diff --git a/.cppcheck-suppressions.txt b/.cppcheck-suppressions.txt index b8fb28cd1..40f1679e6 100644 --- a/.cppcheck-suppressions.txt +++ b/.cppcheck-suppressions.txt @@ -6,3 +6,4 @@ unusedFunction:modules/backend/pass/* unusedFunction:modules/backend/library/* uninitMemberVar missingReturn:modules/frontend/counter_example/* +memleakOnRealloc:tests/unit/pass/inputs/memtrack.c diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 95fb3c08c..fcb448530 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,11 @@ # Unit tests use -DSKIP_KLEE=ON -DSKIP_AFL_PLUS_PLUS=ON, # so the full Dockerfile.dev dependencies are not needed. # +# Runtime: map2check-library (Rust), the pinned release fetched by +# scripts/runtime/fetch-map2check-library.sh into /opt/map2check-library +# (-DMAP2CHECK_RUST_LIB_DIR). The C runtime (modules/backend/library) is out +# of the build and is no longer compiled or analysed here. +# # Phase 1.5 — OpenSSF Best Practices Badge (Analysis section) ############################################################ name: CI @@ -54,6 +59,9 @@ jobs: sudo tar xzf /tmp/wabt.tar.gz -C /opt sudo ln -sf /opt/wabt-1.0.41/bin/wasm2c /usr/local/bin/wasm2c + - name: Fetch map2check-library (Rust runtime) + run: sudo bash scripts/runtime/fetch-map2check-library.sh /opt/map2check-library + - name: Configure CMake run: | mkdir -p build && cd build @@ -61,6 +69,7 @@ jobs: -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ -DSKIP_AFL_PLUS_PLUS=ON \ -DSKIP_KLEE=ON \ + -DMAP2CHECK_RUST_LIB_DIR=/opt/map2check-library/lib \ -DENABLE_TEST=ON env: CC: /usr/bin/clang-16 @@ -99,6 +108,9 @@ jobs: sudo tar xzf /tmp/wabt.tar.gz -C /opt sudo ln -sf /opt/wabt-1.0.41/bin/wasm2c /usr/local/bin/wasm2c + - name: Fetch map2check-library (Rust runtime) + run: sudo bash scripts/runtime/fetch-map2check-library.sh /opt/map2check-library + - name: Generate compile_commands.json run: | mkdir -p build && cd build @@ -106,6 +118,7 @@ jobs: -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ -DSKIP_AFL_PLUS_PLUS=ON \ -DSKIP_KLEE=ON \ + -DMAP2CHECK_RUST_LIB_DIR=/opt/map2check-library/lib \ -DENABLE_TEST=ON \ -DCMAKE_EXPORT_COMPILE_COMMANDS=ON env: @@ -129,23 +142,6 @@ jobs: modules/frontend/ \ tests/unit/ - - name: Run cppcheck (C backend) - # Blocking since the backend was cleared of all findings - # (migration-schedule item 2.0.12 / OpenSSF static_analysis_fixed) - run: | - cppcheck \ - --enable=warning,portability \ - --suppress=missingIncludeSystem \ - --suppress=unknownMacro \ - --suppress=unusedFunction \ - --suppressions-list=.cppcheck-suppressions.txt \ - --inline-suppr \ - --error-exitcode=1 \ - --std=c11 \ - --language=c \ - -I modules/ \ - modules/backend/library/ - - name: Build (for clang-tidy) run: cd build && ninja env: @@ -186,6 +182,9 @@ jobs: sudo tar xzf /tmp/wabt.tar.gz -C /opt sudo ln -sf /opt/wabt-1.0.41/bin/wasm2c /usr/local/bin/wasm2c + - name: Fetch map2check-library (Rust runtime) + run: sudo bash scripts/runtime/fetch-map2check-library.sh /opt/map2check-library + - name: Configure CMake with Sanitizers run: | mkdir -p build && cd build @@ -193,6 +192,7 @@ jobs: -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ -DSKIP_AFL_PLUS_PLUS=ON \ -DSKIP_KLEE=ON \ + -DMAP2CHECK_RUST_LIB_DIR=/opt/map2check-library/lib \ -DENABLE_TEST=ON \ -DMAP2CHECK_ENABLE_SANITIZERS=ON env: @@ -214,6 +214,50 @@ jobs: UBSAN_OPTIONS: "print_stacktrace=1:halt_on_error=1" run: cd build && ctest --output-on-failure + # =========================================================== + # Job: KLEE runtime bitcode of map2check-library + # =========================================================== + # The release archive does not ship the symex (KLEE) runtime; it is built + # from the same pinned tag with rustc 1.72.1 (LLVM 16) and handed to the + # Docker jobs below as -DMAP2CHECK_RUST_KLEE_BC. Cached on the script, + # which holds the pin. + klee-runtime: + name: KLEE Runtime Bitcode + runs-on: ubuntu-22.04 + timeout-minutes: 30 + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Cache the bitcode + id: cache + uses: actions/cache@v4 + with: + path: m2c-klee/map2check-klee.bc + key: map2check-klee-bc-${{ hashFiles('scripts/runtime/map2check-klee-bc.sh') }} + + - name: Install LLVM 16 tools + rustc 1.72.1 + if: steps.cache.outputs.cache-hit != 'true' + run: | + wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc + echo "deb http://apt.llvm.org/jammy/ llvm-toolchain-jammy-16 main" | sudo tee /etc/apt/sources.list.d/llvm-16.list + sudo apt-get update + sudo apt-get install -y llvm-16 + rustup toolchain install 1.72.1 --profile minimal + + - name: Build map2check-klee.bc + if: steps.cache.outputs.cache-hit != 'true' + run: bash scripts/runtime/map2check-klee-bc.sh m2c-klee/map2check-klee.bc + + - name: Upload the bitcode + uses: actions/upload-artifact@v4 + with: + name: map2check-klee-bc + path: m2c-klee/map2check-klee.bc + if-no-files-found: error + retention-days: 7 + # =========================================================== # Job 4: WASM End-to-End Tests (Docker) # =========================================================== @@ -225,7 +269,7 @@ jobs: name: WASM E2E Tests (Docker) runs-on: ubuntu-22.04 timeout-minutes: 45 - needs: [build-and-test] + needs: [build-and-test, klee-runtime] steps: - name: Checkout @@ -241,11 +285,26 @@ jobs: - name: Pull map2check-dev image run: docker pull ghcr.io/hbgit/map2check-dev:latest + - name: Fetch map2check-library (Rust runtime) + run: sudo bash scripts/runtime/fetch-map2check-library.sh /opt/map2check-library + + - name: Download KLEE runtime bitcode + uses: actions/download-artifact@v4 + with: + name: map2check-klee-bc + path: ${{ runner.temp }}/m2c-klee + + - name: Stage KLEE runtime bitcode + run: | + sudo install -D -m 644 "${{ runner.temp }}/m2c-klee/map2check-klee.bc" \ + /opt/map2check-library/klee/map2check-klee.bc + - name: Build + install Map2Check in container run: | docker run --rm \ -u root \ -v "${{ github.workspace }}:/workspace" \ + -v /opt/map2check-library:/opt/map2check-library:ro \ -w /workspace \ -e CC=/usr/bin/clang-16 \ -e CXX=/usr/bin/clang++-16 \ @@ -266,6 +325,8 @@ jobs: mkdir -p build_e2e && cd build_e2e cmake .. -G Ninja \ -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DMAP2CHECK_RUST_LIB_DIR=/opt/map2check-library/lib \ + -DMAP2CHECK_RUST_KLEE_BC=/opt/map2check-library/klee/map2check-klee.bc \ -DENABLE_TEST=ON \ -DMAP2CHECK_DYNAMIC_LINK=ON \ -DCMAKE_INSTALL_PREFIX=/workspace/install_e2e @@ -310,7 +371,7 @@ jobs: name: CASTLE Regression runs-on: ubuntu-22.04 timeout-minutes: 20 - needs: [build-and-test] + needs: [build-and-test, klee-runtime] steps: - name: Checkout @@ -326,11 +387,26 @@ jobs: - name: Pull map2check-dev image run: docker pull ghcr.io/hbgit/map2check-dev:latest + - name: Fetch map2check-library (Rust runtime) + run: sudo bash scripts/runtime/fetch-map2check-library.sh /opt/map2check-library + + - name: Download KLEE runtime bitcode + uses: actions/download-artifact@v4 + with: + name: map2check-klee-bc + path: ${{ runner.temp }}/m2c-klee + + - name: Stage KLEE runtime bitcode + run: | + sudo install -D -m 644 "${{ runner.temp }}/m2c-klee/map2check-klee.bc" \ + /opt/map2check-library/klee/map2check-klee.bc + - name: Build + install Map2Check in container run: | docker run --rm \ -u root \ -v "${{ github.workspace }}:/workspace" \ + -v /opt/map2check-library:/opt/map2check-library:ro \ -w /workspace \ -e CC=/usr/bin/clang-16 \ -e CXX=/usr/bin/clang++-16 \ @@ -339,6 +415,8 @@ jobs: mkdir -p build_castle_ci && cd build_castle_ci cmake .. -G Ninja \ -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DMAP2CHECK_RUST_LIB_DIR=/opt/map2check-library/lib \ + -DMAP2CHECK_RUST_KLEE_BC=/opt/map2check-library/klee/map2check-klee.bc \ -DENABLE_TEST=ON \ -DMAP2CHECK_DYNAMIC_LINK=ON \ -DCMAKE_INSTALL_PREFIX=/workspace/install_castle_ci @@ -387,7 +465,7 @@ jobs: name: Invariants (Clam) runs-on: ubuntu-22.04 timeout-minutes: 25 - needs: [build-and-test] + needs: [build-and-test, klee-runtime] steps: - name: Checkout @@ -403,11 +481,26 @@ jobs: - name: Pull map2check-dev image run: docker pull ghcr.io/hbgit/map2check-dev:latest + - name: Fetch map2check-library (Rust runtime) + run: sudo bash scripts/runtime/fetch-map2check-library.sh /opt/map2check-library + + - name: Download KLEE runtime bitcode + uses: actions/download-artifact@v4 + with: + name: map2check-klee-bc + path: ${{ runner.temp }}/m2c-klee + + - name: Stage KLEE runtime bitcode + run: | + sudo install -D -m 644 "${{ runner.temp }}/m2c-klee/map2check-klee.bc" \ + /opt/map2check-library/klee/map2check-klee.bc + - name: Build with -DENABLE_CLAM=ON run: | docker run --rm \ -u root \ -v "${{ github.workspace }}:/workspace" \ + -v /opt/map2check-library:/opt/map2check-library:ro \ -w /workspace \ -e CC=/usr/bin/clang-16 \ -e CXX=/usr/bin/clang++-16 \ @@ -416,6 +509,8 @@ jobs: mkdir -p build_clam_ci && cd build_clam_ci cmake .. -G Ninja \ -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DMAP2CHECK_RUST_LIB_DIR=/opt/map2check-library/lib \ + -DMAP2CHECK_RUST_KLEE_BC=/opt/map2check-library/klee/map2check-klee.bc \ -DENABLE_CLAM=ON \ -DMAP2CHECK_DYNAMIC_LINK=ON \ -DCMAKE_INSTALL_PREFIX=/workspace/install_clam_ci @@ -452,7 +547,7 @@ jobs: name: Test-Comp Validation (TestCov) runs-on: ubuntu-22.04 timeout-minutes: 25 - needs: [build-and-test] + needs: [build-and-test, klee-runtime] steps: - name: Checkout @@ -468,11 +563,26 @@ jobs: - name: Pull map2check-dev image run: docker pull ghcr.io/hbgit/map2check-dev:latest + - name: Fetch map2check-library (Rust runtime) + run: sudo bash scripts/runtime/fetch-map2check-library.sh /opt/map2check-library + + - name: Download KLEE runtime bitcode + uses: actions/download-artifact@v4 + with: + name: map2check-klee-bc + path: ${{ runner.temp }}/m2c-klee + + - name: Stage KLEE runtime bitcode + run: | + sudo install -D -m 644 "${{ runner.temp }}/m2c-klee/map2check-klee.bc" \ + /opt/map2check-library/klee/map2check-klee.bc + - name: Build + install Map2Check in container run: | docker run --rm \ -u root \ -v "${{ github.workspace }}:/workspace" \ + -v /opt/map2check-library:/opt/map2check-library:ro \ -w /workspace \ -e CC=/usr/bin/clang-16 \ -e CXX=/usr/bin/clang++-16 \ @@ -481,6 +591,8 @@ jobs: mkdir -p build_testcov_ci && cd build_testcov_ci cmake .. -G Ninja \ -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DMAP2CHECK_RUST_LIB_DIR=/opt/map2check-library/lib \ + -DMAP2CHECK_RUST_KLEE_BC=/opt/map2check-library/klee/map2check-klee.bc \ -DMAP2CHECK_DYNAMIC_LINK=ON \ -DCMAKE_INSTALL_PREFIX=/workspace/install_testcov_ci ninja @@ -525,7 +637,7 @@ jobs: valgrind-memcheck: name: Valgrind Memcheck (ctest) runs-on: ubuntu-22.04 - timeout-minutes: 30 + timeout-minutes: 45 steps: - name: Checkout @@ -547,6 +659,9 @@ jobs: sudo tar xzf /tmp/wabt.tar.gz -C /opt sudo ln -sf /opt/wabt-1.0.41/bin/wasm2c /usr/local/bin/wasm2c + - name: Fetch map2check-library (Rust runtime) + run: sudo bash scripts/runtime/fetch-map2check-library.sh /opt/map2check-library + - name: Configure CMake (Debug, sem sanitizers) run: | mkdir -p build && cd build @@ -554,6 +669,7 @@ jobs: -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ -DSKIP_AFL_PLUS_PLUS=ON \ -DSKIP_KLEE=ON \ + -DMAP2CHECK_RUST_LIB_DIR=/opt/map2check-library/lib \ -DENABLE_TEST=ON \ -DCMAKE_BUILD_TYPE=Debug \ -DCMAKE_C_FLAGS="-gdwarf-4" \ diff --git a/CHANGELOG.md b/CHANGELOG.md index ff411b8a9..d2b9dd7a8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,13 @@ The format loosely follows [Keep a Changelog](https://keepachangelog.com/en/1.0. ### Changed +- Runtime replaced by map2check-library (Rust). The C runtime of + `modules/backend/library` is no longer built or installed; Map2Check links + map2check-library 1.1.0-rc1 or later (`libmap2check.a`, plus + `map2check-klee.bc` for symex), selected with `MAP2CHECK_RUST_LIB_DIR`, + `MAP2CHECK_RUST_SRC` and `MAP2CHECK_RUST_KLEE_BC` (see the README build + section). The verdict differences from the C runtime are listed in + `tests/cutover/deltas-aceitos.tsv`. - Replaced LibFuzzer with AFL++ 4.40c (persistent, PCGUARD) as the fuzzing engine. - tacasv2a: `--slice` no longer crashes KLEE and its test suites stay valid on the original program. The slicer runs with `-cutoff-diverging=false` diff --git a/CMakeLists.txt b/CMakeLists.txt index a10f305e4..e9113917f 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -78,6 +78,10 @@ endif() include_directories(${PROJECT_SOURCE_DIR}) +# Before the tests: they link the runtime library this module resolves +# (MAP2CHECK_RUST_RUNTIME_LIB). +include(cmake/Map2CheckRustRuntime.cmake) + if(ENABLE_TEST) # include(CTest) em vez de enable_testing(): gera DartConfiguration.tcl, # necessário para `ctest -T memcheck` (job Valgrind no CI). diff --git a/Dockerfile.dev b/Dockerfile.dev index 9a8080ba2..dae54e594 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -392,6 +392,39 @@ ENV PATH="${WASI_SDK_PATH}/bin:${PATH}" RUN ${WASI_SDK_PATH}/bin/clang --version && \ ${WASI_SDK_PATH}/bin/wasm-ld --version +# ============================================================ +# 9b. Map2Check runtime: map2check-library (Rust), pinned release +# ============================================================ +# The release archive (SHA-256 pinned in the script) holds the static library +# Map2Check links (lib/libmap2check_runtime.a). The KLEE runtime bitcode is +# not in the archive: it is built from the same tag (commit pinned in the +# script) with rustc 1.72.1, whose LLVM is 16, and the LLVM 16 tools above. +# The Rust toolchain only serves this build and is removed afterwards. +# Map2Check's CMake reads MAP2CHECK_RUST_LIB_DIR / MAP2CHECK_RUST_KLEE_BC +# from the environment (cmake/Map2CheckRustRuntime.cmake). +# rustup-init is pinned by version and SHA-256 (the value of the .sha256 file +# published next to it on static.rust-lang.org) and checked before it runs; +# a mismatch stops the build. +ARG RUSTUP_INIT_VERSION=1.28.2 +ARG RUSTUP_INIT_SHA256=20a06e644b0d9bd2fbdbfd52d42540bdde820ea7df86e92e533c073da0cdd43c +COPY scripts/runtime/fetch-map2check-library.sh scripts/runtime/map2check-klee-bc.sh /tmp/m2c-runtime/ +RUN set -eu && \ + bash /tmp/m2c-runtime/fetch-map2check-library.sh /opt/map2check-library && \ + export RUSTUP_HOME=/tmp/m2c-rustup CARGO_HOME=/tmp/m2c-cargo && \ + wget -q "https://static.rust-lang.org/rustup/archive/${RUSTUP_INIT_VERSION}/x86_64-unknown-linux-gnu/rustup-init" \ + -O /tmp/m2c-runtime/rustup-init && \ + echo "${RUSTUP_INIT_SHA256} /tmp/m2c-runtime/rustup-init" | sha256sum -c --quiet - && \ + chmod +x /tmp/m2c-runtime/rustup-init && \ + /tmp/m2c-runtime/rustup-init -y --profile minimal \ + --default-toolchain 1.72.1 --no-modify-path && \ + PATH="/tmp/m2c-cargo/bin:${PATH}" bash /tmp/m2c-runtime/map2check-klee-bc.sh \ + /opt/map2check-library/klee/map2check-klee.bc && \ + llvm-dis-16 /opt/map2check-library/klee/map2check-klee.bc -o /dev/null && \ + rm -rf /tmp/m2c-runtime /tmp/m2c-rustup /tmp/m2c-cargo + +ENV MAP2CHECK_RUST_LIB_DIR=/opt/map2check-library/lib +ENV MAP2CHECK_RUST_KLEE_BC=/opt/map2check-library/klee/map2check-klee.bc + # ============================================================ # 10. User setup # ============================================================ diff --git a/README.md b/README.md index 9fcf74bfe..c1d43ca7d 100644 --- a/README.md +++ b/README.md @@ -181,6 +181,20 @@ $ ninja && ninja install The `Dockerfile.dev` image already builds and installs KLEE 3.1 (to `/opt/klee`) and installs AFL++ 4.40c as a standalone toolchain (found at run time under `/usr/local/bin`), so **do not** pass `-DSKIP_KLEE=ON` or `-DSKIP_AFL_PLUS_PLUS=ON` — those flags skip the `cmake/FindKlee.cmake` / `cmake/FindAFLPlusPlus.cmake` modules entirely. Only pass them `ON` if you deliberately want a build without KLEE/AFL++ support (e.g. `-DSKIP_AFL_PLUS_PLUS=ON -DSKIP_KLEE=ON` for a minimal/CI build). +**Runtime library.** The runtime that Map2Check links into the analysed program is [map2check-library](https://github.com/hbgit/map2check-library) (Rust, C ABI); it replaced the C runtime of `modules/backend/library`. The **minimum supported version is 1.1.0-rc1** (the version pinned in [scripts/runtime/fetch-map2check-library.sh](scripts/runtime/fetch-map2check-library.sh)). CMake takes it from one of these variables (each defaults to the environment variable of the same name, which `Dockerfile.dev` sets, so the build above needs no extra flag): + +- `MAP2CHECK_RUST_LIB_DIR`: a directory with a prebuilt library. Use the `lib/` of the release archive `map2check-library--x86_64-unknown-linux-gnu.tar.gz` (`scripts/runtime/fetch-map2check-library.sh ` downloads and verifies it; pass `/lib`), whose `libmap2check_runtime.a` is the one linked. A local build directory (`target/runtime` of `cargo build --profile runtime --features libfuzzer,wasm`) also works. Configure fails if the directory only has the featureless core `libmap2check.a`. +- `MAP2CHECK_RUST_SRC`: a map2check-library checkout, built by the Map2Check build with `cargo build --profile runtime --features libfuzzer,wasm` on every build (cargo is incremental); the build fails if the resulting `target/runtime/libmap2check.a` is not the runtime build. Used only when `MAP2CHECK_RUST_LIB_DIR` is empty. When `MAP2CHECK_RUST_KLEE_BC` is unset, the checkout has `scripts/build-klee-runtime.sh`, and rustc 1.72.1 (through rustup) and `llvm-dis` are available, it also builds the KLEE runtime bitcode. +- `MAP2CHECK_RUST_KLEE_BC` (optional, needed for `--nondet-generator symex` unless `MAP2CHECK_RUST_SRC` builds it): the KLEE runtime bitcode (LLVM 16). The release archive does not ship it; build it with `scripts/runtime/map2check-klee-bc.sh ` (needs rustc 1.72.1 and the LLVM 16 tools). + +``` bash +$ bash scripts/runtime/fetch-map2check-library.sh /opt/map2check-library +$ bash scripts/runtime/map2check-klee-bc.sh /opt/map2check-library/klee/map2check-klee.bc +$ cmake .. -G Ninja -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm \ + -DMAP2CHECK_RUST_LIB_DIR=/opt/map2check-library/lib \ + -DMAP2CHECK_RUST_KLEE_BC=/opt/map2check-library/klee/map2check-klee.bc +``` + **Building with WASM support** requires **no additional CMake flag** — the `WasmLifter` frontend module is always compiled. The only extra build-time dependency is the WABT 1.0.41 header `wasm-rt.h`: when CMake finds it (searched at `/opt/wabt-1.0.41/include`, `/usr/include`, `/usr/local/include`), it compiles the KLEE-compatible wasm2c runtime `WasmRuntimeStubs.c` to bitcode and installs it as `release/lib/WasmRuntimeStubs.bc`, which is linked into the lifted module when `--wasm` is used. If `wasm-rt.h` is not found, CMake prints a warning and the build proceeds **without** WASM support (the recommended way to get a WASM-enabled build is the Docker image above, which ships WABT and the wasi-sdk out of the box). Minor test: diff --git a/cmake/Map2CheckRustRuntime.cmake b/cmake/Map2CheckRustRuntime.cmake new file mode 100644 index 000000000..f61d3afda --- /dev/null +++ b/cmake/Map2CheckRustRuntime.cmake @@ -0,0 +1,117 @@ +# Map2Check runtime: map2check-library (Rust). Replaces modules/backend/library +# (the C bitcode runtime, no longer part of the build). +# +# Installs ${prefix}/lib/libmap2check.a and, when available, +# ${prefix}/lib/map2check-klee.bc (KLEE runtime bitcode, LLVM 16). +# +# The defaults come from the environment variables of the same name, which the +# map2check-dev image sets (Dockerfile.dev); -D on the command line wins. +# Being CACHE defaults, they are read only on the first configure of a build +# directory: after the environment changes, reconfigure in a fresh one. +set(MAP2CHECK_RUST_LIB_DIR "$ENV{MAP2CHECK_RUST_LIB_DIR}" CACHE PATH "Directory with a prebuilt libmap2check.a (empty = build from MAP2CHECK_RUST_SRC)") +set(MAP2CHECK_RUST_SRC "$ENV{MAP2CHECK_RUST_SRC}" CACHE PATH "map2check-library checkout used when MAP2CHECK_RUST_LIB_DIR is empty") +set(MAP2CHECK_RUST_KLEE_BC "$ENV{MAP2CHECK_RUST_KLEE_BC}" CACHE FILEPATH "Prebuilt KLEE runtime bitcode (empty = none, or built from MAP2CHECK_RUST_SRC when rustc 1.72.1 is available)") + +# --- Static library --- +# Any nm that can read the archive will do (see Map2CheckRustRuntimeCheck.cmake). +find_program(M2C_NM nm) +find_program(M2C_LLVM_NM llvm-nm) +set(_m2c_nms ${CMAKE_NM} ${M2C_NM} ${M2C_LLVM_NM}) +list(REMOVE_DUPLICATES _m2c_nms) +set(_m2c_check "${CMAKE_CURRENT_LIST_DIR}/Map2CheckRustRuntimeCheck.cmake") +set(_m2c_build_hint "Build it with: cargo build --profile runtime --features libfuzzer,wasm") + +if(MAP2CHECK_RUST_LIB_DIR) + # The release archive (lib/ of map2check-library--.tar.gz) + # ships three builds; the one Map2Check links is libmap2check_runtime.a + # (profile runtime, features libfuzzer,wasm). Its libmap2check.a is the + # featureless core build. A directory without libmap2check_runtime.a must + # be a local `cargo build --profile runtime --features libfuzzer,wasm` + # output (target/runtime), whose libmap2check.a is the runtime build under + # the plain name. That fallback is accepted only when the archive defines + # the symbols of both features, so the core or libfuzzer-only build is + # never picked by accident. + if(EXISTS "${MAP2CHECK_RUST_LIB_DIR}/libmap2check_runtime.a") + set(_m2c_rust_lib "${MAP2CHECK_RUST_LIB_DIR}/libmap2check_runtime.a") + else() + set(_m2c_rust_lib "${MAP2CHECK_RUST_LIB_DIR}/libmap2check.a") + if(NOT EXISTS "${_m2c_rust_lib}") + message(FATAL_ERROR "libmap2check.a not found in ${MAP2CHECK_RUST_LIB_DIR} " + "(nor libmap2check_runtime.a; build it with: cargo build --profile runtime --features libfuzzer,wasm)") + endif() + set(M2C_LIB "${_m2c_rust_lib}") + set(M2C_NMS "${_m2c_nms}") + string(CONCAT M2C_HINT "Point MAP2CHECK_RUST_LIB_DIR at the lib/ of the " + "map2check-library release archive (it has libmap2check_runtime.a), or at " + "the target/runtime of: cargo build --profile runtime --features libfuzzer,wasm") + include("${_m2c_check}") + endif() +elseif(MAP2CHECK_RUST_SRC) + find_program(M2C_CARGO cargo REQUIRED) + set(_m2c_rust_lib "${MAP2CHECK_RUST_SRC}/target/runtime/libmap2check.a") + # Always run: cargo is incremental, so this is cheap when nothing changed, + # and an archive already in target/runtime (say, from a build without the + # features) is never taken as up to date. The check after cargo fails the + # build unless the archive is the runtime build. + add_custom_target(Map2CheckRustRuntime ALL + COMMAND ${M2C_CARGO} build --profile runtime --features libfuzzer,wasm + COMMAND ${CMAKE_COMMAND} -DM2C_LIB=${_m2c_rust_lib} "-DM2C_NMS=${_m2c_nms}" + "-DM2C_HINT=${_m2c_build_hint} in ${MAP2CHECK_RUST_SRC}" -P "${_m2c_check}" + BYPRODUCTS "${_m2c_rust_lib}" + WORKING_DIRECTORY "${MAP2CHECK_RUST_SRC}" + COMMENT "Building the Rust runtime (libmap2check.a)" + VERBATIM) +else() + message(FATAL_ERROR "Set MAP2CHECK_RUST_LIB_DIR or MAP2CHECK_RUST_SRC to provide the Rust runtime") +endif() +# The path the tests link (tests/unit/pass); installed under the name the +# frontend expects (kRustRuntimeLibrary). +set(MAP2CHECK_RUST_RUNTIME_LIB "${_m2c_rust_lib}") +install(FILES "${_m2c_rust_lib}" DESTINATION lib RENAME libmap2check.a) +message(STATUS "Rust runtime: ${_m2c_rust_lib}") + +# --- KLEE bitcode (optional) --- +find_program(M2C_LLVM_DIS NAMES llvm-dis-16 llvm-dis + HINTS "${LLVM_TOOLS_BINARY_DIR}" "${LLVM_DIR}/../../../bin") + +if(MAP2CHECK_RUST_KLEE_BC) + if(NOT EXISTS "${MAP2CHECK_RUST_KLEE_BC}") + message(FATAL_ERROR "MAP2CHECK_RUST_KLEE_BC=${MAP2CHECK_RUST_KLEE_BC} does not exist") + endif() + if(NOT M2C_LLVM_DIS) + message(FATAL_ERROR "llvm-dis-16 not found: cannot validate MAP2CHECK_RUST_KLEE_BC") + endif() + execute_process(COMMAND "${M2C_LLVM_DIS}" "${MAP2CHECK_RUST_KLEE_BC}" -o /dev/null + RESULT_VARIABLE _m2c_dis_rc ERROR_VARIABLE _m2c_dis_err OUTPUT_QUIET) + if(NOT _m2c_dis_rc EQUAL 0) + message(FATAL_ERROR "MAP2CHECK_RUST_KLEE_BC=${MAP2CHECK_RUST_KLEE_BC} cannot be read by ${M2C_LLVM_DIS}: ${_m2c_dis_err}") + endif() + install(FILES "${MAP2CHECK_RUST_KLEE_BC}" DESTINATION lib RENAME map2check-klee.bc) + message(STATUS "Rust runtime KLEE bitcode: ${MAP2CHECK_RUST_KLEE_BC}") +elseif(MAP2CHECK_RUST_SRC AND EXISTS "${MAP2CHECK_RUST_SRC}/scripts/build-klee-runtime.sh") + # Optional: build it through the library script (needs rustc 1.72.1 + LLVM 16 tools). + find_program(M2C_RUSTUP rustup) + set(_m2c_klee_ok FALSE) + if(M2C_RUSTUP AND M2C_LLVM_DIS) + execute_process(COMMAND "${M2C_RUSTUP}" run 1.72.1 rustc --version + RESULT_VARIABLE _m2c_rc OUTPUT_QUIET ERROR_QUIET) + if(_m2c_rc EQUAL 0) + set(_m2c_klee_ok TRUE) + endif() + endif() + if(_m2c_klee_ok) + set(_m2c_klee_bc "${CMAKE_BINARY_DIR}/map2check-klee.bc") + add_custom_command(OUTPUT "${_m2c_klee_bc}" + COMMAND "${MAP2CHECK_RUST_SRC}/scripts/build-klee-runtime.sh" "${_m2c_klee_bc}" + WORKING_DIRECTORY "${MAP2CHECK_RUST_SRC}" + COMMENT "Building the Rust runtime KLEE bitcode" + VERBATIM) + add_custom_target(Map2CheckRustKleeBitcode ALL DEPENDS "${_m2c_klee_bc}") + install(FILES "${_m2c_klee_bc}" DESTINATION lib RENAME map2check-klee.bc) + message(STATUS "Rust runtime KLEE bitcode: will be built from ${MAP2CHECK_RUST_SRC}") + else() + message(STATUS "Rust runtime KLEE bitcode: skipped (set MAP2CHECK_RUST_KLEE_BC, or provide rustc 1.72.1 + llvm-dis)") + endif() +else() + message(STATUS "Rust runtime KLEE bitcode: none (MAP2CHECK_RUST_KLEE_BC unset)") +endif() diff --git a/cmake/Map2CheckRustRuntimeCheck.cmake b/cmake/Map2CheckRustRuntimeCheck.cmake new file mode 100644 index 000000000..2d280725e --- /dev/null +++ b/cmake/Map2CheckRustRuntimeCheck.cmake @@ -0,0 +1,55 @@ +# Fails unless M2C_LIB is the Map2Check runtime build of map2check-library +# (cargo build --profile runtime --features libfuzzer,wasm): the archive must +# define LLVMFuzzerTestOneInput (feature libfuzzer) and map2check_wasm_malloc +# (feature wasm). The featureless core build defines neither, the libfuzzer +# build only the first. +# +# Used two ways, with the same inputs: +# include() at configure time, with M2C_LIB and M2C_NMS set; +# cmake -DM2C_LIB= -DM2C_NMS= -DM2C_HINT= -P +# as a build step after cargo (MAP2CHECK_RUST_SRC route). +# +# M2C_NMS: nm programs to try. Any one that can read the archive will do. The +# members carry bitcode from rustc's LLVM, newer than 16, which llvm-nm-16 (the +# CMAKE_NM of a clang-16 toolchain) rejects, so several are tried. +# M2C_HINT: how to get the right archive, appended to the error. +if(NOT EXISTS "${M2C_LIB}") + message(FATAL_ERROR "${M2C_LIB} does not exist. ${M2C_HINT}") +endif() +set(_m2c_syms LLVMFuzzerTestOneInput map2check_wasm_malloc) +set(_m2c_missing "") +set(_m2c_readers "") +foreach(_m2c_nm IN LISTS M2C_NMS) + if(NOT _m2c_nm) + continue() + endif() + execute_process(COMMAND "${_m2c_nm}" -g --defined-only "${M2C_LIB}" + RESULT_VARIABLE _m2c_nm_rc OUTPUT_VARIABLE _m2c_nm_out ERROR_QUIET) + # An nm that fails or prints nothing could not read the archive; its + # silence says nothing about the symbols. + if(NOT _m2c_nm_rc EQUAL 0 OR _m2c_nm_out STREQUAL "") + continue() + endif() + list(APPEND _m2c_readers "${_m2c_nm}") + set(_m2c_missing_here "") + foreach(_m2c_sym IN LISTS _m2c_syms) + if(NOT _m2c_nm_out MATCHES " T ${_m2c_sym}(\n|$)") + list(APPEND _m2c_missing_here ${_m2c_sym}) + endif() + endforeach() + if(NOT _m2c_missing_here) + return() # accepted + endif() + set(_m2c_missing ${_m2c_missing_here}) +endforeach() + +if(NOT _m2c_readers) + list(JOIN M2C_NMS ", " _m2c_tried) + message(FATAL_ERROR "cannot check that ${M2C_LIB} is the Map2Check runtime " + "build: no nm could read the archive (tried: ${_m2c_tried}). Install a " + "binutils nm or an llvm-nm at least as new as rustc's LLVM. ${M2C_HINT}") +endif() +list(JOIN _m2c_missing ", " _m2c_missing) +message(FATAL_ERROR "${M2C_LIB} is not the Map2Check runtime build: it does " + "not define ${_m2c_missing} (the core build defines neither symbol, the " + "libfuzzer build lacks map2check_wasm_malloc). ${M2C_HINT}") diff --git a/modules/backend/CMakeLists.txt b/modules/backend/CMakeLists.txt index ac84c66be..6b246d7e7 100644 --- a/modules/backend/CMakeLists.txt +++ b/modules/backend/CMakeLists.txt @@ -1,2 +1 @@ add_subdirectory(pass) -add_subdirectory(library) diff --git a/modules/backend/pass/AssertPass.cpp b/modules/backend/pass/AssertPass.cpp index 209280b36..7a3f6a23f 100755 --- a/modules/backend/pass/AssertPass.cpp +++ b/modules/backend/pass/AssertPass.cpp @@ -13,6 +13,8 @@ #include #include +#include "RuntimeABI.hpp" + using llvm::dyn_cast; using llvm::IRBuilder; using llvm::FunctionCallee; @@ -20,10 +22,8 @@ using llvm::PassPluginLibraryInfo; PreservedAnalyses AssertPass::run(Function& F, llvm::FunctionAnalysisManager& AM) { - this->map2check_assert = F.getParent()->getOrInsertFunction( - "map2check_assert", Type::getVoidTy(F.getContext()), - Type::getInt32Ty(F.getContext()), Type::getInt32Ty(F.getContext()), - PointerType::get(F.getContext(), 0)); + this->map2check_assert = Map2Check::getOrInsertRuntime( + *F.getParent(), Map2Check::RuntimeHook::Assert); Function::iterator functionIterator = F.begin(); BasicBlock::iterator instructionIterator = functionIterator->begin(); @@ -47,10 +47,19 @@ void AssertPass::instrumentAssert(CallInst* assertInst, LLVMContext* Ctx) { DebugInfo debugInfo(Ctx, assertInst); Value* condition = assertInst->getArgOperand(0); + // The core takes an i32; a program that declares __VERIFIER_assert with + // another integer parameter type still passes "condition != 0". + if (condition->getType()->isIntegerTy() && + !condition->getType()->isIntegerTy(32)) { + condition = builder.CreateZExt( + builder.CreateIsNotNull(condition), Type::getInt32Ty(*Ctx)); + } Value* function_llvm = builder.CreateGlobalStringPtr(assertInst->getFunction()->getName()); - Value* args[] = {condition, debugInfo.getLineNumberValue(), function_llvm}; + // map2check_is_valid_assert(line, function, expression): the condition + // goes last in the core API. + Value* args[] = {debugInfo.getLineNumberValue(), function_llvm, condition}; builder.CreateCall(this->map2check_assert, args); } @@ -65,7 +74,7 @@ void AssertPass::instrumentAssertFail(CallInst* assertInst, LLVMContext* Ctx) { Value* line = assertInst->getArgOperand(2); Value* function_llvm = assertInst->getArgOperand(3); - Value* args[] = {condition, line, function_llvm}; + Value* args[] = {line, function_llvm, condition}; builder.CreateCall(this->map2check_assert, args); } diff --git a/modules/backend/pass/CMakeLists.txt b/modules/backend/pass/CMakeLists.txt index d96789e65..3c94a8cc3 100755 --- a/modules/backend/pass/CMakeLists.txt +++ b/modules/backend/pass/CMakeLists.txt @@ -1,9 +1,14 @@ add_library(DebugInfo OBJECT DebugInfo.cpp) +# Names and types of the runtime functions the passes emit (map2check-library). +add_library(RuntimeABI OBJECT RuntimeABI.cpp) # BUG: If we do not set this flag opt will not work with our pass # even if it was the same build from llvm set(CXX_FLAGS "${CXX_FLAGS} -fno-rtti ") set_target_properties(DebugInfo PROPERTIES COMPILE_FLAGS ${CXX_FLAGS}) +set_target_properties(RuntimeABI PROPERTIES COMPILE_FLAGS ${CXX_FLAGS}) +# Both are linked into every plugin (a shared object). +set_target_properties(DebugInfo RuntimeABI PROPERTIES POSITION_INDEPENDENT_CODE ON) list(APPEND MAP2CHECK_PASS_LIB "") list(APPEND MAP2CHECK_PASS_LIB "NonDetPass") @@ -19,7 +24,14 @@ list(APPEND MAP2CHECK_PASS_LIB "LoopPredAssumePass") foreach(F ${MAP2CHECK_PASS_LIB}) - add_library(${F} SHARED ${F}.cpp $) + add_library(${F} SHARED ${F}.cpp $ + $) set_target_properties(${F} PROPERTIES COMPILE_FLAGS ${CXX_FLAGS}) install(TARGETS ${F} DESTINATION lib) endforeach() + +# TrackBasicBlockPass reads the C source through SourceCodeHelper; without +# these objects the plugin fails to load (undefined SourceCodeHelper::getLine). +target_sources(TrackBasicBlockPass PRIVATE + ${PROJECT_SOURCE_DIR}/modules/frontend/utils/tools.cpp + ${PROJECT_SOURCE_DIR}/modules/frontend/utils/log.cpp) diff --git a/modules/backend/pass/LibraryFunctions.hpp b/modules/backend/pass/LibraryFunctions.hpp deleted file mode 100755 index 75f8e43dd..000000000 --- a/modules/backend/pass/LibraryFunctions.hpp +++ /dev/null @@ -1,60 +0,0 @@ -/** - * Copyright (C) 2014 - 2020 Map2Check tool - * This file is part of the Map2Check tool, and is made available under - * the terms of the GNU General Public License version 2. - * - * LLVM -> NCSA - * - * SPDX-License-Identifier: (GPL-2.0 AND NCSA) - **/ - -#ifndef MODULES_BACKEND_PASS_LIBRARYFUNCTIONS_HPP_ -#define MODULES_BACKEND_PASS_LIBRARYFUNCTIONS_HPP_ - -#include -#include -#include -#include -#include -#include -#include -#include - -#include -#include -#include -#include -#include - -using llvm::Constant; -using llvm::FunctionCallee; -using llvm::PointerType; -using llvm::Function; - -class LibraryFunctions { - FunctionCallee map2check_init; - FunctionCallee map2check_exit; - FunctionCallee map2check_track_bb; - - public: - FunctionCallee getInitFunction() { return this->map2check_init; } - FunctionCallee getTrackBBFunction() { return this->map2check_track_bb; } - FunctionCallee getExitFunction() { return this->map2check_exit; } - - LibraryFunctions(Function* F, LLVMContext* Ctx) { - this->map2check_init = F->getParent()->getOrInsertFunction( - "map2check_init", Type::getVoidTy(*Ctx), Type::getInt32Ty(*Ctx)); - - this->map2check_exit = F->getParent()->getOrInsertFunction( - "map2check_success", Type::getVoidTy(*Ctx)); - - this->map2check_exit = F->getParent()->getOrInsertFunction( - "map2check_success", Type::getVoidTy(*Ctx)); - - this->map2check_track_bb = F->getParent()->getOrInsertFunction( - "map2check_track_bb", Type::getVoidTy(*Ctx), Type::getInt32Ty(*Ctx), - PointerType::get(*Ctx, 0)); - } -}; - -#endif // MODULES_BACKEND_PASS_LIBRARYFUNCTIONS_HPP_ diff --git a/modules/backend/pass/LoopPredAssumePass.cpp b/modules/backend/pass/LoopPredAssumePass.cpp index c203fec46..e1d7bc0e1 100644 --- a/modules/backend/pass/LoopPredAssumePass.cpp +++ b/modules/backend/pass/LoopPredAssumePass.cpp @@ -13,6 +13,8 @@ #include #include +#include "RuntimeABI.hpp" + using llvm::IRBuilder; namespace { @@ -24,10 +26,12 @@ inline Instruction* BBIteratorToInst(BasicBlock::iterator i) { void LoopPredAssumePass::getConditionInLoop(Loop* L) { BasicBlock* header = L->getHeader(); - this->map2check_assume = - header->getParent()->getParent()->getOrInsertFunction( - "map2check_assume_loop", Type::getVoidTy(header->getContext()), - Type::getInt1Ty(header->getContext())); + this->map2check_assume = Map2Check::getOrInsertRuntime( + *header->getParent()->getParent(), Map2Check::RuntimeHook::Assume); + // The program may already declare __VERIFIER_assume nounwind; the + // library's assume unwinds through every call to it. + Map2Check::allowUnwind( + *llvm::cast(this->map2check_assume.getCallee())); if (BranchInst* bi = dyn_cast(header->getTerminator())) { if (bi->isConditional()) { Value* loopCond = bi->getCondition(); @@ -50,7 +54,9 @@ void LoopPredAssumePass::getConditionInLoop(Loop* L) { IRBuilder<> builder(BBIteratorToInst(iT)); - Value* args[] = {new_loop_cond}; + // __VERIFIER_assume takes an i32; the loop predicate is an i1. + Value* args[] = {builder.CreateZExt( + new_loop_cond, Type::getInt32Ty(header->getContext()))}; builder.CreateCall(this->map2check_assume, args); } } diff --git a/modules/backend/pass/LoopPredAssumePass.hpp b/modules/backend/pass/LoopPredAssumePass.hpp index 8efa3549c..2a568fb2e 100644 --- a/modules/backend/pass/LoopPredAssumePass.hpp +++ b/modules/backend/pass/LoopPredAssumePass.hpp @@ -32,7 +32,6 @@ #include "../../frontend/utils/tools.hpp" #include "DebugInfo.hpp" -#include "LibraryFunctions.hpp" namespace Tools = Map2Check; diff --git a/modules/backend/pass/Map2CheckLibrary.cpp b/modules/backend/pass/Map2CheckLibrary.cpp index 209f4f956..9b9a66c4c 100644 --- a/modules/backend/pass/Map2CheckLibrary.cpp +++ b/modules/backend/pass/Map2CheckLibrary.cpp @@ -16,6 +16,8 @@ #include #include +#include "RuntimeABI.hpp" + using llvm::CallInst; using llvm::dyn_cast; using llvm::IRBuilder; @@ -27,9 +29,40 @@ static llvm::cl::opt EntryFunction( llvm::cl::desc("Name of the entry function (default: main)"), llvm::cl::init("main")); +// Values of map2check-library's AnalysisMode (map2check_set_mode). The +// frontend passes the mode of the run; the C runtime got it from the +// AnalysisMode*.bc it linked, the Rust runtime is one library for every mode. +static llvm::cl::opt AnalysisModeOption( + "m2c-analysis-mode", + llvm::cl::desc("Analysis mode passed to map2check_set_mode"), + llvm::cl::values( + clEnumValN(Map2CheckLibrary::AnalysisMode::None, "none", + "no property (cover-branches)"), + clEnumValN(Map2CheckLibrary::AnalysisMode::Memtrack, "memtrack", + "memory safety"), + clEnumValN(Map2CheckLibrary::AnalysisMode::Memcleanup, "memcleanup", + "memory cleanup"), + clEnumValN(Map2CheckLibrary::AnalysisMode::Overflow, "overflow", + "signed integer overflow"), + clEnumValN(Map2CheckLibrary::AnalysisMode::Assert, "assert", + "__VERIFIER_assert"), + clEnumValN(Map2CheckLibrary::AnalysisMode::Target, "target", + "reachability of the target function")), + llvm::cl::init(Map2CheckLibrary::AnalysisMode::None)); + +Map2CheckLibrary::Map2CheckLibrary() : mode(AnalysisModeOption) {} + PreservedAnalyses Map2CheckLibrary::run(Function& F, llvm::FunctionAnalysisManager& AM) { - this->libraryFunctions = make_unique(&F, &F.getContext()); + llvm::Module& M = *F.getParent(); + // Normally done by NonDetPass already; idempotent. + Map2Check::resolveProgramDefinitions(M); + this->setModeFunction = + Map2Check::getOrInsertRuntime(M, Map2Check::RuntimeHook::SetMode); + this->initFunction = + Map2Check::getOrInsertRuntime(M, Map2Check::RuntimeHook::Init); + this->successFunction = + Map2Check::getOrInsertRuntime(M, Map2Check::RuntimeHook::Success); Function::iterator functionIterator = F.begin(); BasicBlock::iterator instructionIterator = functionIterator->begin(); @@ -64,15 +97,18 @@ PreservedAnalyses Map2CheckLibrary::run(Function& F, void Map2CheckLibrary::instrumentStartInstruction(LLVMContext* Ctx) { IRBuilder<> builder(reinterpret_cast(&*currentInstruction)); - Value* argument = - ConstantInt::getSigned(Type::getInt32Ty(*Ctx), this->SVCOMP ? 1 : 0); - Value* args[] = {argument}; - builder.CreateCall(this->libraryFunctions->getInitFunction(), args); + // map2check_set_mode(mode) must precede map2check_init(); init no longer + // takes the dead isSvComp argument of the C runtime. + Value* mode = ConstantInt::getSigned(Type::getInt32Ty(*Ctx), + static_cast(this->mode)); + Value* args[] = {mode}; + builder.CreateCall(this->setModeFunction, args); + builder.CreateCall(this->initFunction); } void Map2CheckLibrary::instrumentReleaseInstruction(LLVMContext* Ctx) { IRBuilder<> builder(reinterpret_cast(&*currentInstruction)); - builder.CreateCall(this->libraryFunctions->getExitFunction()); + builder.CreateCall(this->successFunction); } void Map2CheckLibrary::runOnCallInstruction(CallInst* callInst, diff --git a/modules/backend/pass/Map2CheckLibrary.hpp b/modules/backend/pass/Map2CheckLibrary.hpp index 299bf69e1..6db3f4b8c 100755 --- a/modules/backend/pass/Map2CheckLibrary.hpp +++ b/modules/backend/pass/Map2CheckLibrary.hpp @@ -29,7 +29,6 @@ #include #include "DebugInfo.hpp" -#include "LibraryFunctions.hpp" using llvm::BasicBlock; using llvm::CallInst; @@ -42,7 +41,19 @@ using std::make_unique; using llvm::Value; struct Map2CheckLibrary : public llvm::PassInfoMixin { - explicit Map2CheckLibrary(bool svcomp = false) : SVCOMP(svcomp) {} + /// map2check-library's AnalysisMode, the argument of map2check_set_mode. + enum class AnalysisMode : int { + None = 0, + Memtrack = 1, + Memcleanup = 2, + Overflow = 3, + Assert = 4, + Target = 5 + }; + + /// Mode from the -m2c-analysis-mode option (default none). + Map2CheckLibrary(); + explicit Map2CheckLibrary(AnalysisMode mode) : mode(mode) {} PreservedAnalyses run(Function& F, llvm::FunctionAnalysisManager& AM); static bool isRequired() { return true; } @@ -54,8 +65,10 @@ struct Map2CheckLibrary : public llvm::PassInfoMixin { Value* getFunctionNameValue() { return this->functionName; } private: - std::unique_ptr libraryFunctions; - bool SVCOMP = false; + AnalysisMode mode = AnalysisMode::None; + llvm::FunctionCallee setModeFunction; + llvm::FunctionCallee initFunction; + llvm::FunctionCallee successFunction; Value* functionName = NULL; BasicBlock::iterator currentInstruction; }; diff --git a/modules/backend/pass/MemoryTrackPass.cpp b/modules/backend/pass/MemoryTrackPass.cpp index a35477a80..08be3a00c 100644 --- a/modules/backend/pass/MemoryTrackPass.cpp +++ b/modules/backend/pass/MemoryTrackPass.cpp @@ -1,5 +1,5 @@ /** - * Copyright (C) 2014 - 2020 Map2Check tool + * Copyright (C) 2014 - 2026 Map2Check tool * This file is part of the Map2Check tool, and is made available under * the terms of the GNU General Public License version 2. * @@ -8,6 +8,10 @@ * SPDX-License-Identifier: (GPL-2.0 AND NCSA) **/ +// Memory tracking against the core API of map2check-library: every runtime +// call is a RuntimeHook (RuntimeABI.hpp), with the argument order and widths +// of docs/cutover/abi-mapping.tsv. + #include "MemoryTrackPass.hpp" #include @@ -15,6 +19,9 @@ #include #include #include +#include + +#include "RuntimeABI.hpp" static llvm::cl::opt MemTrackEntryFunction( "m2c-entry-function", @@ -28,11 +35,8 @@ static llvm::cl::opt WasmMode( // using namespace llvm; using llvm::AllocaInst; -using llvm::APInt; -using llvm::Argument; using llvm::BasicBlock; using llvm::CallInst; -using llvm::CastInst; using llvm::ConstantInt; using llvm::DataLayout; using llvm::DebugLoc; @@ -44,67 +48,30 @@ using llvm::IRBuilder; using llvm::LoadInst; using llvm::Module; using llvm::StoreInst; -using llvm::StructType; -using llvm::Twine; using llvm::Type; using llvm::Value; - -// std::string infoFile = "witnessInfo"; -// std::string echoCommand = "echo"; -// TODO(hbgit): Work with other types -// FIX: It it not current function - -/** - void MemoryTrackPass::addWitnessInfo(std::string info) { -// int result = system(info.c_str()); -// If result != 0 means that something gone wrong -}**/ +using Map2Check::RuntimeHook; namespace { inline Instruction *BBIteratorToInst(BasicBlock::iterator i) { Instruction *pointer = reinterpret_cast(&*i); return pointer; } -} // namespace - -// TODO(hbgit): make dynCast only one time -void MemoryTrackPass::instrumentPointer() { - StoreInst *storeInst = dyn_cast(&*this->currentInstruction); - Value *var_address = storeInst->getPointerOperand(); - Value *receives = storeInst->getValueOperand(); - - auto j = this->currentInstruction; - - Twine bitcast("bitcast"); - - Value *varPointerCast = - CastInst::CreatePointerCast(var_address, PointerType::get(*this->Ctx, 0), - bitcast, BBIteratorToInst(j)); - - Value *receivesPointerCast = CastInst::CreatePointerCast( - receives, PointerType::get(*this->Ctx, 0), bitcast, BBIteratorToInst(j)); - - ++j; - IRBuilder<> builder(BBIteratorToInst(j)); - Value *name_llvm = builder.CreateGlobalStringPtr(var_address->getName()); - - Value *function_llvm = - builder.CreateGlobalStringPtr(currentFunction->getName()); - - Value *args[] = {varPointerCast, receivesPointerCast, this->scope_value, - name_llvm, this->line_value, function_llvm}; - - builder.CreateCall(this->map2check_pointer, args); +/// True for what a pass added for the runtime's own use (NonDetPass's value +/// slots): not program memory, so neither tracked nor checked. +bool isRuntimeOwned(const Value *value) { + auto *inst = dyn_cast(value->stripPointerCasts()); + return inst != nullptr && inst->hasMetadata(Map2Check::kRuntimeMetadata); } +} // namespace -/** Widens or narrows a size operand to the type the runtime call declares. +/** Widens or narrows an integer operand to the type the runtime call declares. * * The allocation size is taken straight from the program's own call, and its - * type is whatever that program declared. The runtime helpers are registered - * with an i64 size, so any program allocating with a narrower integer produced - * a call whose argument type did not match its signature -- and LLVM rejects - * the module outright: + * type is whatever that program declared, while the core API takes int32_t + * sizes. A call whose argument type did not match its signature made LLVM + * reject the module outright: * * Call parameter type does not match function signature! * LLVM ERROR: Broken module found, compilation aborted! @@ -124,157 +91,130 @@ static Value *coerceToParamType(IRBuilder<> &builder, Value *value, // value back is what preserves it either way. return builder.CreateSExtOrTrunc(value, wanted); } + if (value->getType()->isPointerTy() && wanted->isPointerTy()) { + return builder.CreatePointerCast(value, wanted); + } return value; } -void MemoryTrackPass::instrumentPosixMemAllign() { - CallInst *callInst = dyn_cast(&*this->currentInstruction); +static ConstantInt *i32Constant(LLVMContext *ctx, uint64_t value) { + return ConstantInt::get(Type::getInt32Ty(*ctx), value); +} - this->calleeFunction = callInst->getCalledFunction(); +Value *MemoryTrackPass::functionName() { + if (this->functionNameValue == nullptr) { + IRBuilder<> builder( + &*this->currentFunction->getEntryBlock().getFirstInsertionPt()); + this->functionNameValue = + builder.CreateGlobalStringPtr(this->currentFunction->getName()); + } + return this->functionNameValue; +} - auto j = this->currentInstruction; - ++j; +// abi-mapping: map2check_add_store_pointer -> map2check_map_store_pointer +// (var, value, scope, name, line, fn), after the store. +void MemoryTrackPass::instrumentPointer() { + StoreInst *storeInst = dyn_cast(&*this->currentInstruction); + Value *var_address = storeInst->getPointerOperand(); + Value *receives = storeInst->getValueOperand(); - // Adds map2check_malloc with allocated address and size - IRBuilder<> builder(BBIteratorToInst(j)); - auto size = callInst->getArgOperand(2); - auto pointer = callInst->getOperand(0); + IRBuilder<> builder(storeInst->getNextNode()); + Value *name_llvm = builder.CreateGlobalStringPtr(var_address->getName()); - Twine bitcast("bitcast"); + Value *args[] = {coerceToParamType(builder, var_address, storePointer, 0), + coerceToParamType(builder, receives, storePointer, 1), + this->scope_value, + name_llvm, + this->line_value, + this->functionName()}; + builder.CreateCall(this->storePointer, args); +} - Value *varPointerCast = CastInst::CreatePointerCast( - pointer, PointerType::get(*this->Ctx, 