2018.4.29

2018.4.29

method Swap(a:array?<int>,i:int,j:int)
 modifies a;
 requires a!=null;
 requires 1<=i<j<a.Length;
 ensures a[i]==old(a[j]);
 ensures a[j]==old(a[i]);
 ensures forall m::0<m<a.Length&&m!=i&&m!=j ==> a[m] == old(a[m]);
 ensures multiset(a[..]) == old(multiset(a[..]));
{
 a[i], a[j]:=a[j],a[i];
}