Comments (3)
fixed in above commit. The issue was with not handling properly the case when optimization removes all basic blocks of the function.
from seahorn.
example.c
#include "seahorn/seahorn.h"
#define LIMIT1 1000
#define LIMIT2 1000
int count;
int *count_global_p = &count;
void incr_count() {
count++;
}
void doit(int i, int j) {
if (i > j) {
incr_count();
}
}
int main() {
int i = 0, j = 0;
for (i = 0; i < LIMIT1; i++) {
//storeGlobalVar
int count_store = *count_global_p;
//renameUsedVar
int j_1 = j;
int i_1 = i;
//initial_loop
for (j = 0; j < LIMIT2; j++) {
doit(i, j);
}
//restoreGlobalVar
*count_global_p = count_store;
//same_loop
for (j_1 = 0; j_1 < LIMIT2; j_1++) {
doit(i_1, j_1);
}
//conditionStmt
sassert(j == j_1) ;
sassert(i == i_1) ;
}
return 0;
}
This example is still about "crash backtrace" message.
In example.c
, the two inner for
loops are equivalent in terms of the operation of the function doit()
. The two statements int count_store = *count_global_p;
and *count_global_p = count_store;
are used to ensure that the global variable count
has the same value before the two for
loops.
I ran sea bpf example.c
but got the unexpected "crash backtrace" message. (shown in this crash- backtrace.txt)
Please help me explain why this message appeares. Thanks.
from seahorn.
Unfortunately this is not something I will be able to fix (at least not quickly). The root cause of the problem is in LLVM's implementation of ScalarEvolution
. It is implemented using recursion, and your program, when unrolled, is too big for the stack. Recursion runs out of stack and that causes a crash.
It works for LIMIT
of 248
or below, and runs out of stack for higher limits on my machine.
Note that you really should not expect bounded model checker to work well on code that requires thousands of loop unrollings. Even if seahorn generates the verification condition, it will not be solvable, except for trivial instances.
If you are working on program equivalence, you should be looking into heuristics to break the problem into parts that can be shown equivalent in isolation. This is a strategy that tends to work well for hardware equivalence checking.
There has been number of works on applying similar techniques for software via what is called a self-composition of a program with itself, or slightly modified version of itself.
from seahorn.
Related Issues (20)
- Bulilding SeaHorn with Docker does not work as expected HOT 7
- Entry point of sea horn HOT 1
- Handling k-safety property HOT 2
- Unexpected result about global variable. HOT 2
- Compile error during installation from source HOT 1
- Not able to execute the counterexample from seahorn using `exe`, `-lstdc++` error. HOT 1
- Termination Analysis leads to ModuleNotFoundError: No module named 'z3' HOT 1
- Problem with adding a special verifier call HOT 2
- Seahorn gives SAT, but the harness failed to show assertion violation. HOT 1
- Compilation error on main branch HOT 1
- CHC mode with `pf` timeout but BMC gives `sat` result. Why are they giving different results? HOT 13
- Mismatch: BPF vs PF HOT 3
- Seahorn misses error in programs with nested array indices HOT 3
- Seahorn unable to find bug with bounded frontend HOT 1
- Initializing arrays yields sat with sentinel frontend HOT 1
- Imprecise results with unsigned overflows
- Not able to emit loop invariant for a program. HOT 1
- argparse error after successful local build HOT 2
- Different behaviors when working with O0
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from seahorn.