Comments (7)
No bugs are reported when Symbooglix is executed on this bpl file like this:
That is because symbooglix is timing out. Symbooglix is not claiming the program is bug free.
This is a fairly simple example, and I do have to wonder if this problem is due to our usage of quantifiers.
It looks that way. Symbooglix gets stuck in the implementation of $global_allocations()
trying to check one of the calls to $galloc()
.
If I use a very recent build of Z3, Symbooglix eventually gives up because Z3 returns unknown (due to the default 120 second query timeout per call) while trying to check one of the calls to $galloc()
.
array2_free_fail.bpl:95: [Cmd] call $galloc(__SMACK_nondet_signed_long, 8);
Solver returned UNKNOWN!
Not executing a speculative Execution State!
State 0:(Speculative) Disallowed speculative path. Starting at [Ensures] (forall q: ref :: { $Alloc[q] } q != base_addr ==> ($Alloc[q] <==> old($Alloc)[q]))
It is very likely that the problem here is the use of quantifiers.
Attached is a log of the queries Symbooglix issued to Z3
z3_in_log.txt. Maybe there's something that can be done to make Z3 handle the queries faster?
from symbooglix.
Ok, I attempted to reproduce this, and here is what I get. The end of the output I get from symbooglix is as follows:
Cancelled reading stderr
Cancelled reading stdout
killed process
Disposed of process
Exiting with NO_ERRORS_NO_TIMEOUT_BUT_FOUND_SPECULATIVE_PATHS
What does that actually mean?
I thought this output means that symbooglix found no bugs, but I guess I am not really sure what speculative paths imply.
Btw, I am using Z3 release 4.5.0.
from symbooglix.
What does that actually mean?
I thought this output means that symbooglix found no bugs,
That's not what it means.
but I guess I am not really sure what speculative paths imply.
A speculative path is a path that Symbooglix could not prove is feasible. A path becomes "speculative" in Symbooglix at branch points (goto
, assume
, assert
, etc.) if the solver fails to confirm feasibility (i.e. the solver times out or it reports unknown
).
The current implementation of Symbooglix immediately terminates paths marked as "speculative". So having speculative paths implies path exploration might be non-exhaustive.
Therefore if
- Path exploration does not timeout
- speculative paths are reported
- No bugs are reported
then we cannot conclude the program is bug free.
from symbooglix.
It would be useful to have a more human-friendly message here, essentially informing users that paths, and thus bugs, might have been missed.
from symbooglix.
@delcypher : Ok, got it, this makes sense now. Btw, could you send me the query on which Z3 times out? I am having trouble isolating it from the txt file you attached. Thx.
from symbooglix.
@ccadar Good suggestion. I've added that in d4751f5
from symbooglix.
@zvonimir Sorry I completely missed your request. I only just saw it now. I've run again and I've attached the query that hits the 120 second solver timeout.
slow.zip
from symbooglix.
Related Issues (20)
- Examine inconsistency in ICST2016 results HOT 1
- Split Symbooglix.dll
- Handle multi-arity maps correctly HOT 6
- Allow polymorphic map types created using type constructors
- Investigate test failures with Mono 4.4.2 HOT 1
- Investigate poor unit test performance
- AssertionFailingException: Incorrect number of arguments HOT 2
- GlobalDeadDeclEliminationPass leaves unused functions HOT 3
- Adding support for specifying loop/recursion unroll bounds HOT 5
- ArgumentException: the decimal value cannot be represented in the requested number of bits HOT 5
- Support reporting reasons for solver responding with UNKNOWN
- NotImplementedException: (_bvbuiltin not supported! HOT 3
- Symbooglix.Solver.SolverErrorException HOT 2
- missing axiom definition in constraints HOT 1
- GlobalDeadDeclEliminationPass should remove unused procedures/implementations
- Throwing System.ArgumentNullException HOT 7
- Update CI Travis script HOT 1
- Improper use of Boogie Graph class
- Switching symbooglix to MIT license (instead of BSD-2) HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from symbooglix.