Skip to main content

GhostIPointsTo

vstd::resource::imap

Struct GhostIPointsTo 

Source 
pub struct GhostIPointsTo<K, V> { /* private fields */ }
Expand description

A resource that asserts client ownership over a single key in the map.

The existence of a GhostIPointsTo implies that:

Implementations§

Source§

impl<K, V> GhostIPointsTo<K, V>

Source

pub closed spec fn id(self) -> Loc

Location of the underlying resource

Source

pub open spec fn view(self) -> (K, V)

{ (self.key(), self.value()) }

Key-Value pair underlying the points to relationship

Source

pub closed spec fn key(self) -> K

Key of the points to

Source

pub closed spec fn value(self) -> V

Pointed-to value

Source

pub proof fn agree(tracked self: &GhostIPointsTo<K, V>, tracked auth: &GhostIMapAuth<K, V>)

requires
self.id() == auth.id(),
ensures
auth@.contains_pair(self.key(), self.value()),

Agreement between a GhostIPointsTo and a corresponding GhostIMapAuth

Verus might not have full context of the GhostIMapAuth and a corresponding GhostIPointsTo. However, whenever we know that they refer to the same resource (i.e., have matching ids) we can assert that the GhostIPointsTo is a key-value pair in the GhostIMapAuth.

proof fn test(tracked &auth: GhostIMapAuth<int, int>, tracked &pt: GhostIPointsTo<int, int>)
    requires
        auth.id() == sub.id(),
        pt@ == (1int, 1int)
    ensures
        auth[1int] == 1int
{
    pt.agree(auth);
    assert(auth[1int] == 1int);
}
Source

pub proof fn combine(tracked self, tracked other: GhostIPointsTo<K, V>) -> tracked r : GhostISubmap<K, V>

requires
self.id() == other.id(),
ensures
r.id() == self.id(),
r@ == imap![self.key() => self.value(), other.key() => other.value()],
self.key() != other.key(),

We can combine two GhostIPointsTos into a GhostISubmap We also learn that they were disjoint.

Source

pub proof fn disjoint(tracked &mut self, tracked other: &GhostIPointsTo<K, V>)

requires
old(self).id() == other.id(),
ensures
final(self).id() == old(self).id(),
final(self)@ == old(self)@,
final(self).key() != other.key(),

Shows that if a two GhostIPointsTos are not owning the same key

Source

pub proof fn disjoint_submap(tracked &mut self, tracked other: &GhostISubmap<K, V>)

requires
old(self).id() == other.id(),
ensures
final(self).id() == old(self).id(),
final(self)@ == old(self)@,
!other.dom().contains(final(self).key()),

Shows that if a GhostIPointsTo and a GhostISubmap are not owning the same key

Source

pub proof fn disjoint_persistent_submap( tracked &mut self, tracked other: &GhostPersistentISubmap<K, V>, )

requires
old(self).id() == other.id(),
ensures
final(self).id() == old(self).id(),
final(self)@ == old(self)@,
!other.dom().contains(final(self).key()),

Shows that if a GhostIPointsTo and a GhostPersistentISubmap are not owning the same key

Source

pub proof fn disjoint_persistent(tracked &mut self, tracked other: &GhostPersistentIPointsTo<K, V>)

requires
old(self).id() == other.id(),
ensures
final(self).id() == old(self).id(),
final(self)@ == old(self)@,
final(self).key() != other.key(),

Shows that if a GhostIPointsTo and a GhostPersistentIPointsTo are not owning the same key

Source

pub proof fn update(tracked &mut self, tracked auth: &mut GhostIMapAuth<K, V>, v: V)

requires
old(self).id() == old(auth).id(),
ensures
final(self).id() == old(self).id(),
final(auth).id() == old(auth).id(),
final(self).key() == old(self).key(),
final(self)@ == (final(self).key(), v),
final(auth)@ == old(auth)@.union_prefer_right(imap![final(self).key() => v]),

Update pointed to value

Source

pub proof fn submap(tracked self) -> tracked r : GhostISubmap<K, V>

ensures
r.id() == self.id(),
r@ == imap![self.key() => self.value()],

Convert the GhostIPointsTo a GhostISubmap

Source

pub proof fn lemma_view(self)

ensures
self@ == (self.key(), self.value()),

Can be used to learn what the key-value pair of GhostIPointsTo is

Source

pub proof fn persist(tracked self) -> tracked r : GhostPersistentIPointsTo<K, V>

ensures
self@ == r@,
self.id() == r.id(),

Convert a GhostIPointsTo into a GhostPersistentIPointsTo

Auto Trait Implementations§

§

impl<K, V> Freeze for GhostIPointsTo<K, V>

§

impl<K, V> RefUnwindSafe for GhostIPointsTo<K, V>
where K: RefUnwindSafe, V: RefUnwindSafe,