0), bitcast, BBIteratorToInst(j)); +// abi-mapping: map2check_posix -> map2check_map_posix_memalign(memptr, i32). +void MemoryTrackPass::instrumentPosixMemAllign() { + CallInst *callInst = dyn_cast(&*this->currentInstruction); - Value *args[] = {varPointerCast, - coerceToParamType(builder, size, map2check_posix, 1)}; - builder.CreateCall(map2check_posix, args); + IRBuilder<> builder(callInst->getNextNode()); + Value *size = callInst->getArgOperand(2); + Value *pointer = callInst->getArgOperand(0); + + Value *args[] = {coerceToParamType(builder, pointer, mapPosixMemalign, 0), + coerceToParamType(builder, size, mapPosixMemalign, 1)}; + builder.CreateCall(mapPosixMemalign, args); } -// TODO(hbgit): make dynCast only one time +// abi-mapping: map2check_malloc -> map2check_map_malloc(block, i32 size). void MemoryTrackPass::instrumentMalloc() { CallInst *callInst = dyn_cast(&*this->currentInstruction); - auto j = this->currentInstruction; - ++j; - - // Adds map2check_malloc with allocated address and size - IRBuilder<> builder(BBIteratorToInst(j)); + IRBuilder<> builder(callInst->getNextNode()); Value *size = callInst->getArgOperand(0); - Twine bitcast("bitcast"); - // if (size == NULL) { - // } - Value *args[] = {callInst, - coerceToParamType(builder, size, map2check_malloc, 1)}; - builder.CreateCall(map2check_malloc, args); + Value *args[] = {callInst, coerceToParamType(builder, size, mapMalloc, 1)}; + builder.CreateCall(mapMalloc, args); } +// realloc(old, n): the old block goes through the resolved-address free check +// (NULL is valid here, is_null_valid 1), which records the release when it +// passes; the new block is mapped as a malloc. void MemoryTrackPass::instrumentRealloc() { CallInst *callInst = dyn_cast(&*this->currentInstruction); - auto j = this->currentInstruction; - IRBuilder<> freeBuilder(BBIteratorToInst(j)); - auto function_name = this->currentFunction->getName(); - Value *function_llvm = freeBuilder.CreateGlobalStringPtr(function_name); - - Value *nullValid = ConstantInt::getSigned(Type::getInt1Ty(*this->Ctx), 1); - - Value *freeArgs[] = {callInst->getArgOperand(0), this->line_value, - function_llvm, nullValid}; - - freeBuilder.CreateCall(map2check_free_resolved_address, freeArgs); + IRBuilder<> freeBuilder(callInst); - ++j; + Value *nullValid = ConstantInt::get(Type::getInt16Ty(*this->Ctx), 1); + Value *freeArgs[] = { + coerceToParamType(freeBuilder, callInst->getArgOperand(0), + checkFreeResolved, 0), + this->line_value, this->functionName(), nullValid}; + freeBuilder.CreateCall(checkFreeResolved, freeArgs); - // Adds map2check_malloc with allocated address and size - IRBuilder<> builder(BBIteratorToInst(j)); - auto size = callInst->getArgOperand(1); - Value *args[] = {callInst, - coerceToParamType(builder, size, map2check_malloc, 1)}; - builder.CreateCall(map2check_malloc, args); + IRBuilder<> builder(callInst->getNextNode()); + Value *size = callInst->getArgOperand(1); + Value *args[] = {callInst, coerceToParamType(builder, size, mapMalloc, 1)}; + builder.CreateCall(mapMalloc, args); } +// abi-mapping: map2check_load + map2check_check_deref -> map2check_check_load +// (ptr, line, scope, size, fn); check_load records the violation itself. // BUG on map2check_load void MemoryTrackPass::instrumentMemset() { CallInst *callInst = dyn_cast(&*this->currentInstruction); - auto j = this->currentInstruction; + IRBuilder<> builder(callInst); - auto function_name = this->currentFunction->getName(); + Value *size = callInst->getArgOperand(2); + Value *pointer = callInst->getArgOperand(0); - auto size = callInst->getArgOperand(2); - auto pointer = callInst->getOperand(0); - - Twine bitcast("bitcast"); - - Value *varPointerCast = CastInst::CreatePointerCast( - pointer, PointerType::get(*this->Ctx, 0), bitcast, BBIteratorToInst(j)); - - IRBuilder<> builder(BBIteratorToInst(j)); - Value *function_llvm = builder.CreateGlobalStringPtr(function_name); - - // Value *args[] = {varPointerCast, size}; - Value *args[] = {pointer, size}; - builder.CreateCall(map2check_load, args); - - Value *args2[] = {this->line_value, function_llvm}; - builder.CreateCall(map2check_check_deref, args2); + Value *args[] = {coerceToParamType(builder, pointer, checkLoad, 0), + this->line_value, this->scope_value, + coerceToParamType(builder, size, checkLoad, 3), + this->functionName()}; + builder.CreateCall(checkLoad, args); } void MemoryTrackPass::instrumentMemcpy() { CallInst *callInst = dyn_cast(&*this->currentInstruction); - auto j = this->currentInstruction; - - auto function_name = this->currentFunction->getName(); - - auto size = callInst->getArgOperand(2); - auto pointer_destiny = callInst->getOperand(0); - auto pointer_origin = callInst->getArgOperand(1); - - Twine bitcast("bitcast_memcpy"); - - Value *varPointerCast = CastInst::CreatePointerCast( - pointer_destiny, PointerType::get(*this->Ctx, 0), bitcast, - BBIteratorToInst(j)); - - Value *sizeCast = CastInst::CreateIntegerCast( - size, Type::getInt64Ty(*this->Ctx), true, bitcast, BBIteratorToInst(j)); - - Value *varPointerCastOrigin = CastInst::CreatePointerCast( - pointer_origin, PointerType::get(*this->Ctx, 0), bitcast, - BBIteratorToInst(j)); - - IRBuilder<> builder(BBIteratorToInst(j)); - Value *function_llvm = builder.CreateGlobalStringPtr(function_name); - - Value *args2[] = {varPointerCastOrigin, sizeCast}; - builder.CreateCall(map2check_load, args2); - - Value *args3[] = {this->line_value, function_llvm}; - // builder.CreateCall(map2check_check_deref, args3); - - Value *args[] = {varPointerCast, sizeCast}; - builder.CreateCall(map2check_load, args); - builder.CreateCall(map2check_load, args2); - builder.CreateCall(map2check_check_deref, args3); + IRBuilder<> builder(callInst); + + Value *size = coerceToParamType(builder, callInst->getArgOperand(2), + checkLoad, 3); + for (Value *pointer : + {callInst->getArgOperand(1), callInst->getArgOperand(0)}) { + Value *args[] = {coerceToParamType(builder, pointer, checkLoad, 0), + this->line_value, this->scope_value, size, + this->functionName()}; + builder.CreateCall(checkLoad, args); + } } +// alloca(n) called as a function: a static block of n bytes. void MemoryTrackPass::instrumentAlloca() { CallInst *callInst = dyn_cast(&*this->currentInstruction); - auto j = this->currentInstruction; - ++j; + IRBuilder<> builder(callInst->getNextNode()); + Value *size = coerceToParamType(builder, callInst->getArgOperand(0), + mapAlloca, 2); - // Adds map2check_malloc with allocated address and size - IRBuilder<> builder(BBIteratorToInst(j)); - auto size = callInst->getArgOperand(0); - - Twine non_det("bitcast_map2check_alloca"); - Value *pointerCast = CastInst::CreatePointerCast( - callInst, PointerType::get(*this->Ctx, 0), non_det, BBIteratorToInst(j)); - - auto function_name = ""; - Value *function_llvm = builder.CreateGlobalStringPtr(function_name); - - Value *args[] = {function_llvm, pointerCast, size, + Value *function_llvm = builder.CreateGlobalStringPtr(""); + Value *args[] = {function_llvm, callInst, size, size, this->line_value, this->scope_value}; - - builder.CreateCall(map2check_alloca, args); + builder.CreateCall(mapAlloca, args); } /* For the purpose of memory checking calloc is basically @@ -283,64 +223,59 @@ void MemoryTrackPass::instrumentAlloca() { */ void MemoryTrackPass::instrumentCalloc() { CallInst *callInst = dyn_cast(&*this->currentInstruction); - auto j = this->currentInstruction; - ++j; - - IRBuilder<> builder(BBIteratorToInst(j)); - auto quantityOfElements = callInst->getArgOperand(0); - auto sizeOfElements = callInst->getArgOperand(1); - Value *args[] = {callInst, quantityOfElements, sizeOfElements}; - builder.CreateCall(map2check_calloc, args); + IRBuilder<> builder(callInst->getNextNode()); + Value *args[] = { + callInst, + coerceToParamType(builder, callInst->getArgOperand(0), mapCalloc, 1), + coerceToParamType(builder, callInst->getArgOperand(1), mapCalloc, 2)}; + builder.CreateCall(mapCalloc, args); } -// TODO(hbgit): make dynCast only one time +// abi-mapping: map2check_free -> map2check_check_free + map2check_map_free. +// free(var) is recorded here and instrumented after the walk; free of any +// other address is one resolved-address check (is_null_valid 0). void MemoryTrackPass::instrumentFree() { CallInst *callInst = dyn_cast(&*this->currentInstruction); - auto j = this->currentInstruction; - // ++j; - - this->calleeFunction = callInst->getCalledFunction(); - this->getDebugInfo(); - LoadInst *li; - IRBuilder<> builder(BBIteratorToInst(j)); + auto *li = + dyn_cast(callInst->getArgOperand(0)->stripPointerCasts()); - auto function_name = this->currentFunction->getName(); - Value *function_llvm = builder.CreateGlobalStringPtr(function_name); - - if (this->calleeFunction == NULL) { - Value *v = callInst->getCalledOperand(); - this->calleeFunction = dyn_cast(v->stripPointerCasts()); - li = dyn_cast(callInst->getArgOperand(0)); - - } else { - // Value* addr = callInst->getArgOperand(0)->stripPointerCasts(); - - li = dyn_cast(callInst->getArgOperand(0)->stripPointerCasts()); + if (li != nullptr && li->getType()->isPointerTy()) { + this->pendingFrees.push_back( + {callInst, li->getPointerOperand(), li, this->line_value, + this->scope_value}); + return; } - if (li == NULL) { - Value *nullNotValid = - ConstantInt::getSigned(Type::getInt1Ty(*this->Ctx), 0); - - Value *args[] = {callInst->getArgOperand(0), this->line_value, - function_llvm, nullNotValid}; - builder.CreateCall(map2check_free_resolved_address, args); - } else { - auto name = li->getPointerOperand()->getName(); - Value *name_llvm = builder.CreateGlobalStringPtr(name); - - Twine non_det("bitcast_map2check"); - Value *pointerCast = CastInst::CreatePointerCast( - li->getPointerOperand(), PointerType::get(*this->Ctx, 0), non_det, - BBIteratorToInst(j)); - - Value *args[] = { - name_llvm, pointerCast, this->scope_value, - this->line_value, function_llvm, - }; - - builder.CreateCall(map2check_free, args); + IRBuilder<> builder(callInst); + Value *nullNotValid = ConstantInt::get(Type::getInt16Ty(*this->Ctx), 0); + Value *args[] = {coerceToParamType(builder, callInst->getArgOperand(0), + checkFreeResolved, 0), + this->line_value, this->functionName(), nullNotValid}; + builder.CreateCall(checkFreeResolved, args); +} + +// The core keys the release on the heap address, and the C runtime read it +// from the pointer variable's slot: the block is the program's own load of +// *slot (the value free receives; no second load), both calls are skipped +// for NULL as the C runtime did, else check_free then map_free, both +// (name, slot, *slot, scope, line, fn). +void MemoryTrackPass::instrumentPendingFrees() { + for (const PendingFree &pending : this->pendingFrees) { + IRBuilder<> builder(pending.call); + Value *name_llvm = + builder.CreateGlobalStringPtr(pending.slot->getName()); + Value *slot = coerceToParamType(builder, pending.slot, checkFree, 1); + LoadInst *block = pending.block; + Value *nonNull = builder.CreateIsNotNull(block); + Instruction *then = llvm::SplitBlockAndInsertIfThen( + nonNull, pending.call, /*Unreachable=*/false); + IRBuilder<> guarded(then); + Value *args[] = {name_llvm, slot, block, + pending.scope, pending.line, this->functionName()}; + guarded.CreateCall(checkFree, args)->setDebugLoc(pending.call->getDebugLoc()); + guarded.CreateCall(mapFree, args)->setDebugLoc(pending.call->getDebugLoc()); } + this->pendingFrees.clear(); } void MemoryTrackPass::getDebugInfo() { @@ -356,10 +291,8 @@ void MemoryTrackPass::getDebugInfo() { line_number = 0; } - this->scope_value = - ConstantInt::getSigned(Type::getInt64Ty(*this->Ctx), scope_number); - this->line_value = - ConstantInt::getSigned(Type::getInt64Ty(*this->Ctx), line_number); + this->scope_value = i32Constant(this->Ctx, scope_number); + this->line_value = i32Constant(this->Ctx, line_number); } int MemoryTrackPass::getLineNumber() { @@ -373,6 +306,7 @@ int MemoryTrackPass::getLineNumber() { return line_number; } +// Globals are mapped as static blocks at the start of the entry function. void MemoryTrackPass::instrumentInit() { Function::iterator bb = this->currentFunction->begin(); BasicBlock::iterator i = bb->begin(); @@ -389,7 +323,6 @@ void MemoryTrackPass::instrumentInit() { for (unsigned pos = 0; pos < globals.size(); pos++) { GlobalVariable *variable = globals[pos]; - // errs () << "VAR: " << variable->getName() << "\n"; const DataLayout dataLayout = currentModule->getDataLayout(); auto type = variable->getValueType(); unsigned typeSize = dataLayout.getTypeSizeInBits(type) / 8; @@ -407,33 +340,18 @@ void MemoryTrackPass::instrumentInit() { Value *name_llvm = builder.CreateGlobalStringPtr(variable->getName()); - ConstantInt *typeSizeValue = - ConstantInt::getSigned(Type::getInt64Ty(*this->Ctx), typeSize); - ConstantInt *primitiveSizeValue = - ConstantInt::getSigned(Type::getInt64Ty(*this->Ctx), primitiveSize); - - Twine non_det("bitcast_map2check"); - Value *pointerCast = CastInst::CreatePointerCast( - variable, PointerType::get(*this->Ctx, 0), non_det, BBIteratorToInst(i)); - // TODO(hbgit): this->currentInstruction = i; this->getDebugInfo(); - /** - errs() << *name_llvm << " (1) \n"; - errs() << *pointerCast << " (2) \n"; - errs() << *typeSizeValue << " (3) \n"; - errs() << *primitiveSizeValue << " (4) \n"; - errs() << *this->line_value << " (5) \n"; - errs() << *this->scope_value << " (6) \n"; - errs() << "----------------- \n"; - **/ - - // const char* name, void* ptr, int size, int size_of_primitive, int line, - // int scope) - Value *args[] = {name_llvm, pointerCast, typeSizeValue, - primitiveSizeValue, this->line_value, this->scope_value}; - builder.CreateCall(map2check_alloca, args); + + // (name, addr, size, size_of_primitive, line, scope) + Value *args[] = {name_llvm, + variable, + i32Constant(this->Ctx, typeSize), + i32Constant(this->Ctx, primitiveSize), + this->line_value, + this->scope_value}; + builder.CreateCall(mapAlloca, args); } } @@ -450,11 +368,10 @@ bool MemoryTrackPass::isWasmDeallocator(llvm::StringRef name) { return name.endswith("_dlfree") || name.endswith("_free"); } +// abi-mapping: map2check_wasm_malloc(u64 offset, u64 size). void MemoryTrackPass::instrumentWasmMalloc() { CallInst *callInst = dyn_cast(&*this->currentInstruction); - auto j = this->currentInstruction; - ++j; - IRBuilder<> builder(BBIteratorToInst(j)); + IRBuilder<> builder(callInst->getNextNode()); // Arg 1 = size (i32) Value *size32 = callInst->getArgOperand(1); @@ -464,20 +381,22 @@ void MemoryTrackPass::instrumentWasmMalloc() { Value *offset64 = builder.CreateZExt(callInst, Type::getInt64Ty(*this->Ctx)); Value *args[] = {offset64, size64}; - builder.CreateCall(map2check_wasm_malloc, args); + builder.CreateCall(wasmMalloc, args); } +// abi-mapping: map2check_wasm_free(u64 offset, i64 line). void MemoryTrackPass::instrumentWasmFree() { CallInst *callInst = dyn_cast(&*this->currentInstruction); - auto j = this->currentInstruction; - IRBuilder<> builder(BBIteratorToInst(j)); + IRBuilder<> builder(callInst); // Arg 1 = offset (i32) → i64 Value *offset32 = callInst->getArgOperand(1); Value *offset64 = builder.CreateZExt(offset32, Type::getInt64Ty(*this->Ctx)); + Value *line64 = + builder.CreateSExt(this->line_value, Type::getInt64Ty(*this->Ctx)); - Value *args[] = {offset64, this->line_value}; - builder.CreateCall(map2check_wasm_free, args); + Value *args[] = {offset64, line64}; + builder.CreateCall(wasmFree, args); } void MemoryTrackPass::switchCallInstruction() { @@ -525,6 +444,8 @@ void MemoryTrackPass::switchCallInstruction() { } } +// abi-mapping: map2check_function -> map2check_map_funct_address(name, addr). +// Not called from run() (as before the cutover). void MemoryTrackPass::instrumentFunctionAddress() { if (!this->mainFunctionInitialized) { this->functionsValues.push_back(this->currentFunction); @@ -532,8 +453,6 @@ void MemoryTrackPass::instrumentFunctionAddress() { } Function::iterator bb = this->mainFunction->begin(); - // // bb--; - BasicBlock::iterator i = bb->begin(); i++; @@ -542,14 +461,9 @@ void MemoryTrackPass::instrumentFunctionAddress() { iterator++) { Value *name_llvm = builder.CreateGlobalStringPtr( this->functionsValues[iterator]->getName()); - - Twine non_det("bitcast_map2check"); - Value *pointerCast = CastInst::CreatePointerCast( - this->functionsValues[iterator], PointerType::get(*this->Ctx, 0), - non_det, BBIteratorToInst(i)); - - Value *instrumentationArgs[] = {name_llvm, pointerCast}; - builder.CreateCall(map2check_function, instrumentationArgs); + Value *instrumentationArgs[] = {name_llvm, + this->functionsValues[iterator]}; + builder.CreateCall(mapFunctAddress, instrumentationArgs); } this->functionsValues.clear(); @@ -558,9 +472,6 @@ void MemoryTrackPass::instrumentFunctionAddress() { void MemoryTrackPass::instrumentAllocation() { AllocaInst *allocaInst = dyn_cast(&*this->currentInstruction); - auto j = this->currentInstruction; - j++; - Module *M = this->currentFunction->getParent(); const DataLayout dataLayout = M->getDataLayout(); @@ -579,21 +490,16 @@ void MemoryTrackPass::instrumentAllocation() { } primitiveSize = dataLayout.getTypeSizeInBits(type) / 8; - IRBuilder<> builder(BBIteratorToInst(j)); + IRBuilder<> builder(allocaInst->getNextNode()); Value *name_llvm = builder.CreateGlobalStringPtr(allocaInst->getName()); - ConstantInt *typeSizeValue = - ConstantInt::getSigned(Type::getInt64Ty(*this->Ctx), typeSize); - ConstantInt *primitiveSizeValue = - ConstantInt::getSigned(Type::getInt64Ty(*this->Ctx), primitiveSize); - - Twine non_det("bitcast_map2check"); - Value *pointerCast = CastInst::CreatePointerCast( - allocaInst, PointerType::get(*this->Ctx, 0), non_det, BBIteratorToInst(j)); - - Value *args[] = {name_llvm, pointerCast, typeSizeValue, - primitiveSizeValue, this->line_value, this->scope_value}; - builder.CreateCall(map2check_alloca, args); + Value *args[] = {name_llvm, + allocaInst, + i32Constant(this->Ctx, typeSize), + i32Constant(this->Ctx, primitiveSize), + this->line_value, + this->scope_value}; + builder.CreateCall(mapAlloca, args); } // TODO(hbgit): make dynCast only one time @@ -616,7 +522,7 @@ void MemoryTrackPass::runOnCallInstruction() { this->calleeFunction = NULL; } -// TODO(hbgit): make dynCast only one time +// A store is checked like a load of the stored size, before it happens. void MemoryTrackPass::runOnStoreInstruction() { StoreInst *storeInst = dyn_cast(&*this->currentInstruction); if (storeInst->getValueOperand()->getType()->isPointerTy()) { @@ -629,94 +535,57 @@ void MemoryTrackPass::runOnStoreInstruction() { Module *M = this->currentFunction->getParent(); const DataLayout dataLayout = M->getDataLayout(); - auto type = receives->getType(); - unsigned typeSize = dataLayout.getTypeSizeInBits(type) / 8; - ConstantInt *typeSizeValue = - ConstantInt::getSigned(Type::getInt64Ty(*this->Ctx), typeSize); - - auto j = this->currentInstruction; - // j--; + unsigned typeSize = dataLayout.getTypeSizeInBits(receives->getType()) / 8; - Twine non_det("bitcast_map2check_store"); - Value *pointerCast = - CastInst::CreatePointerCast(var_address, PointerType::get(*this->Ctx, 0), - non_det, BBIteratorToInst(j)); - // j++; - IRBuilder<> builder(BBIteratorToInst(j)); - Value *args[] = {pointerCast, typeSizeValue}; - builder.CreateCall(map2check_load, args); - - Value *function_name_llvm = - builder.CreateGlobalStringPtr(this->currentFunction->getName()); - Value *args2[] = {this->line_value, function_name_llvm}; - builder.CreateCall(map2check_check_deref, args2); + IRBuilder<> builder(storeInst); + Value *args[] = {coerceToParamType(builder, var_address, checkLoad, 0), + this->line_value, this->scope_value, + i32Constant(this->Ctx, typeSize), this->functionName()}; + builder.CreateCall(checkLoad, args); } +// abi-mapping: map2check_non_static_alloca: the size is the element count; +// the core records count * size_primitive bytes. void MemoryTrackPass::instrumentNotStaticArrayAlloca() { AllocaInst *allocaInst = dyn_cast(&*this->currentInstruction); Value *v = allocaInst->getArraySize(); - // Value* v = allocaInst->getOperand(0); - - auto j = this->currentInstruction; - j++; Module *M = this->currentFunction->getParent(); const DataLayout dataLayout = M->getDataLayout(); auto type = allocaInst->getAllocatedType(); - unsigned primitiveSize = 0; - // type->get - - primitiveSize = dataLayout.getTypeSizeInBits(type) / 8; - IRBuilder<> builder(BBIteratorToInst(j)); + unsigned primitiveSize = dataLayout.getTypeSizeInBits(type) / 8; + IRBuilder<> builder(allocaInst->getNextNode()); Value *name_llvm = builder.CreateGlobalStringPtr(allocaInst->getName()); - ConstantInt *primitiveSizeValue = - ConstantInt::getSigned(Type::getInt64Ty(*this->Ctx), primitiveSize); - - Twine non_det("bitcast_map2check"); - Value *pointerCast = CastInst::CreatePointerCast( - allocaInst, PointerType::get(*this->Ctx, 0), non_det, BBIteratorToInst(j)); - - Value *sizeCast = CastInst::CreateIntegerCast( - v, Type::getInt64Ty(*this->Ctx), true, non_det, BBIteratorToInst(j)); - - Value *args[] = {name_llvm, pointerCast, sizeCast, - primitiveSizeValue, this->line_value, this->scope_value}; - builder.CreateCall(map2check_non_static_alloca, args); + Value *args[] = {name_llvm, + allocaInst, + coerceToParamType(builder, v, mapNonStaticAlloca, 2), + i32Constant(this->Ctx, primitiveSize), + this->line_value, + this->scope_value}; + builder.CreateCall(mapNonStaticAlloca, args); } void MemoryTrackPass::instrumentArrayAlloca() { AllocaInst *allocaInst = dyn_cast(&*this->currentInstruction); Value *v = allocaInst->getArraySize(); - // Value* v = allocaInst->getOperand(0); - - auto j = this->currentInstruction; - j++; Module *M = this->currentFunction->getParent(); const DataLayout dataLayout = M->getDataLayout(); auto type = v->getType(); - unsigned primitiveSize = 0; - - primitiveSize = dataLayout.getTypeSizeInBits(type) / 8; - IRBuilder<> builder(BBIteratorToInst(j)); + unsigned primitiveSize = dataLayout.getTypeSizeInBits(type) / 8; + IRBuilder<> builder(allocaInst->getNextNode()); Value *name_llvm = builder.CreateGlobalStringPtr(allocaInst->getName()); - ConstantInt *primitiveSizeValue = - ConstantInt::getSigned(Type::getInt64Ty(*this->Ctx), primitiveSize); - - Twine non_det("bitcast_map2check"); - Value *pointerCast = CastInst::CreatePointerCast( - allocaInst, PointerType::get(*this->Ctx, 0), non_det, BBIteratorToInst(j)); - - Value *sizeCast = CastInst::CreateIntegerCast( - v, Type::getInt64Ty(*this->Ctx), true, non_det, BBIteratorToInst(j)); - - Value *args[] = {name_llvm, pointerCast, sizeCast, - primitiveSizeValue, this->line_value, this->scope_value}; - builder.CreateCall(map2check_alloca, args); + Value *args[] = {name_llvm, + allocaInst, + coerceToParamType(builder, v, mapAlloca, 2), + i32Constant(this->Ctx, primitiveSize), + this->line_value, + this->scope_value}; + builder.CreateCall(mapAlloca, args); } void MemoryTrackPass::runOnAllocaInstruction() { @@ -734,6 +603,8 @@ void MemoryTrackPass::runOnAllocaInstruction() { } } +// abi-mapping: map2check_load (+ check_deref) -> map2check_check_load +// (ptr, line, scope, size, fn), before the load. void MemoryTrackPass::runOnLoadInstruction() { LoadInst *loadInst = dyn_cast(&*this->currentInstruction); @@ -742,142 +613,42 @@ void MemoryTrackPass::runOnLoadInstruction() { Module *M = this->currentFunction->getParent(); const DataLayout dataLayout = M->getDataLayout(); - auto type = loadInst->getType(); - unsigned typeSize = dataLayout.getTypeSizeInBits(type) / 8; - ConstantInt *typeSizeValue = - ConstantInt::getSigned(Type::getInt64Ty(*this->Ctx), typeSize); - - auto j = this->currentInstruction; - // j--; + unsigned typeSize = dataLayout.getTypeSizeInBits(loadInst->getType()) / 8; - Twine non_det("bitcast_map2check"); - Value *pointerCast = CastInst::CreatePointerCast( - v, PointerType::get(*this->Ctx, 0), non_det, BBIteratorToInst(j)); - // j++; - IRBuilder<> builder(BBIteratorToInst(j)); - Value *args[] = {pointerCast, typeSizeValue}; - builder.CreateCall(map2check_load, args); - - Value *function_name_llvm = - builder.CreateGlobalStringPtr(this->currentFunction->getName()); - Value *args2[] = {this->line_value, function_name_llvm}; - builder.CreateCall(map2check_check_deref, args2); + IRBuilder<> builder(loadInst); + Value *args[] = {coerceToParamType(builder, v, checkLoad, 0), + this->line_value, this->scope_value, + i32Constant(this->Ctx, typeSize), this->functionName()}; + builder.CreateCall(checkLoad, args); } void MemoryTrackPass::prepareMap2CheckInstructions() { - Function &F = *this->currentFunction; - - this->map2check_load = F.getParent()->getOrInsertFunction( - "map2check_load", Type::getVoidTy(*this->Ctx), - PointerType::get(*this->Ctx, 0), Type::getInt64Ty(*this->Ctx)); - - this->map2check_free_resolved_address = F.getParent()->getOrInsertFunction( - "map2check_free_resolved_address", Type::getVoidTy(*this->Ctx), - PointerType::get(*this->Ctx, 0), Type::getInt64Ty(*this->Ctx), - PointerType::get(*this->Ctx, 0), Type::getInt1Ty(*this->Ctx)); - - this->map2check_pointer = F.getParent()->getOrInsertFunction( - "map2check_add_store_pointer", Type::getVoidTy(*this->Ctx), - PointerType::get(*this->Ctx, 0), PointerType::get(*this->Ctx, 0), - Type::getInt64Ty(*this->Ctx), PointerType::get(*this->Ctx, 0), - Type::getInt64Ty(*this->Ctx), PointerType::get(*this->Ctx, 0)); - - this->map2check_check_deref = F.getParent()->getOrInsertFunction( - "map2check_check_deref", Type::getVoidTy(*this->Ctx), - Type::getInt64Ty(*this->Ctx), PointerType::get(*this->Ctx, 0)); - - this->map2check_malloc = F.getParent()->getOrInsertFunction( - "map2check_malloc", Type::getVoidTy(*this->Ctx), - PointerType::get(*this->Ctx, 0), Type::getInt64Ty(*this->Ctx)); - - this->map2check_posix = F.getParent()->getOrInsertFunction( - "map2check_posix", Type::getVoidTy(*this->Ctx), - PointerType::get(*this->Ctx, 0), Type::getInt64Ty(*this->Ctx)); - - this->map2check_calloc = F.getParent()->getOrInsertFunction( - "map2check_calloc", Type::getVoidTy(*this->Ctx), - PointerType::get(*this->Ctx, 0), Type::getInt64Ty(*this->Ctx), - Type::getInt64Ty(*this->Ctx)); - - this->map2check_alloca = F.getParent()->getOrInsertFunction( - "map2check_alloca", Type::getVoidTy(*this->Ctx), - PointerType::get(*this->Ctx, 0), PointerType::get(*this->Ctx, 0), - Type::getInt64Ty(*this->Ctx), Type::getInt64Ty(*this->Ctx), - Type::getInt64Ty(*this->Ctx), Type::getInt64Ty(*this->Ctx)); - - this->map2check_non_static_alloca = F.getParent()->getOrInsertFunction( - "map2check_non_static_alloca", Type::getVoidTy(*this->Ctx), - PointerType::get(*this->Ctx, 0), PointerType::get(*this->Ctx, 0), - Type::getInt64Ty(*this->Ctx), Type::getInt64Ty(*this->Ctx), - Type::getInt64Ty(*this->Ctx), Type::getInt64Ty(*this->Ctx)); - - this->map2check_function = F.getParent()->getOrInsertFunction( - "map2check_function", Type::getVoidTy(*this->Ctx), - PointerType::get(*this->Ctx, 0), PointerType::get(*this->Ctx, 0)); - - this->map2check_free = F.getParent()->getOrInsertFunction( - "map2check_free", Type::getVoidTy(*this->Ctx), - PointerType::get(*this->Ctx, 0), PointerType::get(*this->Ctx, 0), - Type::getInt64Ty(*this->Ctx), Type::getInt64Ty(*this->Ctx), - PointerType::get(*this->Ctx, 0)); + Module &module = *this->currentFunction->getParent(); + + this->checkLoad = Map2Check::getOrInsertRuntime(module, RuntimeHook::Load); + this->checkFreeResolved = + Map2Check::getOrInsertRuntime(module, RuntimeHook::FreeResolved); + this->storePointer = + Map2Check::getOrInsertRuntime(module, RuntimeHook::StorePointer); + this->mapMalloc = Map2Check::getOrInsertRuntime(module, RuntimeHook::Malloc); + this->mapPosixMemalign = + Map2Check::getOrInsertRuntime(module, RuntimeHook::PosixMemalign); + this->mapCalloc = Map2Check::getOrInsertRuntime(module, RuntimeHook::Calloc); + this->mapAlloca = Map2Check::getOrInsertRuntime(module, RuntimeHook::Alloca); + this->mapNonStaticAlloca = + Map2Check::getOrInsertRuntime(module, RuntimeHook::NonStaticAlloca); + this->mapFunctAddress = + Map2Check::getOrInsertRuntime(module, RuntimeHook::FunctionAddr); + this->checkFree = + Map2Check::getOrInsertRuntime(module, RuntimeHook::CheckFree); + this->mapFree = Map2Check::getOrInsertRuntime(module, RuntimeHook::MapFree); if (WasmModeActive) { - this->map2check_wasm_malloc = F.getParent()->getOrInsertFunction( - "map2check_wasm_malloc", Type::getVoidTy(*this->Ctx), - Type::getInt64Ty(*this->Ctx), Type::getInt64Ty(*this->Ctx)); - - this->map2check_wasm_free = F.getParent()->getOrInsertFunction( - "map2check_wasm_free", Type::getVoidTy(*this->Ctx), - Type::getInt64Ty(*this->Ctx), Type::getInt64Ty(*this->Ctx)); - - this->map2check_wasm_check_access = F.getParent()->getOrInsertFunction( - "map2check_wasm_check_access", Type::getVoidTy(*this->Ctx), - Type::getInt64Ty(*this->Ctx), Type::getInt64Ty(*this->Ctx)); - } -} - -void MemoryTrackPass::instrumentFunctionArgumentAddress() { - Function *F = this->currentFunction; - Module *M = this->currentFunction->getParent(); - const DataLayout dataLayout = M->getDataLayout(); - - Function::iterator bb = this->currentFunction->begin(); - // // bb--; - - BasicBlock::iterator i = bb->begin(); - i++; - // i++; - - for (auto arg = F->arg_begin(); arg != F->arg_end(); arg++) { - Argument *functionArg = &(*arg); - - // functionArg-> - auto type = functionArg->getType(); - unsigned typeSize = dataLayout.getTypeSizeInBits(type) / 8; - IRBuilder<> builder(BBIteratorToInst(i)); - Value *name_llvm = builder.CreateGlobalStringPtr(functionArg->getName()); - - ConstantInt *typeSizeValue = - ConstantInt::getSigned(Type::getInt64Ty(*this->Ctx), typeSize); - Value *argCast; - - if (type->isPointerTy()) { - Twine mapcheck_bitcast_argument("mapcheck_bitcast_argument"); - argCast = CastInst::CreatePointerCast( - functionArg, PointerType::get(*this->Ctx, 0), - mapcheck_bitcast_argument, BBIteratorToInst(i)); - - } else { - argCast = functionArg; - } - - // ConstantInt* primitiveSizeValue = - // ConstantInt::getSigned(Type::getInt64Ty(*this->Ctx), - // primitiveSize); - - Value *args[] = {name_llvm, argCast, typeSizeValue, - typeSizeValue, this->line_value, this->scope_value}; - builder.CreateCall(map2check_alloca, args); + this->wasmMalloc = + Map2Check::getOrInsertRuntime(module, RuntimeHook::WasmMalloc); + this->wasmFree = Map2Check::getOrInsertRuntime(module, RuntimeHook::WasmFree); + this->wasmCheckAccess = + Map2Check::getOrInsertRuntime(module, RuntimeHook::WasmCheckAccess); } } @@ -885,6 +656,9 @@ PreservedAnalyses MemoryTrackPass::run(Function &F, llvm::FunctionAnalysisManager &AM) { this->Ctx = &F.getContext(); this->currentFunction = &F; + this->functionNameValue = nullptr; + this->pendingFrees.clear(); + if (F.isDeclaration()) return PreservedAnalyses::all(); this->prepareMap2CheckInstructions(); // this->instrumentInit(); //overhead BUG @@ -898,34 +672,41 @@ PreservedAnalyses MemoryTrackPass::run(Function &F, for (Function::iterator bb = F.begin(), e = F.end(); bb != e; ++bb) { for (BasicBlock::iterator i = bb->begin(), e = bb->end(); i != e; ++i) { this->currentInstruction = i; + if (i->hasMetadata(Map2Check::kRuntimeMetadata)) continue; if (dyn_cast(&*i) != NULL) { this->getDebugInfo(); this->runOnCallInstruction(); - } else if (dyn_cast(&*this->currentInstruction) != NULL) { + } else if (auto *SI = dyn_cast(&*this->currentInstruction)) { + if (isRuntimeOwned(SI->getPointerOperand())) continue; this->getDebugInfo(); this->runOnStoreInstruction(); if (WasmModeActive) { - auto* SI = cast(&*i); - instrumentWasmBoundsCheck(&*i, SI->getPointerOperand(), SI->getValueOperand()->getType()); + instrumentWasmBoundsCheck(&*i, SI->getPointerOperand(), + SI->getValueOperand()->getType()); } } else if (dyn_cast(&*this->currentInstruction) != NULL) { this->getDebugInfo(); this->runOnAllocaInstruction(); - } else if (dyn_cast(&*this->currentInstruction) != NULL) { + } else if (auto *LI = dyn_cast(&*this->currentInstruction)) { + if (isRuntimeOwned(LI->getPointerOperand())) continue; this->getDebugInfo(); this->runOnLoadInstruction(); if (WasmModeActive) { - auto* LI = cast(&*i); - instrumentWasmBoundsCheck(&*i, LI->getPointerOperand(), LI->getType()); + instrumentWasmBoundsCheck(&*i, LI->getPointerOperand(), + LI->getType()); } } } } + // After the walk: guarding a free splits its block. + this->instrumentPendingFrees(); + return PreservedAnalyses::none(); } +// abi-mapping: map2check_wasm_check_access(u64 offset, u64 access_size). void MemoryTrackPass::instrumentWasmBoundsCheck(llvm::Instruction* I, llvm::Value* ptr, llvm::Type* accessType) { @@ -949,7 +730,7 @@ void MemoryTrackPass::instrumentWasmBoundsCheck(llvm::Instruction* I, Value* sizeVal = ConstantInt::get(int64Ty, accessSize); Value* args[] = {offset64, sizeVal}; - builder.CreateCall(map2check_wasm_check_access, args); + builder.CreateCall(wasmCheckAccess, args); } // --- New Pass Manager plugin registration --- diff --git a/modules/backend/pass/MemoryTrackPass.hpp b/modules/backend/pass/MemoryTrackPass.hpp index 2d404a9d2..b9bcc38d0 100644 --- a/modules/backend/pass/MemoryTrackPass.hpp +++ b/modules/backend/pass/MemoryTrackPass.hpp @@ -57,7 +57,6 @@ struct MemoryTrackPass : public llvm::PassInfoMixin { void instrumentNotStaticArrayAlloca(); void instrumentAllocation(); void instrumentFunctionAddress(); - void instrumentFunctionArgumentAddress(); void runOnAllocaInstruction(); void runOnCallInstruction(); void runOnStoreInstruction(); @@ -84,20 +83,33 @@ struct MemoryTrackPass : public llvm::PassInfoMixin { Function* calleeFunction; BasicBlock::iterator currentInstruction; BasicBlock::iterator lastInstructionMain; - FunctionCallee map2check_pointer; - FunctionCallee map2check_malloc; - FunctionCallee map2check_calloc; - FunctionCallee map2check_free; - FunctionCallee map2check_alloca; - FunctionCallee map2check_non_static_alloca; - FunctionCallee map2check_posix; - FunctionCallee map2check_load; - FunctionCallee map2check_check_deref; - FunctionCallee map2check_function; - FunctionCallee map2check_free_resolved_address; - FunctionCallee map2check_wasm_malloc; - FunctionCallee map2check_wasm_free; - FunctionCallee map2check_wasm_check_access; + // Core API of map2check-library (RuntimeABI.hpp), declared per function. + FunctionCallee storePointer; // StorePointer + FunctionCallee mapMalloc; // Malloc + FunctionCallee mapCalloc; // Calloc + FunctionCallee checkFree; // CheckFree + FunctionCallee mapFree; // MapFree + FunctionCallee mapAlloca; // Alloca + FunctionCallee mapNonStaticAlloca; // NonStaticAlloca + FunctionCallee mapPosixMemalign; // PosixMemalign + FunctionCallee checkLoad; // Load + FunctionCallee mapFunctAddress; // FunctionAddr + FunctionCallee checkFreeResolved; // FreeResolved + FunctionCallee wasmMalloc; // WasmMalloc + FunctionCallee wasmFree; // WasmFree + FunctionCallee wasmCheckAccess; // WasmCheckAccess + // free(var) calls, guarded after the walk: the NULL check splits blocks. + struct PendingFree { + llvm::CallInst* call; + llvm::Value* slot; + llvm::LoadInst* block; // the program's own load of *slot + ConstantInt* line; + ConstantInt* scope; + }; + std::vector pendingFrees; + llvm::Value* functionNameValue = nullptr; + llvm::Value* functionName(); + void instrumentPendingFrees(); ConstantInt* scope_value; ConstantInt* line_value; LLVMContext* Ctx; diff --git a/modules/backend/pass/NonDetFunctions.hpp b/modules/backend/pass/NonDetFunctions.hpp deleted file mode 100644 index d22bb6745..000000000 --- a/modules/backend/pass/NonDetFunctions.hpp +++ /dev/null @@ -1,96 +0,0 @@ -/** - * Copyright (C) 2014 - 2020 Map2Check tool - * This file is part of the Map2Check tool, and is made available under - * the terms of the GNU General Public License version 2. - * - * LLVM -> NCSA - * - * SPDX-License-Identifier: (GPL-2.0 AND NCSA) - **/ - -#ifndef MODULES_BACKEND_PASS_NONDETFUNCTIONS_HPP_ -#define MODULES_BACKEND_PASS_NONDETFUNCTIONS_HPP_ - -#include -#include -#include -#include -#include -#include -#include -#include - -#include -#include -#include -#include -#include - -// using namespace llvm; -using llvm::Constant; -using llvm::Function; -using llvm::FunctionCallee; -using llvm::LLVMContext; -using llvm::PointerType; -using llvm::Type; - -#define CONSTANT_GENERATOR(type) \ - private: \ - FunctionCallee NonDet##type; \ - \ - public: \ - FunctionCallee getNonDet##type##Function() { return this->NonDet##type; } - -#define NON_DET_FUNCTIONS_HELPER(type, c_type) \ - this->NonDet##type = F->getParent()->getOrInsertFunction( \ - "map2check_nondet_" #c_type, Type::getVoidTy(*Ctx), \ - Type::getInt32Ty(*Ctx), Type::getInt32Ty(*Ctx), Type::getInt32Ty(*Ctx), \ - PointerType::get(*Ctx, 0)); - -#define NON_DET_FUNCTIONS_HELPER_DOUBLE(type, c_type) \ - this->NonDet##type = F->getParent()->getOrInsertFunction( \ - "map2check_nondet_" #c_type, Type::getVoidTy(*Ctx), \ - Type::getInt32Ty(*Ctx), Type::getInt32Ty(*Ctx), Type::getDoubleTy(*Ctx), \ - PointerType::get(*Ctx, 0)); - -class NonDetFunctions { - CONSTANT_GENERATOR(Integer) - CONSTANT_GENERATOR(Unsigned) - CONSTANT_GENERATOR(Char) - CONSTANT_GENERATOR(Pointer) - CONSTANT_GENERATOR(Long) - CONSTANT_GENERATOR(Ushort) - CONSTANT_GENERATOR(Short) - CONSTANT_GENERATOR(Ulong) - CONSTANT_GENERATOR(Bool) - CONSTANT_GENERATOR(Uchar) - CONSTANT_GENERATOR(Pchar) - CONSTANT_GENERATOR(Size_t) - CONSTANT_GENERATOR(Loff_t) - CONSTANT_GENERATOR(Sector_t) - CONSTANT_GENERATOR(Uint) - CONSTANT_GENERATOR(Double) - // Constant* NonDetAssume = NULL; - - public: - NonDetFunctions(Function *F, LLVMContext *Ctx) { - NON_DET_FUNCTIONS_HELPER(Integer, int) - NON_DET_FUNCTIONS_HELPER(Unsigned, unsigned) - NON_DET_FUNCTIONS_HELPER(Pointer, pointer) - NON_DET_FUNCTIONS_HELPER(Ushort, ushort) - NON_DET_FUNCTIONS_HELPER(Short, short) - NON_DET_FUNCTIONS_HELPER(Char, char) - NON_DET_FUNCTIONS_HELPER(Long, long) - NON_DET_FUNCTIONS_HELPER(Ulong, ulong) - NON_DET_FUNCTIONS_HELPER(Bool, bool) - NON_DET_FUNCTIONS_HELPER(Uchar, uchar) - NON_DET_FUNCTIONS_HELPER(Pchar, pchar) - NON_DET_FUNCTIONS_HELPER(Size_t, size_t) - NON_DET_FUNCTIONS_HELPER(Loff_t, loff_t) - NON_DET_FUNCTIONS_HELPER(Sector_t, sector_t) - NON_DET_FUNCTIONS_HELPER(Uint, uint) - NON_DET_FUNCTIONS_HELPER_DOUBLE(Double, double) - } -}; - -#endif // MODULES_BACKEND_PASS_NONDETFUNCTIONS_HPP_ diff --git a/modules/backend/pass/NonDetPass.cpp b/modules/backend/pass/NonDetPass.cpp index 08dc2b6d0..bb069fef9 100644 --- a/modules/backend/pass/NonDetPass.cpp +++ b/modules/backend/pass/NonDetPass.cpp @@ -10,23 +10,16 @@ #include "NonDetPass.hpp" -#include +#include +#include +#include #include #include -using llvm::CastInst; using llvm::dyn_cast; +using llvm::Instruction; using llvm::IRBuilder; -using std::make_unique; -using llvm::Twine; - -namespace { -inline Instruction *BBIteratorToInst(BasicBlock::iterator i) { - Instruction *pointer = reinterpret_cast(&*i); - return pointer; -} -} // namespace namespace { @@ -42,7 +35,9 @@ namespace { * is replaced instead, which reaches every call site at once. */ const char *const kAssumeByAbort[] = {"assume_abort_if_not", "assume_abort_if_not_", - "__VERIFIER_assume", + // A program's own __VERIFIER_assume is + // discarded for the library's instead + // (resolveProgramDefinitions). // The XCSP family spells it this way, // and spelling was the whole difference: // 59 of 59 XCSP tasks answered @@ -84,17 +79,23 @@ bool rewriteAssumeToPrune(Function &F) { if (F.arg_size() != 1 || !F.getArg(0)->getType()->isIntegerTy()) return false; if (!F.getReturnType()->isVoidTy()) return false; + llvm::FunctionCallee assume = Map2Check::getOrInsertRuntime( + *F.getParent(), Map2Check::RuntimeHook::Assume); + LLVMContext &ctx = F.getContext(); - llvm::Type *int32 = llvm::Type::getInt32Ty(ctx); llvm::Value *condition = F.getArg(0); F.deleteBody(); BasicBlock *entry = BasicBlock::Create(ctx, "entry", &F); IRBuilder<> builder(entry); - llvm::FunctionCallee assume = F.getParent()->getOrInsertFunction( - "map2check_assume", llvm::Type::getVoidTy(ctx), int32); - builder.CreateCall(assume, {builder.CreateSExtOrTrunc(condition, int32)}); + // C reads the int condition as cond != 0. + llvm::Value *holds = builder.CreateICmpNE( + condition, llvm::Constant::getNullValue(condition->getType())); + builder.CreateCall(assume, {builder.CreateZExt(holds, builder.getInt32Ty())}); builder.CreateRetVoid(); + // The assume unwinds through this function now. + Map2Check::allowUnwind(F); + Map2Check::allowUnwind(*llvm::cast(assume.getCallee())); llvm::errs() << "[map2check] rewrote " << F.getName() << " to prune the path instead of aborting\n"; return true; @@ -102,195 +103,177 @@ bool rewriteAssumeToPrune(Function &F) { } // namespace +namespace { + +/// The C type suffixes of the __VERIFIER_nondet_ generators the pass logs +/// (abi-mapping.tsv, family map2check_nondet_). +const char *const kNonDetTypes[] = { + "int", "unsigned", "char", "pointer", "long", "ushort", + "short", "ulong", "bool", "uchar", "pchar", "size_t", + "loff_t", "sector_t", "uint", "double"}; + +/// The C type of a __VERIFIER_nondet_ callee, or "" when it is not one. +llvm::StringRef nonDetType(const Function &callee) { + llvm::StringRef name = callee.getName(); + if (!name.consume_front("__VERIFIER_nondet_")) return ""; + for (const char *type : kNonDetTypes) { + if (name == type) return type; + } + return ""; +} + +/// Converts the generator's value to the C type of the logger's slot, or +/// returns nullptr when the program declared the generator with a type that +/// cannot be converted. +Value *toSlotType(IRBuilder<> &builder, Value *value, + const Map2Check::NonDetValueSlot &slot) { + llvm::Type *from = value->getType(); + llvm::Type *to = slot.type; + if (from == to) return value; + if (from->isIntegerTy() && to->isIntegerTy()) { + // An i1 (_Bool) is 0 or 1 whatever the slot's signedness. + bool isSigned = slot.isSigned && !from->isIntegerTy(1); + return builder.CreateIntCast(value, to, isSigned); + } + if (from->isPointerTy() && to->isIntegerTy()) { + return builder.CreatePtrToInt(value, to); + } + if (from->isIntegerTy() && to->isPointerTy()) { + return builder.CreateIntToPtr(value, to); + } + if (from->isFloatingPointTy() && to->isFloatingPointTy()) { + return builder.CreateFPCast(value, to); + } + return nullptr; +} + +} // namespace + PreservedAnalyses NonDetPass::run(Function &F, llvm::FunctionAnalysisManager &AM) { + // First thing of the first pass: program definitions of library exports + // give way to the library's or become internal (RuntimeABI), before any + // instrumentation looks at them. + bool resolved = Map2Check::resolveProgramDefinitions(*F.getParent()); + + // The library's assume rejects an input by unwinding through its callers, + // so no declaration of it or call to it may be nounwind (D1 condition 11). + if (Function *assume = F.getParent()->getFunction( + Map2Check::runtimeCall(Map2Check::RuntimeHook::Assume, + F.getContext()) + .name)) { + Map2Check::allowUnwind(*assume); + } + // Before anything else: this replaces the whole body, so instrumenting the // old one first would be work thrown away. if (rewriteAssumeToPrune(F)) { return PreservedAnalyses::none(); } + if (F.isDeclaration()) return PreservedAnalyses::none(); - this->nonDetFunctions = make_unique(&F, &F.getContext()); - bool initializedFunctionName = false; - for (Function::iterator bb = F.begin(), e = F.end(); bb != e; ++bb) { - for (BasicBlock::iterator i = bb->begin(), e = bb->end(); i != e; ++i) { - if (!initializedFunctionName) { - IRBuilder<> builder(BBIteratorToInst(i)); - this->functionName = builder.CreateGlobalStringPtr(F.getName()); - initializedFunctionName = true; - } - if (CallInst *callInst = dyn_cast(&*i)) { - currentInstruction = i; - this->runOnCallInstruction(callInst, &F.getContext()); + // Collect first, instrument after: the instrumentation inserts and removes + // instructions. + std::vector> nonDetCalls; + std::vector crabAssumes; + for (BasicBlock &bb : F) { + for (Instruction &i : bb) { + auto *callInst = dyn_cast(&i); + if (callInst == nullptr) continue; + auto *callee = dyn_cast( + callInst->getCalledOperand()->stripPointerCasts()); + if (callee == nullptr) continue; + llvm::StringRef type = nonDetType(*callee); + if (!type.empty()) { + nonDetCalls.emplace_back(callInst, type); + } else if (callee->getName() == "verifier.assume") { + crabAssumes.push_back(callInst); } } } + if (nonDetCalls.empty() && crabAssumes.empty()) { + return resolved ? PreservedAnalyses::none() : PreservedAnalyses::all(); + } + + IRBuilder<> entryBuilder(&*F.getEntryBlock().getFirstInsertionPt()); + this->functionName = entryBuilder.CreateGlobalStringPtr(F.getName()); + for (auto &[callInst, type] : nonDetCalls) { + this->instrumentNonDet(callInst, type); + } + for (CallInst *callInst : crabAssumes) { + this->instrumentCrabAssume(callInst); + } return PreservedAnalyses::none(); } -namespace { -#define CALL_IF_HELPER(type, nondet_type, c_type) \ - if ((calleeFunction->getName() == ("__VERIFIER_nondet_" #c_type))) { \ - this->instrumentNonDet(NonDetType::nondet_type, calleeFunction); \ - this->instrumentNonDet##type(callInst, Ctx); \ - } else if ((calleeFunction->getName() == ("map2check_non_det_" #c_type))) { \ - this->instrumentNonDet##type(callInst, Ctx); \ +// abi-mapping: map2check_non_det_ -> __VERIFIER_nondet_, +// map2check_nondet_ -> map2check_save_nondet_log_. +void NonDetPass::instrumentNonDet(CallInst *callInst, llvm::StringRef type) { + Function &F = *callInst->getFunction(); + llvm::Module &module = *F.getParent(); + LLVMContext &ctx = F.getContext(); + + // The generator keeps its name, except __VERIFIER_nondet_unsigned, which + // the library spells __VERIFIER_nondet_uint. Only this call is retargeted: + // the other calls keep naming their own C type, so they are logged as it. + std::string generator = Map2Check::nonDetGenerator(type); + if (callInst->getCalledOperand()->stripPointerCasts()->getName() != + generator) { + llvm::FunctionCallee core = module.getOrInsertFunction( + generator, callInst->getFunctionType()); + callInst->setCalledFunction(callInst->getFunctionType(), core.getCallee()); } -} // namespace -void NonDetPass::runOnCallInstruction(CallInst *callInst, LLVMContext *Ctx) { - Function *calleeFunction = callInst->getCalledFunction(); + Map2Check::NonDetValueSlot slot = Map2Check::nonDetValueSlot(type, ctx); + if (slot.type == nullptr || callInst->getType()->isVoidTy()) return; - if (calleeFunction == NULL) { - Value *v = callInst->getCalledOperand(); - calleeFunction = dyn_cast(v->stripPointerCasts()); - if (calleeFunction == NULL) { - return; - } - } + // The logger takes the value by address, in its C type + // (docs/api-deltas.md of the library), so it lives in an entry alloca. + // map2check.runtime marks the slot as instrumentation, which + // MemoryTrackPass does not track as program memory. + llvm::MDNode *runtimeTag = llvm::MDNode::get(ctx, {}); + IRBuilder<> entryBuilder(&*F.getEntryBlock().getFirstInsertionPt()); + llvm::AllocaInst *valueSlot = entryBuilder.CreateAlloca( + slot.type, nullptr, "map2check.nondet." + type); + valueSlot->setMetadata(Map2Check::kRuntimeMetadata, runtimeTag); - // TODO(rafa.sa.xp@gmail.com): Should not rename __VERIFIER functions - // clang-format - if (true) { - CALL_IF_HELPER(Integer, INTEGER, int) - } - CALL_IF_HELPER(Unsigned, UNSIGNED, unsigned) - CALL_IF_HELPER(Char, CHAR, char) - CALL_IF_HELPER(Pointer, POINTER, pointer) - CALL_IF_HELPER(Long, LONG, long) - CALL_IF_HELPER(Ushort, USHORT, ushort) - CALL_IF_HELPER(Short, SHORT, short) - CALL_IF_HELPER(Ulong, ULONG, ulong) - CALL_IF_HELPER(Bool, BOOL, bool) - CALL_IF_HELPER(Uchar, UCHAR, uchar) - CALL_IF_HELPER(Pchar, PCHAR, pchar) - CALL_IF_HELPER(Size_t, SIZE_T, size_t) - CALL_IF_HELPER(Loff_t, LOFF_T, loff_t) - CALL_IF_HELPER(Sector_t, SECTOR_T, sector_t) - CALL_IF_HELPER(Uint, UINT, uint) - CALL_IF_HELPER(Double, DOUBLE, double) + IRBuilder<> builder(callInst->getNextNode()); + Value *value = toSlotType(builder, callInst, slot); + if (value == nullptr) return; + llvm::StoreInst *store = builder.CreateStore(value, valueSlot); + store->setMetadata(Map2Check::kRuntimeMetadata, runtimeTag); - if ((calleeFunction->getName() == "__VERIFIER_assume")) { - this->instrumentNonDet(NonDetType::ASSUME, calleeFunction); - } else if ((calleeFunction->getName() == "verifier.assume")) { - this->instrumentNonDet(NonDetType::CRAB_ASSUME, calleeFunction); - } else if ((calleeFunction->getName() == "map2check_assume")) { - // TODO(rafa.sa.xp@gmail.com): Implement method - } - // clang-format on + DebugInfo debugInfo(&ctx, callInst); + llvm::FunctionCallee logger = module.getOrInsertFunction( + Map2Check::nonDetLogger(type), Map2Check::nonDetLoggerType(ctx)); + Value *args[] = {debugInfo.getLineNumberValue(), + debugInfo.getScopeNumberValue(), + llvm::ConstantInt::get(llvm::Type::getInt32Ty(ctx), + slot.typeVar), + valueSlot, this->functionName}; + builder.CreateCall(logger, args); } -namespace { -#define INSTRUMENT_CASE_HELPER(nondet_type, c_type) \ - case (NonDetType::nondet_type): { \ - Twine non_det("map2check_non_det_" #c_type); \ - calleeFunction->setName(non_det); \ - break; \ - } -} // namespace -void NonDetPass::instrumentNonDet(NonDetType nonDetType, - Function *calleeFunction) { - switch (nonDetType) { - INSTRUMENT_CASE_HELPER(INTEGER, int) - INSTRUMENT_CASE_HELPER(UNSIGNED, unsigned) - INSTRUMENT_CASE_HELPER(CHAR, char) - INSTRUMENT_CASE_HELPER(POINTER, pointer) - INSTRUMENT_CASE_HELPER(LONG, long) - INSTRUMENT_CASE_HELPER(USHORT, ushort) - INSTRUMENT_CASE_HELPER(SHORT, short) - INSTRUMENT_CASE_HELPER(ULONG, ulong) - INSTRUMENT_CASE_HELPER(BOOL, bool) - INSTRUMENT_CASE_HELPER(UCHAR, uchar) - INSTRUMENT_CASE_HELPER(PCHAR, pchar) - INSTRUMENT_CASE_HELPER(SIZE_T, size_t) - INSTRUMENT_CASE_HELPER(LOFF_T, loff_t) - INSTRUMENT_CASE_HELPER(SECTOR_T, sector_t) - INSTRUMENT_CASE_HELPER(UINT, uint) - INSTRUMENT_CASE_HELPER(DOUBLE, double) - case (NonDetType::ASSUME): { - Twine assume("map2check_assume"); - calleeFunction->setName(assume); - break; - } - case (NonDetType::CRAB_ASSUME): { - Twine assume("map2check_crab_assume"); - calleeFunction->setName(assume); - break; - } +// abi-mapping: map2check_crab_assume -> __VERIFIER_assume. Clam's +// verifier.assume(i1) is nounwind; the core assume takes an i32 and unwinds, +// so the call is replaced instead of renamed. +void NonDetPass::instrumentCrabAssume(CallInst *callInst) { + llvm::Module &module = *callInst->getModule(); + llvm::FunctionCallee assume = + Map2Check::getOrInsertRuntime(module, Map2Check::RuntimeHook::Assume); + IRBuilder<> builder(callInst); + Value *condition = callInst->getArgOperand(0); + if (!condition->getType()->isIntegerTy(1)) { + condition = builder.CreateICmpNE( + condition, llvm::Constant::getNullValue(condition->getType())); } + CallInst *replacement = builder.CreateCall( + assume, {builder.CreateZExt(condition, builder.getInt32Ty())}); + replacement->setDebugLoc(callInst->getDebugLoc()); + callInst->eraseFromParent(); + Map2Check::allowUnwind(*llvm::cast(assume.getCallee())); } -namespace { -#define NONDET_IMPL_HELPER_POINTER(type) \ - void NonDetPass::instrumentNonDet##type(CallInst *callInst, \ - LLVMContext *Ctx) { \ - auto j = this->currentInstruction; \ - j++; \ - IRBuilder<> builder(BBIteratorToInst(j)); \ - Value *function_llvm = this->getFunctionNameValue(); \ - Value *cast = builder.CreatePtrToInt(callInst, Type::getInt32Ty(*Ctx)); \ - DebugInfo debugInfo(Ctx, callInst); \ - Value *args[] = {debugInfo.getLineNumberValue(), \ - debugInfo.getScopeNumberValue(), cast, function_llvm}; \ - FunctionCallee NonDetFunction = \ - this->nonDetFunctions->getNonDet##type##Function(); \ - builder.CreateCall(NonDetFunction, args); \ - } - -#define NONDET_IMPL_HELPER_CAST(type) \ - void NonDetPass::instrumentNonDet##type(CallInst *callInst, \ - LLVMContext *Ctx) { \ - auto j = this->currentInstruction; \ - j++; \ - IRBuilder<> builder(BBIteratorToInst(j)); \ - Value *function_llvm = this->getFunctionNameValue(); \ - Twine bitcast("map2check_nondet_cast_" #type); \ - Value *castInteger = \ - CastInst::CreateIntegerCast(callInst, Type::getInt32Ty(*Ctx), false, \ - bitcast, BBIteratorToInst(j)); \ - DebugInfo debugInfo(Ctx, callInst); \ - Value *args[] = {debugInfo.getLineNumberValue(), \ - debugInfo.getScopeNumberValue(), castInteger, \ - function_llvm}; \ - FunctionCallee NonDetFunction = \ - this->nonDetFunctions->getNonDet##type##Function(); \ - builder.CreateCall(NonDetFunction, args); \ - } - -#define NONDET_IMPL_HELPER(type) \ - void NonDetPass::instrumentNonDet##type(CallInst *callInst, \ - LLVMContext *Ctx) { \ - auto j = this->currentInstruction; \ - j++; \ - IRBuilder<> builder(BBIteratorToInst(j)); \ - Value *function_llvm = this->getFunctionNameValue(); \ - DebugInfo debugInfo(Ctx, callInst); \ - Value *args[] = {debugInfo.getLineNumberValue(), \ - debugInfo.getScopeNumberValue(), callInst, \ - function_llvm}; \ - FunctionCallee NonDetFunction = \ - this->nonDetFunctions->getNonDet##type##Function(); \ - builder.CreateCall(NonDetFunction, args); \ - } -} // namespace - -NONDET_IMPL_HELPER(Integer) -NONDET_IMPL_HELPER(Unsigned) -NONDET_IMPL_HELPER(Uint) -NONDET_IMPL_HELPER(Double) -NONDET_IMPL_HELPER_CAST(Char) -NONDET_IMPL_HELPER_CAST(Ushort) -NONDET_IMPL_HELPER_CAST(Short) -NONDET_IMPL_HELPER_CAST(Long) -NONDET_IMPL_HELPER_CAST(Ulong) -NONDET_IMPL_HELPER_CAST(Bool) -NONDET_IMPL_HELPER_CAST(Uchar) -NONDET_IMPL_HELPER_CAST(Size_t) -NONDET_IMPL_HELPER_CAST(Loff_t) -NONDET_IMPL_HELPER_CAST(Sector_t) -NONDET_IMPL_HELPER_POINTER(Pchar) -NONDET_IMPL_HELPER_POINTER(Pointer) - // --- New Pass Manager plugin registration --- extern "C" LLVM_ATTRIBUTE_WEAK ::llvm::PassPluginLibraryInfo llvmGetPassPluginInfo() { diff --git a/modules/backend/pass/NonDetPass.hpp b/modules/backend/pass/NonDetPass.hpp index bbe5bd86a..b4bf77938 100644 --- a/modules/backend/pass/NonDetPass.hpp +++ b/modules/backend/pass/NonDetPass.hpp @@ -29,7 +29,7 @@ #include #include "DebugInfo.hpp" -#include "NonDetFunctions.hpp" +#include "RuntimeABI.hpp" using llvm::BasicBlock; using llvm::CallInst; @@ -38,67 +38,17 @@ using llvm::LLVMContext; using llvm::PreservedAnalyses; using llvm::Value; -enum class NonDetType { - INTEGER, - UNSIGNED, - POINTER, - // STRING, - LONG, - ASSUME, - USHORT, - SHORT, - ULONG, - CHAR, - BOOL, - UCHAR, - PCHAR, - SIZE_T, - LOFF_T, - SECTOR_T, - UINT, - CRAB_ASSUME, - DOUBLE -}; - -namespace InstrumentNonDetS { -#define INSTRUMENT_HEADER_HELPER(type) \ - void instrumentNonDet##type(CallInst *callInst, LLVMContext *Ctx); -} // namespace InstrumentNonDetS - +/// Logs every __VERIFIER_nondet_ value through the core +/// map2check_save_nondet_log_ of map2check-library, and turns the +/// program's assume idioms into the library's __VERIFIER_assume. struct NonDetPass : public llvm::PassInfoMixin { PreservedAnalyses run(Function &F, llvm::FunctionAnalysisManager &AM); static bool isRequired() { return true; } - protected: - void instrumentInstruction(); - /** - * @brief Checks if current function is a non det call and instruments it - */ - void runOnCallInstruction(CallInst *callInst, LLVMContext *Ctx); - Value *getFunctionNameValue() { return this->functionName; } - private: - void instrumentNonDet(NonDetType type, Function *calleeFunction); - INSTRUMENT_HEADER_HELPER(Integer) - INSTRUMENT_HEADER_HELPER(Unsigned) - INSTRUMENT_HEADER_HELPER(Char) - INSTRUMENT_HEADER_HELPER(Pointer) - INSTRUMENT_HEADER_HELPER(Long) - INSTRUMENT_HEADER_HELPER(Ushort) - INSTRUMENT_HEADER_HELPER(Short) - INSTRUMENT_HEADER_HELPER(Ulong) - INSTRUMENT_HEADER_HELPER(Bool) - INSTRUMENT_HEADER_HELPER(Uchar) - INSTRUMENT_HEADER_HELPER(Pchar) - INSTRUMENT_HEADER_HELPER(Size_t) - INSTRUMENT_HEADER_HELPER(Loff_t) - INSTRUMENT_HEADER_HELPER(Sector_t) - INSTRUMENT_HEADER_HELPER(Uint) - INSTRUMENT_HEADER_HELPER(Double) - void instrumentCrabAssume(CallInst *callInst, LLVMContext *Ctx); - std::unique_ptr nonDetFunctions; - Value *functionName = NULL; - BasicBlock::iterator currentInstruction; + void instrumentNonDet(CallInst *callInst, llvm::StringRef type); + void instrumentCrabAssume(CallInst *callInst); + Value *functionName = nullptr; }; class NonDetPassException : public std::runtime_error { diff --git a/modules/backend/pass/OperationsFunctions.hpp b/modules/backend/pass/OperationsFunctions.hpp deleted file mode 100644 index 1e12bece1..000000000 --- a/modules/backend/pass/OperationsFunctions.hpp +++ /dev/null @@ -1,103 +0,0 @@ -/** - * Copyright (C) 2014 - 2020 Map2Check tool - * This file is part of the Map2Check tool, and is made available under - * the terms of the GNU General Public License version 2. - * - * LLVM -> NCSA - * - * SPDX-License-Identifier: (GPL-2.0 AND NCSA) - **/ - -#ifndef MODULES_BACKEND_PASS_OPERATIONSFUNCTIONS_HPP_ -#define MODULES_BACKEND_PASS_OPERATIONSFUNCTIONS_HPP_ - -#include -#include -#include -#include -#include -#include -#include -#include - -#include -#include -#include -#include -#include - -// using namespace llvm; -using llvm::Function; -using llvm::FunctionCallee; -using llvm::LLVMContext; -using llvm::PointerType; -using llvm::Type; - -class OperationsFunctions { - FunctionCallee OverflowAdd; - FunctionCallee OverflowAddUint; - FunctionCallee OverflowSub; - FunctionCallee OverflowSubUint; - FunctionCallee OverflowMul; - FunctionCallee OverflowMulUint; - FunctionCallee OverflowSDiv; - FunctionCallee OverflowSRem; - FunctionCallee OverflowError; - - public: - FunctionCallee getOverflowAdd() { return this->OverflowAdd; } - FunctionCallee getOverflowAddUint() { return this->OverflowAddUint; } - FunctionCallee getOverflowSub() { return this->OverflowSub; } - FunctionCallee getOverflowSubUint() { return this->OverflowSubUint; } - FunctionCallee getOverflowMul() { return this->OverflowMul; } - FunctionCallee getOverflowMulUint() { return this->OverflowMulUint; } - FunctionCallee getOverflowSDiv() { return this->OverflowSDiv; } - FunctionCallee getOverflowSRem() { return this->OverflowSRem; } - FunctionCallee getOverflowError() { return this->OverflowError; } - - // Signed binop checkers share one ABI: - // (i64 lhs, i64 rhs, i32 width, i32 line, i32 scope, ptr functionName) - // - // The operands are sign-extended to i64 by the pass (lossless), and `width` - // carries the bit width of the *result type of the operation*. That is the - // quantity SV-COMP's no-overflow property is defined over, so the runtime - // must range-check against it rather than against a fixed width. Keeping a - // single 64-bit ABI (instead of one symbol per width) mirrors how UBSan's - // __ubsan_handle_*_overflow handlers take the type as a parameter. - OperationsFunctions(Function *F, LLVMContext *Ctx) { - // LLVM 16: opaque pointers — use PointerType::get(*Ctx, 0) instead of PointerType::get(, 0) - auto *PtrTy = PointerType::get(*Ctx, 0); - auto *I64 = Type::getInt64Ty(*Ctx); - auto *I32 = Type::getInt32Ty(*Ctx); - auto *VoidTy = Type::getVoidTy(*Ctx); - - this->OverflowAdd = F->getParent()->getOrInsertFunction( - "map2check_binop_add", VoidTy, I64, I64, I32, I32, I32, PtrTy); - - this->OverflowAddUint = F->getParent()->getOrInsertFunction( - "map2check_binop_add_uint", VoidTy, I64, I64, I32, I32, I32, PtrTy); - - this->OverflowSub = F->getParent()->getOrInsertFunction( - "map2check_binop_sub", VoidTy, I64, I64, I32, I32, I32, PtrTy); - - this->OverflowSubUint = F->getParent()->getOrInsertFunction( - "map2check_binop_sub_uint", VoidTy, I64, I64, I32, I32, I32, PtrTy); - - this->OverflowMul = F->getParent()->getOrInsertFunction( - "map2check_binop_mul", VoidTy, I64, I64, I32, I32, I32, PtrTy); - - this->OverflowMulUint = F->getParent()->getOrInsertFunction( - "map2check_binop_mul_uint", VoidTy, I64, I64, I32, I32, I32, PtrTy); - - this->OverflowSDiv = F->getParent()->getOrInsertFunction( - "map2check_binop_sdiv", VoidTy, I64, I64, I32, I32, I32, PtrTy); - - this->OverflowSRem = F->getParent()->getOrInsertFunction( - "map2check_binop_srem", VoidTy, I64, I64, I32, I32, I32, PtrTy); - - this->OverflowError = - F->getParent()->getOrInsertFunction("overflowError", VoidTy, I32, PtrTy); - } -}; - -#endif // MODULES_BACKEND_PASS_OPERATIONSFUNCTIONS_HPP_ diff --git a/modules/backend/pass/OverflowPass.cpp b/modules/backend/pass/OverflowPass.cpp index 86f37bf39..59e415bc5 100644 --- a/modules/backend/pass/OverflowPass.cpp +++ b/modules/backend/pass/OverflowPass.cpp @@ -29,7 +29,6 @@ using llvm::IntegerType; using llvm::IRBuilder; using llvm::isa; using llvm::LoadInst; -using std::make_unique; using llvm::MDNode; using llvm::StoreInst; using llvm::Twine; @@ -55,9 +54,9 @@ void OverflowPass::listAllUintAssign(BasicBlock &B) { if (auto *cI = dyn_cast(&*i)) { Value *v = cI->getCalledOperand(); Function *calleeFunction = dyn_cast(v->stripPointerCasts()); + // NonDetPass keeps the core generator name (__VERIFIER_nondet_uint). if (calleeFunction && - (calleeFunction->getName() == "__VERIFIER_nondet_uint" || - calleeFunction->getName() == "map2check_non_det_uint")) { + calleeFunction->getName() == Map2Check::nonDetGenerator("uint")) { DebugInfo debugInfoCi(this->Ctx, cI); // errs() << debugInfoCi.getLineNumberInt() << "==================\n"; @@ -193,8 +192,17 @@ std::string OverflowPass::getValueNameOperator(Value *Vop) { PreservedAnalyses OverflowPass::run(Function &F, llvm::FunctionAnalysisManager &AM) { - this->operationsFunctions = - make_unique(&F, &F.getContext()); + llvm::Module &module = *F.getParent(); + this->binopAdd = Map2Check::getOrInsertRuntime( + module, Map2Check::RuntimeHook::BinopAdd); + this->binopSub = Map2Check::getOrInsertRuntime( + module, Map2Check::RuntimeHook::BinopSub); + this->binopMul = Map2Check::getOrInsertRuntime( + module, Map2Check::RuntimeHook::BinopMul); + this->binopSDiv = Map2Check::getOrInsertRuntime( + module, Map2Check::RuntimeHook::BinopSDiv); + this->binopSRem = Map2Check::getOrInsertRuntime( + module, Map2Check::RuntimeHook::BinopSRem); Function::iterator functionIterator = F.begin(); BasicBlock::iterator instructionIterator = functionIterator->begin(); @@ -212,24 +220,6 @@ PreservedAnalyses OverflowPass::run(Function &F, for (Function::iterator bb = F.begin(), e = F.end(); bb != e; ++bb) { for (BasicBlock::iterator i = bb->begin(), e = bb->end(); i != e; ++i) { - if (this->errorLines.size() != 0) { - Instruction *currentInstruction = BBIteratorToInst(i); - DebugInfo debugInfo(&F.getContext(), currentInstruction); - int line = debugInfo.getLineNumberInt(); - - std::vector::iterator it = - std::find(this->errorLines.begin(), this->errorLines.end(), line); - - if (it != this->errorLines.end()) { - IRBuilder<> builder(currentInstruction); - Value *args[] = {debugInfo.getLineNumberValue(), functionName}; - builder.CreateCall(this->operationsFunctions->getOverflowError(), - args); - - this->errorLines.erase(it); - } - } - if (StoreInst *storeInst = dyn_cast(&*i)) { Value *firstOperand = storeInst->getValueOperand(); Value *secondOperand = storeInst->getPointerOperand(); @@ -239,7 +229,7 @@ PreservedAnalyses OverflowPass::run(Function &F, std::vector::const_iterator iT; // checking for first operator - // TODO(hbgit): search by map2check_non_det_uint + // TODO(hbgit): search by the __VERIFIER_nondet_uint generator bool isUnsignedNonDet = false; iT = std::find(this->listUnsignedVars.begin(), @@ -280,12 +270,12 @@ PreservedAnalyses OverflowPass::run(Function &F, std::vector::const_iterator iT; // checking for first operator - // TODO(hbgit): search by map2check_non_det_uint + // TODO(hbgit): search by the __VERIFIER_nondet_uint generator bool isUnsigned = false; bool isUnsignedNonDet = false; iT = std::find(this->listUnsignedVars.begin(), this->listUnsignedVars.end(), lvaluep); - if (rvaluep == "map2check_non_det_uint") { + if (rvaluep == Map2Check::nonDetGenerator("uint")) { isUnsignedNonDet = true; } @@ -339,36 +329,30 @@ PreservedAnalyses OverflowPass::run(Function &F, switch (binOp->getOpcode()) { case (Instruction::Add): - if (this->isUnitAssignment) { - // instrumentedFunction = - // this->operationsFunctions->getOverflowAddUint(); - } else { - instrumentedFunction = - this->operationsFunctions->getOverflowAdd(); + // Without nsw the operation is unsigned: wraparound is not an + // overflow, and the C runtime's _uint checker was a no-op. + if (!this->isUnitAssignment) { + instrumentedFunction = this->binopAdd; } break; case (Instruction::FAdd): break; case (Instruction::Sub): - if (this->isUnitAssignment) { - // instrumentedFunction = - // this->operationsFunctions->getOverflowSubUint(); - } else { - instrumentedFunction = - this->operationsFunctions->getOverflowSub(); + // Without nsw the operation is unsigned: wraparound is not an + // overflow, and the C runtime's _uint checker was a no-op. + if (!this->isUnitAssignment) { + instrumentedFunction = this->binopSub; } break; case (Instruction::FSub): break; case (Instruction::Mul): - if (this->isUnitAssignment) { - // instrumentedFunction = - // this->operationsFunctions->getOverflowMulUint(); - } else { - instrumentedFunction = - this->operationsFunctions->getOverflowMul(); + // Without nsw the operation is unsigned: wraparound is not an + // overflow, and the C runtime's _uint checker was a no-op. + if (!this->isUnitAssignment) { + instrumentedFunction = this->binopMul; } break; case (Instruction::FMul): @@ -378,7 +362,7 @@ PreservedAnalyses OverflowPass::run(Function &F, break; case (Instruction::SDiv): - instrumentedFunction = this->operationsFunctions->getOverflowSDiv(); + instrumentedFunction = this->binopSDiv; break; case (Instruction::FDiv): @@ -387,7 +371,7 @@ PreservedAnalyses OverflowPass::run(Function &F, break; case (Instruction::SRem): - instrumentedFunction = this->operationsFunctions->getOverflowSRem(); + instrumentedFunction = this->binopSRem; break; case (Instruction::FRem): @@ -434,12 +418,10 @@ PreservedAnalyses OverflowPass::run(Function &F, Value *width = ConstantInt::get(Type::getInt32Ty(*Ctx), opType->getBitWidth()); - Value *args[] = {firstOperand64Ty, - secondOperand64Ty, - width, - debugInfo.getLineNumberValue(), - debugInfo.getScopeNumberValue(), - functionName}; + // Core order: (a, b, bits, line, function); the core takes no + // scope. + Value *args[] = {firstOperand64Ty, secondOperand64Ty, width, + debugInfo.getLineNumberValue(), functionName}; builder.CreateCall(instrumentedFunction, args); } else { diff --git a/modules/backend/pass/OverflowPass.hpp b/modules/backend/pass/OverflowPass.hpp index 652a0f193..5efdf6c08 100644 --- a/modules/backend/pass/OverflowPass.hpp +++ b/modules/backend/pass/OverflowPass.hpp @@ -30,7 +30,7 @@ #include #include "DebugInfo.hpp" -#include "OperationsFunctions.hpp" +#include "RuntimeABI.hpp" // using namespace llvm; using llvm::BasicBlock; @@ -39,11 +39,11 @@ using llvm::Function; using llvm::Instruction; using llvm::LLVMContext; using llvm::PreservedAnalyses; +using llvm::Type; using llvm::Value; struct OverflowPass : public llvm::PassInfoMixin { OverflowPass() = default; - explicit OverflowPass(std::vector lines) : errorLines(std::move(lines)) {} PreservedAnalyses run(Function &F, llvm::FunctionAnalysisManager &AM); static bool isRequired() { return true; } @@ -51,7 +51,12 @@ struct OverflowPass : public llvm::PassInfoMixin { Value *getFunctionNameValue() { return this->functionName; } private: - std::unique_ptr operationsFunctions; + // Signed binop checkers of map2check-library (RuntimeHook::Binop*). + llvm::FunctionCallee binopAdd; + llvm::FunctionCallee binopSub; + llvm::FunctionCallee binopMul; + llvm::FunctionCallee binopSDiv; + llvm::FunctionCallee binopSRem; Value *functionName = NULL; void hasNonDetUint(Instruction *I); void listAllUintAssign(BasicBlock &B); @@ -59,7 +64,6 @@ struct OverflowPass : public llvm::PassInfoMixin { std::string getValueNameOperator(Value *Vop); void listAllUnsignedVar(Function &F); - std::vector errorLines; std::vector valuesThatShouldBeUint; std::vector storeInstWithUint; std::vector loadInstWithUint; diff --git a/modules/backend/pass/RuntimeABI.cpp b/modules/backend/pass/RuntimeABI.cpp new file mode 100644 index 000000000..3da318418 --- /dev/null +++ b/modules/backend/pass/RuntimeABI.cpp @@ -0,0 +1,262 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * LLVM -> NCSA + * + * SPDX-License-Identifier: (GPL-2.0 AND NCSA) + **/ + +#include "RuntimeABI.hpp" + +#include +#include +#include +#include +#include + +namespace Map2Check { + +namespace { + +llvm::FunctionType* fn(llvm::Type* ret, llvm::ArrayRef params) { + return llvm::FunctionType::get(ret, params, false); +} + +} // namespace + +RuntimeCall runtimeCall(RuntimeHook hook, llvm::LLVMContext& ctx) { + llvm::Type* v = llvm::Type::getVoidTy(ctx); + llvm::Type* i16 = llvm::Type::getInt16Ty(ctx); + llvm::Type* i32 = llvm::Type::getInt32Ty(ctx); + llvm::Type* i64 = llvm::Type::getInt64Ty(ctx); + llvm::Type* p = llvm::PointerType::get(ctx, 0); + + switch (hook) { + // abi-mapping: map2check_init -> map2check_set_mode+map2check_init + case RuntimeHook::SetMode: + return {"map2check_set_mode", fn(v, {i32})}; + case RuntimeHook::Init: + return {"map2check_init", fn(v, {})}; + // abi-mapping: map2check_success + case RuntimeHook::Success: + return {"map2check_success", fn(v, {})}; + // abi-mapping: map2check_track_bb (returns bbtrack_log_t*, ignored) + case RuntimeHook::TrackBB: + return {"map2check_save_basic_block_log", fn(p, {i32, p})}; + // abi-mapping: map2check_target_function + case RuntimeHook::TargetReached: + return {"map2check_reach_target", fn(v, {p, i32, i32})}; + // abi-mapping: map2check_assert (condition moves from first to last) + case RuntimeHook::Assert: + return {"map2check_is_valid_assert", fn(v, {i32, p, i32})}; + // abi-mapping: map2check_assume, map2check_assume_loop, + // map2check_crab_assume (an i1 condition is zero-extended to i32) + case RuntimeHook::Assume: + return {"__VERIFIER_assume", fn(v, {i32})}; + // abi-mapping: map2check_binop_{add,sub,mul,sdiv,srem}; no scope argument + case RuntimeHook::BinopAdd: + return {"map2check_binop_add_signed", fn(v, {i64, i64, i32, i32, p})}; + case RuntimeHook::BinopSub: + return {"map2check_binop_sub_signed", fn(v, {i64, i64, i32, i32, p})}; + case RuntimeHook::BinopMul: + return {"map2check_binop_mul_signed", fn(v, {i64, i64, i32, i32, p})}; + case RuntimeHook::BinopSDiv: + return {"map2check_binop_div_signed", fn(v, {i64, i64, i32, i32, p})}; + case RuntimeHook::BinopSRem: + return {"map2check_binop_rem_signed", fn(v, {i64, i64, i32, i32, p})}; + // abi-mapping: map2check_malloc / map2check_calloc (sizes narrow to i32) + case RuntimeHook::Malloc: + return {"map2check_map_malloc", fn(v, {p, i32})}; + case RuntimeHook::Calloc: + return {"map2check_map_calloc", fn(v, {p, i32, i32})}; + // abi-mapping: map2check_alloca / map2check_non_static_alloca + case RuntimeHook::Alloca: + return {"map2check_map_alloca", fn(v, {p, p, i32, i32, i32, i32})}; + case RuntimeHook::NonStaticAlloca: + return {"map2check_map_non_static_alloca", + fn(v, {p, p, i32, i32, i32, i32})}; + // abi-mapping: map2check_function + case RuntimeHook::FunctionAddr: + return {"map2check_map_funct_address", fn(v, {p, p})}; + // abi-mapping: map2check_add_store_pointer + case RuntimeHook::StorePointer: + return {"map2check_map_store_pointer", fn(v, {p, p, i32, p, i32, p})}; + // abi-mapping: map2check_load (now with line, scope, size, function) + case RuntimeHook::Load: + return {"map2check_check_load", fn(v, {p, i32, i32, i32, p})}; + // abi-mapping: map2check_free -> map2check_check_free+map2check_map_free + // (name, pointer-variable slot, loaded value, scope, line, function) + case RuntimeHook::CheckFree: + return {"map2check_check_free", fn(v, {p, p, p, i32, i32, p})}; + case RuntimeHook::MapFree: + return {"map2check_map_free", fn(v, {p, p, p, i32, i32, p})}; + // abi-mapping: map2check_free_resolved_address (i1 nullValid -> i16) + case RuntimeHook::FreeResolved: + return {"map2check_check_free_resolved_address", fn(v, {p, i32, p, i16})}; + // abi-mapping: map2check_posix + case RuntimeHook::PosixMemalign: + return {"map2check_map_posix_memalign", fn(v, {p, i32})}; + // abi-mapping: map2check_wasm_* (feature wasm of the library) + case RuntimeHook::WasmMalloc: + return {"map2check_wasm_malloc", fn(v, {i64, i64})}; + case RuntimeHook::WasmFree: + return {"map2check_wasm_free", fn(v, {i64, i64})}; + case RuntimeHook::WasmCheckAccess: + return {"map2check_wasm_check_access", fn(v, {i64, i64})}; + } + return {nullptr, nullptr}; +} + +llvm::FunctionCallee getOrInsertRuntime(llvm::Module& module, + RuntimeHook hook) { + RuntimeCall call = runtimeCall(hook, module.getContext()); + return module.getOrInsertFunction(call.name, call.type); +} + +// The nondet family of the mapping: map2check_non_det_ becomes +// __VERIFIER_nondet_, map2check_nondet_ becomes +// map2check_save_nondet_log_. +std::string nonDetGenerator(llvm::StringRef cType) { + llvm::StringRef suffix = llvm::StringSwitch(cType) + .Case("int", "int") + .Case("unsigned", "uint") + .Case("uint", "uint") + .Case("char", "char") + .Case("uchar", "uchar") + .Case("short", "short") + .Case("ushort", "ushort") + .Case("long", "long") + .Case("ulong", "ulong") + .Case("bool", "bool") + .Case("pointer", "pointer") + .Case("pchar", "pchar") + .Case("size_t", "size_t") + .Case("loff_t", "loff_t") + .Case("sector_t", "sector_t") + .Case("double", "double") + .Default(""); + return suffix.empty() ? "" : ("__VERIFIER_nondet_" + suffix).str(); +} + +std::string nonDetLogger(llvm::StringRef cType) { + bool known = llvm::StringSwitch(cType) + .Cases("int", "unsigned", "uint", "char", "uchar", true) + .Cases("short", "ushort", "long", "ulong", "bool", true) + .Cases("pointer", "pchar", "size_t", "loff_t", true) + .Cases("sector_t", "double", true) + .Default(false); + return known ? ("map2check_save_nondet_log_" + cType).str() : ""; +} + +llvm::FunctionType* nonDetLoggerType(llvm::LLVMContext& ctx) { + llvm::Type* i32 = llvm::Type::getInt32Ty(ctx); + llvm::Type* p = llvm::PointerType::get(ctx, 0); + return fn(p, {i32, i32, i32, p, p}); +} + +NonDetValueSlot nonDetValueSlot(llvm::StringRef cType, + llvm::LLVMContext& ctx) { + llvm::Type* i8 = llvm::Type::getInt8Ty(ctx); + llvm::Type* i16 = llvm::Type::getInt16Ty(ctx); + llvm::Type* i32 = llvm::Type::getInt32Ty(ctx); + llvm::Type* i64 = llvm::Type::getInt64Ty(ctx); + llvm::Type* p = llvm::PointerType::get(ctx, 0); + llvm::Type* dbl = llvm::Type::getDoubleTy(ctx); + // enum NONDET_TYPE: INTEGER 0, CHAR 1, POINTER 2, USHORT 3, LONG 4, + // UNSIGNED 5, ULONG 6, BOOL 7, UCHAR 8, PCHAR 9, SIZE_T 10, LOFF_T 11, + // SECTOR_T 12, UINT 13, SHORT 14, DOUBLE 15. + return llvm::StringSwitch(cType) + .Case("int", {i32, true, 0}) + .Case("char", {i8, true, 1}) + .Case("pointer", {p, false, 2}) + .Case("ushort", {i16, false, 3}) + .Case("long", {i64, true, 4}) + .Case("unsigned", {i32, false, 5}) + .Case("ulong", {i64, false, 6}) + .Case("bool", {i32, false, 7}) // typedef int bool; _Bool widens + .Case("uchar", {i8, false, 8}) + .Case("pchar", {p, false, 9}) + .Case("size_t", {i64, false, 10}) + .Case("loff_t", {i64, true, 11}) // long long + .Case("sector_t", {i64, false, 12}) // unsigned long + .Case("uint", {i32, false, 13}) + .Case("short", {i16, true, 14}) + .Case("double", {dbl, true, 15}) + .Default({nullptr, false, -1}); +} + +void allowUnwind(llvm::Function& fn) { + fn.removeFnAttr(llvm::Attribute::NoUnwind); + for (llvm::User* user : fn.users()) { + auto* call = llvm::dyn_cast(user); + if (call != nullptr && call->getCalledOperand() == &fn) { + call->removeFnAttr(llvm::Attribute::NoUnwind); + } + } +} + +const std::vector& discardedProgramDefinitions() { + static const std::vector names = [] { + std::vector all = {"__VERIFIER_assume"}; + // The 16 generators the library exports (feature libfuzzer and klee). + for (const char* type : + {"bool", "char", "uchar", "short", "ushort", "int", "uint", "long", + "ulong", "float", "double", "size_t", "loff_t", "sector_t", + "pointer", "pchar"}) { + all.push_back(std::string("__VERIFIER_nondet_") + type); + } + return all; + }(); + return names; +} + +const std::vector& internalizedProgramDefinitions() { + static const std::vector names = { + "__VERIFIER_assert", "__VERIFIER_error", + "get_current_step", "get_next_step", + "get_current_property", "set_false_result", + "print_all_containers_as_json", "vcc_reset_meta_data"}; + return names; +} + +bool resolveProgramDefinitions(llvm::Module& module) { + bool changed = false; + llvm::LLVMContext& ctx = module.getContext(); + const char* coreAssume = runtimeCall(RuntimeHook::Assume, ctx).name; + + for (const std::string& name : discardedProgramDefinitions()) { + llvm::Function* program = module.getFunction(name); + if (program == nullptr || program->isDeclaration()) continue; + llvm::FunctionType* type = name == coreAssume + ? runtimeCall(RuntimeHook::Assume, ctx).type + : program->getFunctionType(); + program->setName("__map2check_program_" + name); + llvm::FunctionCallee library = module.getOrInsertFunction(name, type); + program->replaceAllUsesWith(library.getCallee()); + program->deleteBody(); + llvm::BasicBlock* entry = llvm::BasicBlock::Create(ctx, "entry", program); + new llvm::UnreachableInst(ctx, entry); + program->setLinkage(llvm::GlobalValue::InternalLinkage); + if (name == coreAssume) { + allowUnwind(*llvm::cast(library.getCallee())); + } + changed = true; + } + + for (const std::string& name : internalizedProgramDefinitions()) { + llvm::Function* program = module.getFunction(name); + if (program == nullptr || program->isDeclaration() || + program->hasLocalLinkage()) { + continue; + } + program->setComdat(nullptr); + program->setVisibility(llvm::GlobalValue::DefaultVisibility); + program->setLinkage(llvm::GlobalValue::InternalLinkage); + changed = true; + } + return changed; +} + +} // namespace Map2Check diff --git a/modules/backend/pass/RuntimeABI.hpp b/modules/backend/pass/RuntimeABI.hpp new file mode 100644 index 000000000..5bf987983 --- /dev/null +++ b/modules/backend/pass/RuntimeABI.hpp @@ -0,0 +1,137 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * LLVM -> NCSA + * + * SPDX-License-Identifier: (GPL-2.0 AND NCSA) + **/ + +// The one place that names the runtime functions the passes emit. +// +// The runtime is map2check-library (Rust). Its core C API is the contract: +// every name and LLVM type below is a row of docs/cutover/abi-mapping.tsv of +// that repository, and the types are the core signatures of its map2check.h +// lowered for x86-64 (int32_t/uint32_t -> i32, int16_t -> i16, +// int64_t/uint64_t -> i64, pointers -> ptr). There is no compatibility layer: +// a pass builds its arguments in the core order and calls the core symbol. +// tests/unit/pass/RuntimeABITest.cpp checks this table against the mapping. + +#ifndef MODULES_BACKEND_PASS_RUNTIMEABI_HPP_ +#define MODULES_BACKEND_PASS_RUNTIMEABI_HPP_ + +#include +#include +#include +#include +#include + +#include +#include + +namespace Map2Check { + +enum class RuntimeHook { + SetMode, // map2check_set_mode(i32 mode) + Init, // map2check_init() + Success, // map2check_success() + TrackBB, // map2check_save_basic_block_log(i32 line, ptr fn) -> ptr + TargetReached, // map2check_reach_target(ptr fn, i32 scope, i32 line) + Assert, // map2check_is_valid_assert(i32 line, ptr fn, i32 cond) + Assume, // __VERIFIER_assume(i32 cond) + BinopAdd, // map2check_binop_add_signed(i64 a, i64 b, i32 bits, + BinopSub, // i32 line, ptr fn), likewise sub/mul/div/rem + BinopMul, + BinopSDiv, + BinopSRem, + Malloc, // map2check_map_malloc(ptr, i32 size) + Calloc, // map2check_map_calloc(ptr, i32 qty, i32 size) + Alloca, // map2check_map_alloca(ptr name, ptr addr, i32 size, + // i32 size_primitive, i32 line, i32 scope) + NonStaticAlloca, // map2check_map_non_static_alloca(same as Alloca) + FunctionAddr, // map2check_map_funct_address(ptr name, ptr addr) + StorePointer, // map2check_map_store_pointer(ptr var, ptr value, + // i32 scope, ptr name, i32 line, ptr fn) + Load, // map2check_check_load(ptr, i32 line, i32 scope, + // i32 size, ptr fn) + CheckFree, // map2check_check_free(ptr name, ptr var_slot, ptr value, + // i32 scope, i32 line, ptr fn) + MapFree, // map2check_map_free(same as CheckFree) + FreeResolved, // map2check_check_free_resolved_address(ptr, i32 line, + // ptr fn, i16 is_null_valid) + PosixMemalign, // map2check_map_posix_memalign(ptr memptr, i32 size) + WasmMalloc, // map2check_wasm_malloc(i64 offset, i64 size) + WasmFree, // map2check_wasm_free(i64 offset, i64 line) + WasmCheckAccess, // map2check_wasm_check_access(i64 offset, i64 size) + Last = WasmCheckAccess +}; + +/// A function of the core runtime API: name + type, for getOrInsertFunction. +struct RuntimeCall { + const char* name; + llvm::FunctionType* type; +}; + +RuntimeCall runtimeCall(RuntimeHook hook, llvm::LLVMContext& ctx); + +/// Declares (or finds) the hook in `module`, with its core type. +llvm::FunctionCallee getOrInsertRuntime(llvm::Module& module, RuntimeHook hook); + +/// __VERIFIER_nondet_ for the C type suffix used by the passes +/// ("int", "unsigned", "pointer", ...); "" when the type is not in the mapping. +std::string nonDetGenerator(llvm::StringRef cType); + +/// map2check_save_nondet_log_; "" when the type is not in the mapping. +std::string nonDetLogger(llvm::StringRef cType); + +/// Type shared by every nondet logger: +/// (i32 line, i32 scope, i32 type_var, ptr value, ptr fn) -> ptr. +llvm::FunctionType* nonDetLoggerType(llvm::LLVMContext& ctx); + +/// Metadata kind on the instructions a pass adds for the runtime's own use +/// (the nondet value slots), which are not program memory to track. +inline constexpr char kRuntimeMetadata[] = "map2check.runtime"; + +/// How a nondet value reaches map2check_save_nondet_log_: the pass stores +/// it in an alloca of `type` (the C type of docs/api-deltas.md of the +/// library: bool widens to int, pointer/pchar are addresses) and passes +/// `typeVar`, the enum NONDET_TYPE number of the type +/// (Map2CheckTypes.h:41-58). `isSigned` says how an integer of another +/// width is converted to `type`. +struct NonDetValueSlot { + llvm::Type* type; // nullptr when the type is not in the mapping + bool isSigned; + int typeVar; +}; +NonDetValueSlot nonDetValueSlot(llvm::StringRef cType, llvm::LLVMContext& ctx); + +/// Removes `nounwind` from `fn` and from every call to it. An assume of the +/// library rejects an input by unwinding through its caller (D1 condition +/// 11), so a nounwind declaration or call site of it is undefined behaviour. +void allowUnwind(llvm::Function& fn); + +/// Library exports a program may define itself (SV-COMP style); the link +/// would see two definitions. Two treatments, as develop had them: +/// +/// - Discarded: the program's definition gives way to the library's. A +/// program-defined nondet generator (`int __VERIFIER_nondet_int(void) +/// { return 0; }`) would feed constants instead of the fuzzer's or KLEE's +/// input, and the program's __VERIFIER_assume would abort where the +/// library prunes the path. Every use is sent to a declaration of the same +/// name; the old body is renamed __map2check_program_, made internal +/// and reduced to `unreachable` (passes later in the pipeline still visit +/// it, so it keeps a body). +/// - Internalized: the program keeps its own definition, with internal +/// linkage and the same name, so its calls use its body. +const std::vector& discardedProgramDefinitions(); +const std::vector& internalizedProgramDefinitions(); + +/// Applies both lists to `module`. Idempotent; true when it changed +/// anything. The first pass of every pipeline (NonDetPass) calls it before +/// any instrumentation. +bool resolveProgramDefinitions(llvm::Module& module); + +} // namespace Map2Check + +#endif // MODULES_BACKEND_PASS_RUNTIMEABI_HPP_ diff --git a/modules/backend/pass/TargetPass.cpp b/modules/backend/pass/TargetPass.cpp index de403a9b4..19d182ec8 100644 --- a/modules/backend/pass/TargetPass.cpp +++ b/modules/backend/pass/TargetPass.cpp @@ -15,6 +15,8 @@ #include #include +#include "RuntimeABI.hpp" + namespace { /// Counts the call sites TargetPass will match, across the whole module. @@ -86,10 +88,8 @@ PreservedAnalyses TargetPass::run(Function& F, } } - this->targetFunctionMap2Check = F.getParent()->getOrInsertFunction( - "map2check_target_function", Type::getVoidTy(F.getContext()), - PointerType::get(F.getContext(), 0), Type::getInt32Ty(F.getContext()), - Type::getInt32Ty(F.getContext())); + this->targetFunctionMap2Check = Map2Check::getOrInsertRuntime( + *F.getParent(), Map2Check::RuntimeHook::TargetReached); Function::iterator functionIterator = F.begin(); BasicBlock::iterator instructionIterator = functionIterator->begin(); @@ -132,6 +132,8 @@ void TargetPass::instrumentErrorInstruction(CallInst* callInst, DebugInfo debugInfo(Ctx, callInst); + // map2check_reach_target(function, scope, line): records TARGET-REACHED and + // returns; the core ignores scope. Value* args[] = {name_llvm, debugInfo.getScopeNumberValue(), debugInfo.getLineNumberValue()}; diff --git a/modules/backend/pass/TrackBasicBlockPass.cpp b/modules/backend/pass/TrackBasicBlockPass.cpp index 31232a8a4..61ca2a523 100644 --- a/modules/backend/pass/TrackBasicBlockPass.cpp +++ b/modules/backend/pass/TrackBasicBlockPass.cpp @@ -16,6 +16,8 @@ #include #include +#include "RuntimeABI.hpp" + using llvm::CallInst; using llvm::dyn_cast; using llvm::IRBuilder; @@ -35,7 +37,8 @@ PreservedAnalyses TrackBasicBlockPass::run(Function& F, llvm::FunctionAnalysisManager& AM) { this->Ctx = &F.getContext(); this->currentFunction = &F; - this->libraryFunctions = make_unique(&F, &F.getContext()); + this->trackBB = + Map2Check::getOrInsertRuntime(*F.getParent(), Map2Check::RuntimeHook::TrackBB); int countBB = 1; for (auto& B : F) { @@ -221,7 +224,10 @@ void TrackBasicBlockPass::runOnBasicBlock(BasicBlock& B, LLVMContext* Ctx) { unsigned countInst = 1; DebugInfo debugInfoAaEmpty(this->Ctx, BBIteratorToInst(this->st_lastBlockInst)); - if (this->sourceCodeHelper->getLine(debugInfoAaEmpty.getLineNumberInt()) + // Without the C source (plugin built with the default constructor, as + // opt does) every line counts as non-empty. + if (this->sourceCodeHelper != nullptr && + this->sourceCodeHelper->getLine(debugInfoAaEmpty.getLineNumberInt()) .empty()) { flagEmpty = true; } @@ -292,9 +298,6 @@ void TrackBasicBlockPass::instrumentInstBB(BasicBlock::iterator& iT) { iT++; } - // Twine track_bb("map2check_track_bb"); - // Function *calleeFunction; - // calleeFunction->setName(track_bb); // errs() << "inst 1 \n"; IRBuilder<> builder(BBIteratorToInst(iT)); @@ -305,9 +308,11 @@ void TrackBasicBlockPass::instrumentInstBB(BasicBlock::iterator& iT) { // errs() << *debugInfo.getLineNumberValue() << "\n"; // errs() << function_llvm->getName() << "\n"; + // map2check_save_basic_block_log(line, function); the returned + // bbtrack_log_t* is ignored. Value* args[] = {debugInfo.getLineNumberValue(), function_llvm}; - builder.CreateCall(this->libraryFunctions->getTrackBBFunction(), args); + builder.CreateCall(this->trackBB, args); // errs() << "inst 3 \n"; } diff --git a/modules/backend/pass/TrackBasicBlockPass.hpp b/modules/backend/pass/TrackBasicBlockPass.hpp index 85a847a1f..3b942e8e0 100644 --- a/modules/backend/pass/TrackBasicBlockPass.hpp +++ b/modules/backend/pass/TrackBasicBlockPass.hpp @@ -30,7 +30,6 @@ #include "../../frontend/utils/tools.hpp" #include "DebugInfo.hpp" -#include "LibraryFunctions.hpp" // using namespace llvm; namespace Tools = Map2Check; @@ -63,7 +62,7 @@ struct TrackBasicBlockPass : public llvm::PassInfoMixin { private: std::unique_ptr sourceCodeHelper; std::string c_program_path; - std::unique_ptr libraryFunctions; + llvm::FunctionCallee trackBB; bool initializedFunctionName = false; bool isUnreachableInst = false; BasicBlock::iterator st_lastBlockInst; diff --git a/modules/frontend/CMakeLists.txt b/modules/frontend/CMakeLists.txt index 19778b60e..28aa25671 100644 --- a/modules/frontend/CMakeLists.txt +++ b/modules/frontend/CMakeLists.txt @@ -16,11 +16,13 @@ configure_file(map2check_version.hpp.in "${CMAKE_CURRENT_BINARY_DIR}/map2check_version.hpp" @ONLY) add_library(Caller OBJECT caller.cpp) +add_library(CallerLink OBJECT caller_link.cpp) add_library(WasmLifter OBJECT wasm_lifter.cpp) #set_target_properties(Caller PROPERTIES COMPILE_FLAGS ${CXX_FLAGS}) add_executable(map2check map2check.cpp $ + $ $ $ $ diff --git a/modules/frontend/caller.cpp b/modules/frontend/caller.cpp index 2c557fb1f..0407c2e2d 100644 --- a/modules/frontend/caller.cpp +++ b/modules/frontend/caller.cpp @@ -29,6 +29,7 @@ #include #include "test_suite/ktest_reader.hpp" +#include "utils/clang.hpp" #include "utils/gen_crypto_hash.hpp" #include "utils/log.hpp" #include "utils/slicer.hpp" @@ -311,6 +312,7 @@ bool Caller::sliceWithRespectToTarget(const std::string &targetFunction, } std::ostringstream compileStub; compileStub << Map2Check::clangBinary << " -Wno-everything -c -emit-llvm -g" + << " " << Map2Check::kProgramUnwindFlags << " " << Caller::preOptimizationFlags() << " -o " << stubBitcode << " " << stubSource << " >> slicer.output 2>&1"; std::ostringstream linkStub; @@ -397,21 +399,20 @@ void Caller::applyNonDetGenerator() { std::to_string(Map2Check::killGracePeriod) + " " + std::to_string(static_cast(compileBudget)) + " "; - command - << bound << Map2Check::aflClangFastBinary() - << " -g " << Caller::postOptimizationFlags() - << " -o " + programHash + "-fuzzed.out" - << " " + programHash + "-result.bc"; - + // Route B1 (D1): afl-clang-fast's libFuzzer driver calls the + // library's LLVMFuzzerTestOneInput, which runs __map2check_main__ once + // per input. The witness binary also links the witness constructor. + Caller::LinkInputs inputs{programHash, map2checkMode, nonDetGenerator, + dataStructure, wasmMode, false}; + command << bound << buildFuzzerCommand(inputs); + Map2Check::Log::Debug(command.str()); system(command.str().c_str()); + Caller::LinkInputs witnessInputs = inputs; + witnessInputs.witness = true; std::ostringstream commandWitness; - commandWitness.str(""); - commandWitness << bound << Map2Check::aflClangFastBinary() - << " -g " - << " -o " + programHash + "-witness-fuzzed.out" - << " " + programHash + "-witness-result.bc"; - + commandWitness << bound << buildFuzzerCommand(witnessInputs); + Map2Check::Log::Debug(commandWitness.str()); system(commandWitness.str().c_str()); // The CmpLog companion binary: the same program instrumented to log @@ -421,12 +422,11 @@ void Caller::applyNonDetGenerator() { // previous fuzzer ran with (-use_value_profile=1); without it the // tacasv1 comparison would pit an unarmed AFL++ against an armed // LibFuzzer. Optional: if it does not build, the fuzzer runs without. + Caller::LinkInputs cmplogInputs = inputs; + cmplogInputs.cmplog = true; std::ostringstream commandCmplog; - commandCmplog << "AFL_LLVM_CMPLOG=1 " << bound - << Map2Check::aflClangFastBinary() << " -g " - << Caller::postOptimizationFlags() - << " -o " + programHash + "-cmplog.out" - << " " + programHash + "-result.bc"; + commandCmplog << bound << buildFuzzerCommand(cmplogInputs); + Map2Check::Log::Debug(commandCmplog.str()); system(commandCmplog.str().c_str()); // Announced rather than discovered later as a silent no-op -- the same @@ -434,9 +434,10 @@ void Caller::applyNonDetGenerator() { std::error_code fuzzErr; if (!std::filesystem::exists(programHash + "-fuzzed.out", fuzzErr)) { Map2Check::Log::Warning( - "the AFL++ binary did not build within " + + "the AFL++ binary did not build (link error, or over the " + std::to_string(static_cast(compileBudget)) + - "s -- skipping the fuzzer phase and leaving the budget to KLEE"); + "s budget) -- skipping the fuzzer phase and leaving the budget " + "to KLEE"); } else if (!std::filesystem::exists(programHash + "-cmplog.out", fuzzErr)) { Map2Check::Log::Warning( @@ -527,6 +528,9 @@ int Caller::callPass(std::string target_function, bool sv_comp) { passesArg << ",map2check-library"; transformCommand << " -entry-function=" << this->entryFunction; + // The Rust runtime is one library for every mode: Map2CheckLibrary emits + // map2check_set_mode() before map2check_init(). + transformCommand << " -m2c-analysis-mode=" << runtimeAnalysisMode(map2checkMode); if (loadsMemoryTrackPass) { transformCommand << " -m2c-entry-function=" << this->entryFunction; } @@ -548,99 +552,59 @@ int Caller::callPass(std::string target_function, bool sv_comp) { } void Caller::linkLLVM() { - /* Link functions called after executing the passes */ - // TODO(rafa.sa.xp@gmail.com) Only link against used libraries - + // The runtime is map2check-library (decision D1). No bitcode of the C + // runtime is linked any more: the mode reaches the library through + // map2check_set_mode, and the witness through a constructor (Step 4b). + // See caller_link.cpp. Map2Check::Log::Info("Linking with map2check library"); - std::ostringstream witnessCommand; - std::ostringstream linkCommand; - linkCommand.str(""); - linkCommand << Map2Check::llvmLinkBinary; - linkCommand << " " + programHash + "-output.bc" - << " ${MAP2CHECK_PATH}/lib/Map2CheckFunctions.bc" - << " ${MAP2CHECK_PATH}/lib/TrackBBLog.bc" - << " ${MAP2CHECK_PATH}/lib/NonDetLog.bc" - << " ${MAP2CHECK_PATH}/lib/PropertyGenerator.bc"; - - switch (dataStructure) { - case DataStructure::Array: { - linkCommand << " ${MAP2CHECK_PATH}/lib/ContainerRealloc.bc"; - break; - } - case DataStructure::BTree: { - linkCommand << " ${MAP2CHECK_PATH}/lib/ContainerBTree.bc" - << " ${MAP2CHECK_PATH}/lib/BTree.bc"; - break; - } + if (this->dataStructure == DataStructure::BTree) { + // Already announced at option parsing; the Rust runtime has one container. + Map2Check::Log::Debug("--btree ignored at link time"); } - switch (map2checkMode) { - case Map2CheckMode::MEMTRACK_MODE: { - linkCommand << " ${MAP2CHECK_PATH}/lib/AnalysisModeMemtrack.bc" - << " ${MAP2CHECK_PATH}/lib/AllocationLog.bc" - << " ${MAP2CHECK_PATH}/lib/ListLog.bc" - << " ${MAP2CHECK_PATH}/lib/HeapLog.bc"; - break; - } - case Map2CheckMode::MEMCLEANUP_MODE: { - linkCommand << " ${MAP2CHECK_PATH}/lib/AnalysisModeMemcleanup.bc" - << " ${MAP2CHECK_PATH}/lib/AllocationLog.bc" - << " ${MAP2CHECK_PATH}/lib/ListLog.bc" - << " ${MAP2CHECK_PATH}/lib/HeapLog.bc"; - break; - } - case Map2CheckMode::OVERFLOW_MODE: { - linkCommand << " ${MAP2CHECK_PATH}/lib/AnalysisModeOverflow.bc"; - break; - } - case Map2CheckMode::ASSERT_MODE: { - linkCommand << " ${MAP2CHECK_PATH}/lib/AnalysisModeAssert.bc"; - break; - } - case Map2CheckMode::REACHABILITY_MODE: { - // Since the map2check api provides the function, we do not need to do any - // analysis - linkCommand << " ${MAP2CHECK_PATH}/lib/AnalysisModeNone.bc"; - break; - } - case Map2CheckMode::COVER_BRANCHES_MODE: { - // No property, so no analysis -- the run exists to explore and record. - linkCommand << " ${MAP2CHECK_PATH}/lib/AnalysisModeNone.bc"; - break; - } + Caller::LinkInputs verification{programHash, map2checkMode, nonDetGenerator, + dataStructure, wasmMode, false}; + Caller::LinkInputs witness = verification; + witness.witness = true; + + if (nonDetGenerator == NonDetGenerator::Klee && !kleeRuntimeInstalled()) { + Map2Check::Log::Error( + "the symex generator needs the KLEE runtime of map2check-library at " + + installedKleeRuntime() + + ", which this install does not have (configure Map2Check with " + "-DMAP2CHECK_RUST_KLEE_BC). Skipping the KLEE phase."); + return; } - switch (nonDetGenerator) { - case (NonDetGenerator::None): { - linkCommand << " ${MAP2CHECK_PATH}/lib/NonDetGeneratorNone.bc"; - break; - } - case (NonDetGenerator::Klee): { // TODO(hbgit): Add klee non det generator - linkCommand << " ${MAP2CHECK_PATH}/lib/NonDetGeneratorKlee.bc"; - break; - } - case (NonDetGenerator::AFLPlusPlus): { - linkCommand << " ${MAP2CHECK_PATH}/lib/NonDetGeneratorAFL.bc"; - break; - } + // The witness constructor: native for the AFL++ witness binary, bitcode + // for KLEE, in both cases with -fexceptions (D1 condition 11). + { + std::ofstream source(witnessSourcePath(witness)); + source << witnessConstructorSource(); + if (!source.good()) + Map2Check::Log::Warning("could not write the witness constructor"); } - - if (this->wasmMode) { - linkCommand << " ${MAP2CHECK_PATH}/lib/WasmRuntimeStubs.bc"; + const std::string compileWitness = buildWitnessObjectCommand(witness); + Map2Check::Log::Debug(compileWitness); + if (system(compileWitness.c_str()) != 0) { + Map2Check::Log::Warning( + "the witness constructor did not compile -- a violation will not be " + "confirmed"); } - witnessCommand.str(""); - witnessCommand << linkCommand.str(); - witnessCommand << " ${MAP2CHECK_PATH}/lib/WitnessGeneration.bc"; - witnessCommand << " > " + programHash + "-witness-result.bc"; - Map2Check::Log::Debug(witnessCommand.str()); - system(witnessCommand.str().c_str()); - - linkCommand << " ${MAP2CHECK_PATH}/lib/WitnessGenerationNone.bc"; - linkCommand << " > " + programHash + "-result.bc"; - Map2Check::Log::Debug(linkCommand.str()); - system(linkCommand.str().c_str()); + // KLEE runs only the witness bitcode, and linking the 7 MB runtime twice + // would be wasted time; the native generators link both variants (the + // runtime itself enters at the afl-clang-fast step). + std::vector variants = {witness}; + if (nonDetGenerator != NonDetGenerator::Klee) variants.push_back(verification); + for (const Caller::LinkInputs &variant : variants) { + const std::string command = buildLinkCommand(variant); + Map2Check::Log::Debug(command); + if (system(command.c_str()) != 0) { + Map2Check::Log::Warning("llvm-link failed for " + resultBitcode(variant)); + } + } } std::string Caller::generateWasmWrapperStatic(const std::string& wasmOutHeaderPath, @@ -692,6 +656,7 @@ std::string Caller::generateWasmWrapperStatic(const std::string& wasmOutHeaderPa } std::ostringstream compileCmd; compileCmd << Map2Check::clangBinary << " -c -emit-llvm" + << " " << Map2Check::kProgramUnwindFlags << " -I" << wasmIncludePath << " -I" << headerDir << " " << wrapperPath << " -o " << wrapperBcPath; @@ -708,6 +673,11 @@ void Caller::executeAnalysis(std::string solvername) { break; } case (NonDetGenerator::Klee): { + if (!std::filesystem::exists(programHash + "-witness-result.bc")) { + Map2Check::Log::Warning( + "no KLEE bitcode was linked -- skipping the KLEE phase"); + break; + } Map2Check::Log::Info("Executing Klee with map2check"); std::ostringstream kleeCommand; kleeCommand.str(""); @@ -898,19 +868,16 @@ void Caller::executeAnalysis(std::string solvername) { // without the exchange leaves no seeds/ behind. Either way it gets one // placeholder input when empty, because afl-fuzz refuses to start // without one (the previous fuzzer could start from nothing). + // + // The placeholder is at least kAflSeedMinBytes long (D1 condition 4): + // the uninstrumented Rust reader adds no edges that would grow the + // corpus to a whole operand, so CmpLog needs one in the seed. std::error_code seedErr; const std::string inputDir = this->seedExchange ? std::string(Caller::seedDirectory) : "afl-in"; - std::filesystem::create_directories(inputDir, seedErr); - if (std::filesystem::is_empty(inputDir, seedErr)) { - std::ofstream seed(inputDir + "/seed"); - seed << "A"; - if (!seed.good()) - Map2Check::Log::Warning("could not write the AFL++ placeholder seed"); - } - if (seedErr) + if (!prepareAflInputDir(inputDir)) Map2Check::Log::Warning("could not prepare the AFL++ input dir " + - inputDir + ": " + seedErr.message()); + inputDir); std::filesystem::remove_all("afl-out", seedErr); // The AFL_* settings go on the command line, not only into the dev // image's ENV, so that a release install or a benchmark host outside @@ -953,9 +920,9 @@ void Caller::executeAnalysis(std::string solvername) { const std::string aflFindings = "afl-out/default"; // Replay crashes with the witness binary to confirm a real violation. - // Standalone, the persistent binary reads its input from stdin (see - // NonDetGeneratorAFL.c), so the crash file is redirected in; the names - // AFL++ gives them contain ':' and ',', hence the quoting. Stop at the + // The crash file is passed as an ARGUMENT: the libFuzzer driver reading + // stdin never ends (D1 condition 2). The names AFL++ gives them contain + // ':' and ',', hence the quoting (buildReplayCommand). Stop at the // first confirmed one: every replay rewrites the recorded property, and // a later one that does not reproduce would overwrite the violation. // Each replay is capped: a crash that does not reproduce from a fresh @@ -972,9 +939,9 @@ void Caller::executeAnalysis(std::string solvername) { if (entry.path().filename() == "README.txt") continue; std::ostringstream commandWitness; commandWitness << "timeout -k " << Map2Check::killGracePeriod << " " - << replayBudget << " ./" << programHash - << "-witness-fuzzed.out < '" << entry.path().string() - << "'"; + << replayBudget << " " + << buildReplayCommand(programHash, + entry.path().string()); system(commandWitness.str().c_str()); if (isWitnessFileCreated()) break; } @@ -1093,6 +1060,8 @@ void Caller::compileCFile(bool is_llvm_bc) { << " -Wno-everything " << " -Winteger-overflow " << " -c -emit-llvm -g" + // D1 condition 11: the runtime unwinds through these frames. + << " " << Map2Check::kProgramUnwindFlags << " " << Caller::preOptimizationFlags() << " -o " << compiledFile << " " << programHash << "-preprocessed.c " << " > " << programHash << "-clang.out 2>&1"; @@ -1112,39 +1081,43 @@ void Caller::compileCFile(bool is_llvm_bc) { // TODO(hbgit): (3) Check for overflow errors on compilation } -void Caller::compileWithClam() { +void Caller::compileWithClam(bool is_llvm_bc) { Map2Check::Log::Info("Compiling with Clam (invariants) in " + this->pathprogram); + // Bitcode input skips the C clean-up and the clang step below: the module + // goes to clam.py as is (clamInput), which skips its own clang step for + // bitcode. // (1) Remove unsupported functions and clean the C code - // TODO(hbgit): improve regex to the next line - std::ostringstream commandRemoveExternMalloc; - commandRemoveExternMalloc.str(""); - commandRemoveExternMalloc << "cat " << this->pathprogram << " | "; - commandRemoveExternMalloc << "sed -e 's/extern void [*].[^_]*lloc.*/ / g' " - << " > " << programHash << "-preprocessed.c "; - system(commandRemoveExternMalloc.str().c_str()); - - std::ostringstream commandRemoveExternMemset; - commandRemoveExternMemset.str(""); - commandRemoveExternMemset << "sed -i 's/extern void [*]memset.*/ / g' " - << " " << programHash << "-preprocessed.c "; - // Map2Check::Log::Info(commandRemoveExternMemset.str().c_str()); - system(commandRemoveExternMemset.str().c_str()); - - std::ostringstream commandRemoveVoidMemset; - commandRemoveVoidMemset.str(""); - commandRemoveVoidMemset << "sed -i 's/void [*]memset(void[*], int, size_t);/ / g' " - << " " << programHash << "-preprocessed.c "; - // Map2Check::Log::Info(commandRemoveExternMemset.str().c_str()); - system(commandRemoveVoidMemset.str().c_str()); - - std::ostringstream commandRemoveVoidMemcpy; - commandRemoveVoidMemcpy.str(""); - commandRemoveVoidMemcpy << "sed -i 's/void [*]memcpy(void[*], const void [*], size_t);/ / g' " - << " " << programHash << "-preprocessed.c "; - // Map2Check::Log::Info(commandRemoveExternMemset.str().c_str()); - system(commandRemoveVoidMemcpy.str().c_str()); + if (!is_llvm_bc) { + // TODO(hbgit): improve regex to the next line + std::ostringstream commandRemoveExternMalloc; + commandRemoveExternMalloc.str(""); + commandRemoveExternMalloc << "cat " << this->pathprogram << " | "; + commandRemoveExternMalloc << "sed -e 's/extern void [*].[^_]*lloc.*/ / g' " + << " > " << programHash << "-preprocessed.c "; + system(commandRemoveExternMalloc.str().c_str()); + + std::ostringstream commandRemoveExternMemset; + commandRemoveExternMemset.str(""); + commandRemoveExternMemset << "sed -i 's/extern void [*]memset.*/ / g' " + << " " << programHash << "-preprocessed.c "; + // Map2Check::Log::Info(commandRemoveExternMemset.str().c_str()); + system(commandRemoveExternMemset.str().c_str()); + std::ostringstream commandRemoveVoidMemset; + commandRemoveVoidMemset.str(""); + commandRemoveVoidMemset << "sed -i 's/void [*]memset(void[*], int, size_t);/ / g' " + << " " << programHash << "-preprocessed.c "; + // Map2Check::Log::Info(commandRemoveExternMemset.str().c_str()); + system(commandRemoveVoidMemset.str().c_str()); + + std::ostringstream commandRemoveVoidMemcpy; + commandRemoveVoidMemcpy.str(""); + commandRemoveVoidMemcpy << "sed -i 's/void [*]memcpy(void[*], const void [*], size_t);/ / g' " + << " " << programHash << "-preprocessed.c "; + // Map2Check::Log::Info(commandRemoveExternMemset.str().c_str()); + system(commandRemoveVoidMemcpy.str().c_str()); + } // (2) Generate .bc file from code // TODO(hbgit): -Winteger-overflow should be called only if is on overflow @@ -1210,12 +1183,40 @@ void Caller::compileWithClam() { // map2check_crab_assume, which the runtime forwards to klee_assume -- so // nothing downstream needs to change. // See docs/reports/2026-08-16-crabllvm-review.md. + // + // D1 condition 11: the program's bitcode must not be nounwind, and clam.py + // has no way to forward clang flags. So the C is compiled here, with the + // flags clam.py itself would use (-disable-O0-optnone, -fdeclspec, + // -fno-discard-value-names, -m64, -g, its include dir) plus + // kProgramUnwindFlags, and clam.py receives bitcode, for which it skips its + // own clang step. Measured on a loop program: the same 8 verifier.assume + // calls are injected as when clam.py compiles the C, and main loses + // nounwind. + const std::string clamInput = programHash + "-clam-input.bc"; + std::ostringstream compileForClam; + compileForClam << Map2Check::clangBinary << " -Wno-everything" + << " -c -emit-llvm -g -m64" + << " " << Map2Check::kProgramUnwindFlags + << " -Xclang -disable-O0-optnone -fdeclspec" + << " -fno-discard-value-names" + << " -I" << clamRoot << "/include" + << " -o " << clamInput << " " << programHash + << "-preprocessed.c"; + if (is_llvm_bc) { + std::ostringstream copyForClam; + copyForClam << "cp " << this->pathprogram << " " << clamInput; + system(copyForClam.str().c_str()); + } else { + Map2Check::Log::Debug(compileForClam.str()); + system(compileForClam.str().c_str()); + } + command << Map2Check::clamBinary() << " -o " << compiledFile << " -m 64 -g" << " --crab-inter" << " --crab-track=num" << " --crab-opt=add-invariants" << " --crab-opt-invariants-loc=block-entry" - << " " << programHash << "-preprocessed.c "; + << " " << clamInput << " "; Map2Check::Log::Debug(command.str()); system(command.str().c_str()); diff --git a/modules/frontend/caller.hpp b/modules/frontend/caller.hpp index eba63101d..c460f66a8 100644 --- a/modules/frontend/caller.hpp +++ b/modules/frontend/caller.hpp @@ -9,6 +9,7 @@ #ifndef MODULES_FRONTEND_CALLER_HPP_ #define MODULES_FRONTEND_CALLER_HPP_ +#include #include #include @@ -36,11 +37,36 @@ enum class Map2CheckMode { COVER_BRANCHES_MODE }; +/** Mode of a run given no mode flag (map2check.cpp). */ +inline constexpr Map2CheckMode kDefaultMode = Map2CheckMode::MEMTRACK_MODE; + +/** Value of opt's -m2c-analysis-mode for `mode`, i.e. the AnalysisMode of + * map2check-library that Map2CheckLibrary passes to map2check_set_mode: + * none=0, memtrack=1, memcleanup=2, overflow=3, assert=4, target=5. + * Cover-branches checks no property; reachability is Target. */ +inline const char* runtimeAnalysisMode(Map2CheckMode mode) { + switch (mode) { + case Map2CheckMode::MEMTRACK_MODE: + return "memtrack"; + case Map2CheckMode::MEMCLEANUP_MODE: + return "memcleanup"; + case Map2CheckMode::OVERFLOW_MODE: + return "overflow"; + case Map2CheckMode::ASSERT_MODE: + return "assert"; + case Map2CheckMode::REACHABILITY_MODE: + return "target"; + case Map2CheckMode::COVER_BRANCHES_MODE: + return "none"; + } + return "none"; +} + /** NonDet generators */ // TODO(hbgit): Add suport to other nondet like: klee, afl++, afl+klee enum class NonDetGenerator { None, /**< Do not generate any input */ - AFLPlusPlus, /**< AFL++ (persistent mode, PCGUARD) */ + AFLPlusPlus, /**< AFL++ through its libFuzzer driver (D1 route B1) */ Klee, /**< Use klee for symbolic analysis */ }; @@ -70,6 +96,19 @@ class Caller { bool witnessVerified = false; public: + /** What decides how the instrumented program is linked with the runtime + * (map2check-library, decision D1). Consumed by the pure command builders + * below, so the link can be tested without running anything. */ + struct LinkInputs { + std::string hash; //!< scratch prefix, -output.bc + Map2CheckMode mode; //!< property mode + NonDetGenerator generator; //!< None/AFLPlusPlus: native, Klee: bitcode + DataStructure dataStructure; //!< ignored by the Rust runtime (--btree) + bool wasm; //!< wasm2c-lifted input + bool witness; //!< witness binary/bitcode (Step 4b) + bool cmplog = false; //!< AFL++ CmpLog companion binary + }; + /** @brief Constructor if .bc file already exists * @param bc_progam_path Path for the file */ Caller(std::string bc_program_path, Map2CheckMode mode, @@ -99,8 +138,9 @@ class Caller { /** Compiles the input through Clam so the emitted bitcode carries * verifier.assume(invariant) calls. Requires Clam dev16 installed; callers - * must have checked availability first (main() refuses the run otherwise). */ - void compileWithClam(); + * must have checked availability first (main() refuses the run otherwise). + * Bitcode input (is_llvm_bc) is handed to Clam as is. */ + void compileWithClam(bool is_llvm_bc); /** @brief Function to call pass for current verification mode * (for REACHABILITY mode) @@ -189,7 +229,7 @@ class Caller { /** Instrument and execute nondeterministic generator */ void applyNonDetGenerator(); - /** Use btree mode */ + /** Use btree mode. Ignored by the Rust runtime (kBtreeIgnoredWarning). */ void useBTree() { this->dataStructure = DataStructure::BTree; } /** Generate wasm wrapper bitcode for KLEE compatibility */ @@ -218,6 +258,74 @@ class Caller { const std::string& entry, const std::string& label); }; +// --------------------------------------------------------------------------- +// Linking with map2check-library (caller_link.cpp). Pure: they build strings +// or touch only the directory they are given, so CallerLinkTest covers them. +// --------------------------------------------------------------------------- + +/** Installed native runtime, linked into every AFL++ binary (route B). */ +inline constexpr const char* kRustRuntimeLibrary = + "${MAP2CHECK_PATH}/lib/libmap2check.a"; +/** Installed KLEE runtime bitcode (route A'), optional in CMake. */ +inline constexpr const char* kRustKleeRuntime = + "${MAP2CHECK_PATH}/lib/map2check-klee.bc"; +/** System libraries the Rust standard library needs. */ +inline constexpr const char* kRustRuntimeSystemLibs = "-ldl -lpthread -lm"; +/** Minimum size of the AFL++ placeholder seed (D1 condition 4): the widest + * value a nondet generator reads (long, double, pointers). */ +inline constexpr std::size_t kAflSeedMinBytes = 8; +/** Logged once when --btree is given. Provisional until decision D3. */ +inline constexpr const char* kBtreeIgnoredWarning = + "--btree is ignored by the Rust runtime"; + +/** -result.bc, or -witness-result.bc for the witness variant. */ +std::string resultBitcode(const Caller::LinkInputs& in); + +/** llvm-link of the instrumented module into resultBitcode(in). Native + * generators link nothing else (the runtime enters at the final link); + * Klee links map2check-klee.bc and, for the witness, the witness bitcode. */ +std::string buildLinkCommand(const Caller::LinkInputs& in); + +/** afl-clang-fast -fsanitize=fuzzer over resultBitcode(in), the native + * witness object (witness only) and libmap2check.a (D1 route B1). CmpLog is + * prefixed with `env AFL_LLVM_CMPLOG=1`, so the command can follow `timeout`. */ +std::string buildFuzzerCommand(const Caller::LinkInputs& in); + +/** Name of the binary buildFuzzerCommand(in) writes. */ +std::string fuzzerBinary(const Caller::LinkInputs& in); + +/** C source of the witness constructor (Step 4b). */ +std::string witnessConstructorSource(); + +/** -witness.c, the file witnessConstructorSource() is written to. */ +std::string witnessSourcePath(const Caller::LinkInputs& in); + +/** -witness.bc for Klee, -witness.o otherwise. */ +std::string witnessObjectPath(const Caller::LinkInputs& in); + +/** clang -c (-emit-llvm for Klee) -fexceptions of the witness constructor. */ +std::string buildWitnessObjectCommand(const Caller::LinkInputs& in); + +/** Replay of one AFL++ finding on the witness binary, the file passed as an + * ARGUMENT (D1 condition 2: the libFuzzer driver never ends reading stdin). */ +std::string buildReplayCommand(const std::string& hash, + const std::string& input); + +/** Makes `dir` usable as afl-fuzz -i: creates it and, only when it is empty, + * writes one placeholder seed of at least kAflSeedMinBytes bytes. A directory + * that already holds seeds (the KLEE exchange) is left untouched. Returns + * false if the directory or the seed could not be written. */ +bool prepareAflInputDir(const std::string& dir); + +/** kRustKleeRuntime with MAP2CHECK_PATH expanded from the environment. */ +std::string installedKleeRuntime(); + +/** Whether installedKleeRuntime() exists. */ +bool kleeRuntimeInstalled(); + +/** Logs kBtreeIgnoredWarning. */ +void warnBtreeIgnored(); + } // namespace Map2Check #endif // MODULES_FRONTEND_CALLER_HPP_ diff --git a/modules/frontend/caller_link.cpp b/modules/frontend/caller_link.cpp new file mode 100644 index 000000000..f6b4008ed --- /dev/null +++ b/modules/frontend/caller_link.cpp @@ -0,0 +1,144 @@ +/** + * Copyright (C) 2014 - 2026 Map2Check tool + * This file is part of the Map2Check tool, and is made available under + * the terms of the GNU General Public License version 2. + * + * SPDX-License-Identifier: (GPL-2.0) + **/ + +// Linking the instrumented program with map2check-library (decision D1 in +// map2check-library's docs/cutover/decisoes.md): +// +// afl / none route B + B1: the instrumented bitcode is compiled natively by +// afl-clang-fast -fsanitize=fuzzer and linked with the installed +// libmap2check.a, whose LLVMFuzzerTestOneInput drives the +// renamed __map2check_main__. No runtime bitcode is llvm-linked. +// symex route A': the instrumented bitcode is llvm-linked with +// map2check-klee.bc (rustc 1.72.1 / LLVM 16), which defines the +// main KLEE runs. +// +// The C runtime chose the property mode, the container, the generator and +// the witness behaviour by WHICH .bc files it linked. The Rust runtime is one +// library: the mode comes from map2check_set_mode (Map2CheckLibrary pass), +// there is one container, and the witness is switched on at run time by a +// constructor that calls map2check_enable_witness (Step 4b), linked only into +// the witness artefacts as WitnessGeneration.bc used to be. + +#include +#include +#include +#include +#include +#include + +#include "caller.hpp" +#include "utils/clang.hpp" +#include "utils/log.hpp" +#include "utils/tools.hpp" + +namespace Map2Check { + +std::string resultBitcode(const Caller::LinkInputs& in) { + return in.hash + (in.witness ? "-witness-result.bc" : "-result.bc"); +} + +std::string witnessSourcePath(const Caller::LinkInputs& in) { + return in.hash + "-witness.c"; +} + +std::string witnessObjectPath(const Caller::LinkInputs& in) { + return in.hash + + (in.generator == NonDetGenerator::Klee ? "-witness.bc" : "-witness.o"); +} + +std::string witnessConstructorSource() { + return "void map2check_enable_witness(void);\n" + "__attribute__((constructor)) static void m2c_witness(void) {\n" + " map2check_enable_witness();\n" + "}\n"; +} + +std::string buildWitnessObjectCommand(const Caller::LinkInputs& in) { + std::ostringstream command; + command << clangBinary << " -c"; + if (in.generator == NonDetGenerator::Klee) command << " -emit-llvm"; + command << " " << kProgramUnwindFlags << " -o " << witnessObjectPath(in) + << " " << witnessSourcePath(in); + return command.str(); +} + +std::string buildLinkCommand(const Caller::LinkInputs& in) { + std::ostringstream command; + command << llvmLinkBinary << " " << in.hash << "-output.bc"; + if (in.generator == NonDetGenerator::Klee) { + command << " " << kRustKleeRuntime; + if (in.witness) command << " " << witnessObjectPath(in); + } + command << " -o " << resultBitcode(in); + return command.str(); +} + +std::string fuzzerBinary(const Caller::LinkInputs& in) { + if (in.cmplog) return in.hash + "-cmplog.out"; + return in.hash + (in.witness ? "-witness-fuzzed.out" : "-fuzzed.out"); +} + +std::string buildFuzzerCommand(const Caller::LinkInputs& in) { + // Flags as before the cutover: the fuzzing and CmpLog binaries at -O2, the + // witness (replay) binary without. CmpLog instruments the fuzzing program, + // so it never carries the witness constructor. + Caller::LinkInputs native = in; + native.generator = NonDetGenerator::AFLPlusPlus; + native.witness = in.witness && !in.cmplog; + std::ostringstream command; + if (in.cmplog) command << "env AFL_LLVM_CMPLOG=1 "; + command << aflClangFastBinary() << " -g "; + if (!native.witness) command << "-O2 "; + command << "-fsanitize=fuzzer " << resultBitcode(native) << " "; + if (native.witness) command << witnessObjectPath(native) << " "; + command << kRustRuntimeLibrary << " " << kRustRuntimeSystemLibs << " -o " + << fuzzerBinary(in); + return command.str(); +} + +std::string buildReplayCommand(const std::string& hash, + const std::string& input) { + std::string quoted; + for (char c : input) { + if (c == '\'') + quoted += "'\\''"; + else + quoted += c; + } + return "./" + hash + "-witness-fuzzed.out '" + quoted + "'"; +} + +bool prepareAflInputDir(const std::string& dir) { + std::error_code error; + std::filesystem::create_directories(dir, error); + if (error) return false; + const bool empty = std::filesystem::is_empty(dir, error); + if (error) return false; + if (!empty) return true; + // afl-fuzz refuses an empty -i. The placeholder is as wide as the widest + // value a generator reads, so CmpLog's input-to-state stage finds a whole + // operand in the input from the first execution (D1 condition 4). + std::ofstream seed(dir + "/seed", std::ios::binary); + seed << std::string(kAflSeedMinBytes, 'A'); + return seed.good(); +} + +std::string installedKleeRuntime() { + const char* prefix = getenv("MAP2CHECK_PATH"); + return std::string(prefix != nullptr ? prefix : "") + + "/lib/map2check-klee.bc"; +} + +bool kleeRuntimeInstalled() { + std::error_code error; + return std::filesystem::is_regular_file(installedKleeRuntime(), error); +} + +void warnBtreeIgnored() { Log::Warning(kBtreeIgnoredWarning); } + +} // namespace Map2Check diff --git a/modules/frontend/map2check.cpp b/modules/frontend/map2check.cpp index 00bb36320..b19487fec 100644 --- a/modules/frontend/map2check.cpp +++ b/modules/frontend/map2check.cpp @@ -489,17 +489,17 @@ int map2check_execution(map2check_args args) { // generator is installed. The old code branched on !is_llvmir_in and so // never even looked at the flag for bitcode input -- how the baselines, the // CASTLE harness and the BenchExec wrappers all invoke the tool -- which is - // why it was ignored without a trace (issue #54). - if (!is_llvmir_in && args.invCrabLlvm) { - caller->compileWithClam(); + // why it was ignored without a trace (issue #54). The run was no longer + // refused, but bitcode input still took compileCFile and Clam never ran: + // test_add_invariants.sh passed only because the C runtime, linked into + // the result bitcode, defined map2check_crab_assume. Bitcode input goes + // through Clam too. + if (args.invCrabLlvm) { + caller->compileWithClam(is_llvmir_in); } else { caller->compileCFile(is_llvmir_in); } - if (args.btree) { - caller->useBTree(); - } - // (2) Instrument functions for current mode // BEFORE instrumentation, and the order was learned the hard way. // @@ -787,8 +787,8 @@ z3 (Z3 is default), btor (Boolector), and yices2 (Yices))") ("architecture", po::value()->default_value("64bit"), "\tmachine model recorded in the test-suite metadata") ("expected-result", po::value(), "\tspecifies type of violation expected") - ("btree", "\tuses btree structure to hold information (experimental, use this " - "if you are having memory problems)") + ("btree", "\tignored: the Rust runtime has a single container (kept for " + "compatibility)") ("wasm", "\tverify a WebAssembly (.wasm) binary via wasm2c lifting") ("entry-function", po::value()->default_value("main"), R"(define the entry function name (default: main))"); @@ -806,7 +806,7 @@ z3 (Z3 is default), btor (Boolector), and yices2 (Yices))") map2check_args args; // Default mode - args.mode = Map2Check::Map2CheckMode::MEMTRACK_MODE; + args.mode = Map2Check::kDefaultMode; // Handling with the options if (vm.count("version")) { std::cout << Map2CheckVersion << "\n"; @@ -865,7 +865,9 @@ z3 (Z3 is default), btor (Boolector), and yices2 (Yices))") args.mode = Map2Check::Map2CheckMode::MEMCLEANUP_MODE; } if (vm.count("btree")) { + // Provisional until decision D3: map2check-library has one container. args.btree = true; + Map2Check::warnBtreeIgnored(); } if (vm.count("add-invariants")) { args.invCrabLlvm = true; @@ -964,6 +966,21 @@ z3 (Z3 is default), btor (Boolector), and yices2 (Yices))") return ERROR_UNAVAILABLE_CAPABILITY; } + // The symex generator runs map2check-library's KLEE runtime bitcode, + // which a build without -DMAP2CHECK_RUST_KLEE_BC does not install. Asked + // for explicitly, that is a missing capability; the hybrid default only + // loses its KLEE phase, and linkLLVM says so. + if (args.generator == Map2Check::NonDetGenerator::Klee && + !Map2Check::kleeRuntimeInstalled()) { + Map2Check::Log::Error( + "--nondet-generator symex needs the KLEE runtime of " + "map2check-library at " + Map2Check::installedKleeRuntime() + + ", which this install does not have. Rebuild Map2Check with " + "-DMAP2CHECK_RUST_KLEE_BC=, or use " + "--nondet-generator afl."); + return ERROR_UNAVAILABLE_CAPABILITY; + } + if (vm.count("input-file")) { std::string pathfile; pathfile = accumulate( diff --git a/modules/frontend/utils/clang.hpp b/modules/frontend/utils/clang.hpp index a0577d2b8..10bd2686e 100644 --- a/modules/frontend/utils/clang.hpp +++ b/modules/frontend/utils/clang.hpp @@ -14,6 +14,16 @@ namespace Map2Check { +/// Flags every clang invocation that turns the analysed program's C into +/// bitcode must pass (map2check-library D1, condition 11). The runtime +/// rejects a fuzzer input whose __VERIFIER_assume fails by unwinding through +/// the program's frames; without -fexceptions clang marks every C function +/// nounwind, and unwinding through a nounwind function is undefined in LLVM +/// IR. The attributes travel in the bitcode, so the flag belongs on the +/// -emit-llvm step. Never pair it with -fno-unwind-tables or +/// -fno-asynchronous-unwind-tables. +inline constexpr const char* kProgramUnwindFlags = "-fexceptions"; + inline std::string GenerateIRCode(std::string clang_path, std::string include_dir, std::string program) { diff --git a/modules/frontend/wasm_lifter.cpp b/modules/frontend/wasm_lifter.cpp index f5528a316..c3255f5f7 100644 --- a/modules/frontend/wasm_lifter.cpp +++ b/modules/frontend/wasm_lifter.cpp @@ -13,6 +13,7 @@ #include #include +#include "utils/clang.hpp" #include "utils/log.hpp" namespace Map2Check { @@ -108,6 +109,8 @@ void WasmLifter::runClang(const std::string& cPath, std::ostringstream cmd; cmd << config_.clangPath << " -c -emit-llvm" + // D1 condition 11: the runtime unwinds through the lifted frames. + << " " << Map2Check::kProgramUnwindFlags << " -I\"" << config_.wasmRtIncludePath << "\"" << " -I\"" << hPath.substr(0, hPath.find_last_of("/")) << "\"" << " -Wno-unused-command-line-argument"; @@ -128,6 +131,7 @@ void WasmLifter::runClangEmitLLVM(const std::string& cPath, std::ostringstream cmd; cmd << config_.clangPath << " -S -emit-llvm" + << " " << Map2Check::kProgramUnwindFlags << " -I\"" << config_.wasmRtIncludePath << "\"" << " -I\"" << hPath.substr(0, hPath.find_last_of("/")) << "\""; diff --git a/scripts/cutover/compare.py b/scripts/cutover/compare.py new file mode 100644 index 000000000..7bef6d2e7 --- /dev/null +++ b/scripts/cutover/compare.py @@ -0,0 +1,80 @@ +#!/usr/bin/env python3 +"""Gate diferencial do cutover: compara as linhas de base C e Rust (critérios 1-8).""" +import argparse, csv, statistics, sys +from collections import Counter, defaultdict + +KEY = ("task", "prp", "gen") +FIELDS = ("verdict", "tag", "line", "function", "witness") + + +def load(path): + groups = defaultdict(list) + with open(path, newline="") as f: + for row in csv.DictReader(f, delimiter="\t"): + groups[tuple(row[k] for k in KEY)].append(row) + return groups + + +def mode(rows, field): + return Counter(r[field] for r in rows).most_common(1)[0][0] + + +def median_num(rows, field): + vals = [float(r[field]) for r in rows if r[field] not in ("-", "")] + return statistics.median(vals) if vals else None + + +def main(): + ap = argparse.ArgumentParser() + ap.add_argument("c"); ap.add_argument("rust") + ap.add_argument("--accepted", required=True) + ap.add_argument("--max-wall", type=float, default=1.10) + ap.add_argument("--max-rss", type=float, default=1.36) + a = ap.parse_args() + c, r = load(a.c), load(a.rust) + accepted = set() + with open(a.accepted, newline="") as f: + for row in csv.DictReader(f, delimiter="\t"): + accepted.add((row["task"], row["prp"], row["gen"], row["field"], row["c_value"], row["rust_value"])) + + failures, wall_ratios, rss_ratios = [], [], [] + timeouts = Counter() + for key in sorted(set(c) | set(r)): + if key not in r or key not in c: + failures.append(f"| {' '.join(key)} | missing | {key in c} | {key in r} |") + continue + for field in FIELDS: + cv, rv = mode(c[key], field), mode(r[key], field) + if cv != rv and (*key, field, cv, rv) not in accepted: + failures.append(f"| {' '.join(key)} | {field} | {cv} | {rv} |") + for side, rows in (("c", c[key]), ("rust", r[key])): + if mode(rows, "verdict") == "TIMEOUT": + timeouts[(key[2], side)] += 1 + cw, rw = median_num(c[key], "wall_s"), median_num(r[key], "wall_s") + if cw and rw: + wall_ratios.append(rw / cw) + cm, rm = median_num(c[key], "maxrss_kb"), median_num(r[key], "maxrss_kb") + if cm and rm: + rss_ratios.append(rm / cm) + + for gen in {k[2] for k in c}: + if timeouts[(gen, "rust")] > timeouts[(gen, "c")]: + failures.append(f"| gen={gen} | TIMEOUT count | {timeouts[(gen, 'c')]} | {timeouts[(gen, 'rust')]} |") + wall = statistics.median(wall_ratios) if wall_ratios else 1.0 + rss = statistics.median(rss_ratios) if rss_ratios else 1.0 + if wall > a.max_wall: + failures.append(f"| all | median wall ratio | <= {a.max_wall} | {wall:.3f} |") + if rss > a.max_rss: + failures.append(f"| all | median rss ratio | <= {a.max_rss} | {rss:.3f} |") + + print(f"median wall ratio: {wall:.3f} median rss ratio: {rss:.3f}\n") + if failures: + print("| key | field | c | rust |\n|---|---|---|---|") + print("\n".join(failures)) + return 1 + print("gate: PASS") + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/scripts/cutover/fixtures/c-assert-synthetic.txt b/scripts/cutover/fixtures/c-assert-synthetic.txt new file mode 100644 index 000000000..71a2801ac --- /dev/null +++ b/scripts/cutover/fixtures/c-assert-synthetic.txt @@ -0,0 +1,5 @@ +Violated property: + file map2check_property line 42 function foo + FALSE-ASSERT + +VERIFICATION FAILED diff --git a/scripts/cutover/fixtures/c-failed-stdout.txt b/scripts/cutover/fixtures/c-failed-stdout.txt new file mode 100644 index 000000000..1a38518d3 --- /dev/null +++ b/scripts/cutover/fixtures/c-failed-stdout.txt @@ -0,0 +1,76 @@ +Adopting z3 solver... +Adopting symex nondet-generator... +Started Map2Check +Compiling /src/tests/regression_test/test_cases/sv-benchmarks/array-examples/relax-1.c +Adding nondet pass +Adding memtrack pass +Adding map2check pass +Linking with map2check library +Applying optimizations for klee +Executing Klee with map2check +Solver backend caller: z3 +KLEE: NOTE: Using klee-uclibc : /src/release/lib/klee/runtime/klee-uclibc.bca +KLEE: output directory is "/tmp/tmp.CKJE0V2SXY/10a8cc7f8ad88ce445fb123804a07fc4ee780c31.map2check/./klee-out-0" +KLEE: Using Z3 solver backend +KLEE: Deterministic allocator: Using quarantine queue size 8 +KLEE: Deterministic allocator: globals (start-address=0x7f18e9600000 size=10 GiB) +KLEE: Deterministic allocator: constants (start-address=0x7f1669600000 size=10 GiB) +KLEE: Deterministic allocator: heap (start-address=0x7e1669600000 size=1024 GiB) +KLEE: Deterministic allocator: stack (start-address=0x7df669600000 size=128 GiB) +KLEE: WARNING: undefined reference to function: close +KLEE: WARNING: undefined reference to function: fcntl +KLEE: WARNING: undefined reference to function: fstat +KLEE: WARNING: undefined reference to function: ioctl +KLEE: WARNING: undefined reference to function: lseek64 +KLEE: WARNING: undefined reference to function: open +KLEE: WARNING: undefined reference to function: write +KLEE: WARNING ONCE: calling external: ioctl(0, 21505, 138542380482560) at libc/termios/tcgetattr.c:43 12 +KLEE: WARNING ONCE: calling __user_main with extra arguments. +KLEE: WARNING ONCE: calling __map2check_main__ with extra arguments. +KLEE: WARNING ONCE: Alignment of memory from call "malloc" is not modelled. Using alignment of 8. +KLEE: WARNING ONCE: Alignment of memory from call "realloc" is not modelled. Using alignment of 8. +KLEE: NOTE: found huge malloc, returning 0 +KLEE: ERROR: 10a8cc7f8ad88ce445fb123804a07fc4ee780c31.map2check-preprocessed.c:127: concretized symbolic size +KLEE: NOTE: now ignoring this error at this location +KLEE: WARNING ONCE: calling external: open(139738663092224, 577, 438) at libc/stdio/_fopen.c:146 8 +KLEE: WARNING ONCE: calling external: write(12, 139499889754112, 8) at libc/stdio/_WRITE.c:52 11 +KLEE: WARNING ONCE: calling external: close(12) at libc/stdio/fclose.c:56 22 +KLEE: NOTE: found huge malloc, returning 0 +KLEE: ERROR: 10a8cc7f8ad88ce445fb123804a07fc4ee780c31.map2check-preprocessed.c:128: concretized symbolic size +KLEE: NOTE: now ignoring this error at this location +KLEE: WARNING ONCE: silently concretizing (reason: external call) expression (Extract w8 0 (Add w32 48 + (URem w32 (Extract w32 0 (Sub w64 0 + (SExt w64 (ReadLSB w32 0 non_det_ulong)))) + 10))) to value 51 (libc/stdio/_WRITE.c:52) +KLEE: ERROR: (location information missing) abort failure +KLEE: NOTE: now ignoring this error at this location +KLEE: halting execution, dumping remaining states + +KLEE: done: total instructions = 4630430 +KLEE: done: completed paths = 0 +KLEE: done: partially completed paths = 115 +KLEE: done: generated tests = 115 +Exited klee with 0 +Started counter example generation +Counter-example: + +State 0: file /src/tests/regression_test/test_cases/sv-benchmarks/array-examples/relax-1.c +------------------------------------------------------------ +>Symbolic log + Value : -3 + Line Number : 125 + Function Scope : main + +State 1: file /src/tests/regression_test/test_cases/sv-benchmarks/array-examples/relax-1.c +------------------------------------------------------------ +>Symbolic log + Value : -2 + Line Number : 125 + Function Scope : main + +---------------------------------------------------- +Violated property: + file map2check_property line 108 function is_relaxed_prefix + FALSE-DEREF: Reference to pointer was lost + +VERIFICATION FAILED diff --git a/scripts/cutover/fixtures/c-false-divbyzero-synthetic.txt b/scripts/cutover/fixtures/c-false-divbyzero-synthetic.txt new file mode 100644 index 000000000..15796abfb --- /dev/null +++ b/scripts/cutover/fixtures/c-false-divbyzero-synthetic.txt @@ -0,0 +1,5 @@ +Violated property: + file map2check_property line 42 function foo + FALSE-DIVBYZERO + +VERIFICATION FAILED diff --git a/scripts/cutover/fixtures/c-false-free-synthetic.txt b/scripts/cutover/fixtures/c-false-free-synthetic.txt new file mode 100644 index 000000000..298f2d9ed --- /dev/null +++ b/scripts/cutover/fixtures/c-false-free-synthetic.txt @@ -0,0 +1,5 @@ +Violated property: + file map2check_property line 42 function foo + FALSE-FREE: Operand of free must have zero pointer offset + +VERIFICATION FAILED diff --git a/scripts/cutover/fixtures/c-false-memcleanup-synthetic.txt b/scripts/cutover/fixtures/c-false-memcleanup-synthetic.txt new file mode 100644 index 000000000..c747b1bc9 --- /dev/null +++ b/scripts/cutover/fixtures/c-false-memcleanup-synthetic.txt @@ -0,0 +1,4 @@ +Violated property: + FALSE-MEMCLEANUP + +VERIFICATION FAILED diff --git a/scripts/cutover/fixtures/c-false-memtrack-synthetic.txt b/scripts/cutover/fixtures/c-false-memtrack-synthetic.txt new file mode 100644 index 000000000..7d6d01d5c --- /dev/null +++ b/scripts/cutover/fixtures/c-false-memtrack-synthetic.txt @@ -0,0 +1,4 @@ +Violated property: + FALSE-MEMTRACK + +VERIFICATION FAILED diff --git a/scripts/cutover/fixtures/c-overflow-synthetic.txt b/scripts/cutover/fixtures/c-overflow-synthetic.txt new file mode 100644 index 000000000..b2a79b23e --- /dev/null +++ b/scripts/cutover/fixtures/c-overflow-synthetic.txt @@ -0,0 +1,5 @@ +Violated property: + file map2check_property line 42 function foo + OVERFLOW + +VERIFICATION FAILED diff --git a/scripts/cutover/fixtures/c-succeeded-stdout.txt b/scripts/cutover/fixtures/c-succeeded-stdout.txt new file mode 100644 index 000000000..8dde1fb20 --- /dev/null +++ b/scripts/cutover/fixtures/c-succeeded-stdout.txt @@ -0,0 +1,42 @@ +Adopting z3 solver... +Adopting symex nondet-generator... +Started Map2Check +Compiling /src/tests/regression_test/test_cases/sv-benchmarks/ldv-memsafety/memsetNonZero.c +Adding nondet pass +Adding memtrack pass +Adding map2check pass +Linking with map2check library +Applying optimizations for klee +Executing Klee with map2check +Solver backend caller: z3 +KLEE: NOTE: Using klee-uclibc : /src/release/lib/klee/runtime/klee-uclibc.bca +KLEE: output directory is "/tmp/tmp.gxPGwExe72/053e01a2cec6b58c9d93ee902fbde2c977d3366f.map2check/./klee-out-0" +KLEE: Using Z3 solver backend +KLEE: Deterministic allocator: Using quarantine queue size 8 +KLEE: Deterministic allocator: globals (start-address=0x7fceaa000000 size=10 GiB) +KLEE: Deterministic allocator: constants (start-address=0x7fcc2a000000 size=10 GiB) +KLEE: Deterministic allocator: heap (start-address=0x7ecc2a000000 size=1024 GiB) +KLEE: Deterministic allocator: stack (start-address=0x7eac2a000000 size=128 GiB) +KLEE: WARNING: undefined reference to function: close +KLEE: WARNING: undefined reference to function: fcntl +KLEE: WARNING: undefined reference to function: fstat +KLEE: WARNING: undefined reference to function: ioctl +KLEE: WARNING: undefined reference to function: lseek64 +KLEE: WARNING: undefined reference to function: open +KLEE: WARNING: undefined reference to function: write +KLEE: WARNING ONCE: calling external: ioctl(0, 21505, 139323001274368) at libc/termios/tcgetattr.c:43 12 +KLEE: WARNING ONCE: calling __user_main with extra arguments. +KLEE: WARNING ONCE: calling __map2check_main__ with extra arguments. +KLEE: WARNING ONCE: Alignment of memory from call "malloc" is not modelled. Using alignment of 8. +KLEE: WARNING ONCE: Alignment of memory from call "realloc" is not modelled. Using alignment of 8. +KLEE: WARNING ONCE: calling external: open(140519686537216, 577, 438) at libc/stdio/_fopen.c:146 8 +KLEE: WARNING ONCE: calling external: write(12, 140239976792064, 5) at libc/stdio/_WRITE.c:52 11 +KLEE: WARNING ONCE: calling external: close(12) at libc/stdio/fclose.c:56 22 + +KLEE: done: total instructions = 91449 +KLEE: done: completed paths = 1 +KLEE: done: partially completed paths = 0 +KLEE: done: generated tests = 1 +Exited klee with 0 + +VERIFICATION SUCCEEDED diff --git a/scripts/cutover/fixtures/c-target-reached-synthetic.txt b/scripts/cutover/fixtures/c-target-reached-synthetic.txt new file mode 100644 index 000000000..f0623bafc --- /dev/null +++ b/scripts/cutover/fixtures/c-target-reached-synthetic.txt @@ -0,0 +1,5 @@ +Violated property: + file map2check_property line 42 function foo + FALSE: Target Reached + +VERIFICATION FAILED diff --git a/scripts/cutover/fixtures/c-unmapped-synthetic.txt b/scripts/cutover/fixtures/c-unmapped-synthetic.txt new file mode 100644 index 000000000..1e580de3c --- /dev/null +++ b/scripts/cutover/fixtures/c-unmapped-synthetic.txt @@ -0,0 +1,5 @@ +Violated property: + file map2check_property line 42 function foo + FALSE-SOMETHING-NEW + +VERIFICATION FAILED diff --git a/scripts/cutover/run-corpus.sh b/scripts/cutover/run-corpus.sh new file mode 100755 index 000000000..fb2228a9b --- /dev/null +++ b/scripts/cutover/run-corpus.sh @@ -0,0 +1,111 @@ +#!/usr/bin/env bash +# Executa o corpus de regressão e grava, por tarefa/propriedade/gerador/repetição, +# o veredito, a tag de map2check_property, linha, função, witness, tempo e RSS. +# Uso: run-corpus.sh +set -euo pipefail +BIN_DIR="$(cd "$1" && pwd)"; OUT="$2" +ROOT="$(cd "$(dirname "$0")/../.." && pwd)" +CASES="${CASES:-$ROOT/tests/regression_test/test_cases/sv-benchmarks}" +GENS="${GENS:-afl symex}"; REPS="${REPS:-5}"; TIMEOUT="${TIMEOUT:-45}" +# EXTRA_FLAGS: flags acrescentadas às da propriedade (ex.: --btree, Task 4.3). +EXTRA_FLAGS="${EXTRA_FLAGS:-}" +# OOM_EVENTS: memory.events do cgroup (default: o do container, se legível). +# Um oom_kill novo durante uma tarefa sem veredito decidido grava veredito OOM. +OOM_EVENTS="${OOM_EVENTS:-/sys/fs/cgroup/memory.events}" +oom_kills() { sed -nE 's/^oom_kill ([0-9]+)$/\1/p' "$OOM_EVENTS" 2>/dev/null || true; } + +flags_for() { + case "$1" in + valid-memsafety) echo "--memtrack" ;; + valid-memcleanup) echo "--memtrack --memcleanup-property" ;; + no-overflow) echo "--check-overflow" ;; + unreach-call) echo "--target-function" ;; + *) return 1 ;; + esac +} + +printf 'task\tprp\tgen\trep\tverdict\ttag\tline\tfunction\twitness\twall_s\tmaxrss_kb\n' > "$OUT" +while IFS= read -r yml; do + dir="$(dirname "$yml")" + input="$dir/$(sed -nE "s/^input_files: *'?([^' ]+)'?.*/\1/p" "$yml")" + while IFS= read -r prp; do + flags="$(flags_for "$prp")" || continue + flags="$flags${EXTRA_FLAGS:+ $EXTRA_FLAGS}" + for gen in $GENS; do + for rep in $(seq 1 "$REPS"); do + work="$(mktemp -d)" + oom_before="$(oom_kills)" + # shellcheck disable=SC2086 + ( cd "$work" && /usr/bin/time -f '%e\t%M' -o time.txt \ + timeout "$((TIMEOUT + 15))" "$BIN_DIR/map2check" --timeout "$TIMEOUT" --nondet-generator "$gen" $flags "$input" \ + > out.txt 2>&1 ) || true + verdict=TIMEOUT + grep -q 'VERIFICATION SUCCEEDED' "$work/out.txt" && verdict=SUCCEEDED + grep -q 'VERIFICATION FAILED' "$work/out.txt" && verdict=FAILED + grep -q 'VERIFICATION UNKNOWN' "$work/out.txt" && verdict=UNKNOWN + oom_after="$(oom_kills)" + if [ -n "$oom_before" ] && [ -n "$oom_after" ] && [ "$oom_after" -gt "$oom_before" ]; then + case "$verdict" in + SUCCEEDED|FAILED) + echo "run-corpus: oom_kill during ${yml#"$CASES"/} ($prp, $gen, rep $rep), verdict $verdict kept" >&2 ;; + *) verdict=OOM ;; + esac + fi + tag=-; line=-; func=- + # tag/line/function are only meaningful for a FAILED verdict; every other + # verdict gets "-" whichever source (property file or stdout) was used. + if [ "$verdict" = FAILED ]; then + raw= + ptag=; [ -f "$work/map2check_property" ] && ptag="$(sed -n 1p "$work/map2check_property")" + case "$ptag" in + ""|NONE|UNKNOWN) ptag= ;; + esac + if [ -n "$ptag" ]; then + # Rust runtime: the property file is left in the cwd. + tag="$ptag" + line="$(sed -nE 's/^Line: *//p' "$work/map2check_property" | head -1)"; line="${line:--}" + func="$(sed -nE 's/^Function: *//p' "$work/map2check_property" | head -1)"; func="${func:--}" + elif [ -f "$work/map2check_property_memtrack" ]; then + # Same precedence as the frontend (modules/frontend/utils/tools.cpp:198-207): + # map2check_property_memtrack is checked before map2check_property_memcleanup. + tag=FALSE-MEMTRACK + elif [ -f "$work/map2check_property_memcleanup" ]; then + tag=FALSE-MEMCLEANUP + else + # C runtime: the property file lives in a scratch dir that is deleted, so + # parse stdout (modules/frontend/counter_example/counter_example.hpp:115-170): + # Violated property: + # file map2check_property line N function F (absent for MEMTRACK/MEMCLEANUP) + # FALSE-DEREF: Reference to pointer was lost | FALSE-FREE: ... | OVERFLOW | + # FALSE: Target Reached | FALSE-ASSERT | FALSE-MEMTRACK | FALSE-MEMCLEANUP | + # FALSE-DIVBYZERO (lines 152-157) + clean="$(sed -E 's/\x1b\[[0-9;]*m//g' "$work/out.txt")" + viol="$(printf '%s\n' "$clean" | sed -n '/^Violated property:/,/^VERIFICATION/p')" + loc="$(printf '%s\n' "$viol" | sed -nE 's/^[[:space:]]*file .