Reasoning with specifications containing method calls and model fields

class AbstractList { //@ model public int size; //@ in isEmpty; //@ model public boolean isEmpty; //@ public represents isEmpty <(size == 0); //@ public invariant size >= 0; //@ assignable isEmpty; //@ ensures isEmpty; abstract public void clear(); //@ assignable size; // but isEmpty is not assignable //@ ensures size <= \old(size); //@ ensures \old(size) > 0 ==> size > 0; abstract public void shrink(); } class ListImpl extends AbstractList {