Regression tests for #4485 and #4487 (fixed by #4515) - #4606
Merged
Merged
Conversation
Both soundness bugs in the VC simplifier no longer reproduce, since #4515 made a computation type carry only a result type, with its specification as a refinement of it: - #4485: clearly_inhabited judged an arrow inhabited from its result type, ignoring the postcondition. `unit -> Pure int True (fun _ -> False)` is now `unit -> r:int{False}`, whose result type is not clearly inhabited. - #4487: term_eq compared computation types by effect and result type, ignoring their effect arguments. Two arrows differing only in their postcondition now differ in their (refined) result types. The tests include the issues' repros, as expect_failure, and their controls. They fail on a build that predates #4515. Fixes #4485 Fixes #4487 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 35922588-addf-481a-aac9-a6e3d6713e84
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This adds regression tests for two soundness bugs in the VC simplifier. Neither reproduces on current master: both were fixed by #4515.
Since #4515, a computation type carries only a result type, and its specification is a refinement of that type.
False#4485:clearly_inhabiteddecided that an arrow type was inhabited by looking only at its result type, ignoring the postcondition.unit -> Pure int True (fun _ -> False)is nowunit -> r:int{False}. A refined type is not onclearly_inhabited's list of inhabited types, sononempty eandexists (g:e). Trueare no longer rewritten toTrue.U.term_eqignores a computation type's pre/postcondition, so the VC simplifier rewrites a false implication toTrue#4487:U.term_eqcompared computation types by effect and result type only, ignoring their effect arguments. Two arrows that differ only in their postcondition now have different (refined) result types. Sop ==> qandp <==> qare no longer rewritten toTruefor suchpandq.Tests
tests/bug-reports/closed/Bug4485.fst: thenonemptyandexistsrepros, aboolvariant, and the issue's three controls (an inhabited arrow type, an empty one given by a refinement of its result type, and a vacuously inhabited one), all asexpect_failure. It also includes two definitions that must be accepted:witness_gives_false, and a witness that the vacuous type is inhabited.tests/bug-reports/closed/Bug4487.fst:==>and<==>repros, both inline and through type abbreviations, asexpect_failure;expect_failure;False, with the false implication as a hypothesis;Checked:
U.term_eqignores a computation type's pre/postcondition, so the VC simplifier rewrites a false implication toTrue#4487 repros and Soundness: the VC simplifier judges an empty function type inhabited, provingFalse#4485'sexistsrepro verify, i.e. they proveFalse(thenonemptyrepro can't be checked there, since thatPrimshas nononempty), and both tests fail.Fixes #4485
Fixes #4487