preconditions (including termination), and then
       // assume each one of them.  After all that (in particular, after assuming all
       // of them), do the postponed reads checks.
@@ -7113,11 +7195,14 @@ namespace Microsoft.Dafny {
       Contract.Requires(codeContext != null && predef != null);
       Contract.Ensures(fuelContext == Contract.OldValue(fuelContext));
       if (stmt is PredicateStmt) {
-        this.fuelContext = FuelSetting.ExpandFuelContext(stmt.Attributes, this.fuelContext);
+        var stmtBuilder = new Bpl.StmtListBuilder();
+        this.fuelContext = FuelSetting.ExpandFuelContext(stmt.Attributes, stmt.Tok, this.fuelContext, this.reporter);
+        var defineFuel = DefineFuelConstant(stmt.Tok, stmt.Attributes, stmtBuilder, etran);
+        var b = defineFuel ? stmtBuilder : builder;
         if (stmt is AssertStmt || DafnyOptions.O.DisallowSoundnessCheating) {
-          AddComment(builder, stmt, "assert statement");
+          AddComment(b, stmt, "assert statement");
           PredicateStmt s = (PredicateStmt)stmt;
-          TrStmt_CheckWellformed(s.Expr, builder, locals, etran, false);
+          TrStmt_CheckWellformed(s.Expr, b, locals, etran, false);
           IToken enclosingToken = null;
           if (Attributes.Contains(stmt.Attributes, "prependAssertToken")) {
             enclosingToken = stmt.Tok;
@@ -7126,14 +7211,21 @@ namespace Microsoft.Dafny {
           var ss = TrSplitExpr(s.Expr, etran, true, out splitHappened);
           if (!splitHappened) {
             var tok = enclosingToken == null ? s.Expr.tok : new NestedToken(enclosingToken, s.Expr.tok);
-            builder.Add(Assert(tok, etran.TrExpr(s.Expr), "assertion violation", stmt.Tok, etran.TrAttributes(stmt.Attributes, null)));
+            b.Add(Assert(tok, etran.TrExpr(s.Expr), "assertion violation", stmt.Tok, etran.TrAttributes(stmt.Attributes, null)));
           } else {
             foreach (var split in ss) {
               if (split.IsChecked) {
                 var tok = enclosingToken == null ? split.E.tok : new NestedToken(enclosingToken, split.E.tok);
-                builder.Add(AssertNS(tok, split.E, "assertion violation", stmt.Tok, etran.TrAttributes(stmt.Attributes, null)));  // attributes go on every split
+                b.Add(AssertNS(tok, split.E, "assertion violation", stmt.Tok, etran.TrAttributes(stmt.Attributes, null)));  // attributes go on every split
               }
             }
+            if (!defineFuel) {
+              b.Add(TrAssumeCmd(stmt.Tok, etran.TrExpr(s.Expr)));
+            }
+          }
+          if (defineFuel) {
+            var ifCmd = new Bpl.IfCmd(s.Tok, null, b.Collect(s.Tok), null, null);
+            builder.Add(ifCmd);
             builder.Add(TrAssumeCmd(stmt.Tok, etran.TrExpr(s.Expr)));
           }
         } else if (stmt is AssumeStmt) {
@@ -7381,7 +7473,8 @@ namespace Microsoft.Dafny {
 
       } else if (stmt is WhileStmt) {
         AddComment(builder, stmt, "while statement");
-        this.fuelContext = FuelSetting.ExpandFuelContext(stmt.Attributes, this.fuelContext);
+        this.fuelContext = FuelSetting.ExpandFuelContext(stmt.Attributes, stmt.Tok, this.fuelContext, this.reporter);
+        DefineFuelConstant(stmt.Tok, stmt.Attributes, builder, etran);
         var s = (WhileStmt)stmt;
         BodyTranslator bodyTr = null;
         if (s.Body != null) {
@@ -7434,7 +7527,8 @@ namespace Microsoft.Dafny {
 
       } else if (stmt is ForallStmt) {
         var s = (ForallStmt)stmt;
-        this.fuelContext = FuelSetting.ExpandFuelContext(stmt.Attributes, this.fuelContext);
+        this.fuelContext = FuelSetting.ExpandFuelContext(stmt.Attributes, stmt.Tok, this.fuelContext, this.reporter);
+        
         if (s.Kind == ForallStmt.ParBodyKind.Assign) {
           AddComment(builder, stmt, "forall statement (assign)");
           Contract.Assert(s.Ens.Count == 0);
@@ -7444,6 +7538,7 @@ namespace Microsoft.Dafny {
             var s0 = (AssignStmt)s.S0;
             var definedness = new Bpl.StmtListBuilder();
             var updater = new Bpl.StmtListBuilder();
+            DefineFuelConstant(stmt.Tok, stmt.Attributes, definedness, etran);
             TrForallAssign(s, s0, definedness, updater, locals, etran);
             // All done, so put the two pieces together
             builder.Add(new Bpl.IfCmd(s.Tok, null, definedness.Collect(s.Tok), null, updater.Collect(s.Tok)));
@@ -7459,6 +7554,7 @@ namespace Microsoft.Dafny {
           } else {
             var s0 = (CallStmt)s.S0;
             var definedness = new Bpl.StmtListBuilder();
+            DefineFuelConstant(stmt.Tok, stmt.Attributes, definedness, etran);
             var exporter = new Bpl.StmtListBuilder();
             TrForallStmtCall(s.Tok, s.BoundVars, s.Range, null, s.ForallExpressions, s0, definedness, exporter, locals, etran);
             // All done, so put the two pieces together
@@ -7470,6 +7566,7 @@ namespace Microsoft.Dafny {
           AddComment(builder, stmt, "forall statement (proof)");
           var definedness = new Bpl.StmtListBuilder();
           var exporter = new Bpl.StmtListBuilder();
+          DefineFuelConstant(stmt.Tok, stmt.Attributes, definedness, etran);
           TrForallProof(s, definedness, exporter, locals, etran);
           // All done, so put the two pieces together
           builder.Add(new Bpl.IfCmd(s.Tok, null, definedness.Collect(s.Tok), null, exporter.Collect(s.Tok)));
@@ -7504,7 +7601,8 @@ namespace Microsoft.Dafny {
         var s = (CalcStmt)stmt;
         Contract.Assert(s.Steps.Count == s.Hints.Count); // established by the resolver
         AddComment(builder, stmt, "calc statement");
-        this.fuelContext = FuelSetting.ExpandFuelContext(stmt.Attributes, this.fuelContext);
+        this.fuelContext = FuelSetting.ExpandFuelContext(stmt.Attributes, stmt.Tok, this.fuelContext, this.reporter);
+        DefineFuelConstant(stmt.Tok, stmt.Attributes, builder, etran);
         CurrentIdGenerator.Push();  // put the entire calc statement within its own sub-branch
         if (s.Lines.Count > 0) {
           Bpl.IfCmd ifCmd = null;
@@ -10312,31 +10410,58 @@ namespace Microsoft.Dafny {
     // C#'s version of a type alias
     internal class FuelContext : Dictionary<Function, FuelSettingPair> { }
 
+    internal class FuelConstant
+    {
+      public Function f;
+      public Bpl.Expr baseFuel;
+      public Bpl.Expr startFuel;
+      public Bpl.Expr startFuelAssert;
+
+      public FuelConstant(Function f, Bpl.Expr baseFuel, Bpl.Expr startFuel, Bpl.Expr startFuelAssert) {
+        this.f = f;
+        this.baseFuel = baseFuel;
+        this.startFuel = startFuel;
+        this.startFuelAssert = startFuelAssert;
+      }
+
+      public Bpl.Expr MoreFuel(Bpl.Program sink, PredefinedDecls predef, FreshIdGenerator idGen) {
+        string uniqueId = idGen.FreshId("MoreFuel_" + f.FullName);
+        Bpl.Constant moreFuel = new Bpl.Constant(f.tok, new Bpl.TypedIdent(f.tok, uniqueId, predef.LayerType), false);
+        sink.AddTopLevelDeclaration(moreFuel);
+        Bpl.Expr moreFuel_expr = new Bpl.IdentifierExpr(f.tok, moreFuel);
+        return moreFuel_expr;
+      }
+    }
+
     internal class FuelSetting
     {
       public enum FuelAmount { NONE, LOW, HIGH };
       public static Stack<FuelContext> SavedContexts = new Stack<FuelContext>();
 
-      private static FuelSettingPair FuelAttrib(Function f) {
+      public static FuelSettingPair FuelAttrib(Function f, out bool found) {
         Contract.Requires(f != null);
         Contract.Ensures(Contract.Result<FuelSettingPair>() != null);
         FuelSettingPair setting = new FuelSettingPair();
+        found = false;
 
         if (f.Attributes != null) {
           List<Expression> args = Attributes.FindExpressions(f.Attributes, "fuel");
-          if (args != null && args.Count >= 2) {
-            LiteralExpr literalLow = args[0] as LiteralExpr;
-            LiteralExpr literalHigh = args[1] as LiteralExpr;
-
-            if (literalLow != null && literalLow.Value is BigInteger && literalHigh != null && literalHigh.Value is BigInteger) {
-              setting.low = (int)((BigInteger)literalLow.Value);
-              setting.high = (int)((BigInteger)literalHigh.Value);
-            }
-          } else if (args != null && args.Count >= 1) {
-            LiteralExpr literal = args[0] as LiteralExpr;
-            if (literal != null && literal.Value is BigInteger) {
-              setting.low = (int)((BigInteger)literal.Value);
-              setting.high = setting.low + 1;
+          if (args != null) {
+            found = true;
+            if (args.Count >= 2) {
+              LiteralExpr literalLow = args[0] as LiteralExpr;
+              LiteralExpr literalHigh = args[1] as LiteralExpr;
+
+              if (literalLow != null && literalLow.Value is BigInteger && literalHigh != null && literalHigh.Value is BigInteger) {
+                setting.low = (int)((BigInteger)literalLow.Value);
+                setting.high = (int)((BigInteger)literalHigh.Value);
+              }
+            } else if (args.Count >= 1) {
+              LiteralExpr literal = args[0] as LiteralExpr;
+              if (literal != null && literal.Value is BigInteger) {
+                setting.low = (int)((BigInteger)literal.Value);
+                setting.high = setting.low + 1;
+              }
             }
           }
         }
@@ -10369,6 +10494,12 @@ namespace Microsoft.Dafny {
         return translator.LayerSucc(LayerZero(), n);
       }
 
+      public Bpl.Expr LayerN(int n, Bpl.Expr baseLayer) {
+        Contract.Requires(0 <= n);
+        Contract.Ensures(Contract.Result<Bpl.Expr>() != null);
+        return translator.LayerSucc(baseLayer, n);
+      }
+
       private Bpl.Expr ToExpr(int amount) {
         if (start == null) {
           return LayerN(amount);
@@ -10394,13 +10525,14 @@ namespace Microsoft.Dafny {
           var found = translator.fuelContext.TryGetValue(f, out setting);
 
           if (!found) {  // If the context doesn't define fuel for this function, check for a fuel attribute (which supplies a default value if none is found)
-            setting = FuelAttrib(f);
+            setting = FuelAttrib(f, out found);
           }
 
+          FuelConstant fuelConstant = Translator.FunctionFuel.Find(x => x.f == f);
           if (this.amount == (int)FuelAmount.LOW) {
-            return ToExpr(setting.low);
+            return GetFunctionFuel(setting.low, found, fuelConstant);
           } else if (this.amount == (int)FuelAmount.HIGH) {
-            return ToExpr(setting.high);
+            return GetFunctionFuel(setting.high, found, fuelConstant);
           } else {
             Contract.Assert(false); // Should not reach here
             return null;
@@ -10408,13 +10540,30 @@ namespace Microsoft.Dafny {
         }
       }
 
+      private Bpl.Expr GetFunctionFuel(int amount, bool hasFuel, FuelConstant fuelConstant) {
+        if (fuelConstant != null) {
+          if (hasFuel) {
+            // it has fuel context
+            return LayerN(amount, fuelConstant.baseFuel);
+          } else {
+            // startfuel
+            if (amount == (int)FuelAmount.LOW) {
+              return fuelConstant.startFuel;
+            } else {
+              return fuelConstant.startFuelAssert;
+            }
+          }
+        } else {
+          return ToExpr(amount);
+        }
+      }
 