* line ([0-9]+) function (.*)$/\1 \2/p' | head -1)" + [ -n "$loc" ] && { line="${loc%% *}"; func="${loc#* }"; func="${func:--}"; } + case "$viol" in + *FALSE-DEREF*) tag=FALSE-DEREF ;; + *FALSE-FREE*) tag=FALSE-FREE ;; + *FALSE-MEMTRACK*) tag=FALSE-MEMTRACK ;; + *FALSE-MEMCLEANUP*) tag=FALSE-MEMCLEANUP ;; + *FALSE-DIVBYZERO*) tag=FALSE-DIVBYZERO ;; + *FALSE-ASSERT*) tag=ASSERT ;; + *"FALSE: Target Reached"*) tag=TARGET-REACHED ;; + *OVERFLOW*) tag=OVERFLOW ;; + *) tag=UNMAPPED + raw="$(printf '%s' "$viol" | tr '\n\t' ' ')" + echo "run-corpus: UNMAPPED property for ${yml#"$CASES"/} ($prp, $gen): $raw" >&2 ;; + esac + fi + fi + witness=0; ls "$work"/*.graphml "$work"/map2check_checked_error >/dev/null 2>&1 && witness=1 + grep -qE 'Generating witness|\.graphml' "$work/out.txt" && witness=1 + timing="$(tail -1 "$work/time.txt" 2>/dev/null || true)" + case "$timing" in *$'\t'*) ;; *) timing=$'-\t-' ;; esac + printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \ + "${yml#"$CASES"/}" "$prp" "$gen" "$rep" "$verdict" "$tag" "$line" "$func" "$witness" "$timing" >> "$OUT" + rm -rf "$work" + done + done + done < <(sed -nE 's#.*property_file: *.*/([a-z-]+)\.prp.*#\1#p' "$yml") +done < <(find "$CASES" -name '*.yml' | sort) diff --git a/scripts/cutover/test-run-corpus.sh b/scripts/cutover/test-run-corpus.sh new file mode 100755 index 000000000..f21f1ff16 --- /dev/null +++ b/scripts/cutover/test-run-corpus.sh @@ -0,0 +1,143 @@ +#!/usr/bin/env bash +# Testa run-corpus.sh com um binário falso e um corpus de uma tarefa. +# Os fixtures *-synthetic.txt espelham o formato exato impresso por +# modules/frontend/counter_example/counter_example.hpp: FALSE-FREE (l.115-123), +# TARGET-REACHED (l.124-133), OVERFLOW (l.143-150), FALSE-DIVBYZERO (l.152-159), +# FALSE-MEMTRACK/MEMCLEANUP (l.160-171, sem linha "file ... line ... function"), +# ASSERT (l.172-181). c-unmapped inventa uma tag desconhecida. c-failed/c-succeeded +# sao stdout capturado de uma execucao real do runtime C. +set -euo pipefail +HERE="$(cd "$(dirname "$0")" && pwd)" +T="$(mktemp -d)"; trap 'rm -rf "$T"' EXIT +mkdir -p "$T/bin" "$T/cases/x" +cat > "$T/bin/map2check" <<'EOS' +#!/usr/bin/env bash +printf 'FALSE-DEREF\nLine: 7\nFunction: main\n' > map2check_property +echo "VERIFICATION FAILED" +EOS +chmod +x "$T/bin/map2check" +printf 'int main(){}\n' > "$T/cases/x/a.c" +cat > "$T/cases/x/a.yml" <<'EOS' +format_version: '1.0' +input_files: 'a.c' +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false +EOS +CASES="$T/cases" GENS=afl REPS=1 "$HERE/run-corpus.sh" "$T/bin" "$T/out.tsv" +row="$(sed -n 2p "$T/out.tsv")" +IFS=$'\t' read -r task prp gen rep verdict tag line func witness wall rss <<<"$row" +[ "$task" = "x/a.yml" ] && [ "$prp" = "valid-memsafety" ] && [ "$gen" = afl ] \ + && [ "$verdict" = FAILED ] && [ "$tag" = FALSE-DEREF ] && [ "$line" = 7 ] \ + && [ "$func" = main ] && [ "$witness" = 0 ] || { echo "linha inesperada: $row" >&2; exit 1; } + + +FIX="$HERE/fixtures" +mkdir -p "$T/cbin" +cat > "$T/cbin/map2check" <<'EOS' +#!/usr/bin/env bash +cat "$FIXTURE" +EOS +chmod +x "$T/cbin/map2check" +rm -f "$T/cases/x/a.yml" +cp "$T/cases/x/a.c" "$T/cases/x/b.c" +cat > "$T/cases/x/b.yml" <<'EOS' +format_version: '1.0' +input_files: 'b.c' +properties: + - property_file: ../properties/valid-memsafety.prp + expected_verdict: false +EOS + +# fixture | verdict | tag | line | function (caminho C: so stdout) +while IFS='|' read -r fx exp_verdict exp_tag exp_line exp_func; do + FIXTURE="$FIX/$fx" CASES="$T/cases" GENS=symex REPS=1 "$HERE/run-corpus.sh" "$T/cbin" "$T/c.tsv" 2>"$T/err" + row="$(sed -n 2p "$T/c.tsv")" + [ "$(awk -F'\t' '{print NF}' <<<"$row")" = 11 ] || { echo "colunas != 11: $row" >&2; exit 1; } + IFS=$'\t' read -r task prp gen rep verdict tag line func witness wall rss <<<"$row" + [ "$verdict" = "$exp_verdict" ] && [ "$tag" = "$exp_tag" ] && [ "$line" = "$exp_line" ] \ + && [ "$func" = "$exp_func" ] && [ "$witness" = 0 ] \ + || { echo "$fx inesperado: $verdict $tag $line $func $witness" >&2; exit 1; } + if [ "$exp_tag" = UNMAPPED ]; then grep -q 'UNMAPPED.*FALSE-SOMETHING-NEW' "$T/err" || { echo "sem aviso UNMAPPED" >&2; exit 1; }; fi +done <<'EOS' +c-failed-stdout.txt|FAILED|FALSE-DEREF|108|is_relaxed_prefix +c-succeeded-stdout.txt|SUCCEEDED|-|-|- +c-false-free-synthetic.txt|FAILED|FALSE-FREE|42|foo +c-false-memtrack-synthetic.txt|FAILED|FALSE-MEMTRACK|-|- +c-false-memcleanup-synthetic.txt|FAILED|FALSE-MEMCLEANUP|-|- +c-overflow-synthetic.txt|FAILED|OVERFLOW|42|foo +c-assert-synthetic.txt|FAILED|ASSERT|42|foo +c-target-reached-synthetic.txt|FAILED|TARGET-REACHED|42|foo +c-false-divbyzero-synthetic.txt|FAILED|FALSE-DIVBYZERO|42|foo +c-unmapped-synthetic.txt|FAILED|UNMAPPED|42|foo +EOS + +# Caminho Rust: arquivos de propriedade no cwd. spec: nome-do-arquivo|conteudo (\n) | tag | line | func +V="VERIFICATION FAILED" +mkrust() { # $1 = shell snippet que cria arquivos + cat > "$T/cbin/map2check" <&2; exit 1; } +} +V="VERIFICATION SUCCEEDED" +mkrust "printf 'NONE\n' > map2check_property" +check_rust "NONE em SUCCEEDED" SUCCEEDED - - - +V="VERIFICATION FAILED" +mkrust "printf 'FALSE-MEMTRACK\n' > map2check_property_memtrack" +check_rust "so memtrack" FAILED FALSE-MEMTRACK - - +mkrust "printf 'x\n' > map2check_property_memcleanup" +check_rust "so memcleanup" FAILED FALSE-MEMCLEANUP - - +cat > "$T/cbin/map2check" <<'EOS' +#!/usr/bin/env bash +printf 'OVERFLOW\nLine: 3\nFunction: f\n' > map2check_property +echo "VERIFICATION UNKNOWN" +EOS +check_rust "violacao com veredito UNKNOWN" UNKNOWN - - - + +# EXTRA_FLAGS e acrescentada as flags da propriedade (Task 4.3: --btree). +cat > "$T/cbin/map2check" < "$T/args" +echo "VERIFICATION UNKNOWN" +EOS +CASES="$T/cases" GENS=symex REPS=1 "$HERE/run-corpus.sh" "$T/cbin" "$T/x.tsv" +grep -q -- '--memtrack .*b.c$' "$T/args" && ! grep -q -- '--btree' "$T/args" \ + || { echo "sem EXTRA_FLAGS: args inesperados: $(cat "$T/args")" >&2; exit 1; } +EXTRA_FLAGS="--btree" CASES="$T/cases" GENS=symex REPS=1 "$HERE/run-corpus.sh" "$T/cbin" "$T/x.tsv" +grep -q -- '--memtrack --btree .*b.c$' "$T/args" \ + || { echo "EXTRA_FLAGS nao repassado: $(cat "$T/args")" >&2; exit 1; } + +# OOM_EVENTS: um oom_kill novo no cgroup durante a tarefa vira veredito OOM, +# a menos que a tarefa tenha decidido (SUCCEEDED/FAILED); nesse caso so avisa. +printf 'oom 0\noom_kill 0\n' > "$T/events" +cat > "$T/cbin/map2check" < "$T/events" +echo "VERIFICATION UNKNOWN" +EOS +OOM_EVENTS="$T/events" CASES="$T/cases" GENS=symex REPS=1 "$HERE/run-corpus.sh" "$T/cbin" "$T/o.tsv" +[ "$(cut -f5 <(sed -n 2p "$T/o.tsv"))" = OOM ] || { echo "OOM nao registrado: $(sed -n 2p "$T/o.tsv")" >&2; exit 1; } +cat > "$T/cbin/map2check" < "$T/events" +echo "VERIFICATION FAILED" +EOS +OOM_EVENTS="$T/events" CASES="$T/cases" GENS=symex REPS=1 "$HERE/run-corpus.sh" "$T/cbin" "$T/o.tsv" 2>"$T/err" +[ "$(cut -f5 <(sed -n 2p "$T/o.tsv"))" = FAILED ] && grep -q 'oom_kill' "$T/err" \ + || { echo "OOM com veredito decidido: $(sed -n 2p "$T/o.tsv")" >&2; exit 1; } +cat > "$T/cbin/map2check" <&2; exit 1; } + +echo ok diff --git a/scripts/cutover/test_compare.py b/scripts/cutover/test_compare.py new file mode 100644 index 000000000..5cba19c0a --- /dev/null +++ b/scripts/cutover/test_compare.py @@ -0,0 +1,41 @@ +# Testes do comparador do gate de cutover. +import subprocess, sys, textwrap, pathlib, tempfile + +HERE = pathlib.Path(__file__).parent +HDR = "task\tprp\tgen\trep\tverdict\ttag\tline\tfunction\twitness\twall_s\tmaxrss_kb\n" + +def run(c_rows, r_rows, accepted=""): + d = pathlib.Path(tempfile.mkdtemp()) + (d / "c.tsv").write_text(HDR + "".join(c_rows)) + (d / "r.tsv").write_text(HDR + "".join(r_rows)) + (d / "a.tsv").write_text("task\tprp\tgen\tfield\tc_value\trust_value\tsd_ref\n" + accepted) + return subprocess.run([sys.executable, HERE / "compare.py", d / "c.tsv", d / "r.tsv", + "--accepted", d / "a.tsv"], capture_output=True, text=True) + +ROW = "t.yml\tvalid-memsafety\tafl\t{rep}\t{v}\t{tag}\t7\tmain\t0\t{wall}\t1000\n" + +def rows(v="FAILED", tag="FALSE-DEREF", wall=1.0): + return [ROW.format(rep=i, v=v, tag=tag, wall=wall) for i in range(1, 6)] + +def test_identical_passes(): + assert run(rows(), rows()).returncode == 0 + +def test_verdict_change_blocks(): + p = run(rows(), rows(v="UNKNOWN", tag="-")) + assert p.returncode == 1 and "verdict" in p.stdout + +def test_accepted_delta_passes(): + acc = "t.yml\tvalid-memsafety\tafl\ttag\tFALSE-DEREF\tFALSE-FREE\tSD-06\n" + assert run(rows(), rows(tag="FALSE-FREE"), acc).returncode == 0 + +def test_slowdown_over_10_percent_blocks(): + p = run(rows(wall=1.0), rows(wall=1.2)) + assert p.returncode == 1 and "wall" in p.stdout + +def test_new_timeout_blocks(): + p = run(rows(), rows(v="TIMEOUT", tag="-")) + assert p.returncode == 1 and "TIMEOUT" in p.stdout + +def test_missing_task_blocks(): + p = run(rows(), []) + assert p.returncode == 1 and "missing" in p.stdout diff --git a/scripts/runtime/fetch-map2check-library.sh b/scripts/runtime/fetch-map2check-library.sh new file mode 100755 index 000000000..c75ace0b5 --- /dev/null +++ b/scripts/runtime/fetch-map2check-library.sh @@ -0,0 +1,37 @@ +#!/usr/bin/env bash +# Downloads the pinned map2check-library release (the Rust runtime Map2Check +# links), checks its SHA-256 and extracts it into DEST (default +# /opt/map2check-library): DEST/include/map2check.h and DEST/lib/*.a. +# Configure Map2Check with -DMAP2CHECK_RUST_LIB_DIR=DEST/lib. +# +# The pin lives here only; CI (.github/workflows/ci.yml) and Dockerfile.dev +# both call this script. +# +# Usage: scripts/runtime/fetch-map2check-library.sh [DEST] +set -euo pipefail + +M2C_LIB_VERSION="1.1.0-rc1" +M2C_LIB_TARGET="x86_64-unknown-linux-gnu" +M2C_LIB_SHA256="dd90e8885288a0de03d4d2b8624b6cb4a8ebee9f53ed9adcbf42501910209666" +M2C_LIB_NAME="map2check-library-${M2C_LIB_VERSION}-${M2C_LIB_TARGET}" +M2C_LIB_URL="https://github.com/hbgit/map2check-library/releases/download/v${M2C_LIB_VERSION}/${M2C_LIB_NAME}.tar.gz" + +dest="${1:-/opt/map2check-library}" +die() { echo "fetch-map2check-library: $*" >&2; exit 1; } + +work="$(mktemp -d)" +trap 'rm -rf "$work"' EXIT +archive="$work/${M2C_LIB_NAME}.tar.gz" + +wget -q "$M2C_LIB_URL" -O "$archive" || die "download failed: $M2C_LIB_URL" +echo "${M2C_LIB_SHA256} ${archive}" | sha256sum -c --quiet - || + die "SHA-256 mismatch for ${M2C_LIB_NAME}.tar.gz" + +mkdir -p "$dest" +tar xzf "$archive" -C "$dest" --strip-components=1 --no-same-owner +for f in include/map2check.h lib/libmap2check_runtime.a; do + [ -f "$dest/$f" ] || die "$dest/$f missing after extraction" +done +grep -qxF "#define MAP2CHECK_VERSION \"${M2C_LIB_VERSION}\"" "$dest/include/map2check.h" || + die "$dest/include/map2check.h is not version ${M2C_LIB_VERSION}" +echo "fetch-map2check-library: ${M2C_LIB_NAME} -> $dest" diff --git a/scripts/runtime/map2check-klee-bc.sh b/scripts/runtime/map2check-klee-bc.sh new file mode 100755 index 000000000..9411ef4fd --- /dev/null +++ b/scripts/runtime/map2check-klee-bc.sh @@ -0,0 +1,29 @@ +#!/usr/bin/env bash +# Builds the KLEE (symex) runtime bitcode of the pinned map2check-library +# release, which the release archive does not ship: a checkout of the tag, +# verified against its commit, then the library's own +# scripts/build-klee-runtime.sh. Configure Map2Check with +# -DMAP2CHECK_RUST_KLEE_BC=. +# +# Needs rustup with the 1.72.1 toolchain installed (its LLVM is 16), the LLVM +# 16 tools (opt-16, llvm-dis-16, llvm-nm-16, llvm-as-16, lli-16), python3, git. +# +# Usage: scripts/runtime/map2check-klee-bc.sh +set -euo pipefail + +M2C_LIB_TAG="v1.1.0-rc1" +M2C_LIB_COMMIT="49a25e40fe8b52932db1f0adfdfa896bac65fb5c" +M2C_LIB_REPO="https://github.com/hbgit/map2check-library.git" + +die() { echo "map2check-klee-bc: $*" >&2; exit 1; } +[ $# -eq 1 ] || die "usage: $0 " +out="$(realpath -m "$1")" + +work="$(mktemp -d)" +trap 'rm -rf "$work"' EXIT +git -c advice.detachedHead=false clone -q --depth 1 --branch "$M2C_LIB_TAG" "$M2C_LIB_REPO" "$work/src" +got="$(git -C "$work/src" rev-parse HEAD)" +[ "$got" = "$M2C_LIB_COMMIT" ] || die "$M2C_LIB_TAG is $got, expected $M2C_LIB_COMMIT" + +mkdir -p "$(dirname "$out")" +CARGO_TARGET_DIR="$work/target" "$work/src/scripts/build-klee-runtime.sh" "$out" diff --git a/tests/cutover/README.md b/tests/cutover/README.md new file mode 100644 index 000000000..6df467e73 --- /dev/null +++ b/tests/cutover/README.md @@ -0,0 +1,52 @@ +# Cutover regression baseline (C runtime) + +Reference data for the Map2Check C -> Rust runtime cutover. Produced by +`scripts/cutover/run-corpus.sh`, consumed by the Rust comparison (Task 4.1). + +- Map2Check commit: `f01e8c3ee66a2d54d91805f87443eaa57b598414` +- Image: `map2check-dev:latest`, ID `sha256:adbb5ec2824d3c3387781c0b6d45ffe365313335bd702dc10a4ae56d097d2b9c` +- CPU: 12th Gen Intel(R) Core(TM) i7-12650H +- The image lacks `/usr/bin/time`; the container installs the `time` package + (`apt-get install -y time`) before the build. The runner needs it. +- Configure flags (as in CI): `-G Ninja -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm -DMAP2CHECK_DYNAMIC_LINK=ON -DCMAKE_INSTALL_PREFIX=/src/release`; + the installed tree needs `lib/klee/runtime` and `lib/clang` symlinks (CI does the same). +- `MAP2CHECK_PATH=/src/release` is exported for the wrapper. + +## Full baseline command + +```sh +docker run --rm -u root -v "$PWD":/src -w /src map2check-dev:latest bash -c ' + apt-get update -qq && apt-get install -y -qq time >/dev/null && + cmake -S . -B build -G Ninja -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm -DMAP2CHECK_DYNAMIC_LINK=ON -DCMAKE_INSTALL_PREFIX=/src/release && + cmake --build build && cmake --install build && + mkdir -p release/lib/klee && + ln -sfn /opt/klee/lib/klee/runtime release/lib/klee/runtime && + ln -sfn /usr/lib/llvm-16/lib/clang release/lib/clang && + GENS="afl symex" REPS=5 TIMEOUT=45 MAP2CHECK_PATH=/src/release \ + scripts/cutover/run-corpus.sh release tests/cutover/baseline-c.tsv' +``` + +Runner self-test: `bash scripts/cutover/test-run-corpus.sh`. + +## Notes on the C runtime (found in the smoke run) + +- The runner argument is `release` (the dir holding the `map2check` wrapper), not `release/bin`. +- Valid generators are `afl` and `symex` (no `fuzzer`). `afl` needs `/usr/local/bin/afl-clang-fast`, + absent from `map2check-dev:latest`; a rebuilt image (`map2check-dev:cutover-f01e8c3e`) adds AFL++. + With the old image only `GENS=symex` works (afl rows come out UNKNOWN in 0.08 s). +- The C pipeline deletes its scratch dir, so `map2check_property` is not left in cwd. The runner + derives tag/line/function from stdout (fixtures in `scripts/cutover/fixtures/`); FALSE-MEMTRACK + and FALSE-MEMCLEANUP carry no line/function (`-`). Witness is 1 only if `--generate-witness` + output is seen (the runner does not pass it). +- The runner passes `--timeout $TIMEOUT` to map2check (default is 0 = unlimited-ish and caused + premature "Forcing timeout" UNKNOWNs); the outer `timeout` is TIMEOUT+15. +- Smoke (symex, REPS=1, 41 rows): 13 FAILED, 8 SUCCEEDED, 20 UNKNOWN. + +## Baseline completa do runtime C (`baseline-c.tsv`) + +- Gerada em 2026-10-15 sobre `develop` `f01e8c3e` com `GENS="afl symex" REPS=5 TIMEOUT=45`. +- Imagem: `map2check-dev:cutover-f01e8c3e` (`sha256:0e5ba2669491ccf6e762d8c25af9218ffc71e53e769700fc435d21b8bf92280d`), reconstruída do `Dockerfile.dev` de `develop` (contém AFL++ 4.40c). Pacote `time` instalado em tempo de execução. Build em `build-afl/`, instalação em `release-afl/` (`MAP2CHECK_PATH=/src/release-afl`). +- 410 linhas (41 tarefas×propriedade × 2 geradores × 5 repetições), todas com 11 colunas. +- Vereditos: `afl` 55 FAILED / 150 UNKNOWN; `symex` 65 FAILED / 40 SUCCEEDED / 100 UNKNOWN. O AFL++ não prova TRUE: nenhum SUCCEEDED com `afl` é esperado. +- Tags: 40 FALSE-DEREF, 40 FALSE-FREE, 20 FALSE-MEMTRACK, 20 TARGET-REACHED; nenhuma UNMAPPED. +- Esta baseline é a referência de estado conhecido do C. O gate da Task 4.2 a regenera no merge-base da branch de migração. diff --git a/tests/cutover/baseline-c-btree.tsv b/tests/cutover/baseline-c-btree.tsv new file mode 100644 index 000000000..4103253bd --- /dev/null +++ b/tests/cutover/baseline-c-btree.tsv @@ -0,0 +1,181 @@ +task prp gen rep verdict tag line function witness wall_s maxrss_kb +array-examples/relax-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.66 94028 +array-examples/relax-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.67 94276 +array-examples/relax-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.68 94464 +array-examples/relax-1.yml valid-memsafety symex 1 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 5.05 151024 +array-examples/relax-1.yml valid-memsafety symex 2 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 4.86 151212 +array-examples/relax-1.yml valid-memsafety symex 3 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 4.81 151940 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.61 93844 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.63 93684 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.62 93980 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 1 FAILED FALSE-DEREF 522 main 0 0.88 135984 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 2 FAILED FALSE-DEREF 522 main 0 0.85 135988 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 3 FAILED FALSE-DEREF 522 main 0 0.83 136532 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.50 93584 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.51 94620 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.50 93748 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.48 137308 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.50 137420 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.51 136764 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.78 94032 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.87 94588 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.94 93712 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.90 137380 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.92 137456 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 2.14 137968 +array-memsafety/lis_unsafe.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.52 94760 +array-memsafety/lis_unsafe.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.50 94292 +array-memsafety/lis_unsafe.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.50 93944 +array-memsafety/lis_unsafe.yml valid-memsafety symex 1 SUCCEEDED - - - 0 3.42 140276 +array-memsafety/lis_unsafe.yml valid-memsafety symex 2 SUCCEEDED - - - 0 3.25 140644 +array-memsafety/lis_unsafe.yml valid-memsafety symex 3 SUCCEEDED - - - 0 3.56 140188 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.64 205516 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.61 340940 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.83 204952 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.18 129500 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.07 129940 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 0.69 129592 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 1 FAILED FALSE-FREE 46 main 0 0.62 94500 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 2 FAILED FALSE-FREE 46 main 0 0.62 94624 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 3 FAILED FALSE-FREE 46 main 0 0.62 94168 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 1 FAILED FALSE-FREE 46 main 0 0.74 129720 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 2 FAILED FALSE-FREE 46 main 0 0.76 129972 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 3 FAILED FALSE-FREE 46 main 0 0.76 129676 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.56 340864 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.72 341052 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.68 341320 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 0.70 128600 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 0.62 128484 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 0.64 128692 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.52 94096 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.48 93980 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.51 93792 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.38 131888 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.40 132316 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.38 132288 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.50 93932 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.51 93756 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.57 94168 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.38 135204 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.38 134652 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.37 134280 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 1 FAILED FALSE-MEMTRACK - - 0 0.76 95088 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 2 FAILED FALSE-MEMTRACK - - 0 0.76 96360 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 3 FAILED FALSE-MEMTRACK - - 0 0.74 96088 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 9.51 148912 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 9.39 151300 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 9.10 149928 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.67 504616 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.66 502504 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.66 505584 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 10.85 151868 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 10.90 151928 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 10.89 151496 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 1 FAILED FALSE-FREE 779 free_17 0 0.76 96048 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 2 FAILED FALSE-FREE 779 free_17 0 0.77 95884 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 3 FAILED FALSE-FREE 779 free_17 0 0.76 95688 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 11.28 153372 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 12.22 152352 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 11.87 154652 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.69 341200 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.86 564400 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.72 599088 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 9.61 149164 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 9.42 149596 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 9.55 149460 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.71 203072 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.74 203032 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.82 340976 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 1 SUCCEEDED - - - 0 0.69 127444 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 2 SUCCEEDED - - - 0 0.58 126740 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 3 SUCCEEDED - - - 0 0.58 127948 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 1 FAILED FALSE-DEREF 533 main 0 0.63 93344 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 2 FAILED FALSE-DEREF 533 main 0 0.63 93460 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 3 FAILED FALSE-DEREF 533 main 0 0.62 93272 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 1 FAILED FALSE-DEREF 533 main 0 1.34 136524 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 2 FAILED FALSE-DEREF 533 main 0 1.39 136252 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 3 FAILED FALSE-DEREF 533 main 0 1.41 137196 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.50 248396 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.53 93924 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.51 340760 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.49 136900 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.49 136604 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.50 136616 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 1 FAILED FALSE-FREE 536 main 0 0.67 93888 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 2 FAILED FALSE-FREE 536 main 0 0.67 93400 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 3 FAILED FALSE-FREE 536 main 0 0.63 93960 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 1 FAILED FALSE-FREE 536 main 0 1.56 136760 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 2 FAILED FALSE-FREE 536 main 0 1.37 136480 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 3 FAILED FALSE-FREE 536 main 0 1.35 136820 +list-ext-properties/list-ext.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.57 94800 +list-ext-properties/list-ext.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.57 94132 +list-ext-properties/list-ext.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.67 94232 +list-ext-properties/list-ext.yml valid-memsafety symex 1 UNKNOWN - - - 0 0.81 135896 +list-ext-properties/list-ext.yml valid-memsafety symex 2 UNKNOWN - - - 0 0.81 135764 +list-ext-properties/list-ext.yml valid-memsafety symex 3 UNKNOWN - - - 0 0.82 136324 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 1 FAILED FALSE-MEMTRACK - - 0 0.64 93480 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 2 FAILED FALSE-MEMTRACK - - 0 0.64 93636 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 3 FAILED FALSE-MEMTRACK - - 0 0.64 93128 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 1 FAILED FALSE-MEMTRACK - - 0 1.02 129200 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 2 FAILED FALSE-MEMTRACK - - 0 1.08 129368 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 3 FAILED FALSE-MEMTRACK - - 0 1.11 129284 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.71 340804 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.69 341112 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.69 341008 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 0.66 135388 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 0.67 134644 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 0.67 135916 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.48 93840 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.51 93668 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.50 93040 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 2.65 137392 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 2.81 138172 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 2.70 138684 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.50 93296 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.47 94548 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.49 94420 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.00 135380 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 2 SUCCEEDED - - - 0 0.99 136456 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.00 135480 +memsafety-ext/tree_stack.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.50 94676 +memsafety-ext/tree_stack.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.49 94200 +memsafety-ext/tree_stack.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.49 94740 +memsafety-ext/tree_stack.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.22 135996 +memsafety-ext/tree_stack.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.24 135948 +memsafety-ext/tree_stack.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.23 136464 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.51 94684 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.51 93604 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.50 93900 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 5.93 140388 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 5.83 140352 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 5.98 140724 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.53 94128 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.53 94312 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.59 94392 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 1 FAILED FALSE-DEREF 540 containsHead 0 16.53 149040 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 2 FAILED FALSE-DEREF 540 containsHead 0 15.06 149456 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 3 FAILED FALSE-DEREF 540 containsHead 0 14.90 148368 +memsafety/960521-1-1.yml valid-memsafety afl 1 FAILED FALSE-FREE 532 main 0 0.64 93124 +memsafety/960521-1-1.yml valid-memsafety afl 2 FAILED FALSE-FREE 532 main 0 0.62 93464 +memsafety/960521-1-1.yml valid-memsafety afl 3 FAILED FALSE-FREE 532 main 0 0.62 93376 +memsafety/960521-1-1.yml valid-memsafety symex 1 FAILED FALSE-FREE 532 main 0 3.00 129636 +memsafety/960521-1-1.yml valid-memsafety symex 2 FAILED FALSE-FREE 532 main 0 2.93 129792 +memsafety/960521-1-1.yml valid-memsafety symex 3 FAILED FALSE-FREE 532 main 0 3.00 129692 +memsafety/960521-1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.47 93436 +memsafety/960521-1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.50 93632 +memsafety/960521-1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.48 93812 +memsafety/960521-1-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.39 129252 +memsafety/960521-1-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.37 129408 +memsafety/960521-1-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.38 129236 +memsafety/960521-1-3.yml valid-memsafety afl 1 FAILED FALSE-DEREF 529 main 0 0.66 94096 +memsafety/960521-1-3.yml valid-memsafety afl 2 FAILED FALSE-DEREF 529 main 0 0.62 94524 +memsafety/960521-1-3.yml valid-memsafety afl 3 FAILED FALSE-DEREF 529 main 0 0.61 93488 +memsafety/960521-1-3.yml valid-memsafety symex 1 FAILED FALSE-DEREF 529 main 0 2.84 130380 +memsafety/960521-1-3.yml valid-memsafety symex 2 FAILED FALSE-DEREF 529 main 0 4.09 130472 +memsafety/960521-1-3.yml valid-memsafety symex 3 FAILED FALSE-DEREF 529 main 0 2.92 129756 +memsafety/test-0102-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.51 93460 +memsafety/test-0102-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.52 93852 +memsafety/test-0102-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.52 94020 +memsafety/test-0102-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 8.12 147332 +memsafety/test-0102-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 8.38 147724 +memsafety/test-0102-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 8.05 147192 diff --git a/tests/cutover/baseline-c-gate.tsv b/tests/cutover/baseline-c-gate.tsv new file mode 100644 index 000000000..4e3c4f213 --- /dev/null +++ b/tests/cutover/baseline-c-gate.tsv @@ -0,0 +1,411 @@ +task prp gen rep verdict tag line function witness wall_s maxrss_kb +array-examples/relax-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.62 93548 +array-examples/relax-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.60 92988 +array-examples/relax-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.62 94232 +array-examples/relax-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 0.63 93936 +array-examples/relax-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 0.61 94060 +array-examples/relax-1.yml valid-memsafety symex 1 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 8.87 178072 +array-examples/relax-1.yml valid-memsafety symex 2 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 8.49 178260 +array-examples/relax-1.yml valid-memsafety symex 3 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 8.81 169348 +array-examples/relax-1.yml valid-memsafety symex 4 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 8.77 178284 +array-examples/relax-1.yml valid-memsafety symex 5 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 8.65 170724 +array-examples/standard_sentinel-2.yml unreach-call afl 1 OOM - - - 0 9.35 91344 +array-examples/standard_sentinel-2.yml unreach-call afl 2 OOM - - - 0 9.56 3109896 +array-examples/standard_sentinel-2.yml unreach-call afl 3 OOM - - - 0 9.56 3110004 +array-examples/standard_sentinel-2.yml unreach-call afl 4 OOM - - - 0 9.54 3109884 +array-examples/standard_sentinel-2.yml unreach-call afl 5 OOM - - - 0 9.55 3109764 +array-examples/standard_sentinel-2.yml unreach-call symex 1 UNKNOWN - - - 0 31.49 182596 +array-examples/standard_sentinel-2.yml unreach-call symex 2 UNKNOWN - - - 0 31.39 174880 +array-examples/standard_sentinel-2.yml unreach-call symex 3 UNKNOWN - - - 0 31.39 163520 +array-examples/standard_sentinel-2.yml unreach-call symex 4 UNKNOWN - - - 0 31.39 168008 +array-examples/standard_sentinel-2.yml unreach-call symex 5 UNKNOWN - - - 0 31.40 174872 +array-examples/standard_two_index_04.yml unreach-call afl 1 OOM - - - 0 9.44 3109996 +array-examples/standard_two_index_04.yml unreach-call afl 2 OOM - - - 0 9.53 3110004 +array-examples/standard_two_index_04.yml unreach-call afl 3 OOM - - - 0 9.55 3109976 +array-examples/standard_two_index_04.yml unreach-call afl 4 OOM - - - 0 9.54 3109928 +array-examples/standard_two_index_04.yml unreach-call afl 5 OOM - - - 0 9.54 3109880 +array-examples/standard_two_index_04.yml unreach-call symex 1 UNKNOWN - - - 0 31.49 163392 +array-examples/standard_two_index_04.yml unreach-call symex 2 UNKNOWN - - - 0 31.41 163480 +array-examples/standard_two_index_04.yml unreach-call symex 3 UNKNOWN - - - 0 31.43 163496 +array-examples/standard_two_index_04.yml unreach-call symex 4 UNKNOWN - - - 0 31.40 157648 +array-examples/standard_two_index_04.yml unreach-call symex 5 UNKNOWN - - - 0 31.38 163392 +array-examples/standard_two_index_05.yml unreach-call afl 1 OOM - - - 0 9.44 3109820 +array-examples/standard_two_index_05.yml unreach-call afl 2 OOM - - - 0 9.46 3109924 +array-examples/standard_two_index_05.yml unreach-call afl 3 OOM - - - 0 9.53 3110076 +array-examples/standard_two_index_05.yml unreach-call afl 4 OOM - - - 0 9.54 3109740 +array-examples/standard_two_index_05.yml unreach-call afl 5 OOM - - - 0 9.54 3110184 +array-examples/standard_two_index_05.yml unreach-call symex 1 UNKNOWN - - - 0 31.48 160664 +array-examples/standard_two_index_05.yml unreach-call symex 2 UNKNOWN - - - 0 31.40 164436 +array-examples/standard_two_index_05.yml unreach-call symex 3 UNKNOWN - - - 0 31.40 166168 +array-examples/standard_two_index_05.yml unreach-call symex 4 UNKNOWN - - - 0 31.39 162624 +array-examples/standard_two_index_05.yml unreach-call symex 5 UNKNOWN - - - 0 31.42 164244 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.60 92676 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.60 93308 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.60 92832 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 4 UNKNOWN - - - 0 0.58 93116 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 5 UNKNOWN - - - 0 0.59 92940 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 1 FAILED FALSE-DEREF 522 main 0 5.64 169036 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 2 FAILED FALSE-DEREF 522 main 0 5.68 168620 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 3 FAILED FALSE-DEREF 522 main 0 5.55 169224 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 4 FAILED FALSE-DEREF 522 main 0 5.49 169676 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 5 FAILED FALSE-DEREF 522 main 0 5.41 169376 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.48 92872 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.46 93412 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.45 93192 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.45 93032 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.44 92816 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.47 168720 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.44 169248 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.49 168676 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.47 168748 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.62 168560 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.92 94012 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.84 93680 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.84 93892 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 0.83 93100 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.37 92724 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.63 143584 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.64 143772 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.76 143736 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.72 143520 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.65 144156 +array-memsafety/lis_unsafe.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.55 93252 +array-memsafety/lis_unsafe.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.52 93384 +array-memsafety/lis_unsafe.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.53 93256 +array-memsafety/lis_unsafe.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.57 94140 +array-memsafety/lis_unsafe.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.56 93180 +array-memsafety/lis_unsafe.yml valid-memsafety symex 1 UNKNOWN - - - 0 4.78 169964 +array-memsafety/lis_unsafe.yml valid-memsafety symex 2 UNKNOWN - - - 0 4.57 169788 +array-memsafety/lis_unsafe.yml valid-memsafety symex 3 UNKNOWN - - - 0 4.45 169968 +array-memsafety/lis_unsafe.yml valid-memsafety symex 4 UNKNOWN - - - 0 4.43 166412 +array-memsafety/lis_unsafe.yml valid-memsafety symex 5 UNKNOWN - - - 0 4.34 170164 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.45 93744 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.43 93532 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.42 93928 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.42 93724 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.44 341056 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 0.42 127512 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 0.41 127272 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 0.41 127776 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 0.44 127632 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 0.42 126844 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 1 FAILED FALSE-FREE 46 main 0 0.58 93868 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 2 FAILED FALSE-FREE 46 main 0 0.57 93488 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 3 FAILED FALSE-FREE 46 main 0 0.57 93664 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 4 FAILED FALSE-FREE 46 main 0 0.59 93752 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 5 FAILED FALSE-FREE 46 main 0 0.58 93656 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 1 FAILED FALSE-FREE 46 main 0 0.47 127672 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 2 FAILED FALSE-FREE 46 main 0 0.44 128036 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 3 FAILED FALSE-FREE 46 main 0 0.47 127452 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 4 FAILED FALSE-FREE 46 main 0 0.46 127384 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 5 FAILED FALSE-FREE 46 main 0 0.48 128080 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.43 92840 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.42 93808 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.43 93476 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.44 341052 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.44 341016 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 0.35 127312 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 0.35 127892 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 0.35 127328 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 0.35 127556 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 0.34 126884 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.44 93088 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.44 93716 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.43 93344 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.43 93356 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.43 93260 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.34 128060 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.35 127760 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.35 127536 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.37 127364 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.34 127404 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.46 94016 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.45 93452 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.46 93644 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.45 93068 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.50 93196 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.35 128688 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.36 128228 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.36 128928 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.36 127920 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.35 127980 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 1 FAILED FALSE-MEMTRACK - - 0 0.95 94860 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 2 FAILED FALSE-MEMTRACK - - 0 0.87 94400 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 3 FAILED FALSE-MEMTRACK - - 0 0.87 94524 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 4 FAILED FALSE-MEMTRACK - - 0 0.92 95508 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 5 FAILED FALSE-MEMTRACK - - 0 0.91 95392 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 1 FAILED FALSE-MEMTRACK - - 0 9.42 167880 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 2 FAILED FALSE-MEMTRACK - - 0 8.68 176792 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 3 FAILED FALSE-MEMTRACK - - 0 8.55 168092 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 4 FAILED FALSE-MEMTRACK - - 0 8.67 170500 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 5 FAILED FALSE-MEMTRACK - - 0 8.74 170592 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.68 570412 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.63 569388 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.67 572588 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.66 341176 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.59 570660 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 14.30 140600 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 14.28 140612 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 13.96 141028 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 13.85 140792 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 13.57 140380 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 1 FAILED FALSE-FREE 779 free_17 0 0.71 95220 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 2 FAILED FALSE-FREE 779 free_17 0 0.70 95932 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 3 FAILED FALSE-FREE 779 free_17 0 0.71 94852 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 4 FAILED FALSE-FREE 779 free_17 0 0.72 95148 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 5 FAILED FALSE-FREE 779 free_17 0 0.72 94740 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 1 FAILED FALSE-FREE 779 free_17 0 28.40 181260 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 2 FAILED FALSE-FREE 779 free_17 0 27.83 180924 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 3 FAILED FALSE-FREE 779 free_17 0 27.21 180948 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 4 FAILED FALSE-FREE 779 free_17 0 27.67 181244 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 5 FAILED FALSE-FREE 779 free_17 0 28.56 181132 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.58 465496 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.56 465576 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.55 341196 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.56 465496 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.58 465320 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 4.55 139080 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 4.31 138276 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 4.56 138640 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 4.48 138520 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 4.53 138472 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.41 92696 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.41 92780 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.41 92696 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.48 341116 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.41 92896 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 1 SUCCEEDED - - - 0 0.37 126964 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 2 SUCCEEDED - - - 0 0.37 127436 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 3 SUCCEEDED - - - 0 0.37 127304 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 4 SUCCEEDED - - - 0 0.36 126988 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 5 SUCCEEDED - - - 0 0.36 127132 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 1 FAILED FALSE-DEREF 533 main 0 0.56 93000 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 2 FAILED FALSE-DEREF 533 main 0 0.57 93860 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 3 FAILED FALSE-DEREF 533 main 0 0.58 93136 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 4 FAILED FALSE-DEREF 533 main 0 0.59 93180 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 5 FAILED FALSE-DEREF 533 main 0 0.57 93152 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 1 FAILED FALSE-DEREF 0 - 0 1.59 136344 