Fix examples after en tree #1827

scuellar · 2023-03-01T22:29:18Z

This PR updates some of the examples and the tutorial to the new Heapster semantics with EnTrees.

We should wait for heapster-ide-info to be merged so we can merge directly into master.

…nto heapster-ide-info

…edMb.hs, to help with GHC 9 support

…nged the names of all of its operationsto use 'Named' as a suffix instead of just using a prime

scuellar · 2023-03-02T15:15:40Z

~~@RyanGlScott I'm tagging you just in case you want to take a look~~. Actually, it would be great if you could review this.

It didn't feel like using manual proves was instructive, so that's why I automated it. I would assume that more automation will be created for refinements, so hopfully what I wrote is a step in the right direction.

RyanGlScott

I've given this a look, mostly focusing on the tutorial. I have not looked deeply at the details of the proofs themselves, so if there is a particular proof that you would like me to give closer scrutiny, let me know.

heapster-saw/doc/tutorial/tutorial.md

RyanGlScott · 2023-03-02T15:34:09Z

heapster-saw/doc/tutorial/tutorial.md

-Import CompMExtraNotation. Open Scope fun_syntax.
+(* The following 2 lines allows better automatio*)
+Require Import Examples.common.
+Require Import Coq.Program.Tactics. (* Great tacticals, move to automation. Perhaps `Require Export`? *)


I'm not sure how to read this comment. Does this belong in a tutorial?

I guess not.

heapster-saw/doc/tutorial/tutorial.md

RyanGlScott · 2023-03-02T15:38:16Z

heapster-saw/doc/tutorial/tutorial.md

+Lemma no_errors_add_mistyped (x: bitvector 64) :
+  spec_refines_eq (add_mistyped x) (safety_spec (x)).
+Proof. solve_trivial_spec 0 0.
+
+(* After rewriting the terms for clarity, you can see the
+   remaining goal says that an `ErrorS` is a refinement of
+   `RetS`. In other words, it's trying to prove that a trivially
+   pure function has an error. That's obviously false. *)
+      clarify_goal_tutorial.
 Abort.


Should this be surrounded with code blocks ``` ... ```?

Good catch.

RyanGlScott · 2023-03-02T15:40:18Z

heapster-saw/doc/tutorial/tutorial.md

 ```

+Lemma no_errors_incr_ptr (x: bitvector 64) :
+  spec_refines_eq (incr_ptr x) (safety_spec x).
+Proof.  solve_trivial_spec 0 0. Qed.```
+


I think this code block is missing a closing ```.

Fixed in latest commit.

heapster-saw/doc/tutorial/tutorial.md

RyanGlScott · 2023-03-02T15:47:01Z

heapster-saw/doc/tutorial/tutorial.md

-entails anything).
+important steps are handled by custom automation. 
+
+TODO: This proof is involved. Perhaps add some more details?


Yes, I definitely think so! Are you planning to resolve this TODO in this PR, or are you leaving this as future work?

It's a good point. The description more or less gets to the limit of what I understand, without going into technical details. Do you have any suggestion of how to improve this section?

We can also just commit the comment and leave it super high level at this point.

Ideally, we would include a more detailed tutorial that goes into the nuances of spec_refines proofs involving loops. But writing such a tutorial would take a fair bit of effort, so I can understand if you don't want to do that here. My recommendation would be to:

Remove this TODO (since TODOs in a tutorial look out of place), and

Open an issue as a reminder to write this more detailed tutorial.

RyanGlScott · 2023-03-02T15:47:54Z

heapster-saw/examples/_CoqProject

-#xor_swap_proofs.v
+xor_swap_proofs.v
 xor_swap_rust_gen.v
 #xor_swap_rust_proofs.v
 c_data_gen.v
-#c_data_proofs.v
+c_data_proofs.v


I'm surprised that this isn't adding back more of the _proofs.v files that you've changed in this PR, such as arrays_proofs.v. Any reason not to?

I haven't finished the proofs in arrays_proofs.v, I only fixed the first one which is the one mentioned in the tutorial.

RyanGlScott · 2023-03-02T15:48:44Z

heapster-saw/examples/arrays_proofs.v

+(*This is a prototype of a tactic to solve all signed inequalities for
+Boolean vectors, as long as there is no overflow. Ideally, if the
+tactic fails, it will show you the bounds you need to prove that thre
+is no overflow. You probably missed them in your invariants.
+
+The idea is pretty simple: convert everything to to `Int` and, becasue
+there is no overflow, we can remove the module quantifiers and crush
+it with standard lia.
+
+TO DO:
+
+- Support all arith relations eq[ ], lt[ ], gt[ ], le[✓], ge[ ]
+
+- Don't directly apply rewrites to all subgoals for efficiency
+
+- Recognize when there is a terminal "node" to apply `lia`. Right now
+  we attempt lia at every step, whcih is wasteful.
+
+ *)


This is probably worth having a discussion about independently of this PR. Can you open an issue to track the design and discussion of this feature?

Added #1836

RyanGlScott · 2023-03-02T15:50:06Z

heapster-saw/examples/arrays_proofs.v

+
+Qed.
+
+(* The old version


A personal thing, but I'd favor just removing the old, commented-out versions. They'll still exist in the git history if we want to look at them again in the future.

Fair enough.

typo Co-authored-by: Ryan Scott <rscott@galois.com>

Typo Co-authored-by: Ryan Scott <rscott@galois.com>

…Inc/saw-script into Fix-Examples-After-EnTree

scuellar

@RyanGlScott , thank you for the review. I think I have addressed all of your points, except the question regarding the TODO. Let me know what you think.

scuellar · 2023-03-07T16:10:37Z

heapster-saw/doc/tutorial/tutorial.md

-Import CompMExtraNotation. Open Scope fun_syntax.
+(* The following 2 lines allows better automatio*)
+Require Import Examples.common.
+Require Import Coq.Program.Tactics. (* Great tacticals, move to automation. Perhaps `Require Export`? *)


I guess not.

scuellar · 2023-03-07T16:12:13Z

heapster-saw/doc/tutorial/tutorial.md

+Lemma no_errors_add_mistyped (x: bitvector 64) :
+  spec_refines_eq (add_mistyped x) (safety_spec (x)).
+Proof. solve_trivial_spec 0 0.
+
+(* After rewriting the terms for clarity, you can see the
+   remaining goal says that an `ErrorS` is a refinement of
+   `RetS`. In other words, it's trying to prove that a trivially
+   pure function has an error. That's obviously false. *)
+      clarify_goal_tutorial.
 Abort.


Good catch.

scuellar · 2023-03-07T16:12:30Z

heapster-saw/doc/tutorial/tutorial.md

