Beispiel #1
0
// get any assumptions from a call/loop to callee through edge.
static void GetCallAssumedBits(BlockMemory *mcfg, PEdge *edge,
                               BlockId *callee, bool indirect,
                               Vector<AssumeInfo> *assume_list)
{
  // add inferred assumptions from the callee.

  BlockSummary *sum = GetBlockSummary(callee);

  const Vector<Bit*> *assumes = sum->GetAssumes();
  size_t assume_count = VectorSize<Bit*>(assumes);

  for (size_t ind = 0; ind < assume_count; ind++) {
    Bit *bit = assumes->At(ind);
    Bit *caller_bit = GetCallerAssume(mcfg, edge, callee, indirect, bit);

    if (!caller_bit) continue;
    caller_bit->MoveRef(NULL, assume_list);

    AssumeInfo info;
    info.point = edge->GetSource();
    info.bit = caller_bit;
    assume_list->PushBack(info);
  }

  sum->DecRef();

  // add annotated postconditions from the callee.

  // only do this for call edges.
  if (!edge->IsCall())
    return;

  Vector<BlockCFG*> *annot_list = BodyAnnotCache.Lookup(callee->Function());

  for (size_t ind = 0; annot_list && ind < annot_list->Size(); ind++) {
    BlockCFG *annot_cfg = annot_list->At(ind);

    if (annot_cfg->GetAnnotationKind() != AK_Postcondition &&
        annot_cfg->GetAnnotationKind() != AK_PostconditionAssume)
      continue;

    Bit *bit = BlockMemory::GetAnnotationBit(annot_cfg);
    if (!bit) continue;

    Bit *caller_bit = GetCallerAssume(mcfg, edge, callee, indirect, bit);
    if (!caller_bit) continue;

    caller_bit->MoveRef(NULL, assume_list);
    annot_cfg->IncRef(assume_list);

    AssumeInfo info;
    info.annot = annot_cfg;
    info.point = edge->GetSource();
    info.bit = caller_bit;
    assume_list->PushBack(info);
  }

  BodyAnnotCache.Release(callee->Function());
}
Beispiel #2
0
// returns whether the error condition is satisfiable within frame.
bool TestErrorSatisfiable(CheckerState *state, CheckerFrame *frame, Bit *bit)
{
  BlockMemory *mcfg = frame->Memory();
  Solver *solver = state->GetSolver();

  if (!solver->IsSatisfiable()) {
    if (checker_verbose.IsSpecified())
      logout << "CHECK: " << frame << ": Guard unsatisfiable: " << bit
             << " [" << bit->Hash() << "]" << endl;
    return false;
  }

  state->PushContext();
  state->AssertBaseBits();

  if (!solver->IsSatisfiable()) {
    if (checker_verbose.IsSpecified())
      logout << "CHECK: " << frame << ": Error unsatisfiable: " << bit
             << " [" << bit->Hash() << "]" << endl;
    state->PopContext();
    return false;
  }

  if (!frame->m_checked_assertions) {
    frame->m_checked_assertions = true;

    // check to see if the error is contradicted by previous assertions
    // in this frame. assert the previous assertions, but don't keep
    // them around past this function to avoid polluting the solver
    // with worthless extra checks.

    BlockSummary *sum = GetBlockSummary(mcfg->GetId());

    const Vector<AssertInfo> *asserts = sum->GetAsserts();
    size_t assert_count = VectorSize<AssertInfo>(asserts);

    for (size_t ind = 0; ind < assert_count; ind++) {
      const AssertInfo &info = asserts->At(ind);

      // only use the same kind of assertion to check for redundancy.
      if (info.kind != state->GetAssertKind())
        continue;

      if (info.cls != ASC_Check)
        continue;

      if (info.point < frame->EndPoint()) {
        // get the asserted condition relative to block entry.