       /// <summary>
       /// Finds all fuel related attributes of the form {:fuel function low [high]}
       /// Adds the setting to the context _if_ the context does not already have a setting for that function.
       /// In other words, it should be called in order from most to least specific contenxt scope.
       /// </summary>    
-      private static void FindFuelAttributes(Attributes attribs, FuelContext fuelContext) {
+      public static void FindFuelAttributes(Attributes attribs, FuelContext fuelContext) {
         Function f = null;
         FuelSettingPair setting = null;
 
@@ -10495,20 +10644,35 @@ namespace Microsoft.Dafny {
       /// <summary>
       /// Extends the given fuel context with any new fuel settings found in attribs
       /// </summary>    
-      public static FuelContext ExpandFuelContext(Attributes attribs, FuelContext oldFuelContext) {
+      public static FuelContext ExpandFuelContext(Attributes attribs, IToken tok, FuelContext oldFuelContext, ErrorReporter reporter) {
         Contract.Ensures(SavedContexts.Count == Contract.OldValue(SavedContexts.Count) + 1);
         FuelContext newContext = new FuelContext();
         FindFuelAttributes(attribs, newContext);
         if (newContext.Count > 0) {
+          // first make sure that the fuel only increase relative to the oldContext
+          foreach (var pair in newContext) {
+            FuelSettingPair newSetting = pair.Value;
+            FuelSettingPair oldSetting;
+            var found = oldFuelContext.TryGetValue(pair.Key, out oldSetting);
+            if (!found) {    // the default is {:fuel, 1, 2}
+              oldSetting = new FuelSettingPair();
+            }
+            // make sure that the fuel can only increase within a given scope
+            if (newSetting.low < oldSetting.low || newSetting.high < oldSetting.high) {
+              reporter.Error(MessageSource.Translator, tok, "Fuel can only increase within a given scope.");
+            }
+          }
+          // add oldContext to newContext if it doesn't exist already
           foreach (var pair in oldFuelContext) {
             if (!newContext.ContainsKey(pair.Key)) {    // Local setting takes precedence over old context
-              newContext.Add(pair.Key, pair.Value);              
+              newContext.Add(pair.Key, pair.Value);
             }
-          }          
+          }
         } else {
           newContext = oldFuelContext;
         }
         SavedContexts.Push(oldFuelContext);
+        
         return newContext;
       }
 
diff --git a/Test/dafny0/Fuel.dfy b/Test/dafny0/Fuel.dfy
index abbc831e..6347e134 100644
--- a/Test/dafny0/Fuel.dfy
+++ b/Test/dafny0/Fuel.dfy
@@ -126,7 +126,7 @@ module TestModule4 {
         requires y > 5;
         requires z < 0;
     {
-        assert {:fuel pos,0,0} pos(z) == 0;               // error: Should fail due to "opaque" fuel setting
+        assert {:fuel pos,0,0} pos(z) == 0;               // error: fuel can't be decreased
         assert pos(-1) == 0;
         if (*) {
             assert pos(y) == 3 + pos(y - 3);  // error: Should fail without extra fuel setting
@@ -404,7 +404,7 @@ module TestModule9 {
         requires y > 5;
         requires z < 0;
     {
-        assert {:fuel abs,0,0} abs(z) == -1*z;  // error: Cannot see the body of abs
+        assert {:fuel abs,0,0} abs(z) == -1*z;  // error: fuel can't be decreased
         assert abs(y) == y;     // Normal success
         assert abs(-1) == 1;    // lit bypasses fuel, so this should succeed
     }
diff --git a/Test/dafny0/Fuel.dfy.expect b/Test/dafny0/Fuel.dfy.expect
index 0c128941..275be237 100644
--- a/Test/dafny0/Fuel.dfy.expect
+++ b/Test/dafny0/Fuel.dfy.expect
@@ -1,3 +1,5 @@
+Fuel.dfy(129,8): Error: Fuel can only increase within a given scope.
+Fuel.dfy(407,8): Error: Fuel can only increase within a given scope.
 Fuel.dfy(17,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
@@ -25,14 +27,17 @@ Execution trace:
 Fuel.dfy(129,38): Error: assertion violation
 Execution trace:
     (0,0): anon0
+    (0,0): anon7_Then
 Fuel.dfy(132,26): Error: assertion violation
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Then
+    Fuel.dfy(129,9): anon7_Else
+    (0,0): anon8_Then
 Fuel.dfy(133,26): Error: assertion violation
 Execution trace:
     (0,0): anon0
-    (0,0): anon3_Then
+    Fuel.dfy(129,9): anon7_Else
+    (0,0): anon8_Then
 Fuel.dfy(157,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
@@ -91,6 +96,7 @@ Execution trace:
 Fuel.dfy(407,38): Error: assertion violation
 Execution trace:
     (0,0): anon0
+    (0,0): anon3_Then
 Fuel.dfy(435,22): Error: assertion violation
 Execution trace:
     (0,0): anon0
diff --git a/Test/dafny4/Bug93.dfy b/Test/dafny4/Bug93.dfy
new file mode 100644
index 00000000..5a1dd27f
--- /dev/null
+++ b/Test/dafny4/Bug93.dfy
@@ -0,0 +1,37 @@
+// RUN: %dafny /compile:0 "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+module Fuel {
+    function FunctionA(x:int) : int
+    {
+        x + 2
+    }
+
+    function FunctionB(y:int) : int
+    {
+        FunctionA(y - 2)
+    }
+
+		method {:fuel FunctionA,0,0}  MethodX(z:int)
+    {
+        assert FunctionB(z) == z; // error: Cannot see the body of FunctionA
+    }
+}
+
+module Opaque {
+    function {:opaque} FunctionA(x:int) : int
+    {
+        x + 2
+    }
+
+    function FunctionB(y:int) : int
+    {
+        FunctionA(y - 2)
+    }
+
+    method MethodX(z:int)
+    {
+        assert FunctionB(z) == z;
+    }
+}
+
diff --git a/Test/dafny4/Bug93.dfy.expect b/Test/dafny4/Bug93.dfy.expect
new file mode 100644
index 00000000..d0baf877
--- /dev/null
+++ b/Test/dafny4/Bug93.dfy.expect
@@ -0,0 +1,8 @@
+Bug93.dfy(17,28): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+Bug93.dfy(34,28): Error: assertion violation
+Execution trace:
+    (0,0): anon0
+
+Dafny program verifier finished with 7 verified, 2 errors
-- 
cgit v1.2.3


From a89b9aee05dff74345a79f8fb4fe0fe3fdbb17ad Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Mon, 21 Mar 2016 11:45:14 -0700
Subject: Update module export error messages. Also for "import Y" if there is
 at least one exported view, but no exported view is marked as default, then
 it is an error.

---
 Source/Dafny/Resolver.cs            | 18 ++++++++++++++----
 Test/dafny0/ModuleExport.dfy        | 37 +++++++++++++++++++++++++++++++++++++
 Test/dafny0/ModuleExport.dfy.expect |  6 +++++-
 3 files changed, 56 insertions(+), 5 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index d3b59b51..aa9ce148 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -742,7 +742,7 @@ namespace Microsoft.Dafny
               d.ExtendDecls.Add(extend);
               exportDependencies.AddEdge(d, extend);
             } else {
-              reporter.Error(MessageSource.Resolver, m.tok, s + " must be an export of" + m + " to be extended");
+              reporter.Error(MessageSource.Resolver, m.tok, s + " must be an export of " + m.Name + " to be extended");
             }
           }
           foreach (ExportSignature export in d.Exports) {
@@ -757,7 +757,7 @@ namespace Microsoft.Dafny
             } else if (sig.StaticMembers.TryGetValue(name, out member)) {
               export.Decl = member;
             } else {
-              reporter.Error(MessageSource.Resolver, d.tok, name + " must be a member of " + m + " to be exported");
+              reporter.Error(MessageSource.Resolver, d.tok, name + " must be a member of " + m.Name + " to be exported");
             }
           }
         }
@@ -779,7 +779,7 @@ namespace Microsoft.Dafny
           if (defaultExport == null) {
             defaultExport = decl;
           } else {
-            reporter.Error(MessageSource.Resolver, m.tok, "more than one default export declared: {0}, {1}", defaultExport, decl);
+            reporter.Error(MessageSource.Resolver, m.tok, "more than one default export declared in module {0}", m.Name);
           }
         }
         // fill in export signature
@@ -811,9 +811,14 @@ namespace Microsoft.Dafny
         }
       }
 
-      // set the default export if it exists, otherwise, default is export everything     
+      // set the default export if it exists
       if (defaultExport != null) {
         literalDecl.DefaultExport = defaultExport.Signature;
+      } else {
+        // if there is at least one exported view, but no exported view marked as default, then defaultExport should be null.
+        if (sortedDecls.Count > 0) {
+          literalDecl.DefaultExport = null;       
+        }
       }
     }
 
@@ -1437,6 +1442,11 @@ namespace Microsoft.Dafny
         // use the default export when the importing the root
         LiteralModuleDecl decl = (LiteralModuleDecl)root;
         p = decl.DefaultExport;
+        if (p == null) {
+          // no default view is specified. 
+          reporter.Error(MessageSource.Resolver, decl.tok, "no default export declared in module: {0}", decl.Name);
+          return false;
+        }
         return true;
       }
 
diff --git a/Test/dafny0/ModuleExport.dfy b/Test/dafny0/ModuleExport.dfy
index 81fe0ed5..1e69764f 100644
--- a/Test/dafny0/ModuleExport.dfy
+++ b/Test/dafny0/ModuleExport.dfy
@@ -65,4 +65,41 @@ module E {
     case Kiwi(x) => 7
 		case Orang => 8  // error
   } 
+}
+
+module F {
+  default export Public { f, h}
+	default export E1 { f, g}
+	export E2 extends Public2, E1 {T}		// error: Public2 is not a exported view of F
+  export Friend extends Public {g2, T}  // error: g2 is not a member of F
+	export Fruit {Data}
+
+  method h() {}
+  function f(): int { 818 }
+  function g() : int { 819 }
+	function k() : int { 820 }
+  
+	class T 
+	{
+	  static method l() {}
+	}
+
+	datatype Data = Lemon | Kiwi(int)
+}
+
+module G {
+  export Public { f, h}
+
+	method h() {}
+  function f(): int { 818 }
+  function g() : int { 819 }
+	function k() : int { 820 }
+}
+
+module H {
+  import G  // error: G has no default export
+}
+
+module I {
+  import G.Public  // OK
 }
\ No newline at end of file
diff --git a/Test/dafny0/ModuleExport.dfy.expect b/Test/dafny0/ModuleExport.dfy.expect
index c7444bdb..274c8f31 100644
--- a/Test/dafny0/ModuleExport.dfy.expect
+++ b/Test/dafny0/ModuleExport.dfy.expect
@@ -6,4 +6,8 @@ ModuleExport.dfy(42,11): Error: unresolved identifier: k
 ModuleExport.dfy(52,9): Error: unresolved identifier: g
 ModuleExport.dfy(53,9): Error: unresolved identifier: k
 ModuleExport.dfy(66,2): Error: member Orang does not exist in datatype Data
-8 resolution/type errors detected in ModuleExport.dfy
+ModuleExport.dfy(70,7): Error: Public2 must be an export of F to be extended
+ModuleExport.dfy(74,9): Error: g2 must be a member of F to be exported
+ModuleExport.dfy(70,7): Error: more than one default export declared in module F
+ModuleExport.dfy(90,7): Error: no default export declared in module: G
+12 resolution/type errors detected in ModuleExport.dfy
-- 
cgit v1.2.3


From 91cee1c2028f9ad995df863f2a4568d95f4ea1a8 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Mon, 28 Mar 2016 12:02:37 -0700
Subject: Make /autoTriggers:1 to be default. Add /autoTriggers:0 to tests that
 requires it. Don't use pretty warning signs since we can't diff them
 correctly in the test output from the test run.

