Question

如果我的索引在每次迭代后都没有减少，我怎么能避免减少错误？为什么我在对象和数组上获得一个modify子句，而我在它们上面使用了modify子句？

class ownerIndexs{
  var oi : map<int, int>;

  constructor(){
  new;
  }
}

class multiowned{

  var m_numOwners : int;
  var m_owners : array<int>;
  var m_ownerIndex : ownerIndexs;

method reorganizeOwners() returns (boo : bool)
  requires m_owners != null && m_ownerIndex != null
  requires  m_owners.Length >= 2
  requires 0 <= m_numOwners < m_owners.Length


  modifies this
  modifies this.m_owners 
  modifies this.m_ownerIndex;
 {
    var frees : int := 1;
    while (frees < m_numOwners)
    decreases m_numOwners - frees      //error 1
    invariant m_owners != null && m_numOwners < m_owners.Length
    invariant m_ownerIndex != null


    {
        while (frees < m_numOwners && m_owners[frees] != 0)
        decreases m_numOwners - frees
        invariant frees <= m_numOwners
        invariant m_owners != null && m_numOwners < m_owners.Length
        invariant m_ownerIndex != null
        {
          frees := frees +1;
        }

       while (m_numOwners > 1 && m_owners[m_numOwners] == 0)
       invariant m_owners != null && m_numOwners < m_owners.Length
       invariant m_ownerIndex != null
        {
          m_numOwners := m_numOwners-1;
       }
 if (frees < m_numOwners && m_owners[m_numOwners] != 0 && m_owners[frees] == 0)
        {
            m_owners[frees] := m_owners[m_numOwners]; //error 2
            m_ownerIndex.oi := m_ownerIndex.oi[m_owners[frees] := frees]; //error 3
            m_owners[m_numOwners] := 0;
        }
    }
    boo := true;
  }

}

我也在Dafny上传了这段代码，你可以在那里再次编译：https://rise4fun.com/Dafny/bYDH。如您所见，我修改了数组m_owner，并将ownerIndex外包给另一个对象，因为其他修改违规问题。但是这里似乎dafnys语言有限，不是吗？

Answer 1

您编写了modifies this.m_owners，但是当您修改this.m_owners时，Dafny不知道this.m_owners仍然引用与方法开始时相同的对象。 / p>

尝试将这些不变量添加到while循环中，

    invariant this.m_owners == old(this.m_owners)
    invariant this.m_ownerIndex == old(this.m_ownerIndex)

对于减少子句，您需要向Dafny证明m_numOwners - frees实际上在减少，这对我来说似乎并不正确-在我看来，这可能是两个内部while循环的情况条件将为false，在这种情况下m_numOwners和frees都不会改变。那可能是您代码中的错误，或者您可能需要更多的前提条件和不变式，我不确定您的意图。

如何避免减少和修改违规？

1 个答案: