Range check and Length check in Ada (SPARK Mode) - ada

Question

these last weeks I have been trying to learn the ADA language, to do it I made an exercise to reverse a string using recursion, however when I compile it with GNATProve it gives me several errors which I have not been able to solve, it would be of great help if you could guide me on how to solve them using Preconditions and Postconditions.
My code:
function String_Reverse(Str:String) return String with
Pre => Str'Length > 0 ,
Post => String_Reverse'Result'Length <= Str'Length;
function String_Reverse (Str : String) return String is
Result : String (Str'Range);
begin
if Str'Length = 1 then
Result := Str;
else
Result :=
String_Reverse (Str (Str'First + 1 .. Str'Last)) &
Str (Str'First);
end if;
return Result;
end String_Reverse;
Errors:
dth113.adb:18:69: low: range check might fail
18>| String_Reverse (Str (Str'First + 1 .. Str'Last)) &
19 | Str (Str'First);
reason for check: result of concatenation must fit in the target type of the assignment
possible fix: precondition of subprogram at line 8 should mention Str
8 | function String_Reverse(Str:String) return String with
| ^ here
dth113.adb:18:69: medium: length check might fail
18>| String_Reverse (Str (Str'First + 1 .. Str'Last)) &
19 | Str (Str'First);
reason for check: array must be of the appropriate length
possible fix: precondition of subprogram at line 8 should mention Str
8 | function String_Reverse(Str:String) return String with
| ^ here
I'm tried using Preconditons and Postconditions about the input Str length

Answer 1

Gnatprove appears to have some difficulty with concatenating arrays.
This below proves, using subtypes rather than pre- and post-conditions. Proving that the result is actually the reverse of the input string might be trickier!
Spec:
pragma SPARK_Mode;
function String_Reverse (Str : String) return String with
Pre => Str'Length > 0,
Post => String_Reverse'Result'Length = Str'Length;
Body:
pragma SPARK_Mode;
function String_Reverse (Str : String) return String is
subtype Result_String is String (Str'Range);
Result : Result_String;
begin
if Str'Length = 1 then
Result := Str;
else
declare
subtype Part_String is String (1 .. Str'Length - 1);
Reversed_Part : constant Part_String
:= String_Reverse (Str (Str'First + 1 .. Str'Last));
begin
Result := Reversed_Part & Str (Str'First);
end;
end if;
return Result;
end String_Reverse;
With a minor change you could handle zero-length strings as well.

Answer 2

Your program keeps appending the bulk of the string to your result. This makes a string much larger than the initial string parameter. You cannot fix this with improved preconditions or post conditions.
See the difference between your solution and the Reverse_String function shown below. In the solution below the size of the returned string cannot be the size of the function string in parameter because it is building the reversed string with each recursion and the size of the string cannot be determined until all recursions complete.
with Ada.Text_IO; use Ada.Text_IO;
procedure Main is
function Reverse_String(S : in String; Idx : Positive) return String is
begin
if Idx < S'Last then
return Reverse_String(S, Idx + 1) & S(Idx);
else
return S(Idx) & "";
end if;
end Reverse_String;
S1 : String := "Hello World";
s2 : String := "1234567890";
N1 : Integer := 12345;
N3 : Integer;
begin
Put_Line(S1 & " : " & Reverse_String(S1, 1));
Put_Line(S2 & " : " & Reverse_String(S2, 1));
N3 := Integer'Value(Reverse_String(N1'Image, 1));
Put_Line(N1'Image & " : " & N3'Image);
end Main;
This version of Reverse_String keeps incrementing the index of the input string and concatenating that character at the end of all the characters yet to reverse.
The Reverse_String's else clause appends an empty string to the last character so that it is viewed by the compiler as a string and not a character because S(Idx) is a single character and is not a string, but concatenating S(Idx) with an empty string results in a string.

Answer 3

Here is another implementation
function String_Reverse (Str : String) return String is
Result : String (Str'Range) := Str;
begin
for I in reverse Str'Range loop
Result(Str'Last - I + Result'First) := Str(I);
end loop;
return Result;
end String_Reverse;

Answer 4

SPARK seems to be happier with expression functions than with regular functions in many cases. I don't know if it will make a difference, but you could try rewriting the body of your function as
function String_Reverse (Str : String) return String is
(if Str'Length = 1 then
Str
else
String_Reverse (Str (Str'First + 1 .. Str'Last) ) & Str (Str'First) );
(I hope I've got the parentheses balanced.)
Typically one allows null strings, and the function becomes something like
function Reversed (S : in String) return String with
Post => Reversed'Result'Length = S'Length;
function Reversed (S : in String) return String is
(if S'Length = 0 then ""
else Reversed (S (S'first + 1 .. S'Last) & S (S'First) );
(Hint: "Ada" is a woman's name, not an acronym. GNATProve is a static-analysis tool, not a compiler.)