---
 Source/Dafny/DafnyOptions.cs                  |  6 ++--
 Source/DafnyServer/Utilities.cs               |  2 +-
 Test/VSI-Benchmarks/b8.dfy                    |  2 +-
 Test/VerifyThis2015/Problem3.dfy              |  2 +-
 Test/cloudmake/CloudMake-CachedBuilds.dfy     |  2 +-
 Test/cloudmake/CloudMake-ConsistentBuilds.dfy |  2 +-
 Test/cloudmake/CloudMake-ParallelBuilds.dfy   |  2 +-
 Test/dafny0/Basics.dfy                        |  2 +-
 Test/dafny0/Calculations.dfy                  |  2 +-
 Test/dafny0/Compilation.dfy                   |  2 +-
 Test/dafny0/ForallCompilation.dfy             |  2 +-
 Test/dafny0/Fuel.dfy                          |  2 +-
 Test/dafny0/LetExpr.dfy                       |  2 +-
 Test/dafny0/LetExpr.dfy.expect                |  1 +
 Test/dafny0/LhsDuplicates.dfy                 |  2 +-
 Test/dafny0/Parallel.dfy                      |  2 +-
 Test/dafny0/SmallTests.dfy.expect             |  1 +
 Test/dafny1/MoreInduction.dfy                 |  2 +-
 Test/dafny1/SchorrWaite-stages.dfy            |  2 +-
 Test/dafny1/SchorrWaite.dfy                   |  2 +-
 Test/dafny1/Substitution.dfy                  |  2 +-
 Test/dafny1/UltraFilter.dfy                   |  2 +-
 Test/dafny2/SnapshotableTrees.dfy             |  2 +-
 Test/dafny3/Filter.dfy                        |  2 +-
 Test/dafny4/GHC-MergeSort.dfy                 |  2 +-
 Test/dafny4/NumberRepresentations.dfy         |  2 +-
 Test/dafny4/Primes.dfy                        |  2 +-
 Test/server/simple-session.transcript.expect  | 41 +++++++++++++++++++++++++++
 Test/vstte2012/BreadthFirstSearch.dfy         |  2 +-
 29 files changed, 71 insertions(+), 28 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index f3b38a84..607090eb 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -66,7 +66,7 @@ namespace Microsoft.Dafny
     public bool AllowGlobals = false;
     public bool CountVerificationErrors = true;
     public bool Optimize = false;
-    public bool AutoTriggers = false;
+    public bool AutoTriggers = true;
     public bool RewriteFocalPredicates = true;
     public bool PrintTooltips = false;
     public bool PrintStats = false;
@@ -386,8 +386,8 @@ namespace Microsoft.Dafny
                 1 (default) - If preprocessing succeeds, set exit code to the number of
                               verification errors.
   /autoTriggers:<n>
-                0 (default) - Do not generate {:trigger} annotations for user-level quantifiers.
-                1 - Add a {:trigger} to each user-level quantifier. Existing
+                0 - Do not generate {:trigger} annotations for user-level quantifiers.
+                1 (default) - Add a {:trigger} to each user-level quantifier. Existing
                               annotations are preserved.
   /rewriteFocalPredicates:<n>
                 0 - Don't rewrite predicates in the body of prefix lemmas.
diff --git a/Source/DafnyServer/Utilities.cs b/Source/DafnyServer/Utilities.cs
index 30d779e7..48bea01a 100644
--- a/Source/DafnyServer/Utilities.cs
+++ b/Source/DafnyServer/Utilities.cs
@@ -51,7 +51,7 @@ namespace Microsoft.Dafny {
         DafnyOptions.O.VerifySnapshots = 2; // Use caching
         DafnyOptions.O.VcsCores = Math.Max(1, System.Environment.ProcessorCount / 2); // Don't use too many cores
         DafnyOptions.O.PrintTooltips = true; // Dump tooptips (ErrorLevel.Info) to stdout
-        DafnyOptions.O.UnicodeOutput = true; // Use pretty warning signs
+        //DafnyOptions.O.UnicodeOutput = true; // Use pretty warning signs
         DafnyOptions.O.TraceProofObligations = true; // Show which method is being verified, but don't show duration of verification
       } else {
         throw new ServerException("Invalid command line options");
diff --git a/Test/VSI-Benchmarks/b8.dfy b/Test/VSI-Benchmarks/b8.dfy
index ea1911fe..a44ff5c3 100644
--- a/Test/VSI-Benchmarks/b8.dfy
+++ b/Test/VSI-Benchmarks/b8.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 "%s" > "%t"
+// RUN: %dafny /compile:0 /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // Benchmark 8
diff --git a/Test/VerifyThis2015/Problem3.dfy b/Test/VerifyThis2015/Problem3.dfy
index 21bdd4ed..60506a33 100644
--- a/Test/VerifyThis2015/Problem3.dfy
+++ b/Test/VerifyThis2015/Problem3.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // Rustan Leino
diff --git a/Test/cloudmake/CloudMake-CachedBuilds.dfy b/Test/cloudmake/CloudMake-CachedBuilds.dfy
index 9e1b511e..5f16da90 100644
--- a/Test/cloudmake/CloudMake-CachedBuilds.dfy
+++ b/Test/cloudmake/CloudMake-CachedBuilds.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // This module proves the correctness of the algorithms.  It leaves a number of things undefined.
diff --git a/Test/cloudmake/CloudMake-ConsistentBuilds.dfy b/Test/cloudmake/CloudMake-ConsistentBuilds.dfy
index 6d86607b..c2fa4205 100644
--- a/Test/cloudmake/CloudMake-ConsistentBuilds.dfy
+++ b/Test/cloudmake/CloudMake-ConsistentBuilds.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 /******* State *******/
diff --git a/Test/cloudmake/CloudMake-ParallelBuilds.dfy b/Test/cloudmake/CloudMake-ParallelBuilds.dfy
index 07cae317..5cc70994 100644
--- a/Test/cloudmake/CloudMake-ParallelBuilds.dfy
+++ b/Test/cloudmake/CloudMake-ParallelBuilds.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // This module proves the correctness of the algorithms.  It leaves a number of things undefined.
diff --git a/Test/dafny0/Basics.dfy b/Test/dafny0/Basics.dfy
index 89b0f02a..7b8b632b 100644
--- a/Test/dafny0/Basics.dfy
+++ b/Test/dafny0/Basics.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 class Global {
diff --git a/Test/dafny0/Calculations.dfy b/Test/dafny0/Calculations.dfy
index a7c8e06c..eb4ff1b9 100644
--- a/Test/dafny0/Calculations.dfy
+++ b/Test/dafny0/Calculations.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint.dfy" "%s" > "%t"
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint.dfy" /autoTriggers:0 "%s" > "%t"
 // RUN: %dafny /noVerify /compile:0 "%t.dprint.dfy" >> "%t"
 // RUN: %diff "%s.expect" "%t"
 
diff --git a/Test/dafny0/Compilation.dfy b/Test/dafny0/Compilation.dfy
index 7a443e47..213ace54 100644
--- a/Test/dafny0/Compilation.dfy
+++ b/Test/dafny0/Compilation.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:3 "%s" > "%t"
+// RUN: %dafny /compile:3 /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // The tests in this file are designed to run through the compiler.  They contain
diff --git a/Test/dafny0/ForallCompilation.dfy b/Test/dafny0/ForallCompilation.dfy
index c812983a..4d89f70d 100644
--- a/Test/dafny0/ForallCompilation.dfy
+++ b/Test/dafny0/ForallCompilation.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:3 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 method Main() {
diff --git a/Test/dafny0/Fuel.dfy b/Test/dafny0/Fuel.dfy
index 6347e134..a768db02 100644
--- a/Test/dafny0/Fuel.dfy
+++ b/Test/dafny0/Fuel.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 module TestModule1 {
diff --git a/Test/dafny0/LetExpr.dfy b/Test/dafny0/LetExpr.dfy
index 000fce53..6a0ca66b 100644
--- a/Test/dafny0/LetExpr.dfy
+++ b/Test/dafny0/LetExpr.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint.dfy" "%s" > "%t"
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint.dfy" /autoTriggers:0 "%s" > "%t"
 // RUN: %dafny /noVerify /compile:0 "%t.dprint.dfy" >> "%t"
 // RUN: %diff "%s.expect" "%t"
 
diff --git a/Test/dafny0/LetExpr.dfy.expect b/Test/dafny0/LetExpr.dfy.expect
index f0f51274..8f365da3 100644
--- a/Test/dafny0/LetExpr.dfy.expect
+++ b/Test/dafny0/LetExpr.dfy.expect
@@ -35,5 +35,6 @@ Execution trace:
     (0,0): anon10_Then
 
 Dafny program verifier finished with 39 verified, 9 errors
+LetExpr.dfy.tmp.dprint.dfy(162,2): Warning: /!\ No terms found to trigger on.
 
 Dafny program verifier finished with 0 verified, 0 errors
diff --git a/Test/dafny0/LhsDuplicates.dfy b/Test/dafny0/LhsDuplicates.dfy
index 6a84c5a5..8a57f6ce 100644
--- a/Test/dafny0/LhsDuplicates.dfy
+++ b/Test/dafny0/LhsDuplicates.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 class MyClass<T> {
diff --git a/Test/dafny0/Parallel.dfy b/Test/dafny0/Parallel.dfy
index 93a16475..00a1514c 100644
--- a/Test/dafny0/Parallel.dfy
+++ b/Test/dafny0/Parallel.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /print:"%t.print" /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 class C {
diff --git a/Test/dafny0/SmallTests.dfy.expect b/Test/dafny0/SmallTests.dfy.expect
index 6161c3dd..746e978a 100644
--- a/Test/dafny0/SmallTests.dfy.expect
+++ b/Test/dafny0/SmallTests.dfy.expect
@@ -197,5 +197,6 @@ Execution trace:
     (0,0): anon0
 
 Dafny program verifier finished with 104 verified, 35 errors
+SmallTests.dfy.tmp.dprint.dfy(369,4): Warning: /!\ No trigger covering all quantified variables found.
 
 Dafny program verifier finished with 0 verified, 0 errors
diff --git a/Test/dafny1/MoreInduction.dfy b/Test/dafny1/MoreInduction.dfy
index bd654db5..2b5187a4 100644
--- a/Test/dafny1/MoreInduction.dfy
+++ b/Test/dafny1/MoreInduction.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 datatype List<X> = Nil | Cons(Node<X>, List<X>)
diff --git a/Test/dafny1/SchorrWaite-stages.dfy b/Test/dafny1/SchorrWaite-stages.dfy
index 0eaed68c..a6e5e3aa 100644
--- a/Test/dafny1/SchorrWaite-stages.dfy
+++ b/Test/dafny1/SchorrWaite-stages.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // Schorr-Waite algorithms, written and verified in Dafny.
diff --git a/Test/dafny1/SchorrWaite.dfy b/Test/dafny1/SchorrWaite.dfy
index 50210eb1..b0877f9f 100644
--- a/Test/dafny1/SchorrWaite.dfy
+++ b/Test/dafny1/SchorrWaite.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // Rustan Leino
diff --git a/Test/dafny1/Substitution.dfy b/Test/dafny1/Substitution.dfy
index da64d004..b9c83aff 100644
--- a/Test/dafny1/Substitution.dfy
+++ b/Test/dafny1/Substitution.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 datatype List = Nil | Cons(Expr, List)
diff --git a/Test/dafny1/UltraFilter.dfy b/Test/dafny1/UltraFilter.dfy
index a32e6e0b..7ac4e749 100644
--- a/Test/dafny1/UltraFilter.dfy
+++ b/Test/dafny1/UltraFilter.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // ultra filter
diff --git a/Test/dafny2/SnapshotableTrees.dfy b/Test/dafny2/SnapshotableTrees.dfy
index 2bdfb83b..033c5db0 100644
--- a/Test/dafny2/SnapshotableTrees.dfy
+++ b/Test/dafny2/SnapshotableTrees.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:2 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:2 /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // Rustan Leino, September 2011.
diff --git a/Test/dafny3/Filter.dfy b/Test/dafny3/Filter.dfy
index 4f8b35ec..7473a580 100644
--- a/Test/dafny3/Filter.dfy
+++ b/Test/dafny3/Filter.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 codatatype Stream<T> = Cons(head: T, tail: Stream)
diff --git a/Test/dafny4/GHC-MergeSort.dfy b/Test/dafny4/GHC-MergeSort.dfy
index 976b8a27..24903d87 100644
--- a/Test/dafny4/GHC-MergeSort.dfy
+++ b/Test/dafny4/GHC-MergeSort.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // Rustan Leino
diff --git a/Test/dafny4/NumberRepresentations.dfy b/Test/dafny4/NumberRepresentations.dfy
index 0d6cffa1..c15f4987 100644
--- a/Test/dafny4/NumberRepresentations.dfy
+++ b/Test/dafny4/NumberRepresentations.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 // We consider a number representation that consists of a sequence of digits.  The least
diff --git a/Test/dafny4/Primes.dfy b/Test/dafny4/Primes.dfy
index fd64b45e..0c2a64dd 100644
--- a/Test/dafny4/Primes.dfy
+++ b/Test/dafny4/Primes.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /dprint:"%t.dprint" "%s" > "%t"
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 predicate IsPrime(n: int)
diff --git a/Test/server/simple-session.transcript.expect b/Test/server/simple-session.transcript.expect
index 1aadca7f..a5f841bc 100644
--- a/Test/server/simple-session.transcript.expect
+++ b/Test/server/simple-session.transcript.expect
@@ -346,6 +346,7 @@ transcript(10,27): Error: invalid UnaryExpression
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,9): Warning: /!\ No terms found to trigger on.
 
