The Whiley Theorem Prover (WyTP) is an automatic and interactive theorem prover designed to discharge verification conditions generated by the Whiley Compiler. WyTP operates over a variant of first-order logic which includes integer arithmetic, arrays and quantification.
type Buffer is ({int[] data} b) where |b.data| > 0
type NonFull is (Buffer b)
assert "division by zero":
forall(NonFull b):
|b.data| != 0
But, replace NonFull by Buffer and it's fine. Clearly it would see the invariant from Buffer are not being passed forward into NonFull b. But, the proof looks like this:
The following fails:
But, replace
NonFull
byBuffer
and it's fine. Clearly it would see the invariant fromBuffer
are not being passed forward intoNonFull b
. But, the proof looks like this:This suggests that the invariant is making its way through the various macro expansions ... ?