1. 16 Apr, 2018 1 commit
  2. 11 Apr, 2018 1 commit
  3. 06 Apr, 2018 1 commit
  4. 21 Mar, 2018 1 commit
    • Guillaume Melquiond's avatar
      Homogenize constructor names. · 6ef0273e
      Guillaume Melquiond authored
      The pattern-matching construct in the logic is now systematically named
      "Tcase" in constructors (Ptree.Tmatch -> Tcase). The one in the
      programs (supporting exceptions) is now systematically named "Ematch"
      (Expr.Ecase -> Ematch, Dexpr.DEcase -> DEmatch). They are now homogeneous
      with the other constructors: Term.Tcase, Dterm.DTcase, Ptree.Ematch,
      Mltree.Ematch. Smart constructor Expr.e_case was renamed accordingly.
      6ef0273e
  5. 20 Mar, 2018 1 commit
  6. 21 Feb, 2018 2 commits
  7. 16 Feb, 2018 2 commits
  8. 14 Feb, 2018 2 commits
  9. 12 Jan, 2018 1 commit
  10. 11 Jan, 2018 1 commit
  11. 24 Dec, 2017 1 commit
  12. 13 Dec, 2017 1 commit
  13. 07 Dec, 2017 2 commits
  14. 22 Nov, 2017 1 commit
  15. 13 Jul, 2017 1 commit
  16. 05 Jul, 2017 1 commit
    • MARCHE Claude's avatar
      ITP: support for qualified ident and infix ident · bccdfacc
      MARCHE Claude authored
      command "search" and transformations taking idents as arguments now can
      support qualified idents and infix symbols.
      
      For example, "search (+) (*)" returns the distributivity axioms
      
      FIXME: "search Int.(+)" fails, probably missing namespaced for
      imported modules
      bccdfacc
  17. 22 Jun, 2017 1 commit
    • Andrei Paskevich's avatar
      WhyML: check type invariants · 15fc3d65
      Andrei Paskevich authored
      Type declarations for records (incuding the private records) can
      now be followed by a "witness": a set of values for the record
      fields that must satisfy the type invariant (if any). The fields
      must be initialized with pure terminating program expressions.
      The current syntax, proposed by Martin, is
      
          type t 'a = { f: ty1; g: ty2 }
            invariant { J[f,g] }
            by { f = e1; g = e2 }
      
      The generated proof obligation is the VC for
      
          let g = e2 in let f = e1 in assert { J[f,g] }
      
      In absence of an explicit witness, an existential proof obligation
      "exists f,g. J[f,g]" is produced.
      15fc3d65
  18. 16 Jun, 2017 2 commits
    • Andrei Paskevich's avatar
      alias specification: reviewed · f23ed837
      Andrei Paskevich authored
      f23ed837
    • Andrei Paskevich's avatar
      WhymL: break and continue · df239061
      Andrei Paskevich authored
      Without an argument, break and continue refer to the innermost loop.
      A label put over an expression sequence starting with a loop, can be
      used as an optional argument for break and continue:
      
        label L in
        [ghost] ["tag"] [M.begin]
          while true do
            ...
            break L
            ...
          done;
          [...]
        [end] [: unit]
      
      In the square brackets are listed the constructions allowed between
      the label declaration and the loop expression.
      df239061
  19. 14 Jun, 2017 1 commit
  20. 13 Jun, 2017 1 commit
    • Andrei Paskevich's avatar
      WhyML: white-box blocks · 516cfd3a
      Andrei Paskevich authored
      Just as abstract blocks, "white-box blocks" are program expressions
      with an additional contract attached to their execution place.
      Contrary to abstract blocks, whiteboxes do not hide their contents
      from the outer computation. In most cases, you would not need
      whiteboxes at all, as the same effect can be achieved by adding
      assertions. Their utility comes from their syntax: the added
      contract clauses bind to the expression and do not require
      additional semicolons, begin-end's, let-in's or try-with's.
      
      Compare:
      
          let x = <expr> in assert { P x }; x
      to  <expr> ensures { P result }
      or  <expr> returns { x -> P x }
      
          if ... then begin let x = <expr> in assert { P x }; x end; ...
      to  if ... then <expr> ensures { P result }; ...
      
          try <expr> with E x -> assert { P x }; raise E x; end
      to  <expr> raises { E x -> P x }
      
      Internally, whiteboxes are just abstract blocks (zero-argument
      anonymous functions executed in-place) with the label "vc:white_box"
      on top. The user never needs to write this label explicitly though.
      516cfd3a
  21. 11 Jun, 2017 2 commits
    • Andrei Paskevich's avatar
      WhyML: tuple terms/expressions do not require parentheses · a1e032f6
      Andrei Paskevich authored
      This makes the syntax cleaner and brings us closer to OCaml.
      
