c# - Code contracts: Array access upper bound warning when mapping to 2d array -

good day.

i'm testing out c# code contracts.
i've been working on matrix implementations, , wanted use code contracts arithmetic checking (eg. when matrix multiplication valid).

in order store data, use 1 dimensional array , access data this:

values[r * totalcolumns + c]   

r: row access
c: column access

my problem is:
code contracts thinks access might above upper bounds of array.
think i've given enough information, in order system validate not possible (see example bellow).

my question is:
can take @ example code , explain me, did wrong , why code contracts still thinks array acces unsafe?
code in question in getvalue method , marked comment.

public class test {     [contractpublicpropertyname("values")]     private readonly double[] values;      [contractpublicpropertyname("x")]     private readonly int x;      [contractpublicpropertyname("y")]     private readonly int y;      // getter properties required contract visibility.     public double[] values => this.values;     public int x => this.x;     public int y => this.y;      public test(int x, int y)     {         contract.requires(x > 0);         contract.requires(y > 0);          contract.ensures(this.x == x);         contract.ensures(this.y == y);         contract.ensures(this.values.length == this.x * this.y);          this.x = x;         this.y = y;         this.values = new double[x * y];     }      [pure]     public double getvalue(int xindex, int yindex)     {         contract.requires(xindex >= 0);         contract.requires(yindex >= 0);         contract.requires(xindex < this.x);         contract.requires(yindex < this.y);          // array access might above upper bound.          // making assumption on this.y static checker unaware of?         return this.values[xindex * this.y + yindex];     }      [contractinvariantmethod]     private void objectinvariant()     {         contract.invariant(this.x > 0);         contract.invariant(this.y > 0);         contract.invariant(this.values.length == this.x * this.y);     } } 

thank

after trial , error, found solution.
seems, code contracts validation process not able verify, formula

xindex * this.y + yindex < this.values.length 

is true given preconditions , invariants.

solution:
adding contract.assume, validation process stops exclaiming.

public double getvalue(int xindex, int yindex) {     contract.requires(xindex >= 0);     contract.requires(yindex >= 0);     contract.requires(xindex < this.x);     contract.requires(yindex < this.y);      // code contract     contract.assume(xindex * this.y + yindex < this.values.length);     return this.values[xindex * this.y + yindex]; } 

conclusion:
while code contracts simple verifications (boundary, etc.), needs developer when verifying more complex formulas.