StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POStatic verification limitations when using pure functions in C# code contracts?
primarykey
Id
3695627
data
AcceptedAnswerId
3695834
AnswerCount
1
ClosedDate
CommentCount
3
CommunityOwnedDate
CreationDate
2010-09-12T16:33:58.373
FavoriteCount
0
LastActivityDate
2010-09-13T01:11:25.587
LastEditDate
2010-09-12T17:07:16.960
LastEditorUserId
402560
OwnerUserId
402560
ParentId
0
PostTypeId
1
Score
2
ViewCount
905
LastEditorDisplayName
text
Body
I'm trying to statically verify the following partial implementation of an array-based stack with code contracts. The method <code>Pop()</code> uses the pure function <code>IsNotEmpty()</code> to ensure that the subsequent array access will be at/above the lower bound. The static verifier fails and suggests that I add the precondition <code>Contract.Requires(0 <= this.top)</code>. Can anyone explain why the verifier cannot prove the array access is valid with respect to the lower bound given the contract <code>IsNotEmpty()</code>? At first I thought the <code>Contract.Requires(IsNotEmpty())</code> approach might be incorrect because a subclass could override <code>IsNotEmpty()</code>. However, the verifier still can't prove the array access is valid if I mark the class as <code>sealed</code>. Update: If I change <code>IsNotEmpty()</code> to a read-only property, the verification succeeds as expected. This raises the question: how / why are read-only properties and pure functions treated differently? <pre><code>class StackAr<T> { private T[] data; private int capacity; /// <summary> /// the index of the top array element /// </summary> private int top; [ContractInvariantMethod] private void ObjectInvariant() { Contract.Invariant(data != null); Contract.Invariant(top < capacity); Contract.Invariant(top >= -1); Contract.Invariant(capacity == data.Length); } public StackAr(int capacity) { Contract.Requires(capacity > 0); this.capacity = capacity; this.data = new T[capacity]; top = -1; } [Pure] public bool IsNotEmpty() { return 0 <= this.top; } public T Pop() { Contract.Requires(IsNotEmpty()); //CodeContracts: Suggested precondition: //Contract.Requires(0 <= this.top); T element = data[top]; top--; return element; } } </code></pre>
Tags
<c#><code-contracts>
Title
Static verification limitations when using pure functions in C# code contracts?
singulars
PostAcceptedAnswerId
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
PostParentId
1. This table or related slice is empty.
PostTypePostTypeId
1. PTQuestion
UserLastEditorUserId
1. USTodd Schiller
UserOwnerUserId
1. USTodd Schiller
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 POStatic verification limitations when using pure functions in C# code contracts?
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
CommentsPostId

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.