Open jhaye opened 2 years ago
This is an unfortunate side-effect of how the contracts are encoded in Rust code, it doesn't play super well with inference. Typically @
is the primary cause of issue, if rust doesn't know the type of i
before the invariant expression, it will fail because there multiple types which have a Model
instance with ModelTy = Int
.
Unfortunately, short of better rustc support, there's not much we can do (that I know of at least).
I took a look at the all zero exercise. When adding the following loop invariant
#[invariant(bounds, @i <= (@*v).len())]
whilev
is also referenced in the already existing invariant, I get the following error:Running with
-Z macro-backtrace
isn't very illuminating and interestingly, other invariants like#[invariant(prev_all_zero, forall<j: Int> 0 <= j && j < @i ==> (@v)[j] == 0u32)]
that also usev
do not produce this error.I have tried some variations of the first invariant:
#[invariant(bounds, @i <= (@v).len())]
#[invariant(bounds, @i <= (@^v).len())]
#[invariant(bounds, @i <= @(v.len()))]
They all produce the same outcome.