From 2174f108cf0c179d027d94684bee149547c3bf77 Mon Sep 17 00:00:00 2001 From: Simmo Saan Date: Mon, 6 Nov 2023 14:06:35 +0200 Subject: [PATCH 1/7] Make memLeak path- & ctx-sensitive Co-authored-by: Michael Schwarz --- src/analyses/memLeak.ml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/analyses/memLeak.ml b/src/analyses/memLeak.ml index dbaa2d69fc..9c09c05cf6 100644 --- a/src/analyses/memLeak.ml +++ b/src/analyses/memLeak.ml @@ -14,9 +14,10 @@ struct let name () = "memLeak" module D = ToppedVarInfoSet - module C = Lattice.Unit + module C = D + module P = IdentityP (D) - let context _ _ = () + let context _ d = d (* HELPER FUNCTIONS *) let warn_for_multi_threaded ctx = From 4279417b24a5c2e3c0bb46dd6cb0c2c6c29a0d03 Mon Sep 17 00:00:00 2001 From: Simmo Saan Date: Mon, 6 Nov 2023 14:07:57 +0200 Subject: [PATCH 2/7] Add test from #1235 --- .../56-witness/52-witness-lifter-ps2.c | 35 +++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 tests/regression/56-witness/52-witness-lifter-ps2.c diff --git a/tests/regression/56-witness/52-witness-lifter-ps2.c b/tests/regression/56-witness/52-witness-lifter-ps2.c new file mode 100644 index 0000000000..bcb7c1410c --- /dev/null +++ b/tests/regression/56-witness/52-witness-lifter-ps2.c @@ -0,0 +1,35 @@ +// PARAM: --enable ana.sv-comp.enabled --enable ana.sv-comp.functions --enable witness.graphml.enabled --set ana.specification 'CHECK( init(main()), LTL(G valid-memtrack) )' --set ana.activated[+] memLeak --set ana.path_sens[+] memLeak --set ana.malloc.unique_address_count 1 +struct _twoIntsStruct { + int intOne ; + int intTwo ; +}; + +typedef struct _twoIntsStruct twoIntsStruct; + +void printStructLine(twoIntsStruct const *structTwoIntsStruct) +{ + return; +} + + +int main(int argc, char **argv) +{ + twoIntsStruct *data; + int tmp_1; + + + if (tmp_1 != 0) { + twoIntsStruct *dataBuffer = malloc(800UL); + data = dataBuffer; + } + else { + + twoIntsStruct *dataBuffer_0 = malloc(800UL); + data = dataBuffer_0; + } + + printStructLine((twoIntsStruct const *)data); + free((void *)data); + + return; +} From 5c8a37773067c55709c6f0cc7a3e20da6bdb08c7 Mon Sep 17 00:00:00 2001 From: Simmo Saan Date: Mon, 6 Nov 2023 14:08:27 +0200 Subject: [PATCH 3/7] Use inline_edge in more witness interfaces --- src/witness/myARG.ml | 2 +- src/witness/svcomp.ml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/witness/myARG.ml b/src/witness/myARG.ml index 068aed7a22..0dd42bc910 100644 --- a/src/witness/myARG.ml +++ b/src/witness/myARG.ml @@ -141,7 +141,7 @@ struct let equal_node_context _ _ = failwith "StackNode: equal_node_context" end -module Stack (Cfg:CfgForward) (Arg: S): +module Stack (Cfg:CfgForward) (Arg: S with module Edge = InlineEdge): S with module Node = StackNode (Arg.Node) and module Edge = Arg.Edge = struct module Node = StackNode (Arg.Node) diff --git a/src/witness/svcomp.ml b/src/witness/svcomp.ml index eae97b1199..9aab121196 100644 --- a/src/witness/svcomp.ml +++ b/src/witness/svcomp.ml @@ -76,7 +76,7 @@ sig val is_sink: Arg.Node.t -> bool end -module StackTaskResult (Cfg:MyCFG.CfgForward) (TaskResult: TaskResult) = +module StackTaskResult (Cfg:MyCFG.CfgForward) (TaskResult: TaskResult with module Arg.Edge = MyARG.InlineEdge) = struct module Arg = MyARG.Stack (Cfg) (TaskResult.Arg) From 23771e41e1afac7268761b8ceb1de0d033b01370 Mon Sep 17 00:00:00 2001 From: Simmo Saan Date: Mon, 6 Nov 2023 14:09:36 +0200 Subject: [PATCH 4/7] Remove CFG-based function return node from MyARG.Stack (closes #1235) --- src/witness/myARG.ml | 44 ++++++++++++++++++-------------------------- 1 file changed, 18 insertions(+), 26 deletions(-) diff --git a/src/witness/myARG.ml b/src/witness/myARG.ml index 0dd42bc910..a11ba44178 100644 --- a/src/witness/myARG.ml +++ b/src/witness/myARG.ml @@ -161,38 +161,30 @@ struct (* | [] -> failwith "StackArg.next: return stack empty" *) | [] -> [] (* main return *) | call_n :: call_stack -> - let call_cfgnode = Arg.Node.cfgnode call_n in let call_next = - Cfg.next call_cfgnode + Arg.next call_n (* filter because infinite loops starting with function call will have another Neg(1) edge from the head *) - |> List.filter (fun (locedges, to_node) -> - List.exists (function - | (_, Proc _) -> true - | (_, _) -> false - ) locedges + |> List.filter (fun (edge, to_n) -> + match edge with + | InlinedEdge _ -> true + | _ -> false ) in begin match call_next with - | [] -> failwith "StackArg.next: call next empty" - | [(_, return_node)] -> - begin match Arg.Node.move_opt call_n return_node with - (* TODO: Is it possible to have a calling node without a returning node? *) - (* | None -> [] *) - | None -> failwith "StackArg.next: no return node" - | Some return_n -> - (* TODO: Instead of next & filter, construct unique return_n directly. Currently edge missing. *) - Arg.next n - |> List.filter (fun (edge, to_n) -> - (* let to_cfgnode = Arg.Node.cfgnode to_n in - MyCFG.Node.equal to_cfgnode return_node *) - Arg.Node.equal_node_context to_n return_n - ) - |> List.map (fun (edge, to_n) -> - let to_n' = to_n :: call_stack in - (edge, to_n') - ) - end + | [] -> failwith "StackArg.next: call next empty" (* TODO: Is it possible to have a calling node without a returning node? *) + | [(_, return_n)] -> + (* TODO: Instead of next & filter, construct unique return_n directly. Currently edge missing. *) + Arg.next n + |> List.filter (fun (edge, to_n) -> + (* let to_cfgnode = Arg.Node.cfgnode to_n in + MyCFG.Node.equal to_cfgnode return_node *) + Arg.Node.equal_node_context to_n return_n + ) + |> List.map (fun (edge, to_n) -> + let to_n' = to_n :: call_stack in + (edge, to_n') + ) | _ :: _ :: _ -> failwith "StackArg.next: call next ambiguous" end end From 3299b75380b60073f075efcc3d46e97513f92ab3 Mon Sep 17 00:00:00 2001 From: Simmo Saan Date: Mon, 6 Nov 2023 14:15:26 +0200 Subject: [PATCH 5/7] Remove now-unused Cfg argument from stack ARG functor --- src/witness/myARG.ml | 4 ++-- src/witness/svcomp.ml | 4 ++-- src/witness/witness.ml | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/src/witness/myARG.ml b/src/witness/myARG.ml index a11ba44178..ae8b5f6772 100644 --- a/src/witness/myARG.ml +++ b/src/witness/myARG.ml @@ -141,7 +141,7 @@ struct let equal_node_context _ _ = failwith "StackNode: equal_node_context" end -module Stack (Cfg:CfgForward) (Arg: S with module Edge = InlineEdge): +module Stack (Arg: S with module Edge = InlineEdge): S with module Node = StackNode (Arg.Node) and module Edge = Arg.Edge = struct module Node = StackNode (Arg.Node) @@ -156,7 +156,7 @@ struct | n :: stack -> let cfgnode = Arg.Node.cfgnode n in match cfgnode with - | Function _ -> (* TODO: can this be done without Cfg? *) + | Function _ -> (* TODO: can this be done without cfgnode? *) begin match stack with (* | [] -> failwith "StackArg.next: return stack empty" *) | [] -> [] (* main return *) diff --git a/src/witness/svcomp.ml b/src/witness/svcomp.ml index 9aab121196..89487ea8d4 100644 --- a/src/witness/svcomp.ml +++ b/src/witness/svcomp.ml @@ -76,9 +76,9 @@ sig val is_sink: Arg.Node.t -> bool end -module StackTaskResult (Cfg:MyCFG.CfgForward) (TaskResult: TaskResult with module Arg.Edge = MyARG.InlineEdge) = +module StackTaskResult (TaskResult: TaskResult with module Arg.Edge = MyARG.InlineEdge) = struct - module Arg = MyARG.Stack (Cfg) (TaskResult.Arg) + module Arg = MyARG.Stack (TaskResult.Arg) let result = TaskResult.result diff --git a/src/witness/witness.ml b/src/witness/witness.ml index d94960d542..235461c348 100644 --- a/src/witness/witness.ml +++ b/src/witness/witness.ml @@ -14,7 +14,7 @@ let write_file filename (module Task:Task) (module TaskResult:WitnessTaskResult) let module TaskResult = (val if get_bool "witness.graphml.stack" then - (module StackTaskResult (Task.Cfg) (TaskResult) : WitnessTaskResult) + (module StackTaskResult (TaskResult) : WitnessTaskResult) else (module TaskResult) ) From 38e82eb7620200427bbc13040c5758471e862fa3 Mon Sep 17 00:00:00 2001 From: Simmo Saan Date: Mon, 6 Nov 2023 14:22:08 +0200 Subject: [PATCH 6/7] Add 56-witness/53-witness-lifter-ps2 version with functon introducing path-sensitivity --- .../56-witness/53-witness-lifter-ps3.c | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 tests/regression/56-witness/53-witness-lifter-ps3.c diff --git a/tests/regression/56-witness/53-witness-lifter-ps3.c b/tests/regression/56-witness/53-witness-lifter-ps3.c new file mode 100644 index 0000000000..06b73b3888 --- /dev/null +++ b/tests/regression/56-witness/53-witness-lifter-ps3.c @@ -0,0 +1,39 @@ +// PARAM: --enable ana.sv-comp.enabled --enable ana.sv-comp.functions --enable witness.graphml.enabled --set ana.specification 'CHECK( init(main()), LTL(G valid-memtrack) )' --set ana.activated[+] memLeak --set ana.path_sens[+] memLeak --set ana.malloc.unique_address_count 1 +struct _twoIntsStruct { + int intOne ; + int intTwo ; +}; + +typedef struct _twoIntsStruct twoIntsStruct; + +void printStructLine(twoIntsStruct const *structTwoIntsStruct) +{ + return; +} + +twoIntsStruct *foo() { + twoIntsStruct *data; + int tmp_1; + + if (tmp_1 != 0) { + twoIntsStruct *dataBuffer = malloc(800UL); + data = dataBuffer; + } + else { + + twoIntsStruct *dataBuffer_0 = malloc(800UL); + data = dataBuffer_0; + } + return data; +} + +int main(int argc, char **argv) +{ + twoIntsStruct *data; + data = foo(); + + printStructLine((twoIntsStruct const *)data); + free((void *)data); + + return; +} From cb32b12a377ba255b02735890e4eb50afab16cca Mon Sep 17 00:00:00 2001 From: Simmo Saan Date: Mon, 6 Nov 2023 14:44:30 +0200 Subject: [PATCH 7/7] Fix 56-witness/53-witness-lifter-ps3 --- src/witness/myARG.ml | 31 ++++++++++++------------------- 1 file changed, 12 insertions(+), 19 deletions(-) diff --git a/src/witness/myARG.ml b/src/witness/myARG.ml index ae8b5f6772..373a66d3d6 100644 --- a/src/witness/myARG.ml +++ b/src/witness/myARG.ml @@ -165,28 +165,21 @@ struct Arg.next call_n (* filter because infinite loops starting with function call will have another Neg(1) edge from the head *) - |> List.filter (fun (edge, to_n) -> + |> List.filter_map (fun (edge, to_n) -> match edge with - | InlinedEdge _ -> true - | _ -> false + | InlinedEdge _ -> Some to_n + | _ -> None ) in - begin match call_next with - | [] -> failwith "StackArg.next: call next empty" (* TODO: Is it possible to have a calling node without a returning node? *) - | [(_, return_n)] -> - (* TODO: Instead of next & filter, construct unique return_n directly. Currently edge missing. *) - Arg.next n - |> List.filter (fun (edge, to_n) -> - (* let to_cfgnode = Arg.Node.cfgnode to_n in - MyCFG.Node.equal to_cfgnode return_node *) - Arg.Node.equal_node_context to_n return_n - ) - |> List.map (fun (edge, to_n) -> - let to_n' = to_n :: call_stack in - (edge, to_n') - ) - | _ :: _ :: _ -> failwith "StackArg.next: call next ambiguous" - end + Arg.next n + |> List.filter_map (fun (edge, to_n) -> + if BatList.mem_cmp Arg.Node.compare to_n call_next then ( + let to_n' = to_n :: call_stack in + Some (edge, to_n') + ) + else + None + ) end | _ -> let+ (edge, to_n) = Arg.next n in