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 2 FAILED FALSE-DEREF 0 - 0 1.55 135884 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 3 FAILED FALSE-DEREF 0 - 0 1.51 136556 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 4 FAILED FALSE-DEREF 0 - 0 1.63 136048 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 5 FAILED FALSE-DEREF 0 - 0 1.59 136300 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.48 341372 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.47 341216 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.47 341308 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.44 341328 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.68 341328 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 14.25 136880 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 14.97 138908 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 14.65 136620 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 14.75 136404 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 14.70 136312 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 1 FAILED FALSE-FREE 536 main 0 0.58 92968 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 2 FAILED FALSE-FREE 536 main 0 0.56 93076 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 3 FAILED FALSE-FREE 536 main 0 0.57 93128 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 4 FAILED FALSE-FREE 536 main 0 0.58 93068 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 5 FAILED FALSE-FREE 536 main 0 0.56 93504 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 1 FAILED FALSE-FREE 536 main 0 1.73 136572 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 2 FAILED FALSE-FREE 536 main 0 1.65 136576 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 3 FAILED FALSE-FREE 536 main 0 1.63 136340 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 4 FAILED FALSE-FREE 536 main 0 1.71 136036 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 5 FAILED FALSE-FREE 536 main 0 1.82 136576 +list-ext-properties/list-ext.yml unreach-call afl 1 UNKNOWN - - - 0 0.50 92148 +list-ext-properties/list-ext.yml unreach-call afl 2 UNKNOWN - - - 0 0.51 92508 +list-ext-properties/list-ext.yml unreach-call afl 3 UNKNOWN - - - 0 0.48 92380 +list-ext-properties/list-ext.yml unreach-call afl 4 UNKNOWN - - - 0 0.48 91896 +list-ext-properties/list-ext.yml unreach-call afl 5 UNKNOWN - - - 0 0.50 92408 +list-ext-properties/list-ext.yml unreach-call symex 1 FAILED TARGET-REACHED 556 main 0 4.53 172304 +list-ext-properties/list-ext.yml unreach-call symex 2 FAILED TARGET-REACHED 556 main 0 3.76 172588 +list-ext-properties/list-ext.yml unreach-call symex 3 FAILED TARGET-REACHED 556 main 0 3.77 172072 +list-ext-properties/list-ext.yml unreach-call symex 4 FAILED TARGET-REACHED 556 main 0 3.81 174084 +list-ext-properties/list-ext.yml unreach-call symex 5 FAILED TARGET-REACHED 556 main 0 3.77 172032 +list-ext-properties/list-ext.yml valid-memsafety afl 1 FAILED FALSE-DEREF 558 main 0 0.59 93608 +list-ext-properties/list-ext.yml valid-memsafety afl 2 FAILED FALSE-DEREF 558 main 0 0.58 93068 +list-ext-properties/list-ext.yml valid-memsafety afl 3 FAILED FALSE-DEREF 558 main 0 0.71 93512 +list-ext-properties/list-ext.yml valid-memsafety afl 4 FAILED FALSE-DEREF 558 main 0 0.64 93300 +list-ext-properties/list-ext.yml valid-memsafety afl 5 FAILED FALSE-DEREF 558 main 0 0.58 93676 +list-ext-properties/list-ext.yml valid-memsafety symex 1 FAILED FALSE-DEREF 558 main 0 32.08 234924 +list-ext-properties/list-ext.yml valid-memsafety symex 2 FAILED FALSE-DEREF 558 main 0 32.18 233880 +list-ext-properties/list-ext.yml valid-memsafety symex 3 FAILED FALSE-DEREF 558 main 0 32.18 232444 +list-ext-properties/list-ext.yml valid-memsafety symex 4 FAILED FALSE-DEREF 558 main 0 32.02 231460 +list-ext-properties/list-ext.yml valid-memsafety symex 5 FAILED FALSE-DEREF 558 main 0 32.27 244472 +list-ext-properties/simple-ext.yml unreach-call afl 1 FAILED TARGET-REACHED 540 main 0 0.50 91776 +list-ext-properties/simple-ext.yml unreach-call afl 2 FAILED TARGET-REACHED 540 main 0 0.48 91888 +list-ext-properties/simple-ext.yml unreach-call afl 3 FAILED TARGET-REACHED 540 main 0 0.51 92072 +list-ext-properties/simple-ext.yml unreach-call afl 4 FAILED TARGET-REACHED 540 main 0 0.48 92312 +list-ext-properties/simple-ext.yml unreach-call afl 5 FAILED TARGET-REACHED 540 main 0 0.50 91540 +list-ext-properties/simple-ext.yml unreach-call symex 1 UNKNOWN - - - 0 0.45 133940 +list-ext-properties/simple-ext.yml unreach-call symex 2 UNKNOWN - - - 0 0.43 133936 +list-ext-properties/simple-ext.yml unreach-call symex 3 UNKNOWN - - - 0 0.45 133724 +list-ext-properties/simple-ext.yml unreach-call symex 4 UNKNOWN - - - 0 0.43 133532 +list-ext-properties/simple-ext.yml unreach-call symex 5 UNKNOWN - - - 0 0.45 133944 +list-ext-properties/simple-ext.yml valid-memcleanup afl 1 UNKNOWN - - - 0 9.46 567880 +list-ext-properties/simple-ext.yml valid-memcleanup afl 2 UNKNOWN - - - 0 9.45 580424 +list-ext-properties/simple-ext.yml valid-memcleanup afl 3 UNKNOWN - - - 0 9.44 593312 +list-ext-properties/simple-ext.yml valid-memcleanup afl 4 UNKNOWN - - - 0 9.45 575988 +list-ext-properties/simple-ext.yml valid-memcleanup afl 5 UNKNOWN - - - 0 9.45 586696 +list-ext-properties/simple-ext.yml valid-memcleanup symex 1 UNKNOWN - - - 0 0.95 134444 +list-ext-properties/simple-ext.yml valid-memcleanup symex 2 UNKNOWN - - - 0 0.96 135020 +list-ext-properties/simple-ext.yml valid-memcleanup symex 3 UNKNOWN - - - 0 0.96 135228 +list-ext-properties/simple-ext.yml valid-memcleanup symex 4 UNKNOWN - - - 0 0.99 134464 +list-ext-properties/simple-ext.yml valid-memcleanup symex 5 UNKNOWN - - - 0 0.94 134464 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 1 FAILED FALSE-MEMTRACK - - 0 0.57 92828 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 2 FAILED FALSE-MEMTRACK - - 0 0.58 93632 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 3 FAILED FALSE-MEMTRACK - - 0 0.58 93616 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 4 FAILED FALSE-MEMTRACK - - 0 0.57 93104 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 5 FAILED FALSE-MEMTRACK - - 0 0.57 92768 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 1 FAILED FALSE-MEMTRACK - - 0 0.59 127540 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 2 FAILED FALSE-MEMTRACK - - 0 0.62 128328 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 3 FAILED FALSE-MEMTRACK - - 0 0.59 129504 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 4 FAILED FALSE-MEMTRACK - - 0 0.59 127956 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 5 FAILED FALSE-MEMTRACK - - 0 0.66 128052 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.43 341040 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.43 341380 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.44 341320 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.47 341076 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.45 341032 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 0.52 134400 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 0.51 134552 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 0.54 134032 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 0.51 134128 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 0.51 134140 +map2check-assert/array_bug.yml unreach-call afl 1 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.49 92272 +map2check-assert/array_bug.yml unreach-call afl 2 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.50 91232 +map2check-assert/array_bug.yml unreach-call afl 3 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.48 92044 +map2check-assert/array_bug.yml unreach-call afl 4 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.52 91372 +map2check-assert/array_bug.yml unreach-call afl 5 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.52 92252 +map2check-assert/array_bug.yml unreach-call symex 1 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 6.19 171440 +map2check-assert/array_bug.yml unreach-call symex 2 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 6.05 171064 +map2check-assert/array_bug.yml unreach-call symex 3 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 5.97 171144 +map2check-assert/array_bug.yml unreach-call symex 4 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 6.01 171492 +map2check-assert/array_bug.yml unreach-call symex 5 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 6.11 171352 +map2check-assert/byte_add_bug.yml unreach-call afl 1 UNKNOWN - - - 0 9.39 91788 +map2check-assert/byte_add_bug.yml unreach-call afl 2 UNKNOWN - - - 0 9.39 91748 +map2check-assert/byte_add_bug.yml unreach-call afl 3 UNKNOWN - - - 0 9.35 91968 +map2check-assert/byte_add_bug.yml unreach-call afl 4 UNKNOWN - - - 0 9.37 91752 +map2check-assert/byte_add_bug.yml unreach-call afl 5 UNKNOWN - - - 0 9.38 340704 +map2check-assert/byte_add_bug.yml unreach-call symex 1 SUCCEEDED - - - 0 0.36 126804 +map2check-assert/byte_add_bug.yml unreach-call symex 2 SUCCEEDED - - - 0 0.36 126812 +map2check-assert/byte_add_bug.yml unreach-call symex 3 SUCCEEDED - - - 0 0.35 127624 +map2check-assert/byte_add_bug.yml unreach-call symex 4 SUCCEEDED - - - 0 0.35 127068 +map2check-assert/byte_add_bug.yml unreach-call symex 5 SUCCEEDED - - - 0 0.36 127192 +map2check-assert/check_if_bug.yml unreach-call afl 1 UNKNOWN - - - 0 0.36 91168 +map2check-assert/check_if_bug.yml unreach-call afl 2 UNKNOWN - - - 0 0.33 91472 +map2check-assert/check_if_bug.yml unreach-call afl 3 UNKNOWN - - - 0 0.32 91452 +map2check-assert/check_if_bug.yml unreach-call afl 4 UNKNOWN - - - 0 0.33 91644 +map2check-assert/check_if_bug.yml unreach-call afl 5 UNKNOWN - - - 0 0.33 91360 +map2check-assert/check_if_bug.yml unreach-call symex 1 UNKNOWN - - - 0 31.77 181296 +map2check-assert/check_if_bug.yml unreach-call symex 2 UNKNOWN - - - 0 31.96 184544 +map2check-assert/check_if_bug.yml unreach-call symex 3 UNKNOWN - - - 0 31.77 176252 +map2check-assert/check_if_bug.yml unreach-call symex 4 UNKNOWN - - - 0 31.82 183956 +map2check-assert/check_if_bug.yml unreach-call symex 5 UNKNOWN - - - 0 31.78 184676 +map2check-assert/ex01_false.yml unreach-call afl 1 UNKNOWN - - - 0 1.35 92272 +map2check-assert/ex01_false.yml unreach-call afl 2 UNKNOWN - - - 0 1.35 91732 +map2check-assert/ex01_false.yml unreach-call afl 3 UNKNOWN - - - 0 1.36 91424 +map2check-assert/ex01_false.yml unreach-call afl 4 UNKNOWN - - - 0 1.36 91524 +map2check-assert/ex01_false.yml unreach-call afl 5 UNKNOWN - - - 0 1.35 91592 +map2check-assert/ex01_false.yml unreach-call symex 1 UNKNOWN - - - 0 2.59 144384 +map2check-assert/ex01_false.yml unreach-call symex 2 UNKNOWN - - - 0 2.61 146564 +map2check-assert/ex01_false.yml unreach-call symex 3 UNKNOWN - - - 0 2.54 144484 +map2check-assert/ex01_false.yml unreach-call symex 4 UNKNOWN - - - 0 2.59 144560 +map2check-assert/ex01_false.yml unreach-call symex 5 UNKNOWN - - - 0 2.57 144128 +map2check-assert/ex02_false.yml unreach-call afl 1 UNKNOWN - - - 0 0.34 91200 +map2check-assert/ex02_false.yml unreach-call afl 2 UNKNOWN - - - 0 0.34 92040 +map2check-assert/ex02_false.yml unreach-call afl 3 UNKNOWN - - - 0 0.34 91332 +map2check-assert/ex02_false.yml unreach-call afl 4 UNKNOWN - - - 0 0.33 91180 +map2check-assert/ex02_false.yml unreach-call afl 5 UNKNOWN - - - 0 0.34 91116 +map2check-assert/ex02_false.yml unreach-call symex 1 UNKNOWN - - - 0 31.40 222104 +map2check-assert/ex02_false.yml unreach-call symex 2 UNKNOWN - - - 0 31.46 220824 +map2check-assert/ex02_false.yml unreach-call symex 3 UNKNOWN - - - 0 31.42 221684 +map2check-assert/ex02_false.yml unreach-call symex 4 UNKNOWN - - - 0 31.45 221196 +map2check-assert/ex02_false.yml unreach-call symex 5 UNKNOWN - - - 0 31.44 222768 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.44 93016 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.43 92684 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.43 93192 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.42 93548 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.43 93188 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.74 167996 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.80 168560 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.91 170172 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.74 170628 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.97 169884 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.45 92880 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.45 93792 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.44 93044 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.44 93152 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.45 92720 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.51 157036 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.58 152260 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.51 153648 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.52 152384 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.51 154968 +memsafety-ext/tree_stack.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.45 93480 +memsafety-ext/tree_stack.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.45 94104 +memsafety-ext/tree_stack.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.46 94228 +memsafety-ext/tree_stack.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.45 92956 +memsafety-ext/tree_stack.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.45 93456 +memsafety-ext/tree_stack.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.60 182152 +memsafety-ext/tree_stack.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.59 181736 +memsafety-ext/tree_stack.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.59 181988 +memsafety-ext/tree_stack.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.59 181960 +memsafety-ext/tree_stack.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.60 182208 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.44 93208 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.45 93032 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.45 93996 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.46 93336 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.46 93096 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.36 141436 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.36 141768 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.36 141688 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.37 143332 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.36 141344 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.48 93720 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.47 93476 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.49 93740 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.48 94368 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.47 93512 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 32.11 243392 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.94 242576 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.96 247204 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.91 242244 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.99 245372 +memsafety/960521-1-1.yml valid-memsafety afl 1 FAILED FALSE-FREE 532 main 0 0.56 92792 +memsafety/960521-1-1.yml valid-memsafety afl 2 FAILED FALSE-FREE 532 main 0 0.56 92784 +memsafety/960521-1-1.yml valid-memsafety afl 3 FAILED FALSE-FREE 532 main 0 0.56 93104 +memsafety/960521-1-1.yml valid-memsafety afl 4 FAILED FALSE-FREE 532 main 0 0.73 92756 +memsafety/960521-1-1.yml valid-memsafety afl 5 FAILED FALSE-FREE 532 main 0 0.59 93232 +memsafety/960521-1-1.yml valid-memsafety symex 1 FAILED FALSE-FREE 532 main 0 1.00 127900 +memsafety/960521-1-1.yml valid-memsafety symex 2 FAILED FALSE-FREE 532 main 0 0.99 127812 +memsafety/960521-1-1.yml valid-memsafety symex 3 FAILED FALSE-FREE 532 main 0 1.00 128020 +memsafety/960521-1-1.yml valid-memsafety symex 4 FAILED FALSE-FREE 532 main 0 1.01 127792 +memsafety/960521-1-1.yml valid-memsafety symex 5 FAILED FALSE-FREE 532 main 0 0.97 127936 +memsafety/960521-1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.43 92968 +memsafety/960521-1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.42 93708 +memsafety/960521-1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.42 93048 +memsafety/960521-1-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.42 93044 +memsafety/960521-1-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.43 92920 +memsafety/960521-1-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.34 127364 +memsafety/960521-1-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.35 127456 +memsafety/960521-1-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.35 127736 +memsafety/960521-1-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.35 127084 +memsafety/960521-1-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.35 127284 +memsafety/960521-1-3.yml valid-memsafety afl 1 FAILED FALSE-DEREF 529 main 0 0.58 92952 +memsafety/960521-1-3.yml valid-memsafety afl 2 FAILED FALSE-DEREF 529 main 0 0.60 93076 +memsafety/960521-1-3.yml valid-memsafety afl 3 FAILED FALSE-DEREF 529 main 0 0.60 93120 +memsafety/960521-1-3.yml valid-memsafety afl 4 FAILED FALSE-DEREF 529 main 0 0.60 93500 +memsafety/960521-1-3.yml valid-memsafety afl 5 FAILED FALSE-DEREF 529 main 0 0.57 93240 +memsafety/960521-1-3.yml valid-memsafety symex 1 FAILED FALSE-DEREF 529 main 0 0.99 127860 +memsafety/960521-1-3.yml valid-memsafety symex 2 FAILED FALSE-DEREF 529 main 0 0.98 128188 +memsafety/960521-1-3.yml valid-memsafety symex 3 FAILED FALSE-DEREF 529 main 0 0.95 127796 +memsafety/960521-1-3.yml valid-memsafety symex 4 FAILED FALSE-DEREF 529 main 0 1.00 127856 +memsafety/960521-1-3.yml valid-memsafety symex 5 FAILED FALSE-DEREF 529 main 0 0.97 128332 +memsafety/test-0102-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.47 94212 +memsafety/test-0102-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.48 94100 +memsafety/test-0102-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.48 93508 +memsafety/test-0102-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.47 93600 +memsafety/test-0102-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.48 94216 +memsafety/test-0102-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.38 149168 +memsafety/test-0102-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.43 149080 +memsafety/test-0102-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.38 150612 +memsafety/test-0102-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.44 149012 +memsafety/test-0102-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.40 150804 diff --git a/tests/cutover/baseline-c.tsv b/tests/cutover/baseline-c.tsv new file mode 100644 index 000000000..f4824abed --- /dev/null +++ b/tests/cutover/baseline-c.tsv @@ -0,0 +1,411 @@ +task prp gen rep verdict tag line function witness wall_s maxrss_kb +array-examples/relax-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.57 94004 +array-examples/relax-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.57 94396 +array-examples/relax-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.59 94712 +array-examples/relax-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 0.60 94272 +array-examples/relax-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 0.58 94384 +array-examples/relax-1.yml valid-memsafety symex 1 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 8.53 179192 +array-examples/relax-1.yml valid-memsafety symex 2 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 8.22 179916 +array-examples/relax-1.yml valid-memsafety symex 3 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 8.44 179808 +array-examples/relax-1.yml valid-memsafety symex 4 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 8.01 172368 +array-examples/relax-1.yml valid-memsafety symex 5 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 8.20 170552 +array-examples/standard_sentinel-2.yml unreach-call afl 1 UNKNOWN - - - 0 9.80 12826256 +array-examples/standard_sentinel-2.yml unreach-call afl 2 UNKNOWN - - - 0 10.03 12978816 +array-examples/standard_sentinel-2.yml unreach-call afl 3 UNKNOWN - - - 0 9.78 13267136 +array-examples/standard_sentinel-2.yml unreach-call afl 4 UNKNOWN - - - 0 9.78 12790856 +array-examples/standard_sentinel-2.yml unreach-call afl 5 UNKNOWN - - - 0 9.79 13080608 +array-examples/standard_sentinel-2.yml unreach-call symex 1 UNKNOWN - - - 0 31.40 161520 +array-examples/standard_sentinel-2.yml unreach-call symex 2 UNKNOWN - - - 0 31.38 162184 +array-examples/standard_sentinel-2.yml unreach-call symex 3 UNKNOWN - - - 0 31.39 161608 +array-examples/standard_sentinel-2.yml unreach-call symex 4 UNKNOWN - - - 0 31.38 166240 +array-examples/standard_sentinel-2.yml unreach-call symex 5 UNKNOWN - - - 0 31.39 165124 +array-examples/standard_two_index_04.yml unreach-call afl 1 UNKNOWN - - - 0 9.75 12787264 +array-examples/standard_two_index_04.yml unreach-call afl 2 UNKNOWN - - - 0 9.98 11925820 +array-examples/standard_two_index_04.yml unreach-call afl 3 UNKNOWN - - - 0 9.77 12409084 +array-examples/standard_two_index_04.yml unreach-call afl 4 UNKNOWN - - - 0 9.77 12805344 +array-examples/standard_two_index_04.yml unreach-call afl 5 UNKNOWN - - - 0 9.77 12787428 +array-examples/standard_two_index_04.yml unreach-call symex 1 UNKNOWN - - - 0 31.39 168068 +array-examples/standard_two_index_04.yml unreach-call symex 2 UNKNOWN - - - 0 31.37 171948 +array-examples/standard_two_index_04.yml unreach-call symex 3 UNKNOWN - - - 0 31.37 175372 +array-examples/standard_two_index_04.yml unreach-call symex 4 UNKNOWN - - - 0 31.38 176060 +array-examples/standard_two_index_04.yml unreach-call symex 5 UNKNOWN - - - 0 31.38 168992 +array-examples/standard_two_index_05.yml unreach-call afl 1 UNKNOWN - - - 0 9.77 12779032 +array-examples/standard_two_index_05.yml unreach-call afl 2 UNKNOWN - - - 0 9.76 12771116 +array-examples/standard_two_index_05.yml unreach-call afl 3 UNKNOWN - - - 0 9.77 12796900 +array-examples/standard_two_index_05.yml unreach-call afl 4 UNKNOWN - - - 0 9.78 12867308 +array-examples/standard_two_index_05.yml unreach-call afl 5 UNKNOWN - - - 0 9.77 12954076 +array-examples/standard_two_index_05.yml unreach-call symex 1 UNKNOWN - - - 0 31.39 168888 +array-examples/standard_two_index_05.yml unreach-call symex 2 UNKNOWN - - - 0 31.40 168636 +array-examples/standard_two_index_05.yml unreach-call symex 3 UNKNOWN - - - 0 31.39 171820 +array-examples/standard_two_index_05.yml unreach-call symex 4 UNKNOWN - - - 0 31.39 176112 +array-examples/standard_two_index_05.yml unreach-call symex 5 UNKNOWN - - - 0 31.38 168096 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.59 92856 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.56 93864 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.54 92584 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 4 UNKNOWN - - - 0 0.55 92540 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 5 UNKNOWN - - - 0 0.57 93932 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 1 FAILED FALSE-DEREF 522 main 0 5.28 169384 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 2 FAILED FALSE-DEREF 522 main 0 5.35 169064 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 3 FAILED FALSE-DEREF 522 main 0 5.51 168864 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 4 FAILED FALSE-DEREF 522 main 0 5.36 168600 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 5 FAILED FALSE-DEREF 522 main 0 5.33 169072 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.45 93052 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.44 93784 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.44 93208 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.47 93404 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.43 92916 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.44 169196 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.42 169288 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.43 168900 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.49 165840 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.43 169556 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.79 93804 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.83 93856 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.78 93156 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 0.79 93264 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 0.85 93260 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.49 144292 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.47 144372 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.43 144224 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.40 143940 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.42 143548 +array-memsafety/lis_unsafe.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.46 93948 +array-memsafety/lis_unsafe.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.45 93036 +array-memsafety/lis_unsafe.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.46 93236 +array-memsafety/lis_unsafe.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.44 94052 +array-memsafety/lis_unsafe.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.44 93228 +array-memsafety/lis_unsafe.yml valid-memsafety symex 1 UNKNOWN - - - 0 3.67 169700 +array-memsafety/lis_unsafe.yml valid-memsafety symex 2 UNKNOWN - - - 0 3.69 170300 +array-memsafety/lis_unsafe.yml valid-memsafety symex 3 UNKNOWN - - - 0 3.63 170284 +array-memsafety/lis_unsafe.yml valid-memsafety symex 4 UNKNOWN - - - 0 3.73 170240 +array-memsafety/lis_unsafe.yml valid-memsafety symex 5 UNKNOWN - - - 0 3.89 168000 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.42 93692 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.44 341132 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.44 341152 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.59 341424 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.42 92568 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 0.41 127480 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 0.41 127864 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 0.41 127168 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 0.40 127432 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 0.40 127176 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 1 FAILED FALSE-FREE 46 main 0 0.57 92848 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 2 FAILED FALSE-FREE 46 main 0 0.56 93204 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 3 FAILED FALSE-FREE 46 main 0 0.55 92796 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 4 FAILED FALSE-FREE 46 main 0 0.56 93632 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 5 FAILED FALSE-FREE 46 main 0 0.68 93140 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 1 FAILED FALSE-FREE 46 main 0 0.53 127676 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 2 FAILED FALSE-FREE 46 main 0 0.53 127828 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 3 FAILED FALSE-FREE 46 main 0 0.53 127884 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 4 FAILED FALSE-FREE 46 main 0 0.51 127700 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 5 FAILED FALSE-FREE 46 main 0 0.53 127476 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.51 341160 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.44 341312 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.43 93668 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.47 93072 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.42 92848 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 0.37 127508 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 0.36 129608 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 0.36 127476 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 0.36 127872 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 0.37 127548 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.44 92748 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.45 93244 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.42 93028 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.42 93460 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.45 93100 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.35 127436 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.33 127032 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.36 127992 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.37 127516 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.34 126720 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.44 94064 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.44 93100 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.44 94080 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.45 93048 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.44 93460 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.34 127740 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.34 127888 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.34 128356 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.36 128496 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.34 128376 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 1 FAILED FALSE-MEMTRACK - - 0 0.66 94836 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 2 FAILED FALSE-MEMTRACK - - 0 0.68 94456 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 3 FAILED FALSE-MEMTRACK - - 0 0.73 94516 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 4 FAILED FALSE-MEMTRACK - - 0 0.69 95040 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 5 FAILED FALSE-MEMTRACK - - 0 0.68 94740 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 1 FAILED FALSE-MEMTRACK - - 0 8.12 171120 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 2 FAILED FALSE-MEMTRACK - - 0 7.28 168388 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 3 FAILED FALSE-MEMTRACK - - 0 7.41 168304 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 4 FAILED FALSE-MEMTRACK - - 0 7.45 168448 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 5 FAILED FALSE-MEMTRACK - - 0 7.00 168256 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.56 570924 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.65 571496 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.63 571932 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.58 570600 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.59 572628 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 13.36 140468 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 13.35 140724 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 13.57 141216 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 13.82 140812 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 13.24 140676 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 1 FAILED FALSE-FREE 779 free_17 0 0.71 95436 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 2 FAILED FALSE-FREE 779 free_17 0 0.70 95232 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 3 FAILED FALSE-FREE 779 free_17 0 0.74 95472 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 4 FAILED FALSE-FREE 779 free_17 0 0.71 94984 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 5 FAILED FALSE-FREE 779 free_17 0 0.69 95228 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 1 FAILED FALSE-FREE 779 free_17 0 26.62 180200 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 2 FAILED FALSE-FREE 779 free_17 0 28.10 181016 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 3 FAILED FALSE-FREE 779 free_17 0 27.14 180724 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 4 FAILED FALSE-FREE 779 free_17 0 26.65 181324 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 5 FAILED FALSE-FREE 779 free_17 0 27.89 181108 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.56 340896 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.58 465440 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.70 341228 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.58 465540 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.57 465840 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 4.42 138084 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 4.70 138096 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 4.42 139128 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 4.28 139212 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 4.58 139044 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.43 93408 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.43 93464 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.47 340916 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.41 93568 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.41 92752 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 1 SUCCEEDED - - - 0 0.37 126488 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 2 SUCCEEDED - - - 0 0.37 126904 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 3 SUCCEEDED - - - 0 0.36 127108 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 4 SUCCEEDED - - - 0 0.37 127540 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 5 SUCCEEDED - - - 0 0.35 126540 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 1 FAILED FALSE-DEREF 533 main 0 0.70 93468 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 2 FAILED FALSE-DEREF 533 main 0 0.57 93176 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 3 FAILED FALSE-DEREF 533 main 0 0.60 92880 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 4 FAILED FALSE-DEREF 533 main 0 0.60 93632 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 5 FAILED FALSE-DEREF 533 main 0 0.58 92984 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 1 FAILED FALSE-DEREF 0 - 0 1.54 136564 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 2 FAILED FALSE-DEREF 0 - 0 1.49 136340 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 3 FAILED FALSE-DEREF 0 - 0 1.51 136440 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 4 FAILED FALSE-DEREF 0 - 0 1.58 136360 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 5 FAILED FALSE-DEREF 0 - 0 1.48 136184 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.46 341200 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.44 341168 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.44 341380 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.44 341248 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.46 340980 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 14.48 136556 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 14.02 136468 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 14.12 136716 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 15.23 136292 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 14.17 137000 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 1 FAILED FALSE-FREE 536 main 0 0.57 93084 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 2 FAILED FALSE-FREE 536 main 0 0.55 93056 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 3 FAILED FALSE-FREE 536 main 0 0.56 92520 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 4 FAILED FALSE-FREE 536 main 0 0.56 93148 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 5 FAILED FALSE-FREE 536 main 0 0.57 93088 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 1 FAILED FALSE-FREE 536 main 0 1.66 136548 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 2 FAILED FALSE-FREE 536 main 0 1.64 135704 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 3 FAILED FALSE-FREE 536 main 0 1.60 136668 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 4 FAILED FALSE-FREE 536 main 0 1.61 136748 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 5 FAILED FALSE-FREE 536 main 0 1.73 135512 +list-ext-properties/list-ext.yml unreach-call afl 1 UNKNOWN - - - 0 0.48 91848 +list-ext-properties/list-ext.yml unreach-call afl 2 UNKNOWN - - - 0 0.47 92220 +list-ext-properties/list-ext.yml unreach-call afl 3 UNKNOWN - - - 0 0.47 91684 +list-ext-properties/list-ext.yml unreach-call afl 4 UNKNOWN - - - 0 0.48 91976 +list-ext-properties/list-ext.yml unreach-call afl 5 UNKNOWN - - - 0 0.48 91908 +list-ext-properties/list-ext.yml unreach-call symex 1 FAILED TARGET-REACHED 556 main 0 3.58 172148 +list-ext-properties/list-ext.yml unreach-call symex 2 FAILED TARGET-REACHED 556 main 0 3.62 172764 +list-ext-properties/list-ext.yml unreach-call symex 3 FAILED TARGET-REACHED 556 main 0 3.63 172212 +list-ext-properties/list-ext.yml unreach-call symex 4 FAILED TARGET-REACHED 556 main 0 3.54 172144 +list-ext-properties/list-ext.yml unreach-call symex 5 FAILED TARGET-REACHED 556 main 0 3.53 172360 +list-ext-properties/list-ext.yml valid-memsafety afl 1 FAILED FALSE-DEREF 558 main 0 0.59 93112 +list-ext-properties/list-ext.yml valid-memsafety afl 2 FAILED FALSE-DEREF 558 main 0 0.57 93116 +list-ext-properties/list-ext.yml valid-memsafety afl 3 FAILED FALSE-DEREF 558 main 0 0.57 93760 +list-ext-properties/list-ext.yml valid-memsafety afl 4 FAILED FALSE-DEREF 558 main 0 0.58 93908 +list-ext-properties/list-ext.yml valid-memsafety afl 5 FAILED FALSE-DEREF 558 main 0 0.58 93492 +list-ext-properties/list-ext.yml valid-memsafety symex 1 FAILED FALSE-DEREF 558 main 0 32.19 248492 +list-ext-properties/list-ext.yml valid-memsafety symex 2 FAILED FALSE-DEREF 558 main 0 32.15 253512 +list-ext-properties/list-ext.yml valid-memsafety symex 3 FAILED FALSE-DEREF 558 main 0 32.21 257240 +list-ext-properties/list-ext.yml valid-memsafety symex 4 FAILED FALSE-DEREF 558 main 0 32.19 247784 +list-ext-properties/list-ext.yml valid-memsafety symex 5 FAILED FALSE-DEREF 558 main 0 32.06 247848 +list-ext-properties/simple-ext.yml unreach-call afl 1 FAILED TARGET-REACHED 540 main 0 0.48 92032 +list-ext-properties/simple-ext.yml unreach-call afl 2 FAILED TARGET-REACHED 540 main 0 0.46 92280 +list-ext-properties/simple-ext.yml unreach-call afl 3 FAILED TARGET-REACHED 540 main 0 0.48 92280 +list-ext-properties/simple-ext.yml unreach-call afl 4 FAILED TARGET-REACHED 540 main 0 0.48 92148 +list-ext-properties/simple-ext.yml unreach-call afl 5 FAILED TARGET-REACHED 540 main 0 0.49 91516 +list-ext-properties/simple-ext.yml unreach-call symex 1 UNKNOWN - - - 0 0.43 133616 +list-ext-properties/simple-ext.yml unreach-call symex 2 UNKNOWN - - - 0 0.43 135976 +list-ext-properties/simple-ext.yml unreach-call symex 3 UNKNOWN - - - 0 0.44 134264 +list-ext-properties/simple-ext.yml unreach-call symex 4 UNKNOWN - - - 0 0.43 133976 +list-ext-properties/simple-ext.yml unreach-call symex 5 UNKNOWN - - - 0 0.44 134048 +list-ext-properties/simple-ext.yml valid-memcleanup afl 1 UNKNOWN - - - 0 9.45 602568 +list-ext-properties/simple-ext.yml valid-memcleanup afl 2 UNKNOWN - - - 0 9.45 609512 +list-ext-properties/simple-ext.yml valid-memcleanup afl 3 UNKNOWN - - - 0 9.44 584136 +list-ext-properties/simple-ext.yml valid-memcleanup afl 4 UNKNOWN - - - 0 9.45 555328 +list-ext-properties/simple-ext.yml valid-memcleanup afl 5 UNKNOWN - - - 0 9.45 602592 +list-ext-properties/simple-ext.yml valid-memcleanup symex 1 UNKNOWN - - - 0 0.93 134628 +list-ext-properties/simple-ext.yml valid-memcleanup symex 2 UNKNOWN - - - 0 0.94 134548 +list-ext-properties/simple-ext.yml valid-memcleanup symex 3 UNKNOWN - - - 0 0.92 134228 +list-ext-properties/simple-ext.yml valid-memcleanup symex 4 UNKNOWN - - - 0 0.95 134752 +list-ext-properties/simple-ext.yml valid-memcleanup symex 5 UNKNOWN - - - 0 0.92 134360 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 1 FAILED FALSE-MEMTRACK - - 0 0.56 92956 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 2 FAILED FALSE-MEMTRACK - - 0 0.56 92944 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 3 FAILED FALSE-MEMTRACK - - 0 0.56 92864 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 4 FAILED FALSE-MEMTRACK - - 0 0.55 92792 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 5 FAILED FALSE-MEMTRACK - - 0 0.57 93696 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 1 FAILED FALSE-MEMTRACK - - 0 0.57 128788 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 2 FAILED FALSE-MEMTRACK - - 0 0.57 127680 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 3 FAILED FALSE-MEMTRACK - - 0 0.56 128020 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 4 FAILED FALSE-MEMTRACK - - 0 0.56 127724 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 5 FAILED FALSE-MEMTRACK - - 0 0.56 128276 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.44 341536 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.43 340528 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.43 341028 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.43 340948 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.43 341176 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 0.48 134520 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 0.48 134392 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 0.50 134208 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 0.47 134368 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 0.48 134124 +map2check-assert/array_bug.yml unreach-call afl 1 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.47 92012 +map2check-assert/array_bug.yml unreach-call afl 2 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.47 91464 +map2check-assert/array_bug.yml unreach-call afl 3 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.47 91748 +map2check-assert/array_bug.yml unreach-call afl 4 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.47 91336 +map2check-assert/array_bug.yml unreach-call afl 5 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.48 91960 +map2check-assert/array_bug.yml unreach-call symex 1 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 5.63 171504 +map2check-assert/array_bug.yml unreach-call symex 2 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 5.51 171348 +map2check-assert/array_bug.yml unreach-call symex 3 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 5.63 171480 +map2check-assert/array_bug.yml unreach-call symex 4 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 5.43 171368 +map2check-assert/array_bug.yml unreach-call symex 5 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 5.43 171484 +map2check-assert/byte_add_bug.yml unreach-call afl 1 UNKNOWN - - - 0 9.35 91956 +map2check-assert/byte_add_bug.yml unreach-call afl 2 UNKNOWN - - - 0 9.34 91800 +map2check-assert/byte_add_bug.yml unreach-call afl 3 UNKNOWN - - - 0 9.34 91740 +map2check-assert/byte_add_bug.yml unreach-call afl 4 UNKNOWN - - - 0 9.35 92316 +map2check-assert/byte_add_bug.yml unreach-call afl 5 UNKNOWN - - - 0 9.36 91548 +map2check-assert/byte_add_bug.yml unreach-call symex 1 SUCCEEDED - - - 0 0.34 126848 +map2check-assert/byte_add_bug.yml unreach-call symex 2 SUCCEEDED - - - 0 0.34 127120 +map2check-assert/byte_add_bug.yml unreach-call symex 3 SUCCEEDED - - - 0 0.34 127516 +map2check-assert/byte_add_bug.yml unreach-call symex 4 SUCCEEDED - - - 0 0.34 127096 +map2check-assert/byte_add_bug.yml unreach-call symex 5 SUCCEEDED - - - 0 0.34 127636 +map2check-assert/check_if_bug.yml unreach-call afl 1 UNKNOWN - - - 0 0.32 91884 +map2check-assert/check_if_bug.yml unreach-call afl 2 UNKNOWN - - - 0 0.32 92300 +map2check-assert/check_if_bug.yml unreach-call afl 3 UNKNOWN - - - 0 0.34 91540 +map2check-assert/check_if_bug.yml unreach-call afl 4 UNKNOWN - - - 0 0.34 91488 +map2check-assert/check_if_bug.yml unreach-call afl 5 UNKNOWN - - - 0 0.34 92312 +map2check-assert/check_if_bug.yml unreach-call symex 1 UNKNOWN - - - 0 31.76 184048 +map2check-assert/check_if_bug.yml unreach-call symex 2 UNKNOWN - - - 0 31.73 183980 +map2check-assert/check_if_bug.yml unreach-call symex 3 UNKNOWN - - - 0 31.69 184208 +map2check-assert/check_if_bug.yml unreach-call symex 4 UNKNOWN - - - 0 31.70 184808 +map2check-assert/check_if_bug.yml unreach-call symex 5 UNKNOWN - - - 0 32.05 183988 +map2check-assert/ex01_false.yml unreach-call afl 1 UNKNOWN - - - 0 1.34 91788 +map2check-assert/ex01_false.yml unreach-call afl 2 UNKNOWN - - - 0 1.34 91048 +map2check-assert/ex01_false.yml unreach-call afl 3 UNKNOWN - - - 0 1.35 91416 +map2check-assert/ex01_false.yml unreach-call afl 4 UNKNOWN - - - 0 1.34 91164 +map2check-assert/ex01_false.yml unreach-call afl 5 UNKNOWN - - - 0 1.34 92128 +map2check-assert/ex01_false.yml unreach-call symex 1 UNKNOWN - - - 0 2.34 144456 +map2check-assert/ex01_false.yml unreach-call symex 2 UNKNOWN - - - 0 2.34 143984 +map2check-assert/ex01_false.yml unreach-call symex 3 UNKNOWN - - - 0 2.35 146832 +map2check-assert/ex01_false.yml unreach-call symex 4 UNKNOWN - - - 0 2.33 144828 +map2check-assert/ex01_false.yml unreach-call symex 5 UNKNOWN - - - 0 2.34 144428 +map2check-assert/ex02_false.yml unreach-call afl 1 UNKNOWN - - - 0 0.32 91924 +map2check-assert/ex02_false.yml unreach-call afl 2 UNKNOWN - - - 0 0.33 91980 +map2check-assert/ex02_false.yml unreach-call afl 3 UNKNOWN - - - 0 0.32 90976 +map2check-assert/ex02_false.yml unreach-call afl 4 UNKNOWN - - - 0 0.32 91352 +map2check-assert/ex02_false.yml unreach-call afl 5 UNKNOWN - - - 0 0.34 91500 +map2check-assert/ex02_false.yml unreach-call symex 1 UNKNOWN - - - 0 31.43 226008 +map2check-assert/ex02_false.yml unreach-call symex 2 UNKNOWN - - - 0 31.40 225284 +map2check-assert/ex02_false.yml unreach-call symex 3 UNKNOWN - - - 0 31.42 226316 +map2check-assert/ex02_false.yml unreach-call symex 4 UNKNOWN - - - 0 31.45 225168 +map2check-assert/ex02_false.yml unreach-call symex 5 UNKNOWN - - - 0 31.41 225940 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.44 93208 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.43 93164 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.43 93076 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.44 93024 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.44 93992 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.86 170120 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.64 170640 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.74 170336 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.80 170444 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.82 170004 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.44 92720 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.43 92896 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.44 93140 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.43 93044 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.44 92716 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.44 158940 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.44 158588 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.45 158932 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.46 158628 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.45 159076 +memsafety-ext/tree_stack.