Skip to content

Commit 6993cf4

Browse files
ArenBabikianSaswatPadhi
ArenBabikian
authored and
SaswatPadhi
committed
Add support for quantifiers in loop contracts
1 parent 627d81f commit 6993cf4

File tree

7 files changed

+182
-9
lines changed

7 files changed

+182
-9
lines changed

‎regression/contracts/quantifiers-loop-01/main.c‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
#include <assert.h>
2+
3+
#define N 16
4+
5+
void main()
6+
{
7+
int a[N];
8+
a[10] = 0;
9+
10+
for(int i = 0; i < N; ++i)
11+
// clang-format off
12+
__CPROVER_loop_invariant(
13+
(0 <= i) && (i <= N) &&
14+
__CPROVER_forall {
15+
int k;
16+
// constant bounds for explicit unrolling with SAT backend
17+
(0 <= k && k <= N) ==> (
18+
// the actual symbolic bound for `k`
19+
k < i ==> a[k] == 1
20+
)
21+
}
22+
)
23+
// clang-format on
24+
{
25+
a[i] = 1;
26+
}
27+
28+
assert(a[10] == 1);
29+
}

‎regression/contracts/quantifiers-loop-01/test.desc‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
CORE
2+
main.c
3+
--enforce-all-contracts
4+
^EXIT=0$
5+
^SIGNAL=0$
6+
^\[main.1\] line .* Check loop invariant before entry: SUCCESS
7+
^\[main.2\] line .* Check that loop invariant is preserved: SUCCESS
8+
^\[main.assertion.1\] line .* assertion a\[10\] == 1: SUCCESS
9+
^VERIFICATION SUCCESSFUL$
10+
--
11+
--
12+
This test case checks the handling of a `forall` quantifier within a loop invariant.
13+
14+
This test case uses explicit constant bounds on the quantified variable,
15+
so that it can be unrolled (to conjunctions) with the SAT backend.

‎regression/contracts/quantifiers-loop-02/main.c‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
#include <assert.h>
2+
3+
void main()
4+
{
5+
int N, a[64];
6+
__CPROVER_assume(0 <= N && N < 64);
7+
8+
for(int i = 0; i < N; ++i)
9+
// clang-format off
10+
__CPROVER_loop_invariant(
11+
(0 <= i) && (i <= N) &&
12+
__CPROVER_forall {
13+
int k;
14+
(0 <= k && k < i) ==> a[k] == 1
15+
}
16+
)
17+
// clang-format on
18+
{
19+
a[i] = 1;
20+
}
21+
22+
// clang-format off
23+
assert(__CPROVER_forall {
24+
int k;
25+
(0 <= k && k < N) ==> a[k] == 1
26+
});
27+
// clang-format on
28+
29+
int k;
30+
__CPROVER_assume(0 <= k && k < N);
31+
assert(a[k] == 1);
32+
}

‎regression/contracts/quantifiers-loop-02/test.desc‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
KNOWNBUG smt-backend broken-cprover-smt-backend
2+
main.c
3+
--enforce-all-contracts
4+
^EXIT=0$
5+
^SIGNAL=0$
6+
^\[main.1\] line .* Check loop invariant before entry: SUCCESS
7+
^\[main.2\] line .* Check that loop invariant is preserved: SUCCESS
8+
^\[main.assertion.1\] line .* assertion .*: SUCCESS
9+
^VERIFICATION SUCCESSFUL$
10+
--
11+
--
12+
This test case checks the handling of a universal quantifier, with a symbolic
13+
upper bound, within a loop invariant.
14+
15+
The test is tagged:
16+
- `smt-backend`:
17+
because the SAT backend does not support (simply ignores) `forall` in negative (e.g. assume) contexts.
18+
- `broken-cprover-smt-backend`:
19+
because the CPROVER SMT2 solver cannot handle (errors out on) `forall` in negative (e.g. assume) contexts.
20+
21+
It has been tagged `KNOWNBUG` for now since `contracts` regression tests are not run with SMT backend yet.