 Verifying CheckWellformed$$_module.__default.A ...
 Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
@@ -366,6 +367,7 @@ Execution trace:
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,9): Warning: /!\ No terms found to trigger on.
 
 Verifying CheckWellformed$$_module.__default.A ...
 Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
@@ -383,6 +385,7 @@ Verifying Impl$$_module.__default.M_k ...
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,9): Warning: /!\ No terms found to trigger on.
 
 Verifying CheckWellformed$$_module.__default.A ...
 Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
@@ -406,6 +409,7 @@ transcript(12,0): Error: invalid UpdateStmt
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,9): Warning: /!\ No terms found to trigger on.
 
 Verifying CheckWellformed$$_module.__default.A ...
 Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
@@ -423,6 +427,7 @@ Verifying Impl$$_module.__default.M_k ...
 Verification completed successfully!
 [SUCCESS] [[DAFNY-SERVER: EOM]]
 transcript(5,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,9): Warning: /!\ No terms found to trigger on.
 
 Verifying CheckWellformed$$_module.__default.A ...
 Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
@@ -498,6 +503,10 @@ transcript(5,0): Warning: module-level methods are always non-instance, so the '
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,9): Warning: /!\ No terms found to trigger on.
+transcript(20,9): Warning: /!\ No terms found to trigger on.
+transcript(29,9): Warning: /!\ No terms found to trigger on.
+transcript(38,9): Warning: /!\ No terms found to trigger on.
 
 Verifying CheckWellformed$$_module.__default.A ...
 Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
@@ -538,6 +547,10 @@ transcript(5,0): Warning: module-level methods are always non-instance, so the '
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,9): Warning: /!\ No terms found to trigger on.
+transcript(20,9): Warning: /!\ No terms found to trigger on.
+transcript(29,9): Warning: /!\ No terms found to trigger on.
+transcript(38,9): Warning: /!\ No terms found to trigger on.
 
 Verifying CheckWellformed$$_module.__default.A ...
 Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
@@ -584,6 +597,10 @@ transcript(5,0): Warning: module-level methods are always non-instance, so the '
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,9): Warning: /!\ No terms found to trigger on.
+transcript(20,9): Warning: /!\ No terms found to trigger on.
+transcript(29,9): Warning: /!\ No terms found to trigger on.
+transcript(38,9): Warning: /!\ No terms found to trigger on.
 
 Verifying CheckWellformed$$_module.__default.A ...
 Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
@@ -638,6 +655,10 @@ transcript(5,0): Warning: module-level methods are always non-instance, so the '
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,9): Warning: /!\ No terms found to trigger on.
+transcript(20,9): Warning: /!\ No terms found to trigger on.
+transcript(29,9): Warning: /!\ No terms found to trigger on.
+transcript(38,9): Warning: /!\ No terms found to trigger on.
 
 Verifying CheckWellformed$$_module.__default.A ...
 Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
@@ -685,6 +706,10 @@ transcript(5,0): Warning: module-level methods are always non-instance, so the '
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,9): Warning: /!\ No terms found to trigger on.
+transcript(20,9): Warning: /!\ No terms found to trigger on.
+transcript(29,9): Warning: /!\ No terms found to trigger on.
+transcript(38,9): Warning: /!\ No terms found to trigger on.
 
 Verifying CheckWellformed$$_module.__default.A ...
 Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
@@ -729,6 +754,10 @@ transcript(5,0): Warning: module-level methods are always non-instance, so the '
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,9): Warning: /!\ No terms found to trigger on.
+transcript(20,9): Warning: /!\ No terms found to trigger on.
+transcript(29,9): Warning: /!\ No terms found to trigger on.
+transcript(38,9): Warning: /!\ No terms found to trigger on.
 
 Verifying CheckWellformed$$_module.__default.A ...
 Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
@@ -796,6 +825,10 @@ transcript(5,0): Warning: module-level methods are always non-instance, so the '
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,9): Warning: /!\ No terms found to trigger on.
+transcript(20,9): Warning: /!\ No terms found to trigger on.
+transcript(29,9): Warning: /!\ No terms found to trigger on.
+transcript(38,9): Warning: /!\ No terms found to trigger on.
 
 Verifying CheckWellformed$$_module.__default.A ...
 Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
@@ -861,6 +894,10 @@ transcript(5,0): Warning: module-level methods are always non-instance, so the '
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,9): Warning: /!\ No terms found to trigger on.
+transcript(20,9): Warning: /!\ No terms found to trigger on.
+transcript(29,9): Warning: /!\ No terms found to trigger on.
+transcript(38,9): Warning: /!\ No terms found to trigger on.
 
 Verifying CheckWellformed$$_module.__default.A ...
 Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
@@ -905,6 +942,10 @@ transcript(5,0): Warning: module-level methods are always non-instance, so the '
 transcript(15,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(24,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
 transcript(33,0): Warning: module-level methods are always non-instance, so the 'static' keyword is not allowed here
+transcript(10,9): Warning: /!\ No terms found to trigger on.
+transcript(20,9): Warning: /!\ No terms found to trigger on.
+transcript(29,9): Warning: /!\ No terms found to trigger on.
+transcript(38,9): Warning: /!\ No terms found to trigger on.
 
 Verifying CheckWellformed$$_module.__default.A ...
 Retrieving cached verification result for implementation CheckWellformed$$_module.__default.A...
diff --git a/Test/vstte2012/BreadthFirstSearch.dfy b/Test/vstte2012/BreadthFirstSearch.dfy
index b111a438..375f4a09 100644
--- a/Test/vstte2012/BreadthFirstSearch.dfy
+++ b/Test/vstte2012/BreadthFirstSearch.dfy
@@ -1,4 +1,4 @@
-// RUN: %dafny /compile:0 /dprint:"%t.dprint" /vcsMaxKeepGoingSplits:10 "%s" > "%t"
+// RUN: %dafny /compile:0 /dprint:"%t.dprint" /vcsMaxKeepGoingSplits:10 /autoTriggers:0 "%s" > "%t"
 // RUN: %diff "%s.expect" "%t"
 
 class BreadthFirstSearch<Vertex(==)>
-- 
cgit v1.2.3


From 62eb04905d6dcb3ab0b6d7cbf1051c97fec01474 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Mon, 28 Mar 2016 14:51:00 -0700
Subject: Allow users to annontate a method as main with {:main} attribute.
 It’s an error if more than one method is so annotated. For that method, the
 usual restrictions for "main" apply, but it is allowed to take ghost
 arguments, and it is allowed to have preconditions.  This lets the programmer
 add some explicit assumptions about the outside world, modeled, for example,
 via ghost parameters.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 Source/Dafny/Compiler.cs | 73 +++++++++++++++++++++++++++++++++++-------------
 1 file changed, 53 insertions(+), 20 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index d6b2d9ba..8af2cb24 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -757,34 +757,63 @@ namespace Microsoft.Dafny {
     }
 
     public bool HasMain(Program program) {
+      Method mainMethod = null;
+      bool hasMain = false;
       foreach (var module in program.Modules) {
+        if (module.IsAbstract) {
+          // the purpose of an abstract module is to skip compilation
+          continue;
+        }
         foreach (var decl in module.TopLevelDecls) {
           var c = decl as ClassDecl;
           if (c != null) {
             foreach (var member in c.Members) {
               var m = member as Method;
               if (m != null && IsMain(m)) {
-                  return true;
+                if (mainMethod == null) {
+                  mainMethod = m;
+                  hasMain = true;
+                } else {
+                  // more than one main in the program
+                  ErrorWriter.WriteLine("More than one method is declared as \"main\"");
+                  ErrorCount++;
+                  hasMain = false;
+                }
               }
             }
           }
         }
       }
-      return false;
+      return hasMain;
     }
 
     public static bool IsMain(Method m) {
       // In order to be a legal Main() method, the following must be true:
-      //    The method takes no parameters 
+      //    The method takes no parameters
       //    The method is not a ghost method 
       //    The method has no requires clause 
       //    The method has no modifies clause 
       //    If the method is an instance (that is, non-static) method in a class, then the enclosing class must not declare any constructor
-      if (!m.IsGhost && m.Name == "Main" && m.TypeArgs.Count == 0 && m.Ins.Count == 0 && m.Outs.Count == 0 && m.Req.Count == 0 
+      // Or if a method is annotated with {:main} and the above restrictions apply, except it is allowed to take ghost arguments, 
+      //    and it is allowed to have preconditions.  This lets the programmer add some explicit assumptions about the outside world, 
+      //    modeled, for example, via ghost parameters.
+      if (!m.IsGhost && m.Name == "Main" && m.TypeArgs.Count == 0 && m.Ins.Count == 0 && m.Outs.Count == 0 && m.Req.Count == 0
             && m.Mod.Expressions.Count == 0 && (m.IsStatic || (((ClassDecl)m.EnclosingClass) == null) || !((ClassDecl)m.EnclosingClass).HasConstructor)) {
         return true;
-      }
-      else {
+      } else if (Attributes.Contains(m.Attributes, "main") && !m.IsGhost && m.TypeArgs.Count == 0 && m.Outs.Count == 0
+            && m.Mod.Expressions.Count == 0 && (m.IsStatic || (((ClassDecl)m.EnclosingClass) == null) || !((ClassDecl)m.EnclosingClass).HasConstructor)) {
+        if (m.Ins.Count == 0) {
+          return true;
+        } else {
+          bool isGhost = true;
+          foreach (var arg in m.Ins) {
+            if (!arg.IsGhost) {
+              isGhost = false;
+            }
+          }
+          return isGhost;
+        }
+      } else {
         return false;
       }
     }
@@ -951,24 +980,28 @@ namespace Microsoft.Dafny {
       Indent(indent, wr); wr.WriteLine("}");
 
       // allow the Main method to be an instance method
-      if (!m.IsStatic && IsMain(m)) {
+      if (IsMain(m) && (!m.IsStatic || m.CompileName != "Main")) {
         Indent(indent, wr);
         wr.WriteLine("public static void Main(string[] args) {");
-        Contract.Assert(m.EnclosingClass == c);
-        Indent(indent + IndentAmount, wr);
-        wr.Write("@{0} b = new @{0}", c.CompileName);
-        if (c.TypeArgs.Count != 0) {
-          // instantiate every parameter, it doesn't particularly matter how
-          wr.Write("<");
-          string sep = "";
-          for (int i = 0; i < c.TypeArgs.Count; i++) {
-            wr.Write("{0}int", sep);
-            sep = ", ";
+        if (!m.IsStatic) {
+          Contract.Assert(m.EnclosingClass == c);
+          Indent(indent + IndentAmount, wr);
+          wr.Write("@{0} b = new @{0}", c.CompileName);
+          if (c.TypeArgs.Count != 0) {
+            // instantiate every parameter, it doesn't particularly matter how
+            wr.Write("<");
+            string sep = "";
+            for (int i = 0; i < c.TypeArgs.Count; i++) {
+              wr.Write("{0}int", sep);
+              sep = ", ";
+            }
+            wr.Write(">");
           }
-          wr.Write(">");
+          wr.WriteLine("();");
+          Indent(indent + IndentAmount, wr); wr.WriteLine("b.@{0}();", m.CompileName);
+        } else {
+          Indent(indent + IndentAmount, wr); wr.WriteLine("@{0}();", m.CompileName);
         }
-        wr.WriteLine("();");
-        Indent(indent + IndentAmount, wr); wr.WriteLine("b.@Main();");
         Indent(indent, wr); wr.WriteLine("}");
       }
     }
-- 
cgit v1.2.3


From 31ec9bc299901a1a85abbd091c3293af00354030 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Thu, 31 Mar 2016 09:10:34 -0700
Subject: Fix issue 75. Adjust the fuel for existentials to use more fuel in an
 assume context and less in an assert.

