Choose under lamba #139
Description
In this PR epfl-lara/stainless#946, I changed the way VCs are generated in the type-checker, and the following file is now valid:
https://github.com/epfl-lara/stainless/blob/965b0ec485e62715003738e73605bd4dbb5da1da/frontends/benchmarks/verification/invalid/Equations1.scala
But I was expecting the second equations to fail, because the makeEqual(x, y) evidence shouldn't "leak".
I've narrowed the issue to this tip file, on which Inox returns UNSAT (I've tried z3 and cvc4 1.8).
Surprisingly, removing the assertion on eq2 makes Inox return SAT. (removing the assertion on eq1 makes Inox return SAT as well)
(declare-datatypes (A B) ((RAEquations (RaCons (lhs (=> A)) (rhs (=> A)) (ev (=> B))))))
(datatype-invariant (par (A B) this (RAEquations A B) (= (@ (lhs this)) (@ (rhs this)))))
(declare-datatypes () ((Unit (Uu))))
(define-fun makeEqual ((x Int) (y Int)) Unit (choose unused Unit (= x y)))
(declare-const x Int)
(declare-const y Int)
(declare-const eq1 (RAEquations Int Unit))
(declare-const eq2 (RAEquations Int Unit))
(assert (= eq1 (RaCons (lambda () x) (lambda () x) (lambda () (makeEqual x y)))))
(assert (= eq2 (RaCons (lambda () x) (lambda () x) (lambda () Uu))))
(assert (not (= y x)))
(check-sat)