-
Notifications
You must be signed in to change notification settings - Fork 277
Closed
Labels
awsBugs or features of importance to AWS CBMC usersBugs or features of importance to AWS CBMC usersaws-highpending mergesoundnessSoundness bug? Review and add "aws" if it is, or remove "soundness" if it isn't.Soundness bug? Review and add "aws" if it is, or remove "soundness" if it isn't.
Description
CBMC version: 5.40.0 (0cdc654) with PR 6376 and 5.31.0
Operating system: Both Ubuntu 20 and macOS 11.6 (20G165)
Exact command line resulting in the issue:
$ cbmc --version
5.31.0 (cbmc-5.31.0)
$ cbmc --object-bits 11 --unwinding-assertions --unwind 2 before-slice.out &> before-log.txt
$ goto-instrument --reachability-slice before-slice.out after-slice.out
Reading GOTO program from 'before-slice.out'
Function Pointer Removal
Virtual function removal
Cleaning inline assembler statements
Performing a reachability slice
Writing GOTO program to 'after-slice.out'
$ cbmc --object-bits 11 --unwinding-assertions --unwind 2 after-slice.out &> after-log.txt
$ cat before-log.txt | grep VERIFICATION
VERIFICATION FAILED
$ cat after-log.txt | grep VERIFICATION
VERIFICATION SUCCESSFUL
The issue seems to be this function goes from nontrivial to an assume(0)
despite being reachable:
// _ZN3std2io5error5Error3new17h1430579a7771a700E
// file /home/ubuntu/rmc/library/std/src/io/error.rs line 407 column 5 function std::io::Error::new
struct _5372671742868111021 _ZN3std2io5error5Error3new17h1430579a7771a700E(struct _5803772184803114267 kind, struct _12284072475024233176 error)
{
struct _5372671742868111021 var_0;
struct _5803772184803114267 var_3;
struct _194830641207493724 var_4;
struct _194830641207493724 var_5;
struct _12284072475024233176 var_6;
bb0:
;
var_3 = kind;
var_5=_ZN50_$LT$T$u20$as$u20$core__convert__Into$LT$U$GT$$GT$4into17h248557188006561aE(var_6);
bb1:
;
var_4 = var_5;
var_0=_ZN3std2io5error5Error4_new17h9c927d8b7dad0d7aE(var_3, var_4);
bb2:
;
return var_0;
}
to
// _ZN3std2io5error5Error3new17h1430579a7771a700E
// file /home/ubuntu/rmc/library/std/src/io/error.rs line 407 column 5 function std::io::Error::new
struct _5372671742868111021 _ZN3std2io5error5Error3new17h1430579a7771a700E(struct _5803772184803114267 kind, struct _12284072475024233176 error)
{
__CPROVER_assume(0);
bb2:
;
}
What behaviour did you expect: same result
What happened instead: verification result changes
Binaries included here, apologies that they are large, so far unable to replicate on a minimal example:
reachability-slice-bug.zip
Metadata
Metadata
Assignees
Labels
awsBugs or features of importance to AWS CBMC usersBugs or features of importance to AWS CBMC usersaws-highpending mergesoundnessSoundness bug? Review and add "aws" if it is, or remove "soundness" if it isn't.Soundness bug? Review and add "aws" if it is, or remove "soundness" if it isn't.