---
 Source/Dafny/DafnyAst.cs     |  37 ++++++++++-
 Source/Dafny/Resolver.cs     |   1 +
 Source/Dafny/Translator.cs   | 151 +++++++++++++++++++++++--------------------
 Test/dafny4/Bug75.dfy        |  50 ++++++++++++++
 Test/dafny4/Bug75.dfy.expect |   2 +
 5 files changed, 169 insertions(+), 72 deletions(-)
 create mode 100644 Test/dafny4/Bug75.dfy
 create mode 100644 Test/dafny4/Bug75.dfy.expect

(limited to 'Source')

diff --git a/Source/Dafny/DafnyAst.cs b/Source/Dafny/DafnyAst.cs
index 0e4c4751..ab1a411a 100644
--- a/Source/Dafny/DafnyAst.cs
+++ b/Source/Dafny/DafnyAst.cs
@@ -2375,6 +2375,7 @@ namespace Microsoft.Dafny {
     bool MustReverify { get; }
     string FullSanitizedName { get; }
     bool AllowsNontermination { get; }
+    bool ContainsQuantifier { get;  set; }
   }
   /// <summary>
   /// An ICallable is a Function, Method, IteratorDecl, or RedirectingTypeDecl.
@@ -2392,6 +2393,7 @@ namespace Microsoft.Dafny {
     /// </summary>
     bool InferredDecreases { get; set; }
   }
+
   public class DontUseICallable : ICallable
   {
     public string WhatKind { get { throw new cce.UnreachableException(); } }
@@ -2409,6 +2411,10 @@ namespace Microsoft.Dafny {
       get { throw new cce.UnreachableException(); }
       set { throw new cce.UnreachableException(); }
     }
+    public bool ContainsQuantifier {
+      get { throw new cce.UnreachableException(); }
+      set { throw new cce.UnreachableException(); }
+    }
   }
   /// <summary>
   /// An IMethodCodeContext is a Method or IteratorDecl.
@@ -2437,6 +2443,11 @@ namespace Microsoft.Dafny {
     bool ICodeContext.MustReverify { get { Contract.Assume(false, "should not be called on NoContext"); throw new cce.UnreachableException(); } }
     public string FullSanitizedName { get { Contract.Assume(false, "should not be called on NoContext"); throw new cce.UnreachableException(); } }
     public bool AllowsNontermination { get { Contract.Assume(false, "should not be called on NoContext"); throw new cce.UnreachableException(); } }
+    public bool ContainsQuantifier { 
+      get { Contract.Assume(false, "should not be called on NoContext"); throw new cce.UnreachableException(); }
+      set { Contract.Assume(false, "should not be called on NoContext"); throw new cce.UnreachableException(); }
+    }
+    
   }
 
   public class IteratorDecl : ClassDecl, IMethodCodeContext
@@ -2464,6 +2475,8 @@ namespace Microsoft.Dafny {
     public Predicate Member_Valid;  // created during registration phase of resolution; its specification is filled in during resolution
     public Method Member_MoveNext;  // created during registration phase of resolution; its specification is filled in during resolution
     public readonly LocalVariable YieldCountVariable;
+    bool containsQuantifier;
+
     public IteratorDecl(IToken tok, string name, ModuleDefinition module, List<TypeParameter> typeArgs,
                         List<Formal> ins, List<Formal> outs,
                         Specification<FrameExpression> reads, Specification<FrameExpression> mod, Specification<Expression> decreases,
@@ -2579,6 +2592,10 @@ namespace Microsoft.Dafny {
       set { _inferredDecr = value; }
       get { return _inferredDecr; }
     }
+    bool ICodeContext.ContainsQuantifier {
+      set { containsQuantifier = value; }
+      get { return containsQuantifier; }
+    }
     ModuleDefinition ICodeContext.EnclosingModule { get { return this.Module; } }
     bool ICodeContext.MustReverify { get { return false; } }
     public bool AllowsNontermination {
@@ -2832,7 +2849,10 @@ namespace Microsoft.Dafny {
       get { throw new cce.UnreachableException(); }  // see comment above about ICallable.Decreases
       set { throw new cce.UnreachableException(); }  // see comment above about ICallable.Decreases
     }
-
+    bool ICodeContext.ContainsQuantifier {
+      get { throw new cce.UnreachableException(); }
+      set { throw new cce.UnreachableException(); }
+    }
     public new NewtypeDecl ClonedFrom {
       get {
         return (NewtypeDecl)base.ClonedFrom;
@@ -2890,6 +2910,10 @@ namespace Microsoft.Dafny {
       get { throw new cce.UnreachableException(); }  // see comment above about ICallable.Decreases
       set { throw new cce.UnreachableException(); }  // see comment above about ICallable.Decreases
     }
+    bool ICodeContext.ContainsQuantifier {
+      get { throw new cce.UnreachableException(); }
+      set { throw new cce.UnreachableException(); }
+    }
   }
 
   [ContractClass(typeof(IVariableContracts))]
@@ -3184,6 +3208,11 @@ namespace Microsoft.Dafny {
     public readonly IToken SignatureEllipsis;
     public bool IsBuiltin;
     public Function OverriddenFunction;
+    public bool containsQuantifier;
+    public bool ContainsQuantifier { 
+      set { containsQuantifier = value; }
+      get { return containsQuantifier;  }
+    }
 
     public override IEnumerable<Expression> SubExpressions {
       get {
@@ -3438,6 +3467,7 @@ namespace Microsoft.Dafny {
     public bool IsTailRecursive;  // filled in during resolution
     public readonly ISet<IVariable> AssignedAssumptionVariables = new HashSet<IVariable>();
     public Method OverriddenMethod;
+    public bool containsQuantifier;
 
     public override IEnumerable<Expression> SubExpressions {
       get {
@@ -3512,6 +3542,11 @@ namespace Microsoft.Dafny {
       set { _inferredDecr = value; }
       get { return _inferredDecr; }
     }
+    bool ICodeContext.ContainsQuantifier {
+      set { containsQuantifier = value; }
+      get { return containsQuantifier; }
+    }
+
     ModuleDefinition ICodeContext.EnclosingModule {
       get {
         Contract.Assert(this.EnclosingClass != null);  // this getter is supposed to be called only after signature-resolution is complete
diff --git a/Source/Dafny/Resolver.cs b/Source/Dafny/Resolver.cs
index aa9ce148..b6e783b4 100644
--- a/Source/Dafny/Resolver.cs
+++ b/Source/Dafny/Resolver.cs
@@ -8173,6 +8173,7 @@ namespace Microsoft.Dafny
         e.Type = e.Body.Type;
       } else if (expr is QuantifierExpr) {
         var e = (QuantifierExpr)expr;
+        opts.codeContext.ContainsQuantifier = true;
         Contract.Assert(e.SplitQuantifier == null); // No split quantifiers during resolution
         int prevErrorCount = reporter.Count(ErrorLevel.Error);
         bool _val = true;
diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index 9466f18a..b2b63a07 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -7232,7 +7232,9 @@ namespace Microsoft.Dafny {
           AddComment(builder, stmt, "assume statement");
           AssumeStmt s = (AssumeStmt)stmt;
           TrStmt_CheckWellformed(s.Expr, builder, locals, etran, false);
-          builder.Add(TrAssumeCmd(stmt.Tok, etran.TrExpr(s.Expr), etran.TrAttributes(stmt.Attributes, null)));
+          // we need to increase fuel for quantifier expr and functions that contain quantifier expr in the assume context.
+          var existEtran = etran.LayerOffset(1);
+          builder.Add(TrAssumeCmd(stmt.Tok, etran.TrExpr(s.Expr, null, existEtran, existEtran), etran.TrAttributes(stmt.Attributes, null)));
         }
         this.fuelContext = FuelSetting.PopFuelContext();
       } else if (stmt is PrintStmt) {
@@ -8348,7 +8350,7 @@ namespace Microsoft.Dafny {
             }
             var receiver = new BoogieWrapper(initEtran.TrExpr(Substitute(s0.Receiver, null, substMap, s0.MethodSelect.TypeArgumentSubstitutions())), s0.Receiver.Type);
             var p = Substitute(e, receiver, argsSubstMap, s0.MethodSelect.TypeArgumentSubstitutions());  // substitute the call's actuals for the method's formals
-            qq = callEtran.TrExpr(p, initEtran);
+            qq = callEtran.TrExpr(p, initEtran, null, null);
             exporter.Add(TrAssumeCmd(tok, qq));
           }
         } else {
@@ -8485,7 +8487,7 @@ namespace Microsoft.Dafny {
 
       Dictionary<IVariable, Expression> substMap = new Dictionary<IVariable, Expression>();
       var p = Substitute(s.ForallExpressions[0], null, substMap);
-      Bpl.Expr qq = etran.TrExpr(p, initEtran);
+      Bpl.Expr qq = etran.TrExpr(p, initEtran, null, null);
       if (s.BoundVars.Count != 0) {
         exporter.Add(TrAssumeCmd(s.Tok, qq));
       } else {
@@ -10916,9 +10918,9 @@ namespace Microsoft.Dafny {
       /// then show up in an error message).
       /// </summary>
       public Bpl.Expr TrExpr(Expression expr) {
-        return TrExpr(expr, null);
+        return TrExpr(expr, null, null, null);
       }
-      public Bpl.Expr TrExpr(Expression expr, ExpressionTranslator etran)
+      public Bpl.Expr TrExpr(Expression expr, ExpressionTranslator initEtran, ExpressionTranslator funcEtran, ExpressionTranslator existEtran)
       {
         Contract.Requires(expr != null);
         Contract.Requires(predef != null);
@@ -10982,7 +10984,7 @@ namespace Microsoft.Dafny {
             args.Add(Old.HeapExpr);
           }
           foreach (var arg in e.Args) {
-            args.Add(TrExpr(arg));
+            args.Add(TrExpr(arg, initEtran, funcEtran, existEtran));
           }
           return new Bpl.NAryExpr(e.tok, new Bpl.FunctionCall(id), args);
 
