Dafny 4.9.1

New features

• Attribute {:isolate} and {:isolate "paths"} simplify the verification of an assertion by introducing additional verification jobs. {:isolate} can be applied to assert, return and continue statements. When using {:isolate_assertions} or --isolate-assertions, each return statement now creates a separate verification job for each ensures clause. Previously all ensures clauses where verified in a single job, for all return statements. (#5832)

• Verification performance improvement: Fill in matching patterns for the quantifiers introduced by automatic induction to represent the induction hypothesis (IH). Suppress the generation of the induction hypothesis if no such matching patterns are found. Enhance tooltips accordingly. This feature is added to stabilize verification, but by sometimes not generating induction hypotheses, some automatic proofs may no longer go through. For backward compatibility, use an explicit {:induction ...} where ... is the list of variables to use for the induction-hypothesis quantifier. Additionally, use a {:nowarn} attribute to suppress any warning about lack of matching patterns.

  • Improve the selection of induction variables.

  • Allow codatatype equality in matching patterns and as a focal predicate for extreme predicates. More specifically:

    • If a lemma bears {:induction x, y, z}, where x, y, z is a subset of the lemma's parameters (in the same order
      that the lemma gives them), then an induction hypothesis (IH) is generated. The IH quantifies over the
      given variables.

      For an instance-member lemma, the variables may include the implicit this parameter.

      For an extreme lemma, the IH generated is the for corresponding prefix lemma, and the given variables may
      include the implicit parameter _k.

      If good matching patterns are found for the quantifier, then these are indicated in tooltips.
      If no patterns are found, then a warning is generated; except, if the lemma bears {:nowarn}, then only
      an informational message is given.

    • If a lemma bears {:induction} or {:induction true}, then a list of induction variables is determined heuristically.

      If the list is empty, then a warning message is generated and no IH is generated. If the list is nonempty,
      an IH is generated and the list of variables is indicated in a tooltip.

      If good matching patterns are found for the quantifier, then these are indicated in tooltips.
      If no patterns are found, then a warning is generated; except, if the lemma bears {:nowarn}, then only
      an informational message is given.

    • If a lemma bears {:induction false}, then no IH is generated.

    • If a lemma bears an :induction attribute other than those listed above, then an error is generated.

    • If a lemma bears no :induction attribute, and the --manual-lemma-induction flag is present, then no IH is generated.

    • Otherwise, a list of induction variables is determined heuristically.

      If this list is empty, then no IH is generated and no warning/info is given.

      If the list is nonempty, then the machinery looks for matching patterns for the IH quantifier. If none are
      found, then no IH is generated. An informational message is generated, saying which candidate variables were
      used and saying that no matching patterns were found.

      If patterns are found, then an IH is generated, the list of variables and the patterns are indicated in tooltips,
      and the patterns are used with the IH quantifier.

      The pattern search can be overriden by providing patterns explicitly using the {:inductionTrigger} attribute.
      This attribute has the same syntax as the {:trigger} attribute. Using an empty list of triggers restores
      Dafny's legacy behavior (no triggers for lemma induction hypotheses). (#5835)

• Accept decreases to and nonincreases to expressions with 0 LHSs and/or 0 RHSs, and allow parentheses to be omitted when there is 1 LHS and 1 RHS. (#5891)

• Allow forall statements in statement expressions (#5894)

• When using --isolate-assertions or {:isolate_assertions}, a separate assertion batch will be generated per pair of return statement and ensures clause. (#5917)

Bug fixes

• Soundness: {:only} on members only affects verification on the current file. (#5730)

• Soundness: The verifier had assumed properties of this already during the first phase of a constructor (#5876)

• Soundness: Map range requires equality for enclosing type to support equality (#5972)

• Soundness: Newtype now support partial equality correctly (#5980)

• Verification performance: Fixed a bug that would cause the symbol verification tasks to be done multiple times when using module refinement (#5967)

• Fixed a bug that caused hide * and reveal * not to work when used in statement expressions,
  after a variable assignment occurred in the same expression.
  (#5781)

• Fix malformed Boogie in function override checks (#5875)

• Don't assume type information before binding variables (for let expressions and named function results) (#5877)

• Enable using reveal statement expression inside witness expressions (#5882)

• Fix formatting of var by statements (#5927)

• Fix bugs that occur when using {:extern} to export members (#5939)

• Improved code navigation for datatype update expressions (#5986)