        Bit *assert_value;
        mcfg->TranslateBit(TRK_Point, info.point, info.bit, &assert_value);
        assert_value->MoveRef(&assert_value, NULL);

        Bit *point_guard = mcfg->GetGuard(info.point);
        point_guard->IncRef();

        Bit *imply_assert =
          Bit::MakeImply(point_guard, assert_value);

        solver->AddConstraint(frame->Id(), imply_assert);
      }
    }

    sum->DecRef();

    if (!solver->IsSatisfiable()) {
      if (checker_verbose.IsSpecified())
        logout << "CHECK: " << frame
               << ": Unsatisfiable from assertions" << endl;

      state->PopContext();
      return false;
    }
  }

  state->PopContext();
  return true;
}
Beispiel #3
0
void BlockSummary::GetAssumedBits(BlockMemory *mcfg, PPoint end_point,
                                  Vector<AssumeInfo> *assume_list)
{
  BlockId *id = mcfg->GetId();
  BlockCFG *cfg = mcfg->GetCFG();

  BlockSummary *sum = GetBlockSummary(id);

  const Vector<Bit*> *assumes = sum->GetAssumes();
  size_t assume_count = VectorSize<Bit*>(assumes);

  // pull in assumptions from the summary for mcfg. in some cases these
  // assumptions won't be useful, e.g. describing the state at exit
  // for functions. for now we're just adding all of them though. TODO: fix.
  for (size_t ind = 0; ind < assume_count; ind++) {
    Bit *bit = assumes->At(ind);
    bit->IncRef(assume_list);

    AssumeInfo info;
    info.bit = bit;
    assume_list->PushBack(info);
  }

  sum->DecRef();

  Vector<BlockCFG*> *annot_list = BodyAnnotCache.Lookup(id->Function());

  // add assumes at function entry for any preconditions.

  if (id->Kind() == B_Function) {
    for (size_t ind = 0; annot_list && ind < annot_list->Size(); ind++) {
      BlockCFG *annot_cfg = annot_list->At(ind);

      if (annot_cfg->GetAnnotationKind() != AK_Precondition &&
          annot_cfg->GetAnnotationKind() != AK_PreconditionAssume)
        continue;

      Bit *bit = BlockMemory::GetAnnotationBit(annot_cfg);
      if (!bit) continue;

      annot_cfg->IncRef(assume_list);
      bit->IncRef(assume_list);

      AssumeInfo info;
      info.annot = annot_cfg;
      info.bit = bit;
      assume_list->PushBack(info);
    }
  }

  // add assumptions from points within the block.

  for (size_t pind = 0; pind < cfg->GetPointAnnotationCount(); pind++) {
    PointAnnotation pann = cfg->GetPointAnnotation(pind);
    if (end_point && pann.point >= end_point)
      continue;

    BlockCFG *annot_cfg = GetAnnotationCFG(pann.annot);
    if (!annot_cfg) continue;

    Assert(annot_cfg->GetAnnotationKind() != AK_AssertRuntime);

    if (Bit *bit = BlockMemory::GetAnnotationBit(annot_cfg)) {
      // get the annotation bit in terms of block entry.
      Bit *point_bit = NULL;
      mcfg->TranslateBit(TRK_Point, pann.point, bit, &point_bit);
      point_bit->MoveRef(&point_bit, assume_list);

      annot_cfg->IncRef(assume_list);

      AssumeInfo info;
      info.annot = annot_cfg;
      info.point = pann.point;
      info.bit = point_bit;
      assume_list->PushBack(info);
    }

    annot_cfg->DecRef();
  }

  // add assumptions from annotation edges within the block, invariants
  // on values accessed by the block, and from the summaries of any callees.

  for (size_t eind = 0; eind < cfg->GetEdgeCount(); eind++) {
    PEdge *edge = cfg->GetEdge(eind);
    PPoint point = edge->GetSource();

    if (end_point && point >= end_point)
      continue;