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.45 93188 +memsafety-ext/tree_stack.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.44 93248 +memsafety-ext/tree_stack.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.44 92784 +memsafety-ext/tree_stack.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.45 93636 +memsafety-ext/tree_stack.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.46 93188 +memsafety-ext/tree_stack.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.59 185740 +memsafety-ext/tree_stack.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.60 185704 +memsafety-ext/tree_stack.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.59 185012 +memsafety-ext/tree_stack.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.60 185712 +memsafety-ext/tree_stack.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.59 185792 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.46 94004 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.45 94012 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.46 93436 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.44 93832 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.46 93128 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.36 141752 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.35 141352 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.35 141632 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.35 141724 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.35 143564 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.47 93820 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.47 93500 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.47 93620 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.47 93192 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.48 94340 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.94 252540 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.94 252424 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.95 252816 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.93 253012 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.94 252560 +memsafety/960521-1-1.yml valid-memsafety afl 1 FAILED FALSE-FREE 532 main 0 0.57 92852 +memsafety/960521-1-1.yml valid-memsafety afl 2 FAILED FALSE-FREE 532 main 0 0.58 93680 +memsafety/960521-1-1.yml valid-memsafety afl 3 FAILED FALSE-FREE 532 main 0 0.55 93092 +memsafety/960521-1-1.yml valid-memsafety afl 4 FAILED FALSE-FREE 532 main 0 0.55 93052 +memsafety/960521-1-1.yml valid-memsafety afl 5 FAILED FALSE-FREE 532 main 0 0.57 93996 +memsafety/960521-1-1.yml valid-memsafety symex 1 FAILED FALSE-FREE 532 main 0 0.93 128024 +memsafety/960521-1-1.yml valid-memsafety symex 2 FAILED FALSE-FREE 532 main 0 0.93 128048 +memsafety/960521-1-1.yml valid-memsafety symex 3 FAILED FALSE-FREE 532 main 0 0.93 127556 +memsafety/960521-1-1.yml valid-memsafety symex 4 FAILED FALSE-FREE 532 main 0 0.93 127876 +memsafety/960521-1-1.yml valid-memsafety symex 5 FAILED FALSE-FREE 532 main 0 0.95 127848 +memsafety/960521-1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.42 92840 +memsafety/960521-1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.43 93088 +memsafety/960521-1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.42 92696 +memsafety/960521-1-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.42 92924 +memsafety/960521-1-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.42 93016 +memsafety/960521-1-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.35 127700 +memsafety/960521-1-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.36 127884 +memsafety/960521-1-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.33 127240 +memsafety/960521-1-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.34 126888 +memsafety/960521-1-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.34 128212 +memsafety/960521-1-3.yml valid-memsafety afl 1 FAILED FALSE-DEREF 529 main 0 0.60 92724 +memsafety/960521-1-3.yml valid-memsafety afl 2 FAILED FALSE-DEREF 529 main 0 0.59 92932 +memsafety/960521-1-3.yml valid-memsafety afl 3 FAILED FALSE-DEREF 529 main 0 0.56 93140 +memsafety/960521-1-3.yml valid-memsafety afl 4 FAILED FALSE-DEREF 529 main 0 0.55 93088 +memsafety/960521-1-3.yml valid-memsafety afl 5 FAILED FALSE-DEREF 529 main 0 0.57 92612 +memsafety/960521-1-3.yml valid-memsafety symex 1 FAILED FALSE-DEREF 529 main 0 0.90 127524 +memsafety/960521-1-3.yml valid-memsafety symex 2 FAILED FALSE-DEREF 529 main 0 0.89 128592 +memsafety/960521-1-3.yml valid-memsafety symex 3 FAILED FALSE-DEREF 529 main 0 0.91 128252 +memsafety/960521-1-3.yml valid-memsafety symex 4 FAILED FALSE-DEREF 529 main 0 0.91 127236 +memsafety/960521-1-3.yml valid-memsafety symex 5 FAILED FALSE-DEREF 529 main 0 0.91 128108 +memsafety/test-0102-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.46 93192 +memsafety/test-0102-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.48 93720 +memsafety/test-0102-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.47 93556 +memsafety/test-0102-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.46 93712 +memsafety/test-0102-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.46 93240 +memsafety/test-0102-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 31.37 150448 +memsafety/test-0102-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 31.38 150584 +memsafety/test-0102-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 31.38 150436 +memsafety/test-0102-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 31.38 149240 +memsafety/test-0102-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 31.40 150276 diff --git a/tests/cutover/baseline-rust-gate2.tsv b/tests/cutover/baseline-rust-gate2.tsv new file mode 100644 index 000000000..5484a258e --- /dev/null +++ b/tests/cutover/baseline-rust-gate2.tsv @@ -0,0 +1,411 @@ +task prp gen rep verdict tag line function witness wall_s maxrss_kb +array-examples/relax-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.68 92488 +array-examples/relax-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.63 92600 +array-examples/relax-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.62 92300 +array-examples/relax-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 0.59 92060 +array-examples/relax-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 0.64 92236 +array-examples/relax-1.yml valid-memsafety symex 1 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 1.65 173412 +array-examples/relax-1.yml valid-memsafety symex 2 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 1.69 174348 +array-examples/relax-1.yml valid-memsafety symex 3 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 1.76 173484 +array-examples/relax-1.yml valid-memsafety symex 4 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 1.60 174208 +array-examples/relax-1.yml valid-memsafety symex 5 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 1.61 174196 +array-examples/standard_sentinel-2.yml unreach-call afl 1 UNKNOWN - - - 0 9.45 340944 +array-examples/standard_sentinel-2.yml unreach-call afl 2 UNKNOWN - - - 0 9.45 340676 +array-examples/standard_sentinel-2.yml unreach-call afl 3 UNKNOWN - - - 0 9.46 341088 +array-examples/standard_sentinel-2.yml unreach-call afl 4 UNKNOWN - - - 0 9.45 340780 +array-examples/standard_sentinel-2.yml unreach-call afl 5 UNKNOWN - - - 0 9.44 357288 +array-examples/standard_sentinel-2.yml unreach-call symex 1 UNKNOWN - - - 0 32.43 211460 +array-examples/standard_sentinel-2.yml unreach-call symex 2 UNKNOWN - - - 0 32.42 211084 +array-examples/standard_sentinel-2.yml unreach-call symex 3 UNKNOWN - - - 0 32.42 209408 +array-examples/standard_sentinel-2.yml unreach-call symex 4 UNKNOWN - - - 0 32.38 209756 +array-examples/standard_sentinel-2.yml unreach-call symex 5 UNKNOWN - - - 0 32.37 211724 +array-examples/standard_two_index_04.yml unreach-call afl 1 UNKNOWN - - - 0 9.45 341200 +array-examples/standard_two_index_04.yml unreach-call afl 2 UNKNOWN - - - 0 9.44 340976 +array-examples/standard_two_index_04.yml unreach-call afl 3 UNKNOWN - - - 0 9.45 341120 +array-examples/standard_two_index_04.yml unreach-call afl 4 UNKNOWN - - - 0 9.45 340972 +array-examples/standard_two_index_04.yml unreach-call afl 5 UNKNOWN - - - 0 9.45 340948 +array-examples/standard_two_index_04.yml unreach-call symex 1 UNKNOWN - - - 0 32.37 209800 +array-examples/standard_two_index_04.yml unreach-call symex 2 UNKNOWN - - - 0 32.44 208872 +array-examples/standard_two_index_04.yml unreach-call symex 3 UNKNOWN - - - 0 32.37 209588 +array-examples/standard_two_index_04.yml unreach-call symex 4 UNKNOWN - - - 0 32.40 209340 +array-examples/standard_two_index_04.yml unreach-call symex 5 UNKNOWN - - - 0 32.39 209604 +array-examples/standard_two_index_05.yml unreach-call afl 1 UNKNOWN - - - 0 9.46 340932 +array-examples/standard_two_index_05.yml unreach-call afl 2 UNKNOWN - - - 0 9.46 340876 +array-examples/standard_two_index_05.yml unreach-call afl 3 UNKNOWN - - - 0 9.45 341016 +array-examples/standard_two_index_05.yml unreach-call afl 4 UNKNOWN - - - 0 9.43 341216 +array-examples/standard_two_index_05.yml unreach-call afl 5 UNKNOWN - - - 0 9.43 341556 +array-examples/standard_two_index_05.yml unreach-call symex 1 UNKNOWN - - - 0 32.37 209644 +array-examples/standard_two_index_05.yml unreach-call symex 2 UNKNOWN - - - 0 32.35 209228 +array-examples/standard_two_index_05.yml unreach-call symex 3 UNKNOWN - - - 0 32.42 208968 +array-examples/standard_two_index_05.yml unreach-call symex 4 UNKNOWN - - - 0 32.39 208696 +array-examples/standard_two_index_05.yml unreach-call symex 5 UNKNOWN - - - 0 32.37 209948 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.58 91744 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.58 91536 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.60 91668 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 4 UNKNOWN - - - 0 0.59 91596 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 5 UNKNOWN - - - 0 0.59 91716 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 1 FAILED FALSE-DEREF 522 main 0 1.48 172368 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 2 FAILED FALSE-DEREF 522 main 0 1.48 172136 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 3 FAILED FALSE-DEREF 522 main 0 1.51 173320 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 4 FAILED FALSE-DEREF 522 main 0 1.46 172304 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 5 FAILED FALSE-DEREF 522 main 0 1.44 172080 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.46 91792 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.48 92076 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.46 92524 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.48 91828 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.47 92304 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 32.60 193916 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 33.44 194212 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 32.66 194092 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 32.54 193328 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 32.54 198516 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.84 340912 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.83 340960 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.84 340888 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 0.82 357216 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.04 340840 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.75 172804 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.56 173012 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.52 171700 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.53 172720 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.58 172280 +array-memsafety/lis_unsafe.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.48 91608 +array-memsafety/lis_unsafe.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.47 91772 +array-memsafety/lis_unsafe.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.47 91600 +array-memsafety/lis_unsafe.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.47 91872 +array-memsafety/lis_unsafe.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.47 91628 +array-memsafety/lis_unsafe.yml valid-memsafety symex 1 UNKNOWN - - - 0 1.48 171776 +array-memsafety/lis_unsafe.yml valid-memsafety symex 2 UNKNOWN - - - 0 1.44 172996 +array-memsafety/lis_unsafe.yml valid-memsafety symex 3 UNKNOWN - - - 0 1.45 172644 +array-memsafety/lis_unsafe.yml valid-memsafety symex 4 UNKNOWN - - - 0 1.52 172768 +array-memsafety/lis_unsafe.yml valid-memsafety symex 5 UNKNOWN - - - 0 1.55 172324 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.46 340864 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.45 341048 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.46 341140 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.46 340788 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.45 341048 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.42 156532 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.43 156672 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.40 156744 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.45 156476 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.53 166608 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 1 FAILED FALSE-FREE 46 main 0 0.62 91396 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 2 FAILED FALSE-FREE 46 main 0 0.63 91000 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 3 FAILED FALSE-FREE 46 main 0 0.63 90704 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 4 FAILED FALSE-FREE 46 main 0 0.64 91148 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 5 FAILED FALSE-FREE 46 main 0 0.64 91148 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 1 FAILED FALSE-FREE 46 main 0 1.52 166612 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 2 FAILED FALSE-FREE 46 main 0 1.60 156532 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 3 FAILED FALSE-FREE 46 main 0 1.58 156944 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 4 FAILED FALSE-FREE 46 main 0 1.56 156760 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 5 FAILED FALSE-FREE 46 main 0 1.61 166732 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.48 340944 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.45 340852 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.45 340704 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.45 341312 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.45 340516 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 1.75 165380 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 1.59 155368 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 1.42 165336 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 1.37 165876 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 1.42 157188 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.46 340980 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.47 341088 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.47 341104 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.46 341140 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.46 340768 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 1 SUCCEEDED - - - 0 27.01 157484 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 2 SUCCEEDED - - - 0 20.56 157624 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 3 SUCCEEDED - - - 0 21.18 157560 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 4 SUCCEEDED - - - 0 20.61 157352 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 5 SUCCEEDED - - - 0 21.14 158148 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.49 90680 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.47 91292 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.47 91056 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.49 90808 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.49 90748 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 1 UNKNOWN - - - 0 32.40 155952 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 2 UNKNOWN - - - 0 32.34 156600 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 3 UNKNOWN - - - 0 32.46 156552 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 4 UNKNOWN - - - 0 32.37 156808 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 5 UNKNOWN - - - 0 32.35 155988 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 1 FAILED FALSE-MEMTRACK - - 0 0.69 92564 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 2 FAILED FALSE-MEMTRACK - - 0 0.68 92580 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 3 FAILED FALSE-MEMTRACK - - 0 0.70 91804 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 4 FAILED FALSE-MEMTRACK - - 0 0.74 92268 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 5 FAILED FALSE-MEMTRACK - - 0 0.69 92328 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 1 FAILED FALSE-MEMTRACK - - 0 1.87 164092 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 2 FAILED FALSE-MEMTRACK - - 0 1.72 164544 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 3 FAILED FALSE-MEMTRACK - - 0 1.88 164288 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 4 FAILED FALSE-MEMTRACK - - 0 1.75 164592 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 5 FAILED FALSE-MEMTRACK - - 0 1.72 164172 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.56 340744 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.55 340860 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.57 340980 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.55 341088 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.57 340604 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 2.33 165280 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 2.41 165424 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 2.37 164768 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 2.40 165188 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 2.42 165492 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 1 FAILED FALSE-FREE 779 free_17 0 0.69 92296 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 2 FAILED FALSE-FREE 779 free_17 0 0.70 91948 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 3 FAILED FALSE-FREE 779 free_17 0 0.69 92340 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 4 FAILED FALSE-FREE 779 free_17 0 0.72 92392 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 5 FAILED FALSE-FREE 779 free_17 0 0.71 92764 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 1 FAILED FALSE-FREE 779 free_17 0 2.88 167264 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 2 FAILED FALSE-FREE 779 free_17 0 2.85 172328 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 3 FAILED FALSE-FREE 779 free_17 0 2.76 166052 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 4 FAILED FALSE-FREE 779 free_17 0 2.86 166764 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 5 FAILED FALSE-FREE 779 free_17 0 2.79 166932 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.53 340848 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.59 341000 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.60 340848 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.54 340956 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.55 340896 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.73 164624 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.69 164272 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.70 164932 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.71 163728 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.89 164164 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.46 341068 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.61 340732 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.74 340800 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.62 340884 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.44 340868 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.32 156004 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.33 156204 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.34 156088 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.36 155660 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.33 156004 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 1 FAILED FALSE-DEREF 533 main 0 0.61 91652 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 2 FAILED FALSE-DEREF 533 main 0 0.60 92156 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 3 FAILED FALSE-DEREF 533 main 0 0.60 91912 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 4 FAILED FALSE-DEREF 533 main 0 0.59 92024 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 5 FAILED FALSE-DEREF 533 main 0 0.60 92020 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 1 FAILED FALSE-DEREF 533 main 0 1.54 172736 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 2 FAILED FALSE-DEREF 533 main 0 1.63 172824 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 3 FAILED FALSE-DEREF 533 main 0 1.64 172980 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 4 FAILED FALSE-DEREF 533 main 0 1.55 164660 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 5 FAILED FALSE-DEREF 533 main 0 1.62 164928 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.46 341140 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.46 340936 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.50 340796 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.48 340972 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.46 341372 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 3.99 173036 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 4.58 173040 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 6.28 170604 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 6.19 164316 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 6.55 171844 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 1 FAILED FALSE-FREE 536 main 0 0.88 90332 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 2 FAILED FALSE-FREE 536 main 0 0.74 90976 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 3 FAILED FALSE-FREE 536 main 0 0.72 91268 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 4 FAILED FALSE-FREE 536 main 0 0.72 90576 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 5 FAILED FALSE-FREE 536 main 0 0.67 91280 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 1 FAILED FALSE-FREE 536 main 0 1.81 171872 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 2 FAILED FALSE-FREE 536 main 0 1.60 171780 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 3 FAILED FALSE-FREE 536 main 0 1.63 171792 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 4 FAILED FALSE-FREE 536 main 0 1.63 173852 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 5 FAILED FALSE-FREE 536 main 0 1.67 171760 +list-ext-properties/list-ext.yml unreach-call afl 1 FAILED TARGET-REACHED 556 main 0 0.81 340688 +list-ext-properties/list-ext.yml unreach-call afl 2 FAILED TARGET-REACHED 556 main 0 0.76 341132 +list-ext-properties/list-ext.yml unreach-call afl 3 FAILED TARGET-REACHED 556 main 0 0.75 340824 +list-ext-properties/list-ext.yml unreach-call afl 4 FAILED TARGET-REACHED 556 main 0 0.76 340732 +list-ext-properties/list-ext.yml unreach-call afl 5 FAILED TARGET-REACHED 556 main 0 0.77 340636 +list-ext-properties/list-ext.yml unreach-call symex 1 FAILED TARGET-REACHED 556 main 0 1.57 164716 +list-ext-properties/list-ext.yml unreach-call symex 2 FAILED TARGET-REACHED 556 main 0 1.58 171552 +list-ext-properties/list-ext.yml unreach-call symex 3 FAILED TARGET-REACHED 556 main 0 1.52 163800 +list-ext-properties/list-ext.yml unreach-call symex 4 FAILED TARGET-REACHED 556 main 0 1.54 163860 +list-ext-properties/list-ext.yml unreach-call symex 5 FAILED TARGET-REACHED 556 main 0 1.55 166164 +list-ext-properties/list-ext.yml valid-memsafety afl 1 FAILED FALSE-DEREF 558 main 0 0.62 91036 +list-ext-properties/list-ext.yml valid-memsafety afl 2 FAILED FALSE-DEREF 558 main 0 0.61 90292 +list-ext-properties/list-ext.yml valid-memsafety afl 3 FAILED FALSE-DEREF 558 main 0 0.60 91064 +list-ext-properties/list-ext.yml valid-memsafety afl 4 FAILED FALSE-DEREF 558 main 0 0.62 90900 +list-ext-properties/list-ext.yml valid-memsafety afl 5 FAILED FALSE-DEREF 558 main 0 0.60 91068 +list-ext-properties/list-ext.yml valid-memsafety symex 1 FAILED FALSE-DEREF 558 main 0 6.83 175588 +list-ext-properties/list-ext.yml valid-memsafety symex 2 FAILED FALSE-DEREF 558 main 0 6.47 173684 +list-ext-properties/list-ext.yml valid-memsafety symex 3 FAILED FALSE-DEREF 558 main 0 6.68 166496 +list-ext-properties/list-ext.yml valid-memsafety symex 4 FAILED FALSE-DEREF 558 main 0 6.80 173628 +list-ext-properties/list-ext.yml valid-memsafety symex 5 FAILED FALSE-DEREF 558 main 0 6.44 173172 +list-ext-properties/simple-ext.yml unreach-call afl 1 FAILED TARGET-REACHED 540 main 0 0.59 90644 +list-ext-properties/simple-ext.yml unreach-call afl 2 FAILED TARGET-REACHED 540 main 0 0.60 90740 +list-ext-properties/simple-ext.yml unreach-call afl 3 FAILED TARGET-REACHED 540 main 0 0.58 90724 +list-ext-properties/simple-ext.yml unreach-call afl 4 FAILED TARGET-REACHED 540 main 0 0.59 91312 +list-ext-properties/simple-ext.yml unreach-call afl 5 FAILED TARGET-REACHED 540 main 0 0.61 91072 +list-ext-properties/simple-ext.yml unreach-call symex 1 FAILED TARGET-REACHED 540 main 0 1.59 161800 +list-ext-properties/simple-ext.yml unreach-call symex 2 FAILED TARGET-REACHED 540 main 0 1.47 162064 +list-ext-properties/simple-ext.yml unreach-call symex 3 FAILED TARGET-REACHED 540 main 0 1.46 162200 +list-ext-properties/simple-ext.yml unreach-call symex 4 FAILED TARGET-REACHED 540 main 0 1.48 162292 +list-ext-properties/simple-ext.yml unreach-call symex 5 FAILED TARGET-REACHED 540 main 0 1.44 162688 +list-ext-properties/simple-ext.yml valid-memcleanup afl 1 UNKNOWN - - - 0 9.48 340988 +list-ext-properties/simple-ext.yml valid-memcleanup afl 2 UNKNOWN - - - 0 9.44 340656 +list-ext-properties/simple-ext.yml valid-memcleanup afl 3 UNKNOWN - - - 0 9.46 340968 +list-ext-properties/simple-ext.yml valid-memcleanup afl 4 UNKNOWN - - - 0 9.45 340960 +list-ext-properties/simple-ext.yml valid-memcleanup afl 5 UNKNOWN - - - 0 9.47 341248 +list-ext-properties/simple-ext.yml valid-memcleanup symex 1 UNKNOWN - - - 0 1.61 162612 +list-ext-properties/simple-ext.yml valid-memcleanup symex 2 UNKNOWN - - - 0 1.61 162572 +list-ext-properties/simple-ext.yml valid-memcleanup symex 3 UNKNOWN - - - 0 1.53 170696 +list-ext-properties/simple-ext.yml valid-memcleanup symex 4 UNKNOWN - - - 0 1.58 162480 +list-ext-properties/simple-ext.yml valid-memcleanup symex 5 UNKNOWN - - - 0 1.66 162524 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 1 FAILED FALSE-MEMTRACK - - 0 0.59 90632 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 2 FAILED FALSE-MEMTRACK - - 0 0.59 90908 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 3 FAILED FALSE-MEMTRACK - - 0 0.58 91208 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 4 FAILED FALSE-MEMTRACK - - 0 0.60 90868 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 5 FAILED FALSE-MEMTRACK - - 0 0.60 91184 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 1 FAILED FALSE-MEMTRACK - - 0 1.45 156212 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 2 FAILED FALSE-MEMTRACK - - 0 1.53 165544 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 3 FAILED FALSE-MEMTRACK - - 0 1.40 166080 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 4 FAILED FALSE-MEMTRACK - - 0 1.44 156404 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 5 FAILED FALSE-MEMTRACK - - 0 1.46 155836 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.46 341308 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.44 340884 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.45 340860 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.44 340576 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.45 340888 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.45 173756 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.43 171152 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.49 162808 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.40 171332 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.48 171332 +map2check-assert/array_bug.yml unreach-call afl 1 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.60 90148 +map2check-assert/array_bug.yml unreach-call afl 2 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.59 89752 +map2check-assert/array_bug.yml unreach-call afl 3 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.60 89452 +map2check-assert/array_bug.yml unreach-call afl 4 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.58 89180 +map2check-assert/array_bug.yml unreach-call afl 5 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.58 90000 +map2check-assert/array_bug.yml unreach-call symex 1 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 1.41 162024 +map2check-assert/array_bug.yml unreach-call symex 2 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 1.42 161924 +map2check-assert/array_bug.yml unreach-call symex 3 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 1.45 162632 +map2check-assert/array_bug.yml unreach-call symex 4 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 1.40 162392 +map2check-assert/array_bug.yml unreach-call symex 5 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 1.43 162832 +map2check-assert/byte_add_bug.yml unreach-call afl 1 UNKNOWN - - - 0 9.46 341188 +map2check-assert/byte_add_bug.yml unreach-call afl 2 UNKNOWN - - - 0 9.46 340880 +map2check-assert/byte_add_bug.yml unreach-call afl 3 UNKNOWN - - - 0 9.46 341020 +map2check-assert/byte_add_bug.yml unreach-call afl 4 UNKNOWN - - - 0 9.45 341020 +map2check-assert/byte_add_bug.yml unreach-call afl 5 UNKNOWN - - - 0 9.45 340712 +map2check-assert/byte_add_bug.yml unreach-call symex 1 SUCCEEDED - - - 0 1.42 155412 +map2check-assert/byte_add_bug.yml unreach-call symex 2 SUCCEEDED - - - 0 1.34 154592 +map2check-assert/byte_add_bug.yml unreach-call symex 3 SUCCEEDED - - - 0 1.44 154884 +map2check-assert/byte_add_bug.yml unreach-call symex 4 SUCCEEDED - - - 0 1.33 154924 +map2check-assert/byte_add_bug.yml unreach-call symex 5 SUCCEEDED - - - 0 1.45 155380 +map2check-assert/check_if_bug.yml unreach-call afl 1 UNKNOWN - - - 0 1.45 89768 +map2check-assert/check_if_bug.yml unreach-call afl 2 UNKNOWN - - - 0 1.45 89696 +map2check-assert/check_if_bug.yml unreach-call afl 3 UNKNOWN - - - 0 1.45 89872 +map2check-assert/check_if_bug.yml unreach-call afl 4 UNKNOWN - - - 0 1.46 89956 +map2check-assert/check_if_bug.yml unreach-call afl 5 UNKNOWN - - - 0 1.47 89968 +map2check-assert/check_if_bug.yml unreach-call symex 1 UNKNOWN - - - 0 32.94 212612 +map2check-assert/check_if_bug.yml unreach-call symex 2 UNKNOWN - - - 0 33.04 206704 +map2check-assert/check_if_bug.yml unreach-call symex 3 UNKNOWN - - - 0 33.72 204560 +map2check-assert/check_if_bug.yml unreach-call symex 4 UNKNOWN - - - 0 32.93 207960 +map2check-assert/check_if_bug.yml unreach-call symex 5 UNKNOWN - - - 0 32.97 206616 +map2check-assert/ex01_false.yml unreach-call afl 1 UNKNOWN - - - 0 1.46 89584 +map2check-assert/ex01_false.yml unreach-call afl 2 UNKNOWN - - - 0 1.47 89604 +map2check-assert/ex01_false.yml unreach-call afl 3 UNKNOWN - - - 0 1.46 89768 +map2check-assert/ex01_false.yml unreach-call afl 4 UNKNOWN - - - 0 1.46 89952 +map2check-assert/ex01_false.yml unreach-call afl 5 UNKNOWN - - - 0 1.46 89796 +map2check-assert/ex01_false.yml unreach-call symex 1 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 3.10 171644 +map2check-assert/ex01_false.yml unreach-call symex 2 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 3.13 170884 +map2check-assert/ex01_false.yml unreach-call symex 3 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 3.13 171448 +map2check-assert/ex01_false.yml unreach-call symex 4 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 3.06 170904 +map2check-assert/ex01_false.yml unreach-call symex 5 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 3.15 171456 +map2check-assert/ex02_false.yml unreach-call afl 1 UNKNOWN - - - 0 1.45 89432 +map2check-assert/ex02_false.yml unreach-call afl 2 UNKNOWN - - - 0 1.45 90080 +map2check-assert/ex02_false.yml unreach-call afl 3 UNKNOWN - - - 0 1.44 89880 +map2check-assert/ex02_false.yml unreach-call afl 4 UNKNOWN - - - 0 1.45 89340 +map2check-assert/ex02_false.yml unreach-call afl 5 UNKNOWN - - - 0 1.46 89940 +map2check-assert/ex02_false.yml unreach-call symex 1 UNKNOWN - - - 0 32.38 204604 +map2check-assert/ex02_false.yml unreach-call symex 2 UNKNOWN - - - 0 32.42 203784 +map2check-assert/ex02_false.yml unreach-call symex 3 UNKNOWN - - - 0 32.45 204736 +map2check-assert/ex02_false.yml unreach-call symex 4 UNKNOWN - - - 0 32.40 204180 +map2check-assert/ex02_false.yml unreach-call symex 5 UNKNOWN - - - 0 32.49 202956 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.47 340784 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.45 90248 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.49 340684 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.49 341216 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.46 340928 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 33.86 205536 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 34.11 205576 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 33.84 199744 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 34.12 205996 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 34.63 208068 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.73 91296 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.73 91052 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.69 91160 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.71 90456 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.69 91024 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 1 UNKNOWN - - - 0 33.49 218868 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 2 UNKNOWN - - - 0 32.88 220292 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 3 UNKNOWN - - - 0 32.91 226580 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 4 UNKNOWN - - - 0 32.77 226228 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 5 UNKNOWN - - - 0 33.15 244208 +memsafety-ext/tree_stack.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.59 89892 +memsafety-ext/tree_stack.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.52 91388 +memsafety-ext/tree_stack.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.51 90960 +memsafety-ext/tree_stack.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.52 90900 +memsafety-ext/tree_stack.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.64 91420 +memsafety-ext/tree_stack.yml valid-memsafety symex 1 UNKNOWN - - - 0 33.21 267064 +memsafety-ext/tree_stack.yml valid-memsafety symex 2 UNKNOWN - - - 0 34.32 235336 +memsafety-ext/tree_stack.yml valid-memsafety symex 3 UNKNOWN - - - 0 40.28 141440 +memsafety-ext/tree_stack.yml valid-memsafety symex 4 SUCCEEDED - - - 0 60.44 90496 +memsafety-ext/tree_stack.yml valid-memsafety symex 5 TIMEOUT - - - 0 60.12 4936 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 53.59 90748 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.65 92264 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.72 91644 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.59 92096 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.58 92488 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 32.77 172028 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 32.73 172012 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 32.64 172904 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 32.49 171492 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 32.93 172916 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.57 91968 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.60 91792 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.57 92080 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.61 92704 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.57 91976 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 33.74 359556 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 33.73 393616 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 33.81 441756 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 33.67 442692 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 33.76 441656 +memsafety/960521-1-1.yml valid-memsafety afl 1 FAILED FALSE-FREE 532 main 0 0.62 91840 +memsafety/960521-1-1.yml valid-memsafety afl 2 FAILED FALSE-FREE 532 main 0 0.59 91524 +memsafety/960521-1-1.yml valid-memsafety afl 3 FAILED FALSE-FREE 532 main 0 0.59 91540 +memsafety/960521-1-1.yml valid-memsafety afl 4 FAILED FALSE-FREE 532 main 0 0.59 92384 +memsafety/960521-1-1.yml valid-memsafety afl 5 FAILED FALSE-FREE 532 main 0 0.59 91852 +memsafety/960521-1-1.yml valid-memsafety symex 1 FAILED FALSE-FREE 532 main 0 1.48 157192 +memsafety/960521-1-1.yml valid-memsafety symex 2 FAILED FALSE-FREE 532 main 0 1.48 158816 +memsafety/960521-1-1.yml valid-memsafety symex 3 FAILED FALSE-FREE 532 main 0 1.47 157040 +memsafety/960521-1-1.yml valid-memsafety symex 4 FAILED FALSE-FREE 532 main 0 1.56 156652 +memsafety/960521-1-1.yml valid-memsafety symex 5 FAILED FALSE-FREE 532 main 0 1.56 156416 +memsafety/960521-1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.45 341168 +memsafety/960521-1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.44 340948 +memsafety/960521-1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.44 340972 +memsafety/960521-1-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.44 341324 +memsafety/960521-1-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.45 340976 +memsafety/960521-1-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 27.07 157048 +memsafety/960521-1-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 26.52 157224 +memsafety/960521-1-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 26.09 157688 +memsafety/960521-1-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 26.39 159844 +memsafety/960521-1-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 27.09 166924 +memsafety/960521-1-3.yml valid-memsafety afl 1 FAILED FALSE-DEREF 529 main 0 0.59 91888 +memsafety/960521-1-3.yml valid-memsafety afl 2 FAILED FALSE-DEREF 529 main 0 0.59 91816 +memsafety/960521-1-3.yml valid-memsafety afl 3 FAILED FALSE-DEREF 529 main 0 0.60 91968 +memsafety/960521-1-3.yml valid-memsafety afl 4 FAILED FALSE-DEREF 529 main 0 0.59 91444 +memsafety/960521-1-3.yml valid-memsafety afl 5 FAILED FALSE-DEREF 529 main 0 0.58 91600 +memsafety/960521-1-3.yml valid-memsafety symex 1 FAILED FALSE-DEREF 529 main 0 1.54 156912 +memsafety/960521-1-3.yml valid-memsafety symex 2 FAILED FALSE-DEREF 529 main 0 1.55 158128 +memsafety/960521-1-3.yml valid-memsafety symex 3 FAILED FALSE-DEREF 529 main 0 1.55 157320 +memsafety/960521-1-3.yml valid-memsafety symex 4 FAILED FALSE-DEREF 529 main 0 1.50 167160 +memsafety/960521-1-3.yml valid-memsafety symex 5 FAILED FALSE-DEREF 529 main 0 1.48 157804 +memsafety/test-0102-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.47 92276 +memsafety/test-0102-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.48 91796 +memsafety/test-0102-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.50 92712 +memsafety/test-0102-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.50 92140 +memsafety/test-0102-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.49 92260 +memsafety/test-0102-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 32.47 241332 +memsafety/test-0102-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 32.50 241296 +memsafety/test-0102-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 32.47 241408 +memsafety/test-0102-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 32.47 240092 +memsafety/test-0102-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 32.51 239788 diff --git a/tests/cutover/baseline-rust-symex-slim.tsv b/tests/cutover/baseline-rust-symex-slim.tsv new file mode 100644 index 000000000..f31c172cd --- /dev/null +++ b/tests/cutover/baseline-rust-symex-slim.tsv @@ -0,0 +1,206 @@ +task prp gen rep verdict tag line function witness wall_s maxrss_kb +array-examples/relax-1.yml valid-memsafety symex 1 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 1.73 173312 +array-examples/relax-1.yml valid-memsafety symex 2 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 1.68 174236 +array-examples/relax-1.yml valid-memsafety symex 3 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 1.72 174264 +array-examples/relax-1.yml valid-memsafety symex 4 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 1.73 174372 +array-examples/relax-1.yml valid-memsafety symex 5 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 1.73 173644 +array-examples/standard_sentinel-2.yml unreach-call symex 1 UNKNOWN - - - 0 32.52 207684 +array-examples/standard_sentinel-2.yml unreach-call symex 2 UNKNOWN - - - 0 32.52 208052 +array-examples/standard_sentinel-2.yml unreach-call symex 3 UNKNOWN - - - 0 32.50 210292 +array-examples/standard_sentinel-2.yml unreach-call symex 4 UNKNOWN - - - 0 32.47 207876 +array-examples/standard_sentinel-2.yml unreach-call symex 5 UNKNOWN - - - 0 32.46 208272 +array-examples/standard_two_index_04.yml unreach-call symex 1 UNKNOWN - - - 0 32.50 208936 +array-examples/standard_two_index_04.yml unreach-call symex 2 UNKNOWN - - - 0 32.51 211456 +array-examples/standard_two_index_04.yml unreach-call symex 3 UNKNOWN - - - 0 32.49 210104 +array-examples/standard_two_index_04.yml unreach-call symex 4 UNKNOWN - - - 0 32.52 209684 +array-examples/standard_two_index_04.yml unreach-call symex 5 UNKNOWN - - - 0 32.52 208500 +array-examples/standard_two_index_05.yml unreach-call symex 1 UNKNOWN - - - 0 32.46 208960 +array-examples/standard_two_index_05.yml unreach-call symex 2 UNKNOWN - - - 0 32.52 208820 +array-examples/standard_two_index_05.yml unreach-call symex 3 UNKNOWN - - - 0 32.45 209412 +array-examples/standard_two_index_05.yml unreach-call symex 4 UNKNOWN - - - 0 32.48 208460 +array-examples/standard_two_index_05.yml unreach-call symex 5 UNKNOWN - - - 0 32.48 209004 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 1 FAILED FALSE-DEREF 522 main 0 1.53 172764 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 2 FAILED FALSE-DEREF 522 main 0 1.55 172712 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 3 FAILED FALSE-DEREF 522 main 0 1.54 172372 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 4 FAILED FALSE-DEREF 522 main 0 1.56 174524 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 5 FAILED FALSE-DEREF 522 main 0 1.58 171772 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 32.59 192832 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 32.56 197836 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 32.58 192304 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 32.52 198024 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 32.64 199776 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.54 172988 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.58 172652 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.58 172780 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.52 172816 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.52 172516 +array-memsafety/lis_unsafe.yml valid-memsafety symex 1 UNKNOWN - - - 0 1.49 172324 +array-memsafety/lis_unsafe.yml valid-memsafety symex 2 UNKNOWN - - - 0 1.50 172840 +array-memsafety/lis_unsafe.yml valid-memsafety symex 3 UNKNOWN - - - 0 1.58 172976 +array-memsafety/lis_unsafe.yml valid-memsafety symex 4 UNKNOWN - - - 0 1.48 172932 +array-memsafety/lis_unsafe.yml valid-memsafety symex 5 UNKNOWN - - - 0 1.43 173044 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.48 156448 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.37 156472 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.36 156248 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.37 156608 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.42 166712 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 1 FAILED FALSE-FREE 46 main 0 1.40 167056 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 2 FAILED FALSE-FREE 46 main 0 1.39 156656 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 3 FAILED FALSE-FREE 46 main 0 1.40 166804 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 4 FAILED FALSE-FREE 46 main 0 1.38 156880 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 5 FAILED FALSE-FREE 46 main 0 1.38 156768 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 1.39 165244 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 1.35 155136 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 1.35 155136 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 1.36 154780 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 1.36 155724 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 1 SUCCEEDED - - - 0 20.08 157112 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 2 SUCCEEDED - - - 0 20.57 157660 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 3 SUCCEEDED - - - 0 20.87 157536 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 4 SUCCEEDED - - - 0 20.60 156952 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 5 SUCCEEDED - - - 0 19.56 158040 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 1 UNKNOWN - - - 0 32.32 157232 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 2 UNKNOWN - - - 0 32.35 155648 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 3 UNKNOWN - - - 0 32.37 157124 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 4 UNKNOWN - - - 0 32.36 157036 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 5 UNKNOWN - - - 0 32.36 156184 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 1 FAILED FALSE-MEMTRACK - - 0 1.68 164192 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 2 FAILED FALSE-MEMTRACK - - 0 1.67 167496 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 3 FAILED FALSE-MEMTRACK - - 0 1.60 165896 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 4 FAILED FALSE-MEMTRACK - - 0 1.62 164944 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 