      One incompatibility with the previous grammar is that "ghost"
      binds stronger than the left arrow of assignment, and thus
      ghost assignments have to be written as "ghost (x.f <- v)".
      
      This is unavoidable, because assignment has to be weaker than
      the tuple comma (think "x.f, y.g <- y.g, x.f" or "a[i] <- u,v"),
      and "ghost" has to be stronger than comma, for consistency with
      our patterns and our return types.
      
      The "return" construction is weaker than comma, for "return a,b".
      It is also weaker than assignment, though "return x.f <- b" does
      not make much sense either way.
      
      This change does not concern type expressions, where a tuple
      type must always have its clothes^Wparentheses on: (int, int).
      It might be nice to write "constant pair: int, bool", but on
      the other hand this would break casts like "42: int, true".
      a1e032f6
    • Andrei Paskevich's avatar
      WhyML: match ... with exception ... end · 6aace661
      Andrei Paskevich authored
      6aace661
  22. 09 Jun, 2017 2 commits
  23. 08 Jun, 2017 4 commits
  24. 06 Jun, 2017 2 commits
  25. 05 Jun, 2017 2 commits
    • Andrei Paskevich's avatar
      Mlw: labels can act as local exceptions · cda6d915
      Andrei Paskevich authored
      Useful to break out of the loops:
      
        label Break in
        while ... do
          label Continue in
          ... raise Break ...
          ... raise Continue ...
        done
      
      When a label is put over a non-unit expression,
      raise acts as return:
      
        label Return in
        if ... then raise Return 42; 0
      
      Also, "return <expr>" returns from the innermost function.
      This includes abstract blocks, too, so if you want to return
      across an abstract block, you should rather use a label at
      the top of the main function. TODO/FIXME: maybe we should
      let "return" pass across abstract blocks by default, to
      avoid surprises?
      
      One shortcoming of the labels-as-exceptions is that they cannot
      be used to transmit tuples with ghost elements, nor return ghost
      values from non-ghost expressions. A local exception with an
      explicit mask should be used instead. Similarly, to return
      a partially ghost value from a function, it must have have
      its mask explicitly written (which is a good practice anyway).
      We cannot know the mask of an expr before we construct it,
      but in order to construct it, we need to create the local
      exceptions first.
      
      Another caveat is that while it is possible to catch an exception
      generated by a label, you should avoid to do so. We only declare
      the local exception if the expression under the label _raises_
      the exception, and thus the following code will not typecheck:
      
        label X in (try raise X with X -> () end)
      
      Indeed, the expression in the parentheses does not raise X,
      and so we do not declare a local exception X for this label,
      and so the program contains an undeclared exception symbol.
      cda6d915
    • Andrei Paskevich's avatar
      Mlw: local exceptions in the surface language · b3a73a61
      Andrei Paskevich authored
      current syntax is
      
          exception Return (int, ghost bool) in
          ...
          try
            ...
            raise Return (5, false)
            ...
          with
            Return (i, b) -> ...
          ...
      
      These exceptions can carry mutable and non-monomorphic values.
      They can be raised from local functions defined in the scope
      of the exception declaration.
      b3a73a61
  26. 04 Jun, 2017 1 commit
  27. 27 May, 2017 1 commit
    • Andrei Paskevich's avatar
      Mlw: support Epure in the surface language (with type inference) · 72714897
      Andrei Paskevich authored
      The current syntax is "{| <term> |}", which is shorter than
      "pure { <term> }", and does not require a keyword. Better
      alternatives are welcome.
      
      As for type inference, we infer the type pf the term under Epure
      without binding destructible type variables in the program.
      In particular,
        let ghost fn x = {| x + 1 |}
      will not typecheck. Indeed, even if we detect that the result
      is [int], the type of the formal parameter [x[ is not inferred
      in the process, and thus stays at ['xi].
      
      Another problem is related to the fact that variable and function
      namespaces are not yet separated when we perform type inference.
      Thus both fuctions
        let ghost fn (x: int) = let x a = a in {| x + 5 |}
      and
        let ghost fn (x: int) = let x a = a in {| x 5 |}
      will not typecheck, since the type of [x] is ['a -> 'a] when
      we infer the type for the Epure term, but it becomes [int],
      when we construct the final program expression. Probably,
      the only reasonable solution is to keep variables and
      functions in the same namespace, so that [x] simply can
      not be used in annotations after being redefined as a
      program function.
      72714897
  28. 24 May, 2017 1 commit