‎regression/contracts/quantifiers-loop-03/main.c‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#include <assert.h>
2+
#include <stdlib.h>
3+
4+
#define MAX_SIZE 64
5+
6+
void main()
7+
{
8+
unsigned N;
9+
__CPROVER_assume(N <= MAX_SIZE);
10+
11+
int *a = malloc(N * sizeof(int));
12+
13+
for(int i = 0; i < N; ++i)
14+
// clang-format off
15+
__CPROVER_loop_invariant(
16+
(0 <= i) && (i <= N) &&
17+
(i != 0 ==> __CPROVER_exists {
18+
int k;
19+
// constant bounds for explicit unrolling with SAT backend
20+
(0 <= k && k <= MAX_SIZE) && (
21+
// the actual symbolic bound for `k`
22+
k < i && a[k] == 1
23+
)
24+
})
25+
)
26+
// clang-format on
27+
{
28+
a[i] = 1;
29+
}
30+
31+
// clang-format off
32+
assert(
33+
N != 0 ==> __CPROVER_exists {
34+
int k;
35+
// constant bounds for explicit unrolling with SAT backend
36+
(0 <= k && k <= MAX_SIZE) && (
37+
// the actual symbolic bound for `k`
38+
k < N && a[k] == 1
39+
)
40+
});
41+
// clang-format on
42+
}

‎regression/contracts/quantifiers-loop-03/test.desc‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
CORE
2+
main.c
3+
--enforce-all-contracts
4+
^EXIT=0$
5+
^SIGNAL=0$
6+
^\[main.1\] line .* Check loop invariant before entry: SUCCESS
7+
^\[main.2\] line .* Check that loop invariant is preserved: SUCCESS
8+
^\[main.assertion.1\] line .* assertion .*: SUCCESS
9+
^VERIFICATION SUCCESSFUL$
10+
--
11+
--
12+
This test case checks the handling of an existential quantifier, with a symbolic
13+
upper bound, within a loop invariant.
14+
15+
This test case uses explicit constant bounds on the quantified variable,
16+
so that it can be unrolled (to conjunctions) with the SAT backend.

‎src/goto-instrument/code_contracts.cpp‎

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -114,9 +114,21 @@ void code_contractst::check_apply_invariants(
114114
// build the havocking code
115115
goto_programt havoc_code;
116116

117-
// assert the invariant
118-
{
119-
code_assertt assertion{invariant};
117+
// process quantified variables correctly (introduce a fresh temporary)
118+
// and return a copy of the invariant
119+
const auto &invariant_expr = [&]() {
120+
auto invariant_copy = invariant;
121+
replace_symbolt replace;
122+
code_contractst::add_quantified_variable(invariant_copy, replace, mode);
123+
replace(invariant_copy);
124+
return invariant_copy;
125+
};
126+
127+
// Generate: assert(invariant) just before the loop
128+
// We use a block scope to create a temporary assertion,
129+
// and immediately convert it to goto instructions.
130+
{
131+
code_assertt assertion{invariant_expr()};
120132
assertion.add_source_location() = loop_head->source_location;
121133
converter.goto_convert(assertion, havoc_code, mode);
122134
havoc_code.instructions.back().source_location.set_comment(
@@ -126,10 +138,14 @@ void code_contractst::check_apply_invariants(
126138
// havoc variables being written to
127139
build_havoc_code(loop_head, modifies, havoc_code);
128140

129-
// assume the invariant
130-
code_assumet assumption{invariant};
131-
assumption.add_source_location() = loop_head->source_location;
132-
converter.goto_convert(assumption, havoc_code, mode);
141+
// Generate: assume(invariant) just after havocing
142+
// We use a block scope to create a temporary assumption,
143+
// and immediately convert it to goto instructions.
144+
{
145+
code_assumet assumption{invariant_expr()};
146+
assumption.add_source_location() = loop_head->source_location;
147+
converter.goto_convert(assumption, havoc_code, mode);
148+
}
133149

134150
// non-deterministically skip the loop if it is a do-while loop
135151
if(!loop_head->is_goto())
@@ -143,9 +159,11 @@ void code_contractst::check_apply_invariants(
143159
// Use insert_before_swap to preserve jumps to loop head.
144160
goto_function.body.insert_before_swap(loop_head, havoc_code);
145161

146-
// assert the invariant at the end of the loop body
162+
// Generate: assert(invariant) just after the loop exits
163+
// We use a block scope to create a temporary assertion,
164+
// and immediately convert it to goto instructions.
147165
{
148-
code_assertt assertion{invariant};
166+
code_assertt assertion{invariant_expr()};
149167
assertion.add_source_location() = loop_end->source_location;
150168
converter.goto_convert(assertion, havoc_code, mode);
151169
havoc_code.instructions.back().source_location.set_comment(

0 commit comments

Comments
 (0)