--- layout: fc_discuss_archives title: Message 16 from Frama-C-discuss on July 2009 ---
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Frama-c-discuss] Frama-C/Jessie: not_assigns and mutable parameter



Pariente Dillon wrote:
> Hello,
>
> Please, what is wrong with this annotated code for which the default
> behavior post-condition PO can not be discharged by Jessie/Why/ATPs (a
> mutable_p var seems to be unexploitable in the hypotheses):
> 	/*@ requires \valid(p) && \valid(q);
> 	assigns *\at(p,Post),p;
> 	*/
> 	int main1(int* p,int* q) { p = q; *p = 1; return 1; }
>   
A general rule: function parameters are not modifiable l-values from the 
caller's point of view.
In other words, the caller cannot see that the implementation uses p as 
a modifiable local variable.

In the contract:

/*@ requires \valid(p) && \valid(q);
    assigns *\at(p,Post),p;
   */
int main1(int* p,int* q) ; 

p is just a parameter and cannot be assigned. assigns p is useless. \at(p,Post) is the same as p.
assigns *\at(p,Post) is wrong because equivalent to assigns *p

- Claude


-- 
Claude March?                          | tel: +33 1 72 92 59 69           
INRIA Saclay - ?le-de-France           | mobile: +33 6 33 14 57 93 
Parc Orsay Universit?                  | fax: +33 1 74 85 42 29   
4, rue Jacques Monod - B?timent N      | http://www.lri.fr/~marche/
F-91893 ORSAY Cedex                    |