NonZero (unchecked_mul & unchecked_add) Proof for Contracts

[tautschnig]

Towards #71

These are the changes contributed by SahithiMV in #184 plus the proposed changes in that PR.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 and MIT licenses.

[carolynzech]

Suggested change

	#[kani::proof_for_contract(<$t>::unchecked_add)]
	#[kani::proof_for_contract(<$nonzero_type>::unchecked_add)]

[tautschnig]

No, that would not produce the right type. We want something like <i8>::unchecked_add, not <NonZeroI8>::unchecked_add.

[carolynzech]

But taking u8 as my example, won't that produce a proof for https://doc.rust-lang.org/std/primitive.u8.html#method.unchecked_add instead of https://doc.rust-lang.org/std/num/struct.NonZero.html#method.unchecked_add?

[tautschnig]

I tried to use your proposed patch, but then I get:

error: Failed to resolve checking function < core::num::NonZeroU8 > :: unchecked_add because unable to find `core` inside module `num::nonzero::verify`
    --> /verify-rust-std.git/library/core/src/num/nonzero.rs:2875:13
     |
2875 |             #[kani::proof_for_contract(<$nonzero_type>::unchecked_add)]
     |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
...
2887 |     nonzero_check_add!(u8, core::num::NonZeroU8, nonzero_check_unchecked_add_for_u8);
     |     -------------------------------------------------------------------------------- in this macro invocation
     |
     = note: this error originates in the attribute macro `kani::proof_for_contract` which comes from the expansion of the macro `nonzero_check_add` (in Nightly builds, run with -Z macro-backtrace for more info)

Maybe I'm doing something wrong, but the one with $t is really the only one I was able to make work so far.

[carolynzech]

You were not doing anything wrong, this is a Kani bug. I've verified that with the changes from model-checking/kani#4051, this:

#[kani::proof_for_contract(NonZero::<$t>::unchecked_add)]

compiles.

[carolynzech]

So in the meantime, this PR can change all the targets of the proof_for_contract to be correct, and then we'll have to wait for Kani to update.

[tautschnig]

Argh, thank you so much for getting this right! I have updated the PR, so expecting CI to fail for the time being.