pschanely / CrossHair, Hacker News

Interprocedural analysis.) CrossHair (1) validates the pre-conditions of called functions and (2) uses post-conditions of called functions to help it prove post-conditions in the caller.

Verify across all implementations.Contracts are particularly helpful when applied to base classes / interfaces: all implementations will be verified against them:

Catch errors. Setting a trivial post-condition of “True” is enough to enable analysis, which will find exceptions like index out-of-bounds errors:

**********

Support your type checker.CrossHair is a nice companion tomypy. Assert statements divide work between the two systems:

**********

**********

Cover doctest’s blind spots.Doctestis great for illustrative examples and CrossHair can document behavior more holistically. Some kinds of projects may be able to skip unittest / pytest entirely.

**********************************

******************** How to Write Contracts**************************

CrossHair largely follows thePEP 656

syntax for expressing “contracts. ” In short:

(Place contracts inside the docstrings for functions.) ****************************************************

Declare your post-conditions (what you expect to be true of the function’s return value) like this: (******************************************************post: __return__>0(If you like, you can use a single underscore (****************************** _________________ ********************************** a short-hand for__ return __
Functions are checked if they have at least one post-condition line in their docstring.
Declare your pre-conditions (what you expect to be true of the function's inputs) like this: (****************************************************pre: x
Delcare that your function mutates arguments with square brackets after the (post) keyword.When doing so, the old values ​​of the arguments are available in a special object called __ old __ :
(********************************************** (post [x]: x>__old __. x******************************************** ()
Comparison for the purposes of mutation checking is a "deep" comparison.
Use empty square brackets to assert that the function does not mutate any argument. (************************************************************
If your function can validly raise certain exceptions, declare them like this: (****************************************************************************************** raises: IndexError , ZeroDivisionError (**************************************
Declare class invariants in the class's docstring like this: (******************************************************** inv: self.fooClass invariants apply additional pre- and post-conditions to each member function.

• Find examples in the (examples /

  directory.

************************************