@@ -10990,7 +10992,7 @@ namespace Microsoft.Dafny {
           SetDisplayExpr e = (SetDisplayExpr)expr;
           Bpl.Expr s = translator.FunctionCall(expr.tok, e.Finite ? BuiltinFunction.SetEmpty : BuiltinFunction.ISetEmpty, predef.BoxType);
           foreach (Expression ee in e.Elements) {
-            Bpl.Expr ss = BoxIfNecessary(expr.tok, TrExpr(ee), cce.NonNull(ee.Type));
+            Bpl.Expr ss = BoxIfNecessary(expr.tok, TrExpr(ee, initEtran, funcEtran, existEtran), cce.NonNull(ee.Type));
             s = translator.FunctionCall(expr.tok, e.Finite ? BuiltinFunction.SetUnionOne : BuiltinFunction.ISetUnionOne, predef.BoxType, s, ss);
           }
           return s;
@@ -10999,7 +11001,7 @@ namespace Microsoft.Dafny {
           MultiSetDisplayExpr e = (MultiSetDisplayExpr)expr;
           Bpl.Expr s = translator.FunctionCall(expr.tok, BuiltinFunction.MultiSetEmpty, predef.BoxType);
           foreach (Expression ee in e.Elements) {
-            Bpl.Expr ss = BoxIfNecessary(expr.tok, TrExpr(ee), cce.NonNull(ee.Type));
+            Bpl.Expr ss = BoxIfNecessary(expr.tok, TrExpr(ee, initEtran, funcEtran, existEtran), cce.NonNull(ee.Type));
             s = translator.FunctionCall(expr.tok, BuiltinFunction.MultiSetUnionOne, predef.BoxType, s, ss);
           }
           return s;
@@ -11010,7 +11012,7 @@ namespace Microsoft.Dafny {
           Bpl.Expr s = translator.FunctionCall(expr.tok, BuiltinFunction.SeqEmpty, predef.BoxType);
           bool isLit = true;
           foreach (Expression ee in e.Elements) {
-            var rawElement = TrExpr(ee);
+            var rawElement = TrExpr(ee, initEtran, funcEtran, existEtran);
             isLit = isLit && translator.IsLit(rawElement);
             Bpl.Expr elt = BoxIfNecessary(expr.tok, rawElement, ee.Type);
             s = translator.FunctionCall(expr.tok, BuiltinFunction.SeqBuild, predef.BoxType, s, elt);
@@ -11026,8 +11028,8 @@ namespace Microsoft.Dafny {
           Bpl.Type maptype = predef.MapType(expr.tok, e.Finite, predef.BoxType, predef.BoxType);
           Bpl.Expr s = translator.FunctionCall(expr.tok, e.Finite ? BuiltinFunction.MapEmpty : BuiltinFunction.IMapEmpty, predef.BoxType);
           foreach (ExpressionPair p in e.Elements) {
-            Bpl.Expr elt = BoxIfNecessary(expr.tok, TrExpr(p.A), cce.NonNull(p.A.Type));
-            Bpl.Expr elt2 = BoxIfNecessary(expr.tok, TrExpr(p.B), cce.NonNull(p.B.Type));
+            Bpl.Expr elt = BoxIfNecessary(expr.tok, TrExpr(p.A, initEtran, funcEtran, existEtran), cce.NonNull(p.A.Type));
+            Bpl.Expr elt2 = BoxIfNecessary(expr.tok, TrExpr(p.B, initEtran, funcEtran, existEtran), cce.NonNull(p.B.Type));
             s = translator.FunctionCall(expr.tok, e.Finite ? "Map#Build" : "IMap#Build", maptype, s, elt, elt2);
           }
           return s;
@@ -11036,7 +11038,7 @@ namespace Microsoft.Dafny {
           var e = (MemberSelectExpr)expr;
           return e.MemberSelectCase(
             field => {
-              Bpl.Expr obj = TrExpr(e.Obj);
+              Bpl.Expr obj = TrExpr(e.Obj, initEtran, funcEtran, existEtran);
               Bpl.Expr result;
               if (field.IsMutable) {
                 result = ReadHeap(expr.tok, HeapExpr, obj, new Bpl.IdentifierExpr(expr.tok, translator.GetField(field)));
@@ -11063,7 +11065,7 @@ namespace Microsoft.Dafny {
             });
         } else if (expr is SeqSelectExpr) {
           SeqSelectExpr e = (SeqSelectExpr)expr;
-          Bpl.Expr seq = TrExpr(e.Seq);
+          Bpl.Expr seq = TrExpr(e.Seq, initEtran, funcEtran, existEtran);
           var seqType = e.Seq.Type.NormalizeExpand();
           Type elmtType = null;
           Type domainType = null;
@@ -11083,14 +11085,14 @@ namespace Microsoft.Dafny {
           } else { Contract.Assert(false); }
           Bpl.Type elType = translator.TrType(elmtType);
           Bpl.Type dType = translator.TrType(domainType);
-          Bpl.Expr e0 = e.E0 == null ? null : TrExpr(e.E0);
-          Bpl.Expr e1 = e.E1 == null ? null : TrExpr(e.E1);
+          Bpl.Expr e0 = e.E0 == null ? null : TrExpr(e.E0, initEtran, funcEtran, existEtran);
+          Bpl.Expr e1 = e.E1 == null ? null : TrExpr(e.E1, initEtran, funcEtran, existEtran);
           if (e.SelectOne) {
             Contract.Assert(e1 == null);
             Bpl.Expr x;
             if (seqType.IsArrayType) {
               Bpl.Expr fieldName = translator.FunctionCall(expr.tok, BuiltinFunction.IndexField, null, e0);
-              x = ReadHeap(expr.tok, HeapExpr, TrExpr(e.Seq), fieldName);
+              x = ReadHeap(expr.tok, HeapExpr, TrExpr(e.Seq, initEtran, funcEtran, existEtran), fieldName);
             } else if (seqType is SeqType) {
               x = translator.FunctionCall(expr.tok, BuiltinFunction.SeqIndex, predef.BoxType, seq, e0);
             } else if (seqType is MapType) {
@@ -11099,7 +11101,7 @@ namespace Microsoft.Dafny {
               x = translator.FunctionCall(expr.tok, f, predef.MapType(e.tok, finite, predef.BoxType, predef.BoxType), seq);
               x = Bpl.Expr.Select(x, BoxIfNecessary(e.tok, e0, domainType));
             } else if (seqType is MultiSetType) {
-              x = Bpl.Expr.SelectTok(expr.tok, TrExpr(e.Seq), BoxIfNecessary(expr.tok, e0, domainType));
+              x = Bpl.Expr.SelectTok(expr.tok, TrExpr(e.Seq, initEtran, funcEtran, existEtran), BoxIfNecessary(expr.tok, e0, domainType));
             } else { Contract.Assert(false); x = null; }
             if (!ModeledAsBoxType(elmtType) && !(seqType is MultiSetType)) {
               x = translator.FunctionCall(expr.tok, BuiltinFunction.Unbox, elType, x);
@@ -11130,32 +11132,32 @@ namespace Microsoft.Dafny {
           SeqUpdateExpr e = (SeqUpdateExpr)expr;
           if (e.ResolvedUpdateExpr != null)
           {
-            return TrExpr(e.ResolvedUpdateExpr);
+            return TrExpr(e.ResolvedUpdateExpr, initEtran, funcEtran, existEtran);
           }
           else
           {
-            Bpl.Expr seq = TrExpr(e.Seq);
+            Bpl.Expr seq = TrExpr(e.Seq, initEtran, funcEtran, existEtran);
             var seqType = e.Seq.Type.NormalizeExpand();
             if (seqType is SeqType)
             {
               Type elmtType = cce.NonNull((SeqType)seqType).Arg;
-              Bpl.Expr index = TrExpr(e.Index);
-              Bpl.Expr val = BoxIfNecessary(expr.tok, TrExpr(e.Value), elmtType);
+              Bpl.Expr index = TrExpr(e.Index, initEtran, funcEtran, existEtran);
+              Bpl.Expr val = BoxIfNecessary(expr.tok, TrExpr(e.Value, initEtran, funcEtran, existEtran), elmtType);
               return translator.FunctionCall(expr.tok, BuiltinFunction.SeqUpdate, predef.BoxType, seq, index, val);
             }
             else if (seqType is MapType)
             {
               MapType mt = (MapType)seqType;
               Bpl.Type maptype = predef.MapType(expr.tok, mt.Finite, predef.BoxType, predef.BoxType);
-              Bpl.Expr index = BoxIfNecessary(expr.tok, TrExpr(e.Index), mt.Domain);
-              Bpl.Expr val = BoxIfNecessary(expr.tok, TrExpr(e.Value), mt.Range);
+              Bpl.Expr index = BoxIfNecessary(expr.tok, TrExpr(e.Index, initEtran, funcEtran, existEtran), mt.Domain);
+              Bpl.Expr val = BoxIfNecessary(expr.tok, TrExpr(e.Value, initEtran, funcEtran, existEtran), mt.Range);
               return translator.FunctionCall(expr.tok, mt.Finite ? "Map#Build" : "IMap#Build", maptype, seq, index, val);
             }
             else if (seqType is MultiSetType)
             {
               Type elmtType = cce.NonNull((MultiSetType)seqType).Arg;
-              Bpl.Expr index = BoxIfNecessary(expr.tok, TrExpr(e.Index), elmtType);
-              Bpl.Expr val = TrExpr(e.Value);
+              Bpl.Expr index = BoxIfNecessary(expr.tok, TrExpr(e.Index, initEtran, funcEtran, existEtran), elmtType);
+              Bpl.Expr val = TrExpr(e.Value, initEtran, funcEtran, existEtran);
               return Bpl.Expr.StoreTok(expr.tok, seq, index, val);
             }
             else
@@ -11171,7 +11173,7 @@ namespace Microsoft.Dafny {
           Bpl.Type elType = translator.TrType(elmtType);
 
           Bpl.Expr fieldName = GetArrayIndexFieldName(expr.tok, e.Indices);
-          Bpl.Expr x = ReadHeap(expr.tok, HeapExpr, TrExpr(e.Array), fieldName);
+          Bpl.Expr x = ReadHeap(expr.tok, HeapExpr, TrExpr(e.Array, initEtran, funcEtran, existEtran), fieldName);
           if (!ModeledAsBoxType(elmtType)) {
             x = translator.FunctionCall(expr.tok, BuiltinFunction.Unbox, elType, x);
           }
@@ -11195,30 +11197,34 @@ namespace Microsoft.Dafny {
                 Function = fn,
                 Type = e.Type,
                 TypeArgumentSubstitutions = Util.Dict(GetTypeParams(fn), mem.TypeApplication)
-              });
+              }, initEtran, funcEtran, existEtran);
             }
           }
 
-          Func<Expression, Bpl.Expr> TrArg = arg => translator.BoxIfUnboxed(TrExpr(arg), arg.Type);
+          Func<Expression, Bpl.Expr> TrArg = arg => translator.BoxIfUnboxed(TrExpr(arg, initEtran, funcEtran, existEtran), arg.Type);
 
           var applied = translator.FunctionCall(expr.tok, translator.Apply(arity), predef.BoxType,
             Concat(Map(tt.TypeArgs,translator.TypeToTy),
-            Cons(TrExpr(e.Function), Cons(HeapExpr, e.Args.ConvertAll(arg => TrArg(arg))))));
+            Cons(TrExpr(e.Function, initEtran, funcEtran, existEtran), Cons(HeapExpr, e.Args.ConvertAll(arg => TrArg(arg))))));
 
           return translator.UnboxIfBoxed(applied, tt.Result);
 
         } else if (expr is FunctionCallExpr) {
           FunctionCallExpr e = (FunctionCallExpr)expr;
           Bpl.Expr layerArgument;
+          var etran = this;
+          if (e.Function.ContainsQuantifier && funcEtran != null) {
+            etran = funcEtran;
+          } 
           if (e.Function.IsFuelAware()) {
             Statistics_CustomLayerFunctionCount++;
             ModuleDefinition module = e.Function.EnclosingClass.Module;
-            if (this.applyLimited_CurrentFunction != null &&
-              this.layerIntraCluster != null &&
+            if (etran.applyLimited_CurrentFunction != null &&
+              etran.layerIntraCluster != null &&
               ModuleDefinition.InSameSCC(e.Function, applyLimited_CurrentFunction)) {
-              layerArgument = this.layerIntraCluster.GetFunctionFuel(e.Function);
+              layerArgument = etran.layerIntraCluster.GetFunctionFuel(e.Function);
             } else {
-              layerArgument = this.layerInterCluster.GetFunctionFuel(e.Function);
+              layerArgument = etran.layerInterCluster.GetFunctionFuel(e.Function);
             }
           } else {
             layerArgument = null;
@@ -11253,7 +11259,7 @@ namespace Microsoft.Dafny {
           for (int i = 0; i < dtv.Arguments.Count; i++) {
             Expression arg = dtv.Arguments[i];
             Type t = dtv.Ctor.Formals[i].Type;
-            var bArg = TrExpr(arg);
+            var bArg = TrExpr(arg, initEtran, funcEtran, existEtran);
             argsAreLit = argsAreLit && translator.IsLit(bArg);
             args.Add(translator.CondApplyBox(expr.tok, bArg, cce.NonNull(arg.Type), t));
           }
@@ -11266,7 +11272,7 @@ namespace Microsoft.Dafny {
           return ret;
         } else if (expr is OldExpr) {
           OldExpr e = (OldExpr)expr;
-          return Old.TrExpr(e.E);
+          return Old.TrExpr(e.E, initEtran, funcEtran, existEtran);
 
         } else if (expr is MultiSetFormingExpr) {
           MultiSetFormingExpr e = (MultiSetFormingExpr)expr;
@@ -11281,7 +11287,7 @@ namespace Microsoft.Dafny {
 