§

impl<K, V> Send for GhostIPointsTo<K, V>
where K: Send, V: Send,

§

impl<K, V> Sync for GhostIPointsTo<K, V>
where K: Sync, V: Sync,

§

impl<K, V> Unpin for GhostIPointsTo<K, V>
where K: Unpin, V: Unpin,

§

impl<K, V> UnsafeUnpin for GhostIPointsTo<K, V>

§

impl<K, V> UnwindSafe for GhostIPointsTo<K, V>
where K: UnwindSafe, V: UnwindSafe,

Blanket Implementations§

Source§

impl<T> Any for T
where T: 'static + ?Sized,

Source§

fn type_id(&self) -> TypeId

Gets the TypeId of self. Read more
Source§

impl<T> Borrow<T> for T
where T: ?Sized,

Source§

fn borrow(&self) -> &T

Immutably borrows from an owned value. Read more
Source§

impl<T> BorrowMut<T> for T
where T: ?Sized,

Source§

fn borrow_mut(&mut self) -> &mut T

Mutably borrows from an owned value. Read more
Source§

impl<T> From<T> for T

Source§

fn from(t: T) -> T

Returns the argument unchanged.

Source§

impl<T, VERUS_SPEC__A> FromSpec<T> for VERUS_SPEC__A
where VERUS_SPEC__A: From<T>,

Source§

exec fn obeys_from_spec() -> bool

Source§

exec fn from_spec(v: T) -> VERUS_SPEC__A

Source§

impl<T, U> Into<U> for T
where U: From<T>,

Source§

fn into(self) -> U

Calls U::from(self).

That is, this conversion is whatever the implementation of From<T> for U chooses to do.

Source§

impl<T, VERUS_SPEC__A> IntoSpec<T> for VERUS_SPEC__A
where VERUS_SPEC__A: Into<T>,

Source§

exec fn obeys_into_spec() -> bool

Source§

exec fn into_spec(self) -> T

Source§

impl<T, U> IntoSpecImpl<U> for T
where U: From<T>,

Source§

open spec fn obeys_into_spec() -> bool

{ <U as FromSpec<Self>>::obeys_from_spec() }
Source§

open spec fn into_spec(self) -> U

{ U::from_spec(self) }
Source§

impl<T, U> TryFrom<U> for T
where U: Into<T>,

Source§

type Error = Infallible

The type returned in the event of a conversion error.
Source§

fn try_from(value: U) -> Result<T, <T as TryFrom<U>>::Error>

Performs the conversion.
Source§

impl<T, VERUS_SPEC__A> TryFromSpec<T> for VERUS_SPEC__A
where VERUS_SPEC__A: TryFrom<T>,

Source§

exec fn obeys_try_from_spec() -> bool

Source§

exec fn try_from_spec( v: T, ) -> Result<VERUS_SPEC__A, <VERUS_SPEC__A as TryFrom<T>>::Error>

Source§

impl<T, U> TryInto<U> for T
where U: TryFrom<T>,

Source§

type Error = <U as TryFrom<T>>::Error

The type returned in the event of a conversion error.
Source§

fn try_into(self) -> Result<U, <U as TryFrom<T>>::Error>

Performs the conversion.
Source§

impl<T, VERUS_SPEC__A> TryIntoSpec<T> for VERUS_SPEC__A
where VERUS_SPEC__A: TryInto<T>,

Source§

exec fn obeys_try_into_spec() -> bool

Source§

exec fn try_into_spec(self) -> Result<T, <VERUS_SPEC__A as TryInto<T>>::Error>

Source§

impl<T, U> TryIntoSpecImpl<U> for T
where U: TryFrom<T>,

Source§

open spec fn obeys_try_into_spec() -> bool

{ <U as TryFromSpec<Self>>::obeys_try_from_spec() }
Source§

open spec fn try_into_spec(self) -> Result<U, <U as TryFrom<T>>::Error>

{ <U as TryFromSpec<Self>>::try_from_spec(self) }
§

impl<A> SpecEq<&A> for A
where A: ?Sized,

§

impl<A> SpecEq<&mut A> for A
where A: ?Sized,

§

impl<A> SpecEq<A> for A
where A: ?Sized,

§

impl<A> SpecEq<Ghost<A>> for A

§

impl<A> SpecEq<Tracked<A>> for A