--- layout: fc_discuss_archives title: Message 16 from Frama-C-discuss on July 2009 ---
Pariente Dillon wrote: > Hello, > > Please, what is wrong with this annotated code for which the default > behavior post-condition PO can not be discharged by Jessie/Why/ATPs (a > mutable_p var seems to be unexploitable in the hypotheses): > /*@ requires \valid(p) && \valid(q); > assigns *\at(p,Post),p; > */ > int main1(int* p,int* q) { p = q; *p = 1; return 1; } > A general rule: function parameters are not modifiable l-values from the caller's point of view. In other words, the caller cannot see that the implementation uses p as a modifiable local variable. In the contract: /*@ requires \valid(p) && \valid(q); assigns *\at(p,Post),p; */ int main1(int* p,int* q) ; p is just a parameter and cannot be assigned. assigns p is useless. \at(p,Post) is the same as p. assigns *\at(p,Post) is wrong because equivalent to assigns *p - Claude -- Claude March? | tel: +33 1 72 92 59 69 INRIA Saclay - ?le-de-France | mobile: +33 6 33 14 57 93 Parc Orsay Universit? | fax: +33 1 74 85 42 29 4, rue Jacques Monod - B?timent N | http://www.lri.fr/~marche/ F-91893 ORSAY Cedex |