Project

General

Profile

Actions

Bug #9132

open

Buggy transformation of Ternary expression while slicing

Added by Asia . over 6 years ago. Updated over 6 years ago.

Status:
Open
Priority:
Normal
Assignee:
-
Start date:
07/19/2018
Due date:
% Done:

0%

Estimated time:
Detected in build:
svn
Platform:
Published in build:

Description

I am currently working on verification of Systemsoftware category of SVCOMP tasks. I am using crude_slicer(Build fcd3b927) to slice the tasks.
I am using Ubuntu 16.04 OS. Crude_slicer is using Frama-c Sulfur 2017.
While slicing, ternary expressions are being transformed to "if-else blocks" by using temporary variable. But in some cases the transformation is resulting in gcc compilation errors. So I have tried replicating it with small example. Consider below c-code construct

int m1,m2,b;
m1=nondet();
m2=nondet();
b=((int)((int const) m1 < (int const)m2 ? (int const)m1 : m2));
if(b==0) {
__VERIFIER_error();
}

The transformed code construct in slice is,

int m1;
int m2;
int b;
int const tmp;
m1 = nondet();
m2 = nondet();
if (m1 < m2)
tmp = m1; else
tmp = m2;
b = tmp;
if (b == 0)
__VERIFIER_error();

As tmp here in transformed code is declared to be "int const", multiple assignments to it result in GCC compilation error " assignment of read-only variable tmp"

I am using the commands:

cd ./cpa-bam-slicing/lib/native/x86_64-linux/

./frama-c.native -no-autoload-plugins -no-findlib -load-module Crude_slicer.cmxs -machdep gcc_x86_64 -crude_slicer -timeout 400 -no-recognize_wrecked_container_of -widening_threshold 2000 -no-summaries -no-assert_stratification -print -ocode -journal-enable slice.c task.c

I am attaching the input to crude_slicer task.c and sliced code slice.c along with frama_c_journal.ml

Below is the error trace for GCC compilation

The command for GCC compilation:

gcc -c slice.c

test.c: In function ‘main’:
test.c:8:20: error: assignment of read-only variable ‘tmp’
b=((int)((int const) m1 < (int const)m2 ? (int const)m1 : m2));
^
test.c:8:35: error: assignment of read-only variable ‘tmp’
b=((int)((int const) m1 < (int const)m2 ? (int const)m1 : m2));
^


Files

slice.c (582 Bytes) slice.c Slice generated using crude_slicer Asia ., 07/19/2018 10:16 AM
test.c (236 Bytes) test.c Source file Asia ., 07/19/2018 10:16 AM
frama_c_journal.ml (1.55 KB) frama_c_journal.ml automatically-generated journal Asia ., 07/19/2018 10:16 AM
Actions #1

Updated by Mikhail Mandrykin over 6 years ago

  • Status changed from New to Open

I commited a fix for this issue to "our repository with patched Frama-C, but it can be also good to report this upstream

Actions

Also available in: Atom PDF