 04 Oct, 2017 1 commit


Robbert Krebbers authored

 26 Sep, 2017 1 commit


Robbert Krebbers authored
We used to normalize the goal, and then checked whether it was of a certain shape. Since `uPred_valid P` normalized to `True ⊢ P`, there was no way of making a distinction between the two, hence `True ⊢ P` was treated as `uPred_valid P`. In this commit, I use type classes to check whether the goal is of a certain shape. Since we declared `uPred_valid` as `Typeclasses Opaque`, we can now make a distinction between `True ⊢ P` and `uPred_valid P`.

 25 Sep, 2017 4 commits


Dan Frumin authored

Dan Frumin authored

Dan Frumin authored

Dan Frumin authored
Instead of writing a separate tactic lemma for each pure reduction, there is a single tactic lemma for performing all of them. The instances of PureExec can be shared between WP tactics and, e.g. symbolic execution in the ghost threadpool

 24 Mar, 2017 1 commit


Robbert Krebbers authored

 09 Mar, 2017 1 commit


Ralf Jung authored

 06 Feb, 2017 1 commit


Ralf Jung authored

 05 Jan, 2017 1 commit


Ralf Jung authored

 03 Jan, 2017 1 commit


Ralf Jung authored
This patch was created using find name *.v  xargs L 1 awk i inplace '{from = 0} /^From/{ from = 1; ever_from = 1} { if (from == 0 && seen == 0 && ever_from == 1) { print "Set Default Proof Using \"Type*\"."; seen = 1 } }1 ' and some minor manual editing

 22 Dec, 2016 1 commit


Ralf Jung authored

 20 Dec, 2016 1 commit


Ralf Jung authored

 12 Dec, 2016 1 commit


Ralf Jung authored

 09 Dec, 2016 6 commits


Ralf Jung authored

Ralf Jung authored
Really, *all* of our files contain proof rules

Robbert Krebbers authored

Robbert Krebbers authored

Robbert Krebbers authored

Robbert Krebbers authored
The WP construction now takes an invariant on states as a parameter (part of the irisG class) and no longer builds in the authoritative ownership of the entire state. When instantiating WP with a concrete language on can choose its state invariant. For example, for heap_lang we directly use `auth (gmap loc (frac * dec_agree val))`, and avoid the indirection through invariants entirely. As a result, we no longer have to carry `heap_ctx` around.

 08 Dec, 2016 2 commits
 06 Dec, 2016 3 commits


Robbert Krebbers authored

Ralf Jung authored

Ralf Jung authored

 22 Nov, 2016 1 commit


Ralf Jung authored

 08 Nov, 2016 1 commit


Robbert Krebbers authored

 03 Nov, 2016 1 commit


Robbert Krebbers authored
The old choice for ★ was a arbitrary: the precedence of the ASCII asterisk * was fixed at a wrong level in Coq, so we had to pick another symbol. The ★ was a random choice from a unicode chart. The new symbol ∗ (as proposed by David Swasey) corresponds better to conventional practise and matches the symbol we use on paper.

 01 Nov, 2016 3 commits
 28 Oct, 2016 1 commit


Robbert Krebbers authored

 25 Oct, 2016 1 commit


Robbert Krebbers authored
And also rename the corresponding proof mode tactics.

 16 Oct, 2016 1 commit


JacquesHenri Jourdan authored
This fact is deduced from reducibility. Unfortunately, this sometimes depends on the type of states being inhabited, so that this additional hypothesis sometimes appear.

 12 Oct, 2016 1 commit


Ralf Jung authored
rename program_logic.{ownership > wsat}. It really is about world satisfaction and invariants more than about ownership.

 05 Oct, 2016 1 commit


Robbert Krebbers authored

 30 Aug, 2016 1 commit


Robbert Krebbers authored

 28 Aug, 2016 1 commit


Robbert Krebbers authored
This also removes the double use of the name 'wp_fork' in both program_logic/weakestpre and heap_lang/lifting.

 23 Aug, 2016 1 commit


Robbert Krebbers authored
Also, since do_head_step no longer has a purpose, I have removed it and just use a bunch of eauto hints.

 22 Aug, 2016 1 commit


Robbert Krebbers authored
This is more consistent with CAS, which also can be used on any value. Note that being able to (atomically) test for equality of any value and being able to CAS on any value is not realistic. See the discussion at https://gitlab.mpisws.org/FP/iriscoq/issues/26, and in particular JH Jourdan's observation: I think indeed for heap_lang this is just too complicated. Anyway, the role of heap_lang is not to model any actual programming language, but rather to show that we can do proofs about certain programs. The fact that you can write unrealistic programs is not a problem, IMHO. The only thing which is important is that the program that we write are realistic (i.e., faithfully represents the algorithm we want to p This commit is based on a commit by Zhen Zhang who generalized equality to work on any literal (and not just integers).
