-
Notifications
You must be signed in to change notification settings - Fork 283
Description
When snapshot-harness tries to set up aliasing pointers, it may use the name of one of the aliases to set up the other. For example, when working correctly it might generate:
int memory[10];
x = memory;
y = &x[1];
But when generating those same assignments it might emit them in the wrong order, as it appears to expect that their RHS values are independent, leading to:
int memory[10];
y = &x[1];
x = memory;
Since x is a global variable this leads to y being (int*)4 rather than pointing into the same array as x as intended.
Real-world example from regression test snapshot-harness/dynamic-array-int:
Good:
generated_entry_function /* generated_entry_function */
// 177 no location
tmp = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 };
// 178 no location
array = tmp;
// 179 no location
iterator1 = tmp;
// 180 no location
iterator2 = &array[1ul];
// 181 no location
iterator3 = &array[1ul];
// 182 no location
func_init_done = FALSE;
// 183 no location
main();
// 184 no location
END_FUNCTION
Bad (note array is read at line 45 before it is set at line 47)
generated_entry_function /* generated_entry_function */
// 44 no location
tmp = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 };
// 45 no location
iterator2 = &array[1ul];
// 46 no location
iterator1 = tmp;
// 47 no location
array = tmp;
// 48 no location
iterator3 = &array[1ul];
// 49 no location
func_init_done = FALSE;
// 50 no location
main();
// 51 no location
END_FUNCTION
Whether or not snapshot-harness malfunctions on any given occasion depends on the order it chooses to emit the assignments, which depends on compiler version, standard library version, phase of moon, etc.
GOTO binaries showing the problem: examples.zip