         } else if (expr is UnaryOpExpr) {
           var e = (UnaryOpExpr)expr;
-          Bpl.Expr arg = TrExpr(e.E);
+          Bpl.Expr arg = TrExpr(e.E, initEtran, funcEtran, existEtran);
           switch (e.Op) {
             case UnaryOpExpr.Opcode.Lit:
               return MaybeLit(arg);
@@ -11321,8 +11327,8 @@ namespace Microsoft.Dafny {
                 // generate:  (forall $i: int :: 0 <= $i && $i < Seq#Length(X) && Unbox(Seq#Index(X,$i)) != null ==> !old($Heap)[Unbox(Seq#Index(X,$i)),alloc])
                 Bpl.Variable iVar = new Bpl.BoundVariable(expr.tok, new Bpl.TypedIdent(expr.tok, "$i", Bpl.Type.Int));
                 Bpl.Expr i = new Bpl.IdentifierExpr(expr.tok, iVar);
-                Bpl.Expr iBounds = translator.InSeqRange(expr.tok, i, TrExpr(e.E), true, null, false);
-                Bpl.Expr XsubI = translator.FunctionCall(expr.tok, BuiltinFunction.SeqIndex, predef.RefType, TrExpr(e.E), i);
+                Bpl.Expr iBounds = translator.InSeqRange(expr.tok, i, TrExpr(e.E, initEtran, funcEtran, existEtran), true, null, false);
+                Bpl.Expr XsubI = translator.FunctionCall(expr.tok, BuiltinFunction.SeqIndex, predef.RefType, TrExpr(e.E, initEtran, funcEtran, existEtran), i);
                 XsubI = translator.FunctionCall(expr.tok, BuiltinFunction.Unbox, predef.RefType, XsubI);
                 Bpl.Expr oNotFresh = Old.IsAlloced(expr.tok, XsubI);
                 Bpl.Expr oIsFresh = Bpl.Expr.Not(oNotFresh);
@@ -11334,12 +11340,12 @@ namespace Microsoft.Dafny {
                 return new Bpl.ForallExpr(expr.tok, new List<Variable> { iVar }, body);
               } else if (eeType.IsDatatype) {
                 // translator.FunctionCall(e.tok, BuiltinFunction.DtAlloc, null, TrExpr(e.E), Old.HeapExpr);
-                Bpl.Expr alloc = translator.MkIsAlloc(TrExpr(e.E), eeType, Old.HeapExpr);
+                Bpl.Expr alloc = translator.MkIsAlloc(TrExpr(e.E, initEtran, funcEtran, existEtran), eeType, Old.HeapExpr);
                 return Bpl.Expr.Unary(expr.tok, UnaryOperator.Opcode.Not, alloc);
               } else {
                 // generate:  x != null && !old($Heap)[x]
-                Bpl.Expr oNull = Bpl.Expr.Neq(TrExpr(e.E), predef.Null);
-                Bpl.Expr oIsFresh = Bpl.Expr.Not(Old.IsAlloced(expr.tok, TrExpr(e.E)));
+                Bpl.Expr oNull = Bpl.Expr.Neq(TrExpr(e.E, initEtran, funcEtran, existEtran), predef.Null);
+                Bpl.Expr oIsFresh = Bpl.Expr.Not(Old.IsAlloced(expr.tok, TrExpr(e.E, initEtran, funcEtran, existEtran)));
                 return Bpl.Expr.Binary(expr.tok, BinaryOperator.Opcode.And, oNull, oIsFresh);
               }
             default:
@@ -11359,14 +11365,14 @@ namespace Microsoft.Dafny {
             ct = BuiltinFunction.RealToInt;
           } else {
             Contract.Assert(fromInt == toInt);
-            return TrExpr(e.E);
+            return TrExpr(e.E, initEtran, funcEtran, existEtran);
           }
-          return translator.FunctionCall(e.tok, ct, null, TrExpr(e.E));
+          return translator.FunctionCall(e.tok, ct, null, TrExpr(e.E, initEtran, funcEtran, existEtran));
 
         } else if (expr is BinaryExpr) {
           BinaryExpr e = (BinaryExpr)expr;
           bool isReal = e.E0.Type.IsNumericBased(Type.NumericPersuation.Real);
-          Bpl.Expr e0 = TrExpr(e.E0);
+          Bpl.Expr e0 = TrExpr(e.E0, initEtran, funcEtran, existEtran);
           if (e.ResolvedOp == BinaryExpr.ResolvedOpcode.InSet) {
             return TrInSet(expr.tok, e0, e.E1, cce.NonNull(e.E0.Type));  // let TrInSet translate e.E1
           } else if (e.ResolvedOp == BinaryExpr.ResolvedOpcode.NotInSet) {
@@ -11378,7 +11384,7 @@ namespace Microsoft.Dafny {
             Bpl.Expr arg = TrInMultiSet(expr.tok, e0, e.E1, cce.NonNull(e.E0.Type));  // let TrInMultiSet translate e.E1
             return Bpl.Expr.Unary(expr.tok, UnaryOperator.Opcode.Not, arg);
           }
-          Bpl.Expr e1 = TrExpr(e.E1);
+          Bpl.Expr e1 = TrExpr(e.E1, initEtran, funcEtran, existEtran);
           BinaryOperator.Opcode bOpcode;
           Bpl.Type typ;
           var oe0 = e0;
@@ -11695,9 +11701,9 @@ namespace Microsoft.Dafny {
           return re;
         } else if (expr is TernaryExpr) {
           var e = (TernaryExpr)expr;
-          var e0 = TrExpr(e.E0);
-          var e1 = TrExpr(e.E1);
-          var e2 = TrExpr(e.E2);
+          var e0 = TrExpr(e.E0, initEtran, funcEtran, existEtran);
+          var e1 = TrExpr(e.E1, initEtran, funcEtran, existEtran);
+          var e2 = TrExpr(e.E2, initEtran, funcEtran, existEtran);
           switch (e.Op) {
             case TernaryExpr.Opcode.PrefixEqOp:
             case TernaryExpr.Opcode.PrefixNeqOp:
@@ -11717,24 +11723,25 @@ namespace Microsoft.Dafny {
         } else if (expr is LetExpr) {
           var e = (LetExpr)expr;
           if (e.Exact) {
-            return TrExpr(GetSubstitutedBody(e));
+            return TrExpr(GetSubstitutedBody(e), initEtran, funcEtran, existEtran);
           } else {
             var d = translator.LetDesugaring(e);
-            return TrExpr(d);
+            return TrExpr(d, initEtran, funcEtran, existEtran);
           }
         } else if (expr is NamedExpr) {
-          return TrExpr(((NamedExpr)expr).Body);
+          return TrExpr(((NamedExpr)expr).Body, initEtran, funcEtran, existEtran);
         } else if (expr is QuantifierExpr) {
           QuantifierExpr e = (QuantifierExpr)expr;
 
           if (e.SplitQuantifier != null) {
-            return TrExpr(e.SplitQuantifierExpression);
+            return TrExpr(e.SplitQuantifierExpression, initEtran, existEtran, existEtran);
           } else {
             List<Variable> tyvars = translator.MkTyParamBinders(e.TypeArgs);
             List<Variable> bvars = new List<Variable>();
 
-            var initEtran = (etran == null) ? this : etran;
+            var etran = initEtran ?? this;
             var bodyEtran = this;
+            existEtran = e is ForallExpr ? this : existEtran;
             bool _scratch = true;
 
             Bpl.Expr antecedent = Bpl.Expr.True;
@@ -11750,11 +11757,11 @@ namespace Microsoft.Dafny {
               antecedent = BplAnd(new List<Bpl.Expr> {
               antecedent,
               translator.FunctionCall(e.tok, BuiltinFunction.IsGoodHeap, null, h),
-              translator.HeapSameOrSucc(initEtran.HeapExpr, h)
+              translator.HeapSameOrSucc(etran.HeapExpr, h)
             });
             }
 
-            antecedent = BplAnd(antecedent, initEtran.TrBoundVariables(e.BoundVars, bvars));
+            antecedent = BplAnd(antecedent, etran.TrBoundVariables(e.BoundVars, bvars));
 
             Bpl.QKeyValue kv = TrAttributes(e.Attributes, "trigger");
             Bpl.Trigger tr = null;
@@ -11763,15 +11770,15 @@ namespace Microsoft.Dafny {
               if (aa.Name == "trigger") {
                 List<Bpl.Expr> tt = new List<Bpl.Expr>();
                 foreach (var arg in aa.Args) {
-                  tt.Add(argsEtran.TrExpr(arg));
+                  tt.Add(argsEtran.TrExpr(arg, initEtran, existEtran, existEtran));
                 }
                 tr = new Bpl.Trigger(expr.tok, true, tt, tr);
               }
             }
             if (e.Range != null) {
-              antecedent = BplAnd(antecedent, initEtran.TrExpr(e.Range));
+              antecedent = BplAnd(antecedent, etran.TrExpr(e.Range, initEtran, existEtran, existEtran));
             }
-            Bpl.Expr body = bodyEtran.TrExpr(e.Term);
+            Bpl.Expr body = bodyEtran.TrExpr(e.Term, initEtran, existEtran, existEtran);
 
             if (e is ForallExpr) {
               return new Bpl.ForallExpr(expr.tok, new List<TypeVariable>(), Concat(tyvars, bvars), kv, tr, Bpl.Expr.Imp(antecedent, body));
@@ -11790,8 +11797,8 @@ namespace Microsoft.Dafny {
           var yVar = new Bpl.BoundVariable(expr.tok, new Bpl.TypedIdent(expr.tok, translator.CurrentIdGenerator.FreshId("$y#"), predef.BoxType));
           Bpl.Expr y = new Bpl.IdentifierExpr(expr.tok, yVar);
 
-          var eq = Bpl.Expr.Eq(y, BoxIfNecessary(expr.tok, TrExpr(e.Term), e.Term.Type));
-          var ebody = Bpl.Expr.And(BplAnd(typeAntecedent, TrExpr(e.Range)), eq);
+          var eq = Bpl.Expr.Eq(y, BoxIfNecessary(expr.tok, TrExpr(e.Term, initEtran, funcEtran, existEtran), e.Term.Type));
+          var ebody = Bpl.Expr.And(BplAnd(typeAntecedent, TrExpr(e.Range, initEtran, funcEtran, existEtran)), eq);
           var triggers = translator.TrTrigger(this, e.Attributes, e.tok);
           var exst = new Bpl.ExistsExpr(expr.tok, bvars, triggers, ebody);
 
@@ -11818,9 +11825,9 @@ namespace Microsoft.Dafny {
           Dictionary<IVariable, Expression> subst = new Dictionary<IVariable,Expression>();
           subst.Add(e.BoundVars[0], new BoogieWrapper(unboxy,e.BoundVars[0].Type));
 
-          var ebody = BplAnd(typeAntecedent ?? Bpl.Expr.True, TrExpr(translator.Substitute(e.Range, null, subst)));
+          var ebody = BplAnd(typeAntecedent ?? Bpl.Expr.True, TrExpr(translator.Substitute(e.Range, null, subst), initEtran, funcEtran, existEtran));
           Bpl.Expr l1 = new Bpl.LambdaExpr(e.tok, new List<TypeVariable>(), new List<Variable> { yVar }, kv, ebody);
-          ebody = TrExpr(translator.Substitute(e.Term, null, subst));
+          ebody = TrExpr(translator.Substitute(e.Term, null, subst), initEtran, funcEtran, existEtran);
           Bpl.Expr l2 = new Bpl.LambdaExpr(e.tok, new List<TypeVariable>(), new List<Variable> { yVar }, kv, BoxIfNecessary(expr.tok, ebody, e.Term.Type));
 
           bool finite = e.Finite;
@@ -11833,31 +11840,31 @@ namespace Microsoft.Dafny {
 
         } else if (expr is StmtExpr) {
           var e = (StmtExpr)expr;
-          return TrExpr(e.E);
+          return TrExpr(e.E, initEtran, funcEtran, existEtran);
 
         } else if (expr is ITEExpr) {
           ITEExpr e = (ITEExpr)expr;
-          var g = translator.RemoveLit(TrExpr(e.Test));
-          var thn = translator.RemoveLit(TrExpr(e.Thn));
-          var els = translator.RemoveLit(TrExpr(e.Els));
+          var g = translator.RemoveLit(TrExpr(e.Test, initEtran, funcEtran, existEtran));
+          var thn = translator.RemoveLit(TrExpr(e.Thn, initEtran, funcEtran, existEtran));
+          var els = translator.RemoveLit(TrExpr(e.Els, initEtran, funcEtran, existEtran));
           return new NAryExpr(expr.tok, new IfThenElse(expr.tok), new List<Bpl.Expr> { g, thn, els });
 