 ```

+Lemma no_errors_incr_ptr (x: bitvector 64) :
+  spec_refines_eq (incr_ptr x) (safety_spec x).
+Proof.  solve_trivial_spec 0 0. Qed.```
+


Fixed in latest commit.

scuellar · 2023-03-07T16:15:17Z

heapster-saw/doc/tutorial/tutorial.md

 ```

-The arguments `e1`, `e2` and `p1` correspond to the length `len`, the
+The arguments `e0`, `e1` and `p1` correspond to the length `len`, the


Good point. Added some text.

scuellar · 2023-03-07T16:17:47Z

heapster-saw/doc/tutorial/tutorial.md

-entails anything).
+important steps are handled by custom automation. 
+
+TODO: This proof is involved. Perhaps add some more details?


It's a good point. The description more or less gets to the limit of what I understand, without going into technical details. Do you have any suggestion of how to improve this section?

We can also just commit the comment and leave it super high level at this point.

scuellar · 2023-03-07T16:18:58Z

heapster-saw/examples/_CoqProject

-#xor_swap_proofs.v
+xor_swap_proofs.v
 xor_swap_rust_gen.v
 #xor_swap_rust_proofs.v
 c_data_gen.v
-#c_data_proofs.v
+c_data_proofs.v


I haven't finished the proofs in arrays_proofs.v, I only fixed the first one which is the one mentioned in the tutorial.

scuellar · 2023-03-07T16:19:15Z

heapster-saw/examples/arrays_proofs.v

+(*This is a prototype of a tactic to solve all signed inequalities for
+Boolean vectors, as long as there is no overflow. Ideally, if the
+tactic fails, it will show you the bounds you need to prove that thre
+is no overflow. You probably missed them in your invariants.
+
+The idea is pretty simple: convert everything to to `Int` and, becasue
+there is no overflow, we can remove the module quantifiers and crush
+it with standard lia.
+
+TO DO:
+
+- Support all arith relations eq[ ], lt[ ], gt[ ], le[✓], ge[ ]
+
+- Don't directly apply rewrites to all subgoals for efficiency
+
+- Recognize when there is a terminal "node" to apply `lia`. Right now
+  we attempt lia at every step, whcih is wasteful.
+
+ *)


Added #1836

scuellar · 2023-03-07T16:45:23Z

heapster-saw/examples/arrays_proofs.v

+
+Qed.
+
+(* The old version


Fair enough.

Karl Smeltzer and others added 30 commits June 28, 2021 13:35

add basic IDE logging, start error cleanup

3a9c13b

clean up additional implication errors

bfd0566

add structure to stmt fail in line with impl fail

49f72e4

redesign error message types, pipe through to log

716a2e1

fix default heapster environments missing ioref

9283f0e

carry more information through on most common implication error

1e427a4

Merge branch 'heapster-ide-info' of github.com:GaloisInc/saw-script i…

059ab7b

…nto heapster-ide-info

remove Some from error constructor

6fef67a

Merge branch 'master' into heapster-ide-info

f3b76bb

Export valueperms in full json detail

e2c9cd6

Avoid generating orphan ToJSON instances and using Given

b59adb9

refine jsonexport instances

65ae7dd

Document JSONExport

931d802

Remove need for passing undefined

2ad2225

JSONExport support for PermImpls

ce3313b

export entrypoint and caller ID information

df114c1

cleanup imports, 80 char columns

8875708

heapster: export function name for IDE

5f12cc4

heapster-saw: LogEntry with names and structure

cb7c57c

Incorporate names from bindings in JsonExport

e768f1f

Merge remote-tracking branch 'origin/master' into heapster-ide-info

f60affd

Update PPInfo while exporting

51665d7

checkpoint

dc70b93

Use types to generate names for pretty permissions where possible

f0c7747

Merge branch 'master' into heapster-ide-info

45380a5

