-
Notifications
You must be signed in to change notification settings - Fork 84
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support for inductively verifying contracts of recursive functions #2809
Support for inductively verifying contracts of recursive functions #2809
Conversation
BTW, I have the following pre-commit hook to avoid all the whitespace issues: #!/usr/bin/env bash
# Copyright Kani Contributors
# SPDX-License-Identifier: Apache-2.0 OR MIT
set -e
# source: https://github.com/awslabs/git-secrets
git secrets --pre_commit_hook -- "$@"
TOP_DIR=$(git rev-parse --show-toplevel)
check_rust_style() {
pushd ${TOP_DIR}
./scripts/kani-fmt.sh --check
cargo clippy --all -- -D warnings
popd
}
check_rust_style |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice! A few comments/questions.
Co-authored-by: Zyad Hassan <88045115+zhassan-aws@users.noreply.github.com>
Hmm, my formatting was wrong even though I ran |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @JustusAdam! It's great to be able to support recursive functions!
Thanks. Yeah I'll do that. |
Co-authored-by: Zyad Hassan <88045115+zhassan-aws@users.noreply.github.com>
This adds support for verifying the contracts of recursive functions inductively.
The idea is quite simple. We use a global variable to track whether we're reentering a function and depending on that value we either continue with checking the contract or assume the hypothesis by using its replacement.
The precise mechanism that I implemented is explained in the documentation here
Resolves #2724
Open Question: to facilitate induction the return type of the function must implement
kani::Arbitrary
. Since we can't discriminate between recursive and non-recursive functions in the proc-macro this means that this applies to all functions with contracts, not just recursive ones. This may be an unacceptable restriction. We could consider making inductive verification explicit with an annotation like#[kani::inductive]
or conversely make inductive the default and let users opt-out with#[kani::no_inductive]
. This is now tracked in #2823I had to remove the names of the functions in which the messages occur in the test cases, since they are now generated, hard to read names
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 and MIT licenses.