-
Notifications
You must be signed in to change notification settings - Fork 285
Class/Trait Invariants #6313
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Class/Trait Invariants #6313
Conversation
TODO: source under SyntaxDeserializer needs to be properly regenerated TODO: tests for parsing and resolving need to be completed
…into feat-invariants
…Expressivity.dfy Co-authored-by: Robin Salkeld <[email protected]>
Co-authored-by: Robin Salkeld <[email protected]>
…dingly - Wellformedness checks simplified, since they do not have to be scoped to an enclosing declaration - VerifyInvariants renamed to CheckInvariants and is automatically checked when a MemberDecl is coerced to an Invariant - Refinement is now implemented, solving issue in InheritedMemberError.dfy - Printing now implemented
…om invariants to be done as a visitor-based check
…f rewriting and axioms
…on, keeping invariant-as-predicate
…ly well-formed after printing
…ack of triggers on type parameters
|
Do we want to mention this as a new feature in the release notes for 4.11.0? |
Absolutely at least add a |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I will comment only the error messages, but otherwise it looks great !
.../IntegrationTests/TestFiles/LitTests/LitTest/invariants/TwoPhaseConstructorsError.dfy.expect
Outdated
Show resolved
Hide resolved
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/InheritedMemberError.dfy.expect
Show resolved
Hide resolved
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/DerivedInvariantOverrideError.dfy
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just some initial comments on the reference manual for now
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/Account.dfy
Show resolved
Hide resolved
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/Account.dfy
Show resolved
Hide resolved
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/Account.dfy
Show resolved
Hide resolved
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/Account.dfy
Outdated
Show resolved
Hide resolved
…ns + feature announcement
… for member assignments
…, removes need for "convenience assumption" of invariants for objects in scope
…ctions/methods by moving it to call graph builder
… method and function calls; going to specialize to open set is always empty
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it would be good to have a performance related test.
Something like:
class HasInvariant {
var valid: boolean
invariant valid
}
class HasNoInvariant {
var valid: boolean
}
method processHasInvariant(h: HasInvariant) {
useInvariant(h);
}
method useInvariant(h: HasInvariant) {
assert h.valid;
}
method processHasNoInvariant(h: HasNoInvariant) {
useHasNoInvariant(h);
}
method useHasNoInvariant(h: HasNoInvariant) {}and then verify that the resource usage of processHasInvariant and processHasNoInvariant are equal: that processHasInvariant is agnostic to the existence of the invariant.
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/Expressivity.dfy
Outdated
Show resolved
Hide resolved
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/Expressivity.dfy
Show resolved
Hide resolved
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/FunctionCallInInvariantError.dfy
Show resolved
Hide resolved
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/FunctionCallInInvariantError.dfy
Show resolved
Hide resolved
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/InheritedMemberError.dfy
Show resolved
Hide resolved
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/InheritedMemberError.dfy
Show resolved
Hide resolved
...IntegrationTests/TestFiles/LitTests/LitTest/invariants/MethodCallInInvariantError.dfy.expect
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Initial comments as I'm not done but it can still help
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/ValidIdiom.dfy
Outdated
Show resolved
Hide resolved
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/TempInvariantBreakingError.dfy
Show resolved
Hide resolved
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/TempInvariantBreaking.dfy_ignore
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Finished commenting
Co-authored-by: Mikaël Mayer <[email protected]>
- Open set is empty everywhere - Invariant is inductive over program transitions and constructors are the initial condition - Consequently, invariants must hold by the end of the first constructor phase - VCs removed to retain performance of non-invariant-utilizing code (see Performance.dfy)
Source/DafnyCore/Verifier/BoogieGenerator.Functions.Wellformedness.cs
Outdated
Show resolved
Hide resolved
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants/Performance.dfy
Outdated
Show resolved
Hide resolved
|
Note for myself: don't delete the branch after merging. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Without a test that proves that code that does not use a type invariant, but does use the type, does not have its verification performance affected by the invariant's existence, I don't think we should merge this.
…ded fix for implicit cycle unsoundness
…able from the invariant
What was changed?
This PR introduces class and trait invariants as described in the updated reference manual (in this PR).
How has this been tested?
Tests in
Source/IntegrationTests/TestFiles/LitTests/LitTest/invariants.By submitting this pull request, I confirm that my contribution is made under the terms of the MIT license.