         } else if (expr is MatchExpr) {
           var e = (MatchExpr)expr;
           var ite = DesugarMatchExpr(e);
-          return TrExpr(ite);
+          return TrExpr(ite, initEtran, funcEtran, existEtran);
 
         } else if (expr is ConcreteSyntaxExpression) {
           var e = (ConcreteSyntaxExpression)expr;
-          return TrExpr(e.ResolvedExpression);
+          return TrExpr(e.ResolvedExpression, initEtran, funcEtran, existEtran);
 
         } else if (expr is BoxingCastExpr) {
           BoxingCastExpr e = (BoxingCastExpr)expr;
-          return translator.CondApplyBox(e.tok, TrExpr(e.E), e.FromType, e.ToType);
+          return translator.CondApplyBox(e.tok, TrExpr(e.E, initEtran, funcEtran, existEtran), e.FromType, e.ToType);
 
         } else if (expr is UnboxingCastExpr) {
           UnboxingCastExpr e = (UnboxingCastExpr)expr;
-          return translator.CondApplyUnbox(e.tok, TrExpr(e.E), e.FromType, e.ToType);
+          return translator.CondApplyUnbox(e.tok, TrExpr(e.E, initEtran, funcEtran, existEtran), e.FromType, e.ToType);
 
         } else {
           Contract.Assert(false); throw new cce.UnreachableException();  // unexpected expression
@@ -13314,8 +13321,10 @@ namespace Microsoft.Dafny {
         translatedExpression = etran.TrExpr(expr);
         splitHappened = false;
       } else {
+        // for quantifierExpr, we don't want to increase fuel in assert context
+        var existEtran = etran;
         etran = etran.LayerOffset(1);
-        translatedExpression = etran.TrExpr(expr);
+        translatedExpression = etran.TrExpr(expr, null, etran, existEtran);
         splitHappened = etran.Statistics_CustomLayerFunctionCount != 0;  // return true if the LayerOffset(1) came into play
       }
       if (TrSplitNeedsTokenAdjustment(expr)) {
diff --git a/Test/dafny4/Bug75.dfy b/Test/dafny4/Bug75.dfy
new file mode 100644
index 00000000..37d35f77
--- /dev/null
+++ b/Test/dafny4/Bug75.dfy
@@ -0,0 +1,50 @@
+// RUN: %dafny /compile:0  "%s" > "%t"
+// RUN: %diff "%s.expect" "%t"
+
+predicate R1(x:int, y:int) { x > 0 ==> R2(x - 1) }
+predicate R2(x:int) { exists y :: R1(x, y) }
+
+lemma L1(x:int)
+{
+    assume R2(x);
+    assert exists y :: R1(x, y); // FAILS
+}
+
+lemma L2(x:int)
+    requires R2(x); // Oddly, adding this requires fixes the problem
+{
+    assume R2(x);
+    assert exists y :: R1(x, y); // SUCCEEDS
+}
+
+// this predicate says that the first "n" elements of "s"
+
+// are in strictly increasing order
+
+predicate method Increasing(s: seq<int>, n: nat)
+  requires n <= |s|
+{
+  n < 2 ||
+  (s[n-2] < s[n-1] && Increasing(s, n-1))
+} 
+
+method Extend(s: seq<int>, n: nat) returns (n': nat)
+  requires n < |s|
+  requires forall i :: 0 <= i < n ==> Increasing(s, i)
+  ensures n <= n' <= |s|
+  ensures forall j :: 0 <= j < n' ==> Increasing(s, j)
+{
+  if 2 <= n && s[n-2] < s[n-1] {
+    n' := n + 1;
+  } else {
+    n' := n;
+  }
+}
+
+function pred(i:int):int { i - 1 }
+predicate f(a:int, s:int)            { (a <= 0 || (exists s0 :: f(pred(a), s0))) }
+
+lemma Fuel1(a:int, s:int)
+{
+    assert  f(a, s) <==> (a <= 0 || (exists s0 :: f(pred(a), s0))); // FAILS
+}
diff --git a/Test/dafny4/Bug75.dfy.expect b/Test/dafny4/Bug75.dfy.expect
new file mode 100644
index 00000000..aeb37948
--- /dev/null
+++ b/Test/dafny4/Bug75.dfy.expect
@@ -0,0 +1,2 @@
+
+Dafny program verifier finished with 13 verified, 0 errors
-- 
cgit v1.2.3


From 8b9126340fb1b5c5c4abe67b940911b675d22c63 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Thu, 31 Mar 2016 10:54:30 -0700
Subject: Fix issue 143. The list that stores the function fuel constants was
 declared as static field and not initialized correctly. Make it an instance
 field instead.

---
 Source/Dafny/Translator.cs | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Translator.cs b/Source/Dafny/Translator.cs
index b2b63a07..99571a8c 100644
--- a/Source/Dafny/Translator.cs
+++ b/Source/Dafny/Translator.cs
@@ -113,7 +113,7 @@ namespace Microsoft.Dafny {
     readonly Dictionary<TopLevelDecl, string>/*!*/ classConstants = new Dictionary<TopLevelDecl, string>();
     readonly Dictionary<int, string> functionConstants = new Dictionary<int, string>();
     readonly Dictionary<Function, string> functionHandles = new Dictionary<Function, string>();
-    readonly static List<FuelConstant> FunctionFuel = new List<FuelConstant>();
+    readonly List<FuelConstant> functionFuel = new List<FuelConstant>();
     readonly Dictionary<Field/*!*/,Bpl.Constant/*!*/>/*!*/ fields = new Dictionary<Field/*!*/,Bpl.Constant/*!*/>();
     readonly Dictionary<Field/*!*/, Bpl.Function/*!*/>/*!*/ fieldFunctions = new Dictionary<Field/*!*/, Bpl.Function/*!*/>();
     readonly Dictionary<string, Bpl.Constant> fieldConstants = new Dictionary<string,Constant>();
@@ -603,7 +603,7 @@ namespace Microsoft.Dafny {
                   Bpl.Constant startFuelAssert = new Bpl.Constant(f.tok, new Bpl.TypedIdent(f.tok, "StartFuelAssert_" + f.FullName, predef.LayerType), false);
                   sink.AddTopLevelDeclaration(startFuelAssert);
                   Bpl.Expr startFuelAssert_expr = new Bpl.IdentifierExpr(f.tok, startFuelAssert);
-                  Translator.FunctionFuel.Add(new FuelConstant(f, baseFuel_expr, startFuel_expr, startFuelAssert_expr));
+                  this.functionFuel.Add(new FuelConstant(f, baseFuel_expr, startFuel_expr, startFuelAssert_expr));
                 }
               }
             }
@@ -2971,9 +2971,11 @@ namespace Microsoft.Dafny {
     }
 
     void InitializeFuelConstant(IToken tok, Bpl.StmtListBuilder builder, ExpressionTranslator etran) {
-      builder.Add(new CommentCmd("initialize fuel constant"));
+      if (this.functionFuel.Count > 0) {
+        builder.Add(new CommentCmd("initialize fuel constant"));
+      }
       FuelContext fuelContext = this.fuelContext;
-      foreach (FuelConstant fuelConstant in Translator.FunctionFuel) {
+      foreach (FuelConstant fuelConstant in this.functionFuel) {
         Function f = fuelConstant.f;
         Bpl.Expr baseFuel = fuelConstant.baseFuel;
         Bpl.Expr startFuel = fuelConstant.startFuel;
@@ -3001,7 +3003,7 @@ namespace Microsoft.Dafny {
       foreach (KeyValuePair<Function, FuelSettingPair> fuel in fuelContext) {
         Function f = fuel.Key;
         FuelSettingPair settings = fuel.Value;
-        FuelConstant fuelConstant = Translator.FunctionFuel.Find(x => x.f == f);
+        FuelConstant fuelConstant = this.functionFuel.Find(x => x.f == f);
         if (fuelConstant != null) {
           Bpl.Expr startFuel = fuelConstant.startFuel;
           Bpl.Expr startFuelAssert = fuelConstant.startFuelAssert;
@@ -10530,7 +10532,7 @@ namespace Microsoft.Dafny {
             setting = FuelAttrib(f, out found);
           }
 
-          FuelConstant fuelConstant = Translator.FunctionFuel.Find(x => x.f == f);
+          FuelConstant fuelConstant = translator.functionFuel.Find(x => x.f == f);
           if (this.amount == (int)FuelAmount.LOW) {
             return GetFunctionFuel(setting.low, found, fuelConstant);
           } else if (this.amount == (int)FuelAmount.HIGH) {
-- 
cgit v1.2.3


From 31b0c4345b02b2314ca92a032ce90fbfdf66d1e8 Mon Sep 17 00:00:00 2001
From: qunyanm <unknown>
Date: Thu, 31 Mar 2016 14:43:46 -0700
Subject: Allow modifies clauses for a "Main" method annotated with {:main}
 attribute.

---
 Source/Dafny/Compiler.cs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/Compiler.cs b/Source/Dafny/Compiler.cs
index 8af2cb24..66765b34 100644
--- a/Source/Dafny/Compiler.cs
+++ b/Source/Dafny/Compiler.cs
@@ -795,13 +795,13 @@ namespace Microsoft.Dafny {
       //    The method has no modifies clause 
       //    If the method is an instance (that is, non-static) method in a class, then the enclosing class must not declare any constructor
       // Or if a method is annotated with {:main} and the above restrictions apply, except it is allowed to take ghost arguments, 
-      //    and it is allowed to have preconditions.  This lets the programmer add some explicit assumptions about the outside world, 
+      //    and it is allowed to have preconditions and modifies.  This lets the programmer add some explicit assumptions about the outside world, 
       //    modeled, for example, via ghost parameters.
       if (!m.IsGhost && m.Name == "Main" && m.TypeArgs.Count == 0 && m.Ins.Count == 0 && m.Outs.Count == 0 && m.Req.Count == 0
             && m.Mod.Expressions.Count == 0 && (m.IsStatic || (((ClassDecl)m.EnclosingClass) == null) || !((ClassDecl)m.EnclosingClass).HasConstructor)) {
         return true;
       } else if (Attributes.Contains(m.Attributes, "main") && !m.IsGhost && m.TypeArgs.Count == 0 && m.Outs.Count == 0
-            && m.Mod.Expressions.Count == 0 && (m.IsStatic || (((ClassDecl)m.EnclosingClass) == null) || !((ClassDecl)m.EnclosingClass).HasConstructor)) {
+            && (m.IsStatic || (((ClassDecl)m.EnclosingClass) == null) || !((ClassDecl)m.EnclosingClass).HasConstructor)) {
         if (m.Ins.Count == 0) {
           return true;
         } else {
-- 
cgit v1.2.3


From df5c5f547990c1f80ab7594a1f9287ee03a61754 Mon Sep 17 00:00:00 2001
From: leino <unknown>
Date: Fri, 1 Apr 2016 15:41:57 -0700
Subject: New version number 1.9.7.30401, for binary release on Codeplex and
 Rise4fun. Changed copyright date to include 2016.

---
 Source/Dafny/DafnyOptions.cs | 2 +-
 Source/version.cs            | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

(limited to 'Source')

diff --git a/Source/Dafny/DafnyOptions.cs b/Source/Dafny/DafnyOptions.cs
index 607090eb..9258503b 100644
--- a/Source/Dafny/DafnyOptions.cs
+++ b/Source/Dafny/DafnyOptions.cs
@@ -28,7 +28,7 @@ namespace Microsoft.Dafny
     }
     public override string VersionSuffix {
       get {
-        return " version " + VersionNumber + ", Copyright (c) 2003-2015, Microsoft.";
+        return " version " + VersionNumber + ", Copyright (c) 2003-2016, Microsoft.";
       }
     }
 
diff --git a/Source/version.cs b/Source/version.cs
index 86b12fed..24de7cec 100644
--- a/Source/version.cs
+++ b/Source/version.cs
@@ -1,4 +1,4 @@
 using System.Reflection;
-// Version 1.9.6, year 2013+2 month 11 day 16
-[assembly: AssemblyVersion("1.9.6.21116")]
-[assembly: AssemblyFileVersion("1.9.6.21116")]
+// Version 1.9.7, year 2013+3 month 04 day 01
+[assembly: AssemblyVersion("1.9.7.30401")]
+[assembly: AssemblyFileVersion("1.9.7.30401")]
-- 
cgit v1.2.3