Code contracts, if X < Y and Y = Z+1 why is X < Z+1 not proved

Question

I have a contract that does this:

for (int i = 0; i < delegateParameterTypes.Length; i++)
{
    Contract.Assert(i < delegateParameterTypes.Length);
    Contract.Assert(delegateParameterTypes.Length == methodParameters.Length + (1));
    // Q.E.D.
    Contract.Assert(i < methodParameters.Length + (1));
}

The first two pass analysis fine but the third says that the assert is unproven, off by one? consider guard. It seems like simple math. is there something I'm missing?

trying it with string arrays and local values seems to work fine. Might be to do with the .Length call somehow? I tried swapping the int to UInt16 to see if it's due to buffer overflow in a loop but that wasn't it either.

can you use `(methodParameters.Length + 1)` instead of `methodParameters.Length + (1)`? — Iłya Bursov, Nov 04 '15 at 23:17
That also fails. I just had the parentheses there from previous attempts to solve it. — Andrew Tk Khoo, Nov 05 '15 at 03:20
Are `delegateParameterTypes` and `methodParameters` local variables, parameters or fields? — Ɖiamond ǤeezeƦ, Nov 11 '15 at 01:22

fourpastmidnight · Answer 1 · 2016-03-01T13:41:12.047

Hmm, the only thing I can think of is that the static analyzer is having a problem with these asserts. Follow me on this:

You call Contract.Assert(i < delegateParameterTypes.Length);. Assuming this is true, we go on.
At this point, the static analyzer doesn't know if anything has changed about delegateParameterTypes.Length between the call that's about to happen to Contract.Assert(predicate) and step 1 above. You and I know nothing happened, but the analyzer does not--despite the fact the two lines of code are adjacent (who's to say there's not some thread touching shared state out there somewhere?)
You make the next call: Contract.Assert(delegateParameterTypes.Length == methodParameters.Length + (1)); The analyzer checks this, and this is OK, too.
At this point, the analyzer has no idea whether anything's changed about delegateParameterTypes or methodParameters--QED, Assert unproven for Contract.Assert(i < methodParameters.Length + (1)); on the next line.

Again, there could be some shared global state associated with those things, and that state could have changed between the two calls to Contract.Assert. Remember, to you and me, the code looks linear and synchronous. The reality is or could be quite different, and the static analyzer can make no assumptions about the state of those objects between successive calls to Contract.Assert.

What may work, however:

int delegateParameterTypesLength = delegateParameterTypes.Length;
int methodParametersLength = methodParameters.Length + 1;

for (int i = 0; i < delegateParameterTypesLength; i++)
{
    Contract.Assert(delegateParameterTypesLength == methodParametersLength);
    // QED
    Contract.Assert(i < methodParametersLength);
}

By assigning the lengths to variables, the static analyzer can now know that those values don't change within the for loop, or external of the method in which they're assigned. Now you're comparing i with values that are known not to change. Now, the static analyzer can make some inferences about the comparisons of these values and should be able to prove the assertions.

Code contracts, if X < Y and Y = Z+1 why is X < Z+1 not proved

1 Answers1