Ghost Constraint Stabilization#1271
Merged
Aurel300 merged 66 commits intoviperproject:masterfrom Jan 13, 2023
Merged
Conversation
turns out the previous implementation was flawed in that it made the function pure whether or not the constraint held
you can still introduce unsound behavior with them, but they're far from the only way to do so, and absolutely necessary for prusti std
…ng strings & comments
removed a check preventing use of this feature previously; this effectively formalizes it as working
expressions are not implicitly in parentheses, creating very strange errors when desugaring e.g. a + b to &a + b
not thoroughly tested, but let's not let perfect be the enemy of good enough
not thoroughly tested, but let's not let perfect be the enemy of good enough
testing-specific workaround is now only present when cfg(test) is active
Aurel300
reviewed
Jan 5, 2023
Aurel300
reviewed
Jan 5, 2023
Aurel300
reviewed
Jan 5, 2023
Aurel300
reviewed
Jan 5, 2023
Aurel300
reviewed
Jan 5, 2023
Aurel300
reviewed
Jan 5, 2023
prusti-tests/tests/verify_overflow/fail/type-cond-specs/in-non-trusted-function.rs
Outdated
Show resolved
Hide resolved
Aurel300
reviewed
Jan 5, 2023
| // The called method might be a trait method. | ||
| // We try to resolve it to the concrete implementation | ||
| // and type substitutions. | ||
| let query = self.encoder.env().query; |
Member
There was a problem hiding this comment.
Why this alias? It doesn't seem to be used later on.
Contributor
Author
There was a problem hiding this comment.
Without it, the long line spilled over into a silly-looking chained function call spanning like 5 lines, lol. I considered updating the later usage, but that felt worse. Should I just accept the other formatting rather than polluting this long function's namespace?
better no information than inaccurate information!
while preserving the safety of parenthesizing incoming LHS/RHS
the latter didn't work anyway, and now that we have type-cond-specs, we know we won't need it, so we can drop the annotations entirely.
where clauses on traits
we were getting spurious failures for the core proof tests from old data
it's like they were never there! no more use crate::*;
keep the changes to a minimum
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
As part of my thesis under @Aurel300, I've been writing specs for the standard library (#1249), which will ship with Prusti for users to benefit from.
Ghost Constraints → Type-Conditional Spec Refinements
These specs often rely on ghost constraints, e.g. to provide a way to opt out of specs applied by default to certain trait implementations, or to specify known return values for e.g.
core::mem::size_of. Since these specs will be active by default, they would require enabling ghost constraints to use Prusti at all (barring the option of conditionalizing specs on enabled Prusti features somehow). Hence we propose to stabilize ghost constraints, addressing some issues with them to get them to a place where this makes sense.Ghost constraints are now called type-conditional spec refinements (
TypeCondSpecfor short) and spelled as follows:The
wheredraws a clear analogy to existing Rust syntax to help users understand this attribute, and it even results in correct syntax highlighting for the constraints. Note also thatpureis now supported here (correctly—my previous implementation was broken), and that you can apply multiple bounds.Extern Spec Improvements
I also polished up & resolved some limitations with extern specs:
whereclause.#[extern_spec(core::mem)] fn swap(...). This argument also works on traits & modules (impls already allow qualifying involved type paths).Miscellaneous
As part of this PR, I enabled auto-formatting for the
prusti-specscrate, and reformatted it in the process. This crate is one of the last few holdovers that weren't yet auto-formatted, the other big one beingprusti-viper. It looked like this crate is not currently being majorly worked on by anyone else!Finally, I fixed a bug where lifetimes would make trait method resolution fail, by instead erasing all regions involved in the resolution process. This made some tests fail before I reworked the piece of code that encodes lifetimes for function calls. This bug made it impossible to specify e.g.
impl Add<&i32> for i32, because Prusti could not resolve the generalAdd::addto this specific implementation (due to the lifetimes necessarily differing between call site & declaration site).