Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Recursive functions cause arg/lookup to return edges that point to nodes that don't exist #1026

Closed
FeldrinH opened this issue Mar 29, 2023 · 0 comments · Fixed by #1027
Closed
Assignees
Labels
bug debugging Abstract debugging
Milestone

Comments

@FeldrinH
Copy link
Collaborator

FeldrinH commented Mar 29, 2023

In some cases recursive functions cause arg/lookup to return nodes that have edges to ARG nodes that don't exist.

Reproduction:

// recursion.c
int fib(int n) {
    if (n < 2) {
        return 1;
    }
    return fib(n - 1) + fib(n - 2);
}

int main() {
    int a;
    fib(a);
}
// goblint.json
{
  "files": ["recursion.c"]
}
{"jsonrpc":"2.0","id":"20","method":"arg/lookup","params":{"node":"fun1620fib(18)[15]"}}

returns

{"id":"20","jsonrpc":"2.0","result":[{"node":"fun1620fib(18)[15]","cfg_node":"fun1620","context":"18","path":"15","location":{"file":"recursion.c","line":1,"column":1,"byte":136,"endLine":6,"endColumn":1,"endByte":230},"function":"fib","next":[{"edge":{"cfg":{"string":"(body)","type":"entry","function":"fib"}},"node":"s77(18)[20]","cfg_node":"77","context":"18","path":"20","location":{"file":"recursion.c","line":2,"column":9,"byte":161,"endLine":2,"endColumn":14,"endByte":166},"function":"fib"}],"prev":[{"edge":{"entry":{"lval":null,"function":"fib","args":["a"]}},"node":"s84(9)[11]","cfg_node":"84","context":"9","path":"11","location":{"file":"recursion.c","line":10,"column":5,"byte":261,"endLine":10,"endColumn":11,"endByte":267},"function":"main"},{"edge":{"entry":{"lval":"tmp___0","function":"fib","args":["n - 2"]}},"node":"s81(18)[61]","cfg_node":"81","context":"18","path":"61","location":{"file":"recursion.c","line":5,"column":5,"byte":198,"endLine":5,"endColumn":35,"endByte":228},"function":"fib"},{"edge":{"entry":{"lval":"tmp___0","function":"fib","args":["n - 2"]}},"node":"s81(18)[38]","cfg_node":"81","context":"18","path":"38","location":{"file":"recursion.c","line":5,"column":5,"byte":198,"endLine":5,"endColumn":35,"endByte":228},"function":"fib"},{"edge":{"entry":{"lval":"tmp___0","function":"fib","args":["n - 2"]}},"node":"s81(18)[27]","cfg_node":"81","context":"18","path":"27","location":{"file":"recursion.c","line":5,"column":5,"byte":198,"endLine":5,"endColumn":35,"endByte":228},"function":"fib"},{"edge":{"entry":{"lval":"tmp","function":"fib","args":["n - 1"]}},"node":"s80(18)[27]","cfg_node":"80","context":"18","path":"27","location":{"file":"recursion.c","line":5,"column":5,"byte":198,"endLine":5,"endColumn":35,"endByte":228},"function":"fib"}]}]}

Where the node s81(18)[61] does not exist according to both arg/lookup and arg/dot.

The issue seems to occur when analyzing with reset=true as well as reset=false.

Tested on Goblint version heads/master-0-g9daa89f52.

@sim642 sim642 added bug debugging Abstract debugging labels Mar 30, 2023
@sim642 sim642 added this to the v2.2.0 milestone Apr 5, 2023
sim642 added a commit to sim642/opam-repository that referenced this issue Sep 13, 2023
CHANGES:

* Add `setjmp`/`longjmp` analysis (goblint/analyzer#887, goblint/analyzer#970, goblint/analyzer#1015, goblint/analyzer#1019).
* Refactor race analysis to lazy distribution (goblint/analyzer#1084, goblint/analyzer#1089, goblint/analyzer#1136, goblint/analyzer#1016).
* Add thread-unsafe library function call analysis (goblint/analyzer#723, goblint/analyzer#1082).
* Add mutex type analysis and mutex API analysis (goblint/analyzer#800, goblint/analyzer#839, goblint/analyzer#1073).
* Add interval set domain and string literals domain (goblint/analyzer#901, goblint/analyzer#966, goblint/analyzer#994, goblint/analyzer#1048).
* Add affine equalities analysis (goblint/analyzer#592).
* Add use-after-free analysis (goblint/analyzer#1050, goblint/analyzer#1114).
* Add dead code elimination transformation (goblint/analyzer#850, goblint/analyzer#979).
* Add taint analysis for partial contexts (goblint/analyzer#553, goblint/analyzer#952).
* Add YAML witness validation via unassume (goblint/analyzer#796, goblint/analyzer#977, goblint/analyzer#1044, goblint/analyzer#1045, goblint/analyzer#1124).
* Add incremental analysis rename detection (goblint/analyzer#774, goblint/analyzer#777).
* Fix address sets unsoundness (goblint/analyzer#822, goblint/analyzer#967, goblint/analyzer#564, goblint/analyzer#1032, goblint/analyzer#998, goblint/analyzer#1031).
* Fix thread escape analysis unsoundness (goblint/analyzer#939, goblint/analyzer#984, goblint/analyzer#1074, goblint/analyzer#1078).
* Fix many incremental analysis issues (goblint/analyzer#627, goblint/analyzer#836, goblint/analyzer#835, goblint/analyzer#841, goblint/analyzer#932, goblint/analyzer#678, goblint/analyzer#942, goblint/analyzer#949, goblint/analyzer#950, goblint/analyzer#957, goblint/analyzer#955, goblint/analyzer#954, goblint/analyzer#960, goblint/analyzer#959, goblint/analyzer#1004, goblint/analyzer#558, goblint/analyzer#1010, goblint/analyzer#1091).
* Fix server mode for abstract debugging (goblint/analyzer#983, goblint/analyzer#990, goblint/analyzer#997, goblint/analyzer#1000, goblint/analyzer#1001, goblint/analyzer#1013, goblint/analyzer#1018, goblint/analyzer#1017, goblint/analyzer#1026, goblint/analyzer#1027).
* Add documentation for configuration JSON schema and OCaml API (goblint/analyzer#999, goblint/analyzer#1054, goblint/analyzer#1055, goblint/analyzer#1053).
* Add many library function specifications (goblint/analyzer#962, goblint/analyzer#996, goblint/analyzer#1028, goblint/analyzer#1079, goblint/analyzer#1121, goblint/analyzer#1135, goblint/analyzer#1138).
* Add OCaml 5.0 support (goblint/analyzer#1003, goblint/analyzer#945, goblint/analyzer#1162).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug debugging Abstract debugging
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants