Using a symbolic index into an array of function pointers doesn't work about crucible

[brianhuffman]

I tried running this example again, and it produces a different error. It no longer always returns the first element of the array. However, the symbolic function pointer cannot be called with an argument.

The updated saw-script:

bc <- llvm_load_module "issue10.bc";
crucible_llvm_verify bc "mytestfunction" [] false
  do {
    i <- crucible_fresh_var "i" (llvm_int 32);
    j <- crucible_fresh_var "j" (llvm_int 32);
    crucible_precond {{ i < 2 }};
    crucible_execute_func [crucible_term i, crucible_term j];
    crucible_return (crucible_term {{ j + 1 }});
  }
  z3;

It produces the following error:

Symbolic execution failed.
LoadHandle: not a valid function pointer
in mytestfunction at issue10.c:8:12
Stack frame
  Allocations:
    StackAlloc 9 0x10:[64] "issue10.c:7:19"
    StackAlloc 8 0x4:[64] "issue10.c:6:31"
    StackAlloc 7 0x4:[64] "issue10.c:6:24"
  Writes:
    memcopy (9, 0x0:[64]) (6, 0x0:[64]) 0x10:[64]
    *(8, 0x0:[64]) := c@3:bv
    *(7, 0x0:[64]) := c@2:bv
Base memory
  Allocations:
    GlobalAlloc 6 0x10:[64] mytestfunction.funs
    GlobalAlloc 5 0x0:[64] succ
    GlobalAlloc 4 0x0:[64] pred
    GlobalAlloc 3 0x0:[64] mytestfunction
    GlobalAlloc 2 0x0:[64] llvm.memcpy.p0i8.p0i8.i64
    GlobalAlloc 1 0x0:[64] llvm.dbg.declare
  Writes:
    *(6, 0x0:[64]) := [(5, 0x0:[64])
                      ,(4, 0x0:[64])]

[robdockins]

I took a quick look into this. The issue is that function handles are associated to block allocation numbers in a side lookup table. Currently, function handle lookup only succeeds if the pointer value is a concrete pointer. The message is perhaps misleading, but the root cause here is that the pointer ins't concrete, so we aren't sure which function handle to return.

A proper fix for this issue will require being able to merge distinct function handles, and perform the necessary branching at call sites when they are called, etc. I the meantime, I'll alter the error message to be more specific about the cause of the problem (the pointer is symbolic).

[travitch]

Working on this in #615