|
| 1 | +# Correctness Witness Validation by Abstract Interpretation |
| 2 | +## Artifact |
| 3 | + |
| 4 | +This artifact contains everything mentioned in the evaluation section of the paper: Goblint implementation, scripts, benchmarks, manual witnesses and other tools. |
| 5 | + |
| 6 | +**Note to artifact reviewers:** in the smoke test phase, try to only run the performance evaluation since it is very quick compared to the precision evaluation. |
| 7 | + |
| 8 | +## Requirements |
| 9 | +* [VirtualBox](https://www.virtualbox.org/). |
| 10 | +* 2 CPU cores. |
| 11 | +* 8 GB RAM. |
| 12 | +* 7 GB disk space. |
| 13 | +* ~45min. |
| 14 | + |
| 15 | +## Layout |
| 16 | +* `README.md`/`README.pdf` — this file. |
| 17 | +* `LICENSE`. |
| 18 | +* `unassume.ova` — VirtualBox virtual machine. |
| 19 | + |
| 20 | + In `/home/vagrant` contains: |
| 21 | + * `goblint/` — Goblint with unassume support, including source code. |
| 22 | + * `CPAchecker-2.2-unix/` — CPAchecker from [SV-COMP 2023 archives](https://gitlab.com/sosy-lab/sv-comp/archives-2023). |
| 23 | + * `UAutomizer-linux/` — Ultimate Automizer from [SV-COMP 2023 archives](https://gitlab.com/sosy-lab/sv-comp/archives-2023). |
| 24 | + * `eval-prec/` — precision evaluation (script, benchmarks, manual witnesses). |
| 25 | + * `eval-perf/` — performance evaluation (script, benchmarks, manual witnesses). |
| 26 | + * `results/` — results (initially empty). |
| 27 | + |
| 28 | +* `results/` — evaluation results tables with data used for the paper. |
| 29 | + |
| 30 | +## Reproduction |
| 31 | +1. Import the virtual machine into VirtualBox. |
| 32 | +2. Start the virtual machine and log in with username "vagrant" (not "Ubuntu"!) and password "vagrant". |
| 33 | +3. Right click on the desktop and open Applications → Accessories → Terminal Emulator. |
| 34 | + |
| 35 | +### Precision evaluation |
| 36 | +1. Run `./eval-prec/run.sh` in the terminal emulator. This takes ~42min. |
| 37 | +2. Run `firefox results/eval-prec/table-generator.table.html` to view the results. |
| 38 | + |
| 39 | + The HTML table contains the following status columns (cputime, walltime and memory can be ignored): |
| 40 | + 1. Goblint w/o witness (true means verified). |
| 41 | + 2. Goblint w/ manual witness (true means witness validated). |
| 42 | + 3. Goblint w/ witness from CPAchecker (true means program verified with witness-guidance). |
| 43 | + 4. Goblint w/ witness from CPAchecker (true means witness validated). |
| 44 | + 5. Goblint w/ witness from UAutomizer (true means program verified with witness-guidance). |
| 45 | + 6. Goblint w/ witness from UAutomizer (true means witness validated). |
| 46 | + |
| 47 | + Table 1 in the paper presents these results, except the rows are likely in a different order. |
| 48 | + |
| 49 | +### Performance evaluation |
| 50 | +1. Run `./eval-perf/run.sh` in the terminal emulator. This takes ~30s. |
| 51 | +2. Run `firefox results/eval-perf/table-generator.table.html` to view the results. |
| 52 | + |
| 53 | + The HTML table contains the following relevant columns (others can be ignored): |
| 54 | + 1. Goblint w/o witness, evals. |
| 55 | + 2. Goblint w/o witness, cputime. |
| 56 | + 3. Goblint w/ manual witness, evals. |
| 57 | + 4. Goblint w/ manual witness, cputime. |
| 58 | + |
| 59 | + Table 2 in the paper presents these results, except the rows are likely in a different order. |
| 60 | + |
| 61 | + |
| 62 | +## Goblint implementation |
| 63 | +[Goblint](https://github.com/goblint/analyzer) is an open source static analysis framework for C. |
| 64 | +Goblint itself is written in OCaml. |
| 65 | +Being open source, it allows existing implementations of analyses and abstract domains to be reused and modified. |
| 66 | +As a framework, it also allows new ones to be easily added. |
| 67 | +For more details, refer to the linked GitHub repository and related documentation. |
| 68 | + |
| 69 | +Key parts of the code related to this paper are the following: |
| 70 | + |
| 71 | +1. `src/analyses/unassumeAnalysis.ml`: analysis, which emits unassume operation events to other analyses for YAML-witness–guided verification. |
| 72 | +2. `src/analyses/base.ml` lines 2551–2641: propagating unassume for non-relational domains of the `base` analysis. |
| 73 | +3. `src/analyses/apron/relationAnalysis.apron.ml` lines 668–693: strengthening-based dual-narrowing unassume for relational Apron domains of the `apron` analysis. |
| 74 | +4. `src/cdomains/apron/apronDomain.apron.ml` lines 625–679: strengthening operator used for dual-narrowing of Apron domains. |
| 75 | +5. `src/util/wideningTokens.ml`: analysis lifter that adds widening tokens for delaying widenings from unassuming. |
| 76 | +6. `src/witness/yamlWitness.ml` lines 398–683: YAML witness validation. |
0 commit comments