Skip to main content

FracGhost

vstd::resource::frac

Struct FracGhost 

Source 
pub struct FracGhost<T> { /* private fields */ }
Expand description

An implementation of a resource for fractional ownership of a ghost variable.

If you just want to split the permission in half, you can also use the GhostVar<T> and GhostVarAuth<T> library.

§Example

fn example_use() {
    let tracked mut r = FracGhost::<u64>::new(123);
    assert(r@ == 123);
    assert(r.frac() == 1 as real);
    let tracked r2 = r.split();
    assert(r@ == 123);
    assert(r2@ == 123);
    assert(r.frac() == (0.5 as real));
    assert(r2.frac() == (0.5 as real));
    proof {
        r.combine(r2);
        r.update(456);
    }
    assert(r@ == 456);
    assert(r.frac() == 3 as real);

    let tracked mut a = FracGhost::<u32>::new(5);
    assert(a@ == 5);
    assert(a.frac() == 1real);
    let tracked mut b = a.split();
    assert(a.frac() == (0.5 as real));
    assert(b.frac() == (0.5 as real));
    proof {
        a.update_with(&mut b, 123);
    }
    assert(a@ == 123);

    proof {
        a.combine(b);
        a.update(6);
    }
    assert(a@ == 6);
}

Implementations§

Source§

impl<T> FracGhost<T>

Source

pub closed spec fn id(self) -> Loc

Source

pub closed spec fn view(self) -> T

Source

pub closed spec fn frac(self) -> real

The fractional quantity of this permission

Source

pub open spec fn valid(self, id: Loc, frac: real) -> bool

{
    &&& self.id() == id
    &&& self.frac() == frac

}
Source

pub proof fn new(v: T) -> tracked result : Self

ensures
result.frac() == 1 as real,
result@ == v,

Allocate a new resource with the given value.

Source

pub proof fn agree(tracked &self, tracked other: &Self)

requires
self.id() == other.id(),
ensures
self@ == other@,

Two resources agree on their values.

Source

pub proof fn take(tracked &mut self) -> tracked result : Self

ensures
result == *old(self),

Take a token out of a mutable reference, leaving a meaningless token behind.

Source

pub proof fn split_to(tracked &mut self, result_frac: real) -> tracked result : Self

requires
(0 as real) < result_frac < old(self).frac(),
ensures
final(self).id() == old(self).id(),
result.id() == final(self).id(),
final(self)@ == old(self)@,
result@ == old(self)@,
final(self).frac() == old(self).frac() - result_frac,
result.frac() == result_frac,

Split one resource into two. Both the returned resource and self have half of the original fraction.

Source

pub proof fn split(tracked &mut self) -> tracked result : Self

ensures
final(self).id() == old(self).id(),
result.id() == final(self).id(),
final(self)@ == old(self)@,
result@ == old(self)@,
final(self).frac() == old(self).frac() / 2 as real,
result.frac() == old(self).frac() / 2 as real,

Split one resource into two. Both the returned resource and self have half of the original fraction.

Source

pub proof fn combine(tracked &mut self, tracked other: Self)

requires
old(self).id() == other.id(),
ensures
final(self).id() == old(self).id(),
final(self)@ == old(self)@,
final(self)@ == other@,
final(self).frac() == old(self).frac() + other.frac(),

Combine two resources, summing their quantities.

Source

pub proof fn update(tracked &mut self, v: T)

requires
old(self).frac() == (1 as real),
ensures
final(self).id() == old(self).id(),
final(self)@ == v,
final(self).frac() == old(self).frac(),

Update the value of the resource. This requires having ALL the permissions,

Source

pub proof fn update_with(tracked &mut self, tracked other: &mut Self, v: T)

requires
old(self).id() == old(other).id(),
old(self).frac() + old(other).frac() == 1 as real,
ensures
final(self).id() == old(self).id(),
final(other).id() == old(other).id(),
final(self).frac() == old(self).frac(),
final(other).frac() == old(other).frac(),
old(self)@ == old(other)@,
final(self)@ == v,
final(other)@ == v,

Update the value of the token. This requires having ALL the permissions (i.e., a fractional authority of 1),

Source

pub proof fn bounded(tracked &self)

ensures
(0 as real) < self.frac() <= (1 as real),

Allowed values for a resource’s fractional component.