WIP: fixing errors introduced by the merge.

6170858

got SAW to compile after the latest merge of master

7694e2f

Merge branch 'master' into heapster-ide-info

009caf6

Merge branch 'master' into heapster-ide-info

8ac9eb5

Updtate deps

bb9c52d

scuellar and others added 14 commits February 16, 2023 16:51

Fix xor proofs

1a6a03d

Add a file with generlalized tactics and definitions

b85f7b7

Quick fix.

c19c2ae

BROKEN: c_data_proofs.v is broken. pushing to get assitance.

4f04499

One more example fixed, more powerful automation to support it.

2cadcbf

Updating a couple more examples and some automation.

2cbf50d

Small clean

3d76821

bumping the cryptol submodule to match master

dd69d30

moved nuMatching and Liftable instances to the top of the file in Nam…

dbc3ccf

…edMb.hs, to help with GHC 9 support

GHC 9 fixes

1310346

renamed the Mb' datatype to the more accessible name NamedMb, and cha…

599cf2a

…nged the names of all of its operationsto use 'Named' as a suffix instead of just using a prime

Fix the tutorial proofs.

856e49b

Update the tutorial text

7d53a24

Merge branch 'heapster-ide-info' into Fix-Examples-After-EnTree

defedde

scuellar changed the base branch from heapster-ide-info to master March 2, 2023 15:07

scuellar changed the title ~~(WIP) Fix examples after en tree~~ Fix examples after en tree Mar 2, 2023

scuellar requested a review from eddywestbrook March 2, 2023 15:12

Merge branch 'master' into Fix-Examples-After-EnTree

013f9f9

scuellar requested review from RyanGlScott and removed request for eddywestbrook March 2, 2023 15:22

RyanGlScott reviewed Mar 2, 2023

View reviewed changes

scuellar and others added 6 commits March 7, 2023 11:04

Update heapster-saw/doc/tutorial/tutorial.md

42981b1

typo Co-authored-by: Ryan Scott <rscott@galois.com>

Update heapster-saw/doc/tutorial/tutorial.md

b7ffbf3

typo Co-authored-by: Ryan Scott <rscott@galois.com>

Update heapster-saw/doc/tutorial/tutorial.md

45c6fcf

typo Co-authored-by: Ryan Scott <rscott@galois.com>

Update heapster-saw/doc/tutorial/tutorial.md

5615ae1

Typo Co-authored-by: Ryan Scott <rscott@galois.com>

simple changes after review.

7a74d26

Merge branch 'Fix-Examples-After-EnTree' of https://github.com/Galois…

9e538c7

…Inc/saw-script into Fix-Examples-After-EnTree

scuellar commented Mar 7, 2023

View reviewed changes

RyanGlScott approved these changes Mar 7, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix examples after en tree #1827

Fix examples after en tree #1827

scuellar commented Mar 1, 2023

scuellar commented Mar 2, 2023 •

edited

Loading

RyanGlScott left a comment

RyanGlScott Mar 2, 2023

scuellar Mar 7, 2023

RyanGlScott Mar 2, 2023

scuellar Mar 7, 2023

RyanGlScott Mar 2, 2023

scuellar Mar 7, 2023

RyanGlScott Mar 2, 2023

scuellar Mar 7, 2023

RyanGlScott Mar 7, 2023

RyanGlScott Mar 2, 2023

scuellar Mar 7, 2023

RyanGlScott Mar 2, 2023

scuellar Mar 7, 2023

RyanGlScott Mar 2, 2023

scuellar Mar 7, 2023

scuellar left a comment

scuellar Mar 7, 2023

scuellar Mar 7, 2023

scuellar Mar 7, 2023

scuellar Mar 7, 2023

scuellar Mar 7, 2023

scuellar Mar 7, 2023

scuellar Mar 7, 2023

scuellar Mar 7, 2023

Fix examples after en tree #1827

Are you sure you want to change the base?

Fix examples after en tree #1827

Conversation

scuellar commented Mar 1, 2023

scuellar commented Mar 2, 2023 • edited Loading

RyanGlScott left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

scuellar left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

scuellar commented Mar 2, 2023 •

edited

Loading