From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on polar.synack.me X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,FREEMAIL_FROM autolearn=ham autolearn_force=no version=3.4.4 X-Google-Thread: a07f3367d7,b49755ab898bcffd X-Google-Attributes: gida07f3367d7,public,usenet X-Google-NewGroupId: yes X-Google-Language: ENGLISH,UTF8 Path: g2news2.google.com!news4.google.com!proxad.net!feeder1-2.proxad.net!usenet-fr.net!gegeweb.org!aioe.org!not-for-mail From: =?utf-8?Q?Yannick_Duch=C3=AAne_=28Hibou57?= =?utf-8?Q?=29?= Newsgroups: comp.lang.ada Subject: Re: SPARK again : for-loop vs single loop - a strange case Date: Sat, 29 May 2010 00:41:31 +0200 Organization: Ada At Home Message-ID: References: <2b6ae662-77e2-4d1a-a2b2-3df54f8ab98e@v37g2000vbv.googlegroups.com> NNTP-Posting-Host: MBnfDkYuJKoIyXbkYutszA.user.speranza.aioe.org Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed; delsp=yes Content-Transfer-Encoding: Quoted-Printable X-Complaints-To: abuse@aioe.org X-Notice: Filtered by postfilter v. 0.8.2 User-Agent: Opera Mail/10.53 (Win32) Xref: g2news2.google.com comp.lang.ada:12136 Date: 2010-05-29T00:41:31+02:00 List-Id: Le Fri, 28 May 2010 13:50:51 +0200, Phil Thornley = a =C3=A9crit: > So the fact that adding L >=3D Length_Type'First allows the Simplifier= > to prove the check suggests that you are not getting these hypotheses > - possibly for one of the above reasons. OK, with the for-loop, L cannot goes outside of the range expression, so= = the Examiner can always assume these hypotheses exist. However, there is= = still the Length_Type and associated VC for RTC, which can turn into = hypotheses. I would understand I may had a trouble with a VC associated = to = a RTC, I can't understand this one. You suggested to look Generation of RTC, section 4.5.2.1. It says: > The default assertion states the subprogram=E2=80=99s precondition > is satisfied OK. Then > In the case of for loops, the invariant also states that theloop count= er = > is in its subtype. OK. I could not see something about local variables here indeed. Something about it is said in 4.2: > Additionally, the Examiner exploits the benefit of data > flow analysis by assuming that a local variable, anywhereit is = > referenced in an expression, must be validly in type. providing there is no flow error, as explained later in 4.2 There was no flow error, so the Length_Type range should be enough as an= = hypothesis, and it should be there (and that was my assumption, that is = = why I did not understood what's happened). > If you should be getting these hypotheses then post (or email) the > complete SPARKable code. Will see. I will try somethings else before. -- = There is even better than a pragma Assert: a SPARK --# check. --# check C and WhoKnowWhat and YouKnowWho; --# assert Ada; -- i.e. forget about previous premises which leads to conclusion -- and start with new conclusion as premise.