Source

pub proof fn dummy() -> tracked result : Self

Obtain an arbitrary resource with no information about it. Useful if you need a well-typed placeholder.

Auto Trait Implementations§

§

impl<T> Freeze for FracGhost<T>

§

impl<T> RefUnwindSafe for FracGhost<T>
where T: RefUnwindSafe,

§

impl<T> Send for FracGhost<T>
where T: Send,

§

impl<T> Sync for FracGhost<T>
where T: Sync,

§

impl<T> Unpin for FracGhost<T>
where T: Unpin,

§

impl<T> UnsafeUnpin for FracGhost<T>

§

impl<T> UnwindSafe for FracGhost<T>
where T: UnwindSafe,

Blanket Implementations§

Source§

impl<T> Any for T
where T: 'static + ?Sized,

Source§

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more
Source§

impl<T> Borrow<T> for T
where T: ?Sized,

Source§

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more
Source§

impl<T> BorrowMut<T> for T
where T: ?Sized,

Source§

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more
Source§

impl<T> From<T> for T

Source§

fn from(t: T) -> T

Returns the argument unchanged.

Source§

impl<T, VERUS_SPEC__A> FromSpec<T> for VERUS_SPEC__A
where VERUS_SPEC__A: From<T>,

Source§

exec fn obeys_from_spec() -> bool

Source§

exec fn from_spec(v: T) -> VERUS_SPEC__A

Source§

impl<T, U> Into<U> for T
where U: From<T>,

Source§

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

Source§

impl<T, VERUS_SPEC__A> IntoSpec<T> for VERUS_SPEC__A
where VERUS_SPEC__A: Into<T>,

Source§

exec fn obeys_into_spec() -> bool

Source§

exec fn into_spec(self) -> T

Source§

impl<T, U> IntoSpecImpl<U> for T
where U: From<T>,

Source§

open spec fn obeys_into_spec() -> bool

{ <U as FromSpec<Self>>::obeys_from_spec() }
Source§

open spec fn into_spec(self) -> U

{ U::from_spec(self) }
Source§

impl<T, U> TryFrom<U> for T
where U: Into<T>,

Source§

type Error = Infallible

The type returned in the event of a conversion error.
Source§

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.
Source§

impl<T, VERUS_SPEC__A> TryFromSpec<T> for VERUS_SPEC__A
where VERUS_SPEC__A: TryFrom<T>,

Source§

exec fn obeys_try_from_spec() -> bool

Source§

exec fn try_from_spec( v: T, ) -> Result<VERUS_SPEC__A, <VERUS_SPEC__A as TryFrom<T>>::Error>

Source§

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

Source§

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.
Source§

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.
Source§

impl<T, VERUS_SPEC__A> TryIntoSpec<T> for VERUS_SPEC__A
where VERUS_SPEC__A: TryInto<T>,

Source§

exec fn obeys_try_into_spec() -> bool

Source§

exec fn try_into_spec(self) -> Result<T, <VERUS_SPEC__A as TryInto<T>>::Error>

Source§

impl<T, U> TryIntoSpecImpl<U> for T
where U: TryFrom<T>,

Source§

open spec fn obeys_try_into_spec() -> bool

{ <U as TryFromSpec<Self>>::obeys_try_from_spec() }
Source§

open spec fn try_into_spec(self) -> Result<U, <U as TryFrom<T>>::Error>

{ <U as TryFromSpec<Self>>::try_from_spec(self) }
§

impl<A> SpecEq<&A> for A
where A: ?Sized,

§

impl<A> SpecEq<&mut A> for A
where A: ?Sized,

§

impl<A> SpecEq<A> for A
where A: ?Sized,

§

impl<A> SpecEq<Ghost<A>> for A

§

impl<A> SpecEq<Tracked<A>> for A