Closed DavePearce closed 7 years ago
UPDATE: the following does verify:
assert "type invariant not satisfied":
forall(LinkedList list, int distance):
if:
list is Link
list.next is !LinkedList
then:
distance == 0
This gives the following proof:
82. exists(LinkedList list, int distance).((((list is !!Link) && (list.next ()
84. exists(LinkedList list, int distance).(((list is !!Link) && (lis (Simp 82)
83. ((list is !!Link) && (list.next is !!!LinkedList)) && (dista (Exists-E 84)
75. (list is !!Link) && (list.next is !!!LinkedList) (And-E 83)
74. list.next is !!!LinkedList (And-E 75)
63. false (Is-I 74)
Hmmmm, it's almost as though TypeTestClosure
doesn't witness list is !!Link
or something?
Hmmm, ok when it fails the terms are witnessed in this order:
WITNESSING: list.next is !(LinkedList)
WITNESSING: list is !(!(Link))
and when it passes (in both cases above) they are witnessed in this order:
WITNESSING: list is !(!(Link))
WITNESSING: list.next is !(LinkedList)
The problem is that it doesn't retype list
when list.next
is encountered. It only closes over it.
This is closed now though, of course, another bug / problem is exposed.
The following assertion fails:
The unusual thing is that removing the unnecessary term
distance == 0
and it verifies.Proof with
distance == 0
:Proof without
distance == 0
:It looks like
list is !!Link
reduces tofalse
in the latter proof.