The Fortress Language Specification - CiteSeerX

The invariant clause consists of a sequence of expressions of any type. These expressions are evaluated before and
after a function call. For each expression e in this sequence, if the value of e when evaluated before the function call
is not equal to the value of e after the function call, a CalleeViolation exception is thrown.
Here are some examples:
factorial(n : Z64) requires n ≥ 0 =
if n = 0 then 1
else nfactorial(n − 1)
end
mangle(input : List) ensures sorted(result) provided sorted(input) =
if input ≠ Empty
then mangle(first(input))
mangle(rest(input))
end
Overloaded function contracts are handled similarly with method contracts described in Section 9.4. In particular,
substitutability is preserved: the statically most applicable function to a call should be substitutable with the dynamically
most applicable function to the call. For a call of function f, we use the term static contract of f to refer to a
contract declared in the statically most applicable function declaration and the term dynamic contract of f to refer to
a contract declared in the dynamically most applicable function declaration. Three exceptions may be thrown due to
an overloaded function contract violation: CallerViolation is thrown when the requires clause of the static contract
fails, CalleeViolation is thrown when the ensures or invariant clause of the dynamic contract fails, and
ContractOverloadingViolation is thrown when the requires clause of the dynamic contract or the ensures or
invariant clause of the static contract fails.
Evaluation of a call of function f proceeds as follows. Let C and C ′ be the static and dynamic contracts of f,
respectively. If the requires clause of C fails, a CallerViolation exception is thrown. Otherwise, if the requires
clause of C ′ fails, a ContractOverloadingViolation exception is thrown. Otherwise, the provided subclauses of C
and C ′ are evaluated. For every provided subclause that evaluates to true , the corresponding ensures subclause is
recorded in a table E for later comparison. Similarly, the invariant clauses of C and C ′ are evaluated and the results
are stored in E for later comparison. Then the body of the dynamically most applicable function declaration of f is
evaluated. After evaluation of the body, all ensures subclauses of the dynamic contract recorded in E are checked
to ensure that they evaluate to true , and all invariant clauses of the dynamic contract recorded in E are checked
to ensure that they evaluate to values equal to the values they evaluated to before evaluation of the body. If any such
check fails, a CalleeViolation exception is thrown. Otherwise, all ensures subclauses and invariant clauses
of the static contract in E are checked. If any of these checks fails, a ContractOverloadingViolation exception is
thrown.
90