Static Invariants and Initialization: When are static invariants proven? #3950
Unanswered
WolframPfeifer
asked this question in
Q&A
Replies: 3 comments 2 replies
|
Actually, in recent LLM experiments (by @samysweb and @BookWood7th), the LLMs found this "shortcut" for making method contracts provable by encoding false in the static invariant. |
1 reply
|
Even for static methods, the static invariant is just implicitly added to the precondition. This seems unsound, at least for the main method. |
0 replies
|
Does anyone have knowledge of how OpenJML handles this case? |
1 reply
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
If
falseis encoded in a static invariant, this can be used to prove arbitrary postconditions.Consider the following class:
Of course, in general this could happen accidentally and more sophisticated.
The question is: Where is the static invariant proven?
In my understanding, it would need to be proven whenever the static initialization of the class happens.
However, by default this is disabled, so the static invariant is just an assumption.
KeY has the feature of enabling static intialization (taclet option:
initialisation:enableStaticInitialisation). I have never used this until today, and when I tried it, the symbolic execution did not terminate (at least not within 30k steps), and KeY was completely unresponsive, probably because of the heavy branching and huge sequents. Is this expected? How are you supposed to work with this setting? I was not able to prove even the simplestmethodconstructor contract ("ensures true" with no method body).I would have expected that at least the constructor contract above would not be provable with static initialization enabled.
However, they are! Actually, the static invariant is assumed in the precondition. Is this correct? What am I missing?
Edit: I did a mistake there: I am able to close method contracts, the problem where the symbolic execution runs seemingly endless are constructor contracts.
All reactions