TreeMaker approximation refactorings and bug fixes

- TypeTestTreeMaker subsumes the old TypeTestTM and TypeAndEqualityTM
  its type- and equality-testing logic is configurable so that it can:
    - generate trees (main purpose)
    - check whether this tree maker is a pure type test
    - generate the proposition that models this tree maker
      (for exhaustivity and other analyses)

- [CSE] subst binders of dropped tm's to stored ones
  somehow the refactoring broke the replacement of the binder of dropped
  treemakers by the binder of the reused treemaker

  when replacing

  TM1(x1 => ...) >> TM2(x2 => ...) >> TM3(x3 => ...) >>  ...
  TM1'(x1' => ...) >> TM2'(x2' => ...) >> TM3(x3' => ...) >> ...

  by

  Memo1(x1 => ...) >> TM2(x2 => ...) >> Memo2(x3 => ...) >>  ...
  Reuse(Memo2)...

  you need to replace x1' and x2' by x1

  since TM2 tested a shared condition but was not memo-ised,
  that implies it simply passed x1 through to x3 unmodified,
  and x2' can simply use the stored x1

- type of first uniqued binder sets type of tree
  when approximating a tree of treemakers as a DAG,
  where sharing indicates the same value is tested,
  use the type of the binder that was first used to
  create a unique tree as the type of that tree,
  and thus all trees used for the same binder in the future

- track substitution of alternatives when approximating

- error on unswitchable @switch annotated matches
  if we can't turn a match (with more than two cases) into a switch,
  but the user insists, emit an error

misc notes:
- when all you need is nextBinder, FunTreeMaker is your guy
- must pass flag to TypeTestTM for extractorarg test
  case TypeTestTreeMaker(prevBinder, testedBinder, expectedTp, nextBinderTp)
  (prevBinder eq testedBinder) does not imply it's a pure type test for an extractor call
  note that the expected type for an extractor argument is not a type pattern,
  thus we only do a classic type test -- the idea was to detect that case by noticing we're
  being called with the same previous and tested binder, but that case also arises
  for Typed patterns
Exhaustivity: TreeMakers as boolean propositions

We check exhaustivity by representing a match as a formula in
finite-domain propositional logic (FDPL) that is false when
the match may fail. The variables in the formula represent
tested trees in the match (type tests/value equality tests).

The approximation uses the same framework as the CSE analysis.
A matrix of tree makers is turned into a DAG, where sharing
represents the same value/type being tested.

We reduce FDPL to Boolean PL as follows.
For all assignments, V_i = c_i_j, we introduce a proposition
P_i_j that is true iff V_i is equal to the constant c_i_j,
for a given i, and all j, P_i_j are mutually exclusive
(a variable cannot have multiple values).
If the variable's domain is closed, we assert that one of P_i_j
must be true for each i and some j. The conjunction of these
propositions constitutes the equality axioms.

After going through negational normal form to conjunctive normal
form, we use a small SAT solver (the DPLL algorithm) to find
a model under which the equational axioms hold but the match fails.
The formula: EqAxioms /\ -MatchSucceeds.
Note that match failure expresses nicely in CNF: the
negation of each case (which yields a disjunction) is anded.

We then turn this model into variable assignments
(what's the variable (not) equal to, along with recursive
assignments for its fields). Valid assignments (no ill-typed
field assignments) are then presented to the user as counter examples.
A counter example is a value, a type test, a constructor call
or a wildcard. We prune the example set and only report the
most general examples. (Finally, we sort the output to yield stable,
i.e. testable, warning messages.)

A match is only checked for exhaustivity when the type of the
selector is "checkable" (has a sealed type or is a tuple
with at least one component of sealed type).

We consider statically known guard outcomes, but generally back
off (don't check exhaustivity) when a match has guards
or user-defined extractor calls. (Sometimes constant folding
lets us statically decide a guard.)
We ignore possibly failing null checks (which are performed
before calling extractors, for example), though this could
be done easily in the current framework. The problem is false
positives. People don't usually put nulls in tuples or lists.

To improve the exhaustivity checks, we rewrite `List()` to Nil.
TODO: more general rewrite of List(a, b, ..., z) to `a :: b :: ... :: z`.
When presenting counter examples, we represent lists in the
user-friendly List(a,...,z) format. (Similarly for tuples.)

There are no exhaustivity checks for a match-defined PartialFunction.

misc notes:
- fix pure case of dpll solver
  impure set (symbol that occurs both as a positive and negative literal)
  was always empty since I was looking for literals (which are not equal if positivity is not equal)
  but should have been looking for symbols

- FDPL -> BoolPL translation collects all syms in props
  since propForEqualsTo generates an Or, must traverse the prop
  rather than assuming only top-level Syms are relevant...

  also, propForEqualsTo will not assume Or'ing a whole domain is equivalent to True
  (which it isn't, since the type test may fail in general)

- improve counter example description
  - treat as constructor call when we either have definite type information about a real class,
    or we have no equality information at all, but the variable's type is a class
    and we gathered constraints about its fields (typically when selector is a tuple)
  - flatten a :: b :: ... :: Nil to List(a, b, ...)
  - don't print tuple constructor names, so instead of "Tuple2(a, b)", say "(a, b)"

- filter out more statically impossible subtypes
  the static types convey more information than is actually checkable at run time
  this is good, as it allows us to narrow down the subtypes of a sealed type,

  however, when modeling the corresponding run-time checks we need to "erase" the
  uncheckable parts (using existentials so that the types are still well-kinded),
  so that we can use static subtyping as a sound model for dynamic type checks

- experimental java enum handling seals enum class
    before, we created a refinement class as the placeholder for the sealed children
    it seems more direct to use the enum class for that
    this way, the new pattern matcher's exhaustiveness checker just works for java enums
Merge pull request #601 from adriaanm/3f7b8b58748eb70aec4269f1ef63853b5ad4af60

virtpatmat: treemaker approximation refactorings and exhaustivity