    InvariantAssumeVisitor visitor(mcfg, point, assume_list);
    edge->DoVisit(&visitor);

    if (PEdgeAnnotation *nedge = edge->IfAnnotation()) {
      // add an assumption for this annotation.
      BlockCFG *annot_cfg = GetAnnotationCFG(nedge->GetAnnotationId());
      if (!annot_cfg) continue;

      Bit *bit = BlockMemory::GetAnnotationBit(annot_cfg);

      // don't incorporate AssertRuntimes, these are not assumed.
      if (bit && annot_cfg->GetAnnotationKind() != AK_AssertRuntime) {
        // get the annotation bit in terms of block entry.
        Bit *point_bit = NULL;
        mcfg->TranslateBit(TRK_Point, point, bit, &point_bit);
        point_bit->MoveRef(&point_bit, assume_list);

        annot_cfg->IncRef(assume_list);

        AssumeInfo info;
        info.annot = annot_cfg;
        info.point = point;
        info.bit = point_bit;
        assume_list->PushBack(info);
      }

      annot_cfg->DecRef();
    }

    if (BlockId *callee = edge->GetDirectCallee()) {
      GetCallAssumedBits(mcfg, edge, callee, false, assume_list);
      callee->DecRef();
    }
    else if (edge->IsCall()) {
      // add conditional assumes for the indirect targets of the call.
      // this is most useful for baked information and annotations, where
      // we sometimes need to attach information at indirect calls.

      CallEdgeSet *callees = CalleeCache.Lookup(id->BaseVar());
      size_t old_count = assume_list->Size();

      if (callees) {
        for (size_t cind = 0; cind < callees->GetEdgeCount(); cind++) {
          const CallEdge &cedge = callees->GetEdge(cind);
          if (cedge.where.id == id && cedge.where.point == point) {
            cedge.callee->IncRef();
            BlockId *callee = BlockId::Make(B_Function, cedge.callee);

            GetCallAssumedBits(mcfg, edge, callee, true, assume_list);
            callee->DecRef();
          }
        }
      }

      if (assume_list->Size() != old_count) {
        // we managed to do something at this indirect call site.
        // add another assumption restricting the possible callees to
        // only those identified by our callgraph.

        GuardExpVector receiver_list;
        mcfg->TranslateReceiver(point, &receiver_list);

        for (size_t rind = 0; rind < receiver_list.Size(); rind++) {
          const GuardExp &gs = receiver_list[rind];
          gs.guard->IncRef();

          // make a bit: !when || rcv == callee0 || rcv == callee1 || ...
          Bit *extra_bit = Bit::MakeNot(gs.guard);

          for (size_t cind = 0; cind < callees->GetEdgeCount(); cind++) {
            const CallEdge &cedge = callees->GetEdge(cind);
            if (cedge.where.id == id && cedge.where.point == point) {
              Variable *callee_var = cedge.callee;
              callee_var->IncRef();
              Exp *callee_exp = Exp::MakeVar(callee_var);

              gs.exp->IncRef();
              Bit *equal = Exp::MakeCompareBit(B_Equal, callee_exp, gs.exp);

              extra_bit = Bit::MakeOr(extra_bit, equal);
            }
          }

          extra_bit->MoveRef(NULL, assume_list);

          AssumeInfo info;
          info.bit = extra_bit;
          assume_list->PushBack(info);
        }
      }

      CalleeCache.Release(id->BaseVar());
    }
  }

  BodyAnnotCache.Release(id->Function());

  // add assumptions from heap invariants describing values mentioned
  // in added assumptions. we could keep doing this transitively but don't,
  // to ensure termination.
  size_t count = assume_list->Size();
  for (size_t ind = 0; ind < count; ind++) {
    InvariantAssumeVisitor visitor(NULL, 0, assume_list);
    assume_list->At(ind).bit->DoVisit(&visitor);
  }

  CombineAssumeList(assume_list);
}