5 FAILED FALSE-MEMTRACK - - 0 1.66 165456 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 2.34 165980 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 2.32 167504 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 2.41 166108 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 2.27 165988 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 2.31 165840 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 1 FAILED FALSE-FREE 779 free_17 0 2.66 167252 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 2 FAILED FALSE-FREE 779 free_17 0 2.67 167372 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 3 FAILED FALSE-FREE 779 free_17 0 2.69 167076 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 4 FAILED FALSE-FREE 779 free_17 0 2.64 167188 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 5 FAILED FALSE-FREE 779 free_17 0 2.72 167888 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.61 165720 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.62 165068 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.62 164252 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.69 165232 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.68 164884 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.34 155332 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.38 155912 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.34 156212 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.38 155908 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.37 155828 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 1 FAILED FALSE-DEREF 533 main 0 1.53 173048 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 2 FAILED FALSE-DEREF 533 main 0 1.55 173252 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 3 FAILED FALSE-DEREF 533 main 0 1.54 172800 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 4 FAILED FALSE-DEREF 533 main 0 1.55 172176 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 5 FAILED FALSE-DEREF 533 main 0 1.55 173048 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 3.93 173684 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 3.97 172928 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 3.93 173900 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 4.09 164948 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 3.91 165244 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 1 FAILED FALSE-FREE 536 main 0 1.54 172412 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 2 FAILED FALSE-FREE 536 main 0 1.57 172328 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 3 FAILED FALSE-FREE 536 main 0 1.56 172712 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 4 FAILED FALSE-FREE 536 main 0 1.53 173140 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 5 FAILED FALSE-FREE 536 main 0 1.59 172932 +list-ext-properties/list-ext.yml unreach-call symex 1 FAILED TARGET-REACHED 556 main 0 1.50 166172 +list-ext-properties/list-ext.yml unreach-call symex 2 FAILED TARGET-REACHED 556 main 0 1.52 166452 +list-ext-properties/list-ext.yml unreach-call symex 3 FAILED TARGET-REACHED 556 main 0 1.50 172356 +list-ext-properties/list-ext.yml unreach-call symex 4 FAILED TARGET-REACHED 556 main 0 1.51 165164 +list-ext-properties/list-ext.yml unreach-call symex 5 FAILED TARGET-REACHED 556 main 0 1.48 165580 +list-ext-properties/list-ext.yml valid-memsafety symex 1 FAILED FALSE-DEREF 558 main 0 6.22 174248 +list-ext-properties/list-ext.yml valid-memsafety symex 2 FAILED FALSE-DEREF 558 main 0 6.56 168228 +list-ext-properties/list-ext.yml valid-memsafety symex 3 FAILED FALSE-DEREF 558 main 0 6.62 167960 +list-ext-properties/list-ext.yml valid-memsafety symex 4 FAILED FALSE-DEREF 558 main 0 6.52 176644 +list-ext-properties/list-ext.yml valid-memsafety symex 5 FAILED FALSE-DEREF 558 main 0 6.49 167436 +list-ext-properties/simple-ext.yml unreach-call symex 1 FAILED TARGET-REACHED 540 main 0 1.44 162916 +list-ext-properties/simple-ext.yml unreach-call symex 2 FAILED TARGET-REACHED 540 main 0 1.41 165244 +list-ext-properties/simple-ext.yml unreach-call symex 3 FAILED TARGET-REACHED 540 main 0 1.43 162688 +list-ext-properties/simple-ext.yml unreach-call symex 4 FAILED TARGET-REACHED 540 main 0 1.42 163680 +list-ext-properties/simple-ext.yml unreach-call symex 5 FAILED TARGET-REACHED 540 main 0 1.47 162788 +list-ext-properties/simple-ext.yml valid-memcleanup symex 1 UNKNOWN - - - 0 1.52 162836 +list-ext-properties/simple-ext.yml valid-memcleanup symex 2 UNKNOWN - - - 0 1.52 163460 +list-ext-properties/simple-ext.yml valid-memcleanup symex 3 UNKNOWN - - - 0 1.58 163724 +list-ext-properties/simple-ext.yml valid-memcleanup symex 4 UNKNOWN - - - 0 1.55 171836 +list-ext-properties/simple-ext.yml valid-memcleanup symex 5 UNKNOWN - - - 0 1.57 163576 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 1 FAILED FALSE-MEMTRACK - - 0 1.44 156960 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 2 FAILED FALSE-MEMTRACK - - 0 1.40 156508 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 3 FAILED FALSE-MEMTRACK - - 0 1.41 157092 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 4 FAILED FALSE-MEMTRACK - - 0 1.40 168888 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 5 FAILED FALSE-MEMTRACK - - 0 1.43 159220 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.38 163912 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.42 164156 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.39 164080 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.42 172680 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.40 172856 +map2check-assert/array_bug.yml unreach-call symex 1 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 1.40 163752 +map2check-assert/array_bug.yml unreach-call symex 2 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 1.36 163816 +map2check-assert/array_bug.yml unreach-call symex 3 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 1.40 163004 +map2check-assert/array_bug.yml unreach-call symex 4 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 1.38 163468 +map2check-assert/array_bug.yml unreach-call symex 5 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 1.36 163700 +map2check-assert/byte_add_bug.yml unreach-call symex 1 SUCCEEDED - - - 0 1.32 155760 +map2check-assert/byte_add_bug.yml unreach-call symex 2 SUCCEEDED - - - 0 1.34 155828 +map2check-assert/byte_add_bug.yml unreach-call symex 3 SUCCEEDED - - - 0 1.37 155308 +map2check-assert/byte_add_bug.yml unreach-call symex 4 SUCCEEDED - - - 0 1.35 158528 +map2check-assert/byte_add_bug.yml unreach-call symex 5 SUCCEEDED - - - 0 1.38 155868 +map2check-assert/check_if_bug.yml unreach-call symex 1 UNKNOWN - - - 0 32.96 208548 +map2check-assert/check_if_bug.yml unreach-call symex 2 UNKNOWN - - - 0 32.81 210100 +map2check-assert/check_if_bug.yml unreach-call symex 3 UNKNOWN - - - 0 32.88 210860 +map2check-assert/check_if_bug.yml unreach-call symex 4 UNKNOWN - - - 0 32.89 210624 +map2check-assert/check_if_bug.yml unreach-call symex 5 UNKNOWN - - - 0 32.88 206772 +map2check-assert/ex01_false.yml unreach-call symex 1 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 2.99 171952 +map2check-assert/ex01_false.yml unreach-call symex 2 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 3.08 172292 +map2check-assert/ex01_false.yml unreach-call symex 3 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 3.00 172088 +map2check-assert/ex01_false.yml unreach-call symex 4 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 2.95 171892 +map2check-assert/ex01_false.yml unreach-call symex 5 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 2.99 172100 +map2check-assert/ex02_false.yml unreach-call symex 1 UNKNOWN - - - 0 32.39 207772 +map2check-assert/ex02_false.yml unreach-call symex 2 UNKNOWN - - - 0 32.41 207624 +map2check-assert/ex02_false.yml unreach-call symex 3 UNKNOWN - - - 0 32.35 207188 +map2check-assert/ex02_false.yml unreach-call symex 4 UNKNOWN - - - 0 32.39 210016 +map2check-assert/ex02_false.yml unreach-call symex 5 UNKNOWN - - - 0 32.35 207744 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 33.80 201364 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 33.96 201188 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 33.94 206540 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 33.80 206864 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 33.82 201788 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 1 UNKNOWN - - - 0 32.67 244192 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 2 UNKNOWN - - - 0 32.66 247596 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 3 UNKNOWN - - - 0 32.71 244184 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 4 UNKNOWN - - - 0 32.71 244892 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 5 UNKNOWN - - - 0 32.66 244356 +memsafety-ext/tree_stack.yml valid-memsafety symex 1 UNKNOWN - - - 0 33.05 282904 +memsafety-ext/tree_stack.yml valid-memsafety symex 2 UNKNOWN - - - 0 33.04 281920 +memsafety-ext/tree_stack.yml valid-memsafety symex 3 UNKNOWN - - - 0 33.00 283976 +memsafety-ext/tree_stack.yml valid-memsafety symex 4 UNKNOWN - - - 0 33.00 283912 +memsafety-ext/tree_stack.yml valid-memsafety symex 5 UNKNOWN - - - 0 33.02 283452 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 32.36 173904 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 32.36 173472 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 32.36 173644 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 32.37 176272 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 32.34 176780 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 33.74 445396 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 33.75 443952 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 33.73 443568 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 33.69 442876 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 33.76 443648 +memsafety/960521-1-1.yml valid-memsafety symex 1 FAILED FALSE-FREE 532 main 0 1.48 157108 +memsafety/960521-1-1.yml valid-memsafety symex 2 FAILED FALSE-FREE 532 main 0 1.49 156932 +memsafety/960521-1-1.yml valid-memsafety symex 3 FAILED FALSE-FREE 532 main 0 1.45 156568 +memsafety/960521-1-1.yml valid-memsafety symex 4 FAILED FALSE-FREE 532 main 0 1.44 156420 +memsafety/960521-1-1.yml valid-memsafety symex 5 FAILED FALSE-FREE 532 main 0 1.49 156984 +memsafety/960521-1-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 27.02 156344 +memsafety/960521-1-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 27.23 157812 +memsafety/960521-1-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 27.05 167368 +memsafety/960521-1-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 25.56 157724 +memsafety/960521-1-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 25.93 156576 +memsafety/960521-1-3.yml valid-memsafety symex 1 FAILED FALSE-DEREF 529 main 0 1.47 166892 +memsafety/960521-1-3.yml valid-memsafety symex 2 FAILED FALSE-DEREF 529 main 0 1.49 157004 +memsafety/960521-1-3.yml valid-memsafety symex 3 FAILED FALSE-DEREF 529 main 0 1.50 157872 +memsafety/960521-1-3.yml valid-memsafety symex 4 FAILED FALSE-DEREF 529 main 0 1.47 157236 +memsafety/960521-1-3.yml valid-memsafety symex 5 FAILED FALSE-DEREF 529 main 0 1.48 157312 +memsafety/test-0102-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 32.53 240364 +memsafety/test-0102-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 32.49 240192 +memsafety/test-0102-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 32.53 240600 +memsafety/test-0102-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 32.52 240936 +memsafety/test-0102-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 32.53 240944 diff --git a/tests/cutover/baseline-rust-v2.tsv b/tests/cutover/baseline-rust-v2.tsv new file mode 100644 index 000000000..6535d76a1 --- /dev/null +++ b/tests/cutover/baseline-rust-v2.tsv @@ -0,0 +1,411 @@ +task prp gen rep verdict tag line function witness wall_s maxrss_kb +array-examples/relax-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.60 92376 +array-examples/relax-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.61 92200 +array-examples/relax-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.60 92280 +array-examples/relax-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 0.62 91984 +array-examples/relax-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 0.62 92292 +array-examples/standard_sentinel-2.yml unreach-call afl 1 UNKNOWN - - - 0 9.44 340960 +array-examples/standard_sentinel-2.yml unreach-call afl 2 UNKNOWN - - - 0 9.44 340724 +array-examples/standard_sentinel-2.yml unreach-call afl 3 UNKNOWN - - - 0 9.44 340924 +array-examples/standard_sentinel-2.yml unreach-call afl 4 UNKNOWN - - - 0 9.44 341064 +array-examples/standard_sentinel-2.yml unreach-call afl 5 UNKNOWN - - - 0 9.45 340992 +array-examples/standard_two_index_04.yml unreach-call afl 1 UNKNOWN - - - 0 9.45 340996 +array-examples/standard_two_index_04.yml unreach-call afl 2 UNKNOWN - - - 0 9.43 340984 +array-examples/standard_two_index_04.yml unreach-call afl 3 UNKNOWN - - - 0 9.44 341364 +array-examples/standard_two_index_04.yml unreach-call afl 4 UNKNOWN - - - 0 9.45 340864 +array-examples/standard_two_index_04.yml unreach-call afl 5 UNKNOWN - - - 0 9.44 340900 +array-examples/standard_two_index_05.yml unreach-call afl 1 UNKNOWN - - - 0 9.44 341016 +array-examples/standard_two_index_05.yml unreach-call afl 2 UNKNOWN - - - 0 9.44 340944 +array-examples/standard_two_index_05.yml unreach-call afl 3 UNKNOWN - - - 0 9.43 340928 +array-examples/standard_two_index_05.yml unreach-call afl 4 UNKNOWN - - - 0 9.44 341204 +array-examples/standard_two_index_05.yml unreach-call afl 5 UNKNOWN - - - 0 9.46 341212 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.61 92192 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.59 91832 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.60 92108 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 4 UNKNOWN - - - 0 0.60 92280 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 5 UNKNOWN - - - 0 0.59 92028 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.47 91788 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.46 91876 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.46 92148 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.46 92004 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.45 92240 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.90 340820 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.76 341148 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.76 341056 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 0.76 340828 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 0.76 341056 +array-memsafety/lis_unsafe.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.47 91876 +array-memsafety/lis_unsafe.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.46 91660 +array-memsafety/lis_unsafe.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.47 91904 +array-memsafety/lis_unsafe.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.47 91852 +array-memsafety/lis_unsafe.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.47 91668 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.43 340980 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.45 340772 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.44 340900 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.44 341432 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.44 340964 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 1 FAILED FALSE-FREE 46 main 0 0.61 91428 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 2 FAILED FALSE-FREE 46 main 0 0.59 92228 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 3 FAILED FALSE-FREE 46 main 0 0.60 91428 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 4 FAILED FALSE-FREE 46 main 0 0.60 91556 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 5 FAILED FALSE-FREE 46 main 0 0.59 91240 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.44 340784 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.44 340948 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.43 341176 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.45 341272 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.44 341288 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.45 341132 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.45 341012 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.45 341116 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.45 341420 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.44 341164 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.47 91448 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.46 91176 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.47 91672 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.48 90948 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.46 91672 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 1 FAILED FALSE-MEMTRACK - - 0 0.67 92496 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 2 FAILED FALSE-MEMTRACK - - 0 0.67 91944 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 3 FAILED FALSE-MEMTRACK - - 0 0.68 92420 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 4 FAILED FALSE-MEMTRACK - - 0 0.70 92432 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 5 FAILED FALSE-MEMTRACK - - 0 0.70 93132 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.56 341196 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.55 341132 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.53 340604 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.54 340808 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.55 341076 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 1 FAILED FALSE-FREE 779 free_17 0 0.72 92688 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 2 FAILED FALSE-FREE 779 free_17 0 0.69 92540 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 3 FAILED FALSE-FREE 779 free_17 0 0.71 93060 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 4 FAILED FALSE-FREE 779 free_17 0 0.71 93024 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 5 FAILED FALSE-FREE 779 free_17 0 0.70 92632 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.53 341144 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.52 341132 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.53 340956 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.55 340836 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.54 340592 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.44 340996 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.44 340508 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.44 340720 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.43 341112 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.44 340772 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 1 FAILED FALSE-DEREF 533 main 0 0.61 92052 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 2 FAILED FALSE-DEREF 533 main 0 0.60 91640 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 3 FAILED FALSE-DEREF 533 main 0 0.59 92072 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 4 FAILED FALSE-DEREF 533 main 0 0.61 91812 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 5 FAILED FALSE-DEREF 533 main 0 0.61 91772 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.45 340940 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.51 341372 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.48 341244 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.46 340832 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.45 340904 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 1 FAILED FALSE-FREE 536 main 0 0.59 92476 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 2 FAILED FALSE-FREE 536 main 0 0.61 91664 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 3 FAILED FALSE-FREE 536 main 0 0.59 91472 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 4 FAILED FALSE-FREE 536 main 0 0.61 91736 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 5 FAILED FALSE-FREE 536 main 0 0.59 91660 +list-ext-properties/list-ext.yml unreach-call afl 1 FAILED TARGET-REACHED 556 main 0 0.78 340928 +list-ext-properties/list-ext.yml unreach-call afl 2 FAILED TARGET-REACHED 556 main 0 0.81 341184 +list-ext-properties/list-ext.yml unreach-call afl 3 FAILED TARGET-REACHED 556 main 0 0.76 340552 +list-ext-properties/list-ext.yml unreach-call afl 4 FAILED TARGET-REACHED 556 main 0 0.77 340568 +list-ext-properties/list-ext.yml unreach-call afl 5 FAILED TARGET-REACHED 556 main 0 0.78 340540 +list-ext-properties/list-ext.yml valid-memsafety afl 1 FAILED FALSE-DEREF 558 main 0 0.61 92284 +list-ext-properties/list-ext.yml valid-memsafety afl 2 FAILED FALSE-DEREF 558 main 0 0.63 92044 +list-ext-properties/list-ext.yml valid-memsafety afl 3 FAILED FALSE-DEREF 558 main 0 0.61 92360 +list-ext-properties/list-ext.yml valid-memsafety afl 4 FAILED FALSE-DEREF 558 main 0 0.61 91680 +list-ext-properties/list-ext.yml valid-memsafety afl 5 FAILED FALSE-DEREF 558 main 0 0.59 91956 +list-ext-properties/simple-ext.yml unreach-call afl 1 FAILED TARGET-REACHED 540 main 0 0.61 91960 +list-ext-properties/simple-ext.yml unreach-call afl 2 FAILED TARGET-REACHED 540 main 0 0.59 92076 +list-ext-properties/simple-ext.yml unreach-call afl 3 FAILED TARGET-REACHED 540 main 0 0.60 91704 +list-ext-properties/simple-ext.yml unreach-call afl 4 FAILED TARGET-REACHED 540 main 0 0.60 92000 +list-ext-properties/simple-ext.yml unreach-call afl 5 FAILED TARGET-REACHED 540 main 0 0.59 92044 +list-ext-properties/simple-ext.yml valid-memcleanup afl 1 UNKNOWN - - - 0 9.46 341140 +list-ext-properties/simple-ext.yml valid-memcleanup afl 2 UNKNOWN - - - 0 9.46 340876 +list-ext-properties/simple-ext.yml valid-memcleanup afl 3 UNKNOWN - - - 0 9.46 341088 +list-ext-properties/simple-ext.yml valid-memcleanup afl 4 UNKNOWN - - - 0 9.45 341028 +list-ext-properties/simple-ext.yml valid-memcleanup afl 5 UNKNOWN - - - 0 9.46 341316 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 1 FAILED FALSE-MEMTRACK - - 0 0.60 91780 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 2 FAILED FALSE-MEMTRACK - - 0 0.60 92380 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 3 FAILED FALSE-MEMTRACK - - 0 0.60 92068 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 4 FAILED FALSE-MEMTRACK - - 0 0.59 92616 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 5 FAILED FALSE-MEMTRACK - - 0 0.58 92540 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.47 340712 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.45 340788 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.44 340624 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.44 341140 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.45 340860 +map2check-assert/array_bug.yml unreach-call afl 1 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.60 90700 +map2check-assert/array_bug.yml unreach-call afl 2 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.58 91468 +map2check-assert/array_bug.yml unreach-call afl 3 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.57 90796 +map2check-assert/array_bug.yml unreach-call afl 4 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.59 90764 +map2check-assert/array_bug.yml unreach-call afl 5 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.58 91564 +map2check-assert/byte_add_bug.yml unreach-call afl 1 UNKNOWN - - - 0 9.45 340932 +map2check-assert/byte_add_bug.yml unreach-call afl 2 UNKNOWN - - - 0 9.46 341136 +map2check-assert/byte_add_bug.yml unreach-call afl 3 UNKNOWN - - - 0 9.46 340744 +map2check-assert/byte_add_bug.yml unreach-call afl 4 UNKNOWN - - - 0 9.47 341032 +map2check-assert/byte_add_bug.yml unreach-call afl 5 UNKNOWN - - - 0 9.46 341080 +map2check-assert/check_if_bug.yml unreach-call afl 1 UNKNOWN - - - 0 1.45 90736 +map2check-assert/check_if_bug.yml unreach-call afl 2 UNKNOWN - - - 0 1.45 91656 +map2check-assert/check_if_bug.yml unreach-call afl 3 UNKNOWN - - - 0 1.47 90976 +map2check-assert/check_if_bug.yml unreach-call afl 4 UNKNOWN - - - 0 1.45 90984 +map2check-assert/check_if_bug.yml unreach-call afl 5 UNKNOWN - - - 0 1.45 91308 +map2check-assert/ex01_false.yml unreach-call afl 1 UNKNOWN - - - 0 1.46 91304 +map2check-assert/ex01_false.yml unreach-call afl 2 UNKNOWN - - - 0 1.45 91368 +map2check-assert/ex01_false.yml unreach-call afl 3 UNKNOWN - - - 0 1.45 91208 +map2check-assert/ex01_false.yml unreach-call afl 4 UNKNOWN - - - 0 1.44 90676 +map2check-assert/ex01_false.yml unreach-call afl 5 UNKNOWN - - - 0 1.46 90744 +map2check-assert/ex02_false.yml unreach-call afl 1 UNKNOWN - - - 0 1.44 91132 +map2check-assert/ex02_false.yml unreach-call afl 2 UNKNOWN - - - 0 1.44 90824 +map2check-assert/ex02_false.yml unreach-call afl 3 UNKNOWN - - - 0 1.44 90572 +map2check-assert/ex02_false.yml unreach-call afl 4 UNKNOWN - - - 0 1.45 90536 +map2check-assert/ex02_false.yml unreach-call afl 5 UNKNOWN - - - 0 1.44 91140 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.46 341004 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.45 340788 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.46 340864 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.45 340544 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.45 340976 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.48 91820 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.46 92232 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.46 91864 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.47 91804 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.47 92524 +memsafety-ext/tree_stack.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.47 91908 +memsafety-ext/tree_stack.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.47 91664 +memsafety-ext/tree_stack.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.48 91760 +memsafety-ext/tree_stack.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.48 91980 +memsafety-ext/tree_stack.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.47 91968 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.48 91732 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.46 92008 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.47 92460 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.47 91736 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.48 92048 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.50 92108 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.48 92220 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.49 92452 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.50 92732 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.49 92076 +memsafety/960521-1-1.yml valid-memsafety afl 1 FAILED FALSE-FREE 532 main 0 0.59 91732 +memsafety/960521-1-1.yml valid-memsafety afl 2 FAILED FALSE-FREE 532 main 0 0.59 92744 +memsafety/960521-1-1.yml valid-memsafety afl 3 FAILED FALSE-FREE 532 main 0 0.57 91732 +memsafety/960521-1-1.yml valid-memsafety afl 4 FAILED FALSE-FREE 532 main 0 0.58 91472 +memsafety/960521-1-1.yml valid-memsafety afl 5 FAILED FALSE-FREE 532 main 0 0.61 91548 +memsafety/960521-1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.45 340752 +memsafety/960521-1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.46 340852 +memsafety/960521-1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.45 340984 +memsafety/960521-1-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.45 341216 +memsafety/960521-1-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.44 340784 +memsafety/960521-1-3.yml valid-memsafety afl 1 FAILED FALSE-DEREF 529 main 0 0.61 92324 +memsafety/960521-1-3.yml valid-memsafety afl 2 FAILED FALSE-DEREF 529 main 0 0.61 91776 +memsafety/960521-1-3.yml valid-memsafety afl 3 FAILED FALSE-DEREF 529 main 0 0.60 91828 +memsafety/960521-1-3.yml valid-memsafety afl 4 FAILED FALSE-DEREF 529 main 0 0.62 92420 +memsafety/960521-1-3.yml valid-memsafety afl 5 FAILED FALSE-DEREF 529 main 0 0.60 91888 +memsafety/test-0102-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.48 91960 +memsafety/test-0102-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.49 91744 +memsafety/test-0102-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.48 92908 +memsafety/test-0102-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.50 92740 +memsafety/test-0102-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.48 92220 +array-examples/relax-1.yml valid-memsafety symex 1 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 1.73 173312 +array-examples/relax-1.yml valid-memsafety symex 2 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 1.68 174236 +array-examples/relax-1.yml valid-memsafety symex 3 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 1.72 174264 +array-examples/relax-1.yml valid-memsafety symex 4 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 1.73 174372 +array-examples/relax-1.yml valid-memsafety symex 5 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 1.73 173644 +array-examples/standard_sentinel-2.yml unreach-call symex 1 UNKNOWN - - - 0 32.52 207684 +array-examples/standard_sentinel-2.yml unreach-call symex 2 UNKNOWN - - - 0 32.52 208052 +array-examples/standard_sentinel-2.yml unreach-call symex 3 UNKNOWN - - - 0 32.50 210292 +array-examples/standard_sentinel-2.yml unreach-call symex 4 UNKNOWN - - - 0 32.47 207876 +array-examples/standard_sentinel-2.yml unreach-call symex 5 UNKNOWN - - - 0 32.46 208272 +array-examples/standard_two_index_04.yml unreach-call symex 1 UNKNOWN - - - 0 32.50 208936 +array-examples/standard_two_index_04.yml unreach-call symex 2 UNKNOWN - - - 0 32.51 211456 +array-examples/standard_two_index_04.yml unreach-call symex 3 UNKNOWN - - - 0 32.49 210104 +array-examples/standard_two_index_04.yml unreach-call symex 4 UNKNOWN - - - 0 32.52 209684 +array-examples/standard_two_index_04.yml unreach-call symex 5 UNKNOWN - - - 0 32.52 208500 +array-examples/standard_two_index_05.yml unreach-call symex 1 UNKNOWN - - - 0 32.46 208960 +array-examples/standard_two_index_05.yml unreach-call symex 2 UNKNOWN - - - 0 32.52 208820 +array-examples/standard_two_index_05.yml unreach-call symex 3 UNKNOWN - - - 0 32.45 209412 +array-examples/standard_two_index_05.yml unreach-call symex 4 UNKNOWN - - - 0 32.48 208460 +array-examples/standard_two_index_05.yml unreach-call symex 5 UNKNOWN - - - 0 32.48 209004 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 1 FAILED FALSE-DEREF 522 main 0 1.53 172764 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 2 FAILED FALSE-DEREF 522 main 0 1.55 172712 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 3 FAILED FALSE-DEREF 522 main 0 1.54 172372 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 4 FAILED FALSE-DEREF 522 main 0 1.56 174524 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 5 FAILED FALSE-DEREF 522 main 0 1.58 171772 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 32.59 192832 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 32.56 197836 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 32.58 192304 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 32.52 198024 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 32.64 199776 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.54 172988 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.58 172652 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.58 172780 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.52 172816 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.52 172516 +array-memsafety/lis_unsafe.yml valid-memsafety symex 1 UNKNOWN - - - 0 1.49 172324 +array-memsafety/lis_unsafe.yml valid-memsafety symex 2 UNKNOWN - - - 0 1.50 172840 +array-memsafety/lis_unsafe.yml valid-memsafety symex 3 UNKNOWN - - - 0 1.58 172976 +array-memsafety/lis_unsafe.yml valid-memsafety symex 4 UNKNOWN - - - 0 1.48 172932 +array-memsafety/lis_unsafe.yml valid-memsafety symex 5 UNKNOWN - - - 0 1.43 173044 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.48 156448 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.37 156472 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.36 156248 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.37 156608 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.42 166712 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 1 FAILED FALSE-FREE 46 main 0 1.40 167056 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 2 FAILED FALSE-FREE 46 main 0 1.39 156656 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 3 FAILED FALSE-FREE 46 main 0 1.40 166804 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 4 FAILED FALSE-FREE 46 main 0 1.38 156880 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 5 FAILED FALSE-FREE 46 main 0 1.38 156768 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 1.39 165244 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 1.35 155136 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 1.35 155136 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 1.36 154780 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 1.36 155724 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 1 SUCCEEDED - - - 0 20.08 157112 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 2 SUCCEEDED - - - 0 20.57 157660 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 3 SUCCEEDED - - - 0 20.87 157536 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 4 SUCCEEDED - - - 0 20.60 156952 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 5 SUCCEEDED - - - 0 19.56 158040 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 1 UNKNOWN - - - 0 32.32 157232 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 2 UNKNOWN - - - 0 32.35 155648 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 3 UNKNOWN - - - 0 32.37 157124 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 4 UNKNOWN - - - 0 32.36 157036 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 5 UNKNOWN - - - 0 32.36 156184 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 1 FAILED FALSE-MEMTRACK - - 0 1.68 164192 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 2 FAILED FALSE-MEMTRACK - - 0 1.67 167496 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 3 FAILED FALSE-MEMTRACK - - 0 1.60 165896 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 4 FAILED FALSE-MEMTRACK - - 0 1.62 164944 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 5 FAILED FALSE-MEMTRACK - - 0 1.66 165456 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 2.34 165980 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 2.32 167504 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 2.41 166108 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 2.27 165988 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 2.31 165840 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 1 FAILED FALSE-FREE 779 free_17 0 2.66 167252 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 2 FAILED FALSE-FREE 779 free_17 0 2.67 167372 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 3 FAILED FALSE-FREE 779 free_17 0 2.69 167076 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 4 FAILED FALSE-FREE 779 free_17 0 2.64 167188 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 5 FAILED FALSE-FREE 779 free_17 0 2.72 167888 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.61 165720 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.62 165068 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.62 164252 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.69 165232 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.68 164884 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.34 155332 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.38 155912 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.34 156212 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.38 155908 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.37 155828 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 1 FAILED FALSE-DEREF 533 main 0 1.53 173048 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 2 FAILED FALSE-DEREF 533 main 0 1.55 173252 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 3 FAILED FALSE-DEREF 533 main 0 1.54 172800 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 4 FAILED FALSE-DEREF 533 main 0 1.55 172176 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 5 FAILED FALSE-DEREF 533 main 0 1.55 173048 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 3.93 173684 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 3.97 172928 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 3.93 173900 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 4.09 164948 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 3.91 165244 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 1 FAILED FALSE-FREE 536 main 0 1.54 172412 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 2 FAILED FALSE-FREE 536 main 0 1.57 172328 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 3 FAILED FALSE-FREE 536 main 0 1.56 172712 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 4 FAILED FALSE-FREE 536 main 0 1.53 173140 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 5 FAILED FALSE-FREE 536 main 0 1.59 172932 +list-ext-properties/list-ext.yml unreach-call symex 1 FAILED TARGET-REACHED 556 main 0 1.50 166172 +list-ext-properties/list-ext.yml unreach-call symex 2 FAILED TARGET-REACHED 556 main 0 1.52 166452 +list-ext-properties/list-ext.yml unreach-call symex 3 FAILED TARGET-REACHED 556 main 0 1.50 172356 +list-ext-properties/list-ext.yml unreach-call symex 4 FAILED TARGET-REACHED 556 main 0 1.51 165164 +list-ext-properties/list-ext.yml unreach-call symex 5 FAILED TARGET-REACHED 556 main 0 1.48 165580 +list-ext-properties/list-ext.yml valid-memsafety symex 1 FAILED FALSE-DEREF 558 main 0 6.22 174248 +list-ext-properties/list-ext.yml valid-memsafety symex 2 FAILED FALSE-DEREF 558 main 0 6.56 168228 +list-ext-properties/list-ext.yml valid-memsafety symex 3 FAILED FALSE-DEREF 558 main 0 6.62 167960 +list-ext-properties/list-ext.yml valid-memsafety symex 4 FAILED FALSE-DEREF 558 main 0 6.52 176644 +list-ext-properties/list-ext.yml valid-memsafety symex 5 FAILED FALSE-DEREF 558 main 0 6.49 167436 +list-ext-properties/simple-ext.yml unreach-call symex 1 FAILED TARGET-REACHED 540 main 0 1.44 162916 +list-ext-properties/simple-ext.yml unreach-call symex 2 FAILED TARGET-REACHED 540 main 0 1.41 165244 +list-ext-properties/simple-ext.yml unreach-call symex 3 FAILED TARGET-REACHED 540 main 0 1.43 162688 +list-ext-properties/simple-ext.yml unreach-call symex 4 FAILED TARGET-REACHED 540 main 0 1.42 163680 +list-ext-properties/simple-ext.yml unreach-call symex 5 FAILED TARGET-REACHED 540 main 0 1.47 162788 +list-ext-properties/simple-ext.yml valid-memcleanup symex 1 UNKNOWN - - - 0 1.52 162836 +list-ext-properties/simple-ext.yml valid-memcleanup symex 2 UNKNOWN - - - 0 1.52 163460 +list-ext-properties/simple-ext.yml valid-memcleanup symex 3 UNKNOWN - - - 0 1.58 163724 +list-ext-properties/simple-ext.yml valid-memcleanup symex 4 UNKNOWN - - - 0 1.55 171836 +list-ext-properties/simple-ext.yml valid-memcleanup symex 5 UNKNOWN - - - 0 1.57 163576 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 1 FAILED FALSE-MEMTRACK - - 0 1.44 156960 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 2 FAILED FALSE-MEMTRACK - - 0 1.40 156508 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 3 FAILED FALSE-MEMTRACK - - 0 1.41 157092 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 4 FAILED FALSE-MEMTRACK - - 0 1.40 168888 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 5 FAILED FALSE-MEMTRACK - - 0 1.43 159220 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 1.38 163912 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 1.42 164156 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 1.39 164080 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 1.42 172680 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 1.40 172856 +map2check-assert/array_bug.yml unreach-call symex 1 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 1.40 163752 +map2check-assert/array_bug.yml unreach-call symex 2 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 1.36 163816 +map2check-assert/array_bug.yml unreach-call symex 3 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 1.40 163004 +map2check-assert/array_bug.yml unreach-call symex 4 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 1.38 163468 +map2check-assert/array_bug.yml unreach-call symex 5 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 1.36 163700 +map2check-assert/byte_add_bug.yml unreach-call symex 1 SUCCEEDED - - - 0 1.32 155760 +map2check-assert/byte_add_bug.yml unreach-call symex 2 SUCCEEDED - - - 0 1.34 155828 +map2check-assert/byte_add_bug.yml unreach-call symex 3 SUCCEEDED - - - 0 1.37 155308 +map2check-assert/byte_add_bug.yml unreach-call symex 4 SUCCEEDED - - - 0 1.35 158528 +map2check-assert/byte_add_bug.yml unreach-call symex 5 SUCCEEDED - - - 0 1.38 155868 +map2check-assert/check_if_bug.yml unreach-call symex 1 UNKNOWN - - - 0 32.96 208548 +map2check-assert/check_if_bug.yml unreach-call symex 2 UNKNOWN - - - 0 32.81 210100 +map2check-assert/check_if_bug.yml unreach-call symex 3 UNKNOWN - - - 0 32.88 210860 +map2check-assert/check_if_bug.yml unreach-call symex 4 UNKNOWN - - - 0 32.89 210624 +map2check-assert/check_if_bug.yml unreach-call symex 5 UNKNOWN - - - 0 32.88 206772 +map2check-assert/ex01_false.yml unreach-call symex 1 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 2.99 171952 +map2check-assert/ex01_false.yml unreach-call symex 2 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 3.08 172292 +map2check-assert/ex01_false.yml unreach-call symex 3 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 3.00 172088 +map2check-assert/ex01_false.yml unreach-call symex 4 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 2.95 171892 +map2check-assert/ex01_false.yml unreach-call symex 5 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 2.99 172100 +map2check-assert/ex02_false.yml unreach-call symex 1 UNKNOWN - - - 0 32.39 207772 +map2check-assert/ex02_false.yml unreach-call symex 2 UNKNOWN - - - 0 32.41 207624 +map2check-assert/ex02_false.yml unreach-call symex 3 UNKNOWN - - - 0 32.35 207188 +map2check-assert/ex02_false.yml unreach-call symex 4 UNKNOWN - - - 0 32.39 210016 +map2check-assert/ex02_false.yml unreach-call symex 5 UNKNOWN - - - 0 32.35 207744 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 33.80 201364 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 33.96 201188 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 33.94 206540 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 33.80 206864 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 33.82 201788 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 1 UNKNOWN - - - 0 32.67 244192 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 2 UNKNOWN - - - 0 32.66 247596 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 3 UNKNOWN - - - 0 32.71 244184 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 4 UNKNOWN - - - 0 32.71 244892 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 5 UNKNOWN - - - 0 32.66 244356 +memsafety-ext/tree_stack.yml valid-memsafety symex 1 UNKNOWN - - - 0 33.05 282904 +memsafety-ext/tree_stack.yml valid-memsafety symex 2 UNKNOWN - - - 0 33.04 281920 +memsafety-ext/tree_stack.yml valid-memsafety symex 3 UNKNOWN - - - 0 33.00 283976 +memsafety-ext/tree_stack.yml valid-memsafety symex 4 UNKNOWN - - - 0 33.00 283912 +memsafety-ext/tree_stack.yml valid-memsafety symex 5 UNKNOWN - - - 0 33.02 283452 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 32.36 173904 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 32.36 173472 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 32.36 173644 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 32.37 176272 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 32.34 176780 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 33.74 445396 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 33.75 443952 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 33.73 443568 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 33.69 442876 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 33.76 443648 +memsafety/960521-1-1.yml valid-memsafety symex 1 FAILED FALSE-FREE 532 main 0 1.48 157108 +memsafety/960521-1-1.yml valid-memsafety symex 2 FAILED FALSE-FREE 532 main 0 1.49 156932 +memsafety/960521-1-1.yml valid-memsafety symex 3 FAILED FALSE-FREE 532 main 0 1.45 156568 +memsafety/960521-1-1.yml valid-memsafety symex 4 FAILED FALSE-FREE 532 main 0 1.44 156420 +memsafety/960521-1-1.yml valid-memsafety symex 5 FAILED FALSE-FREE 532 main 0 1.49 156984 +memsafety/960521-1-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 27.02 156344 +memsafety/960521-1-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 27.23 157812 +memsafety/960521-1-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 27.05 167368 +memsafety/960521-1-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 25.56 157724 +memsafety/960521-1-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 25.93 156576 +memsafety/960521-1-3.yml valid-memsafety symex 1 FAILED FALSE-DEREF 529 main 0 1.47 166892 +memsafety/960521-1-3.yml valid-memsafety symex 2 FAILED FALSE-DEREF 529 main 0 1.49 157004 +memsafety/960521-1-3.yml valid-memsafety symex 3 FAILED FALSE-DEREF 529 main 0 1.50 157872 +memsafety/960521-1-3.yml valid-memsafety symex 4 FAILED FALSE-DEREF 529 main 0 1.47 157236 +memsafety/960521-1-3.yml valid-memsafety symex 5 FAILED FALSE-DEREF 529 main 0 1.48 157312 +memsafety/test-0102-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 32.53 240364 +memsafety/test-0102-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 32.49 240192 +memsafety/test-0102-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 32.53 240600 +memsafety/test-0102-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 32.52 240936 +memsafety/test-0102-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 32.53 240944 diff --git a/tests/cutover/baseline-rust.tsv b/tests/cutover/baseline-rust.tsv new file mode 100644 index 000000000..2474e34d4 --- /dev/null +++ b/tests/cutover/baseline-rust.tsv @@ -0,0 +1,411 @@ +task prp gen rep verdict tag line function witness wall_s maxrss_kb +array-examples/relax-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.60 92376 +array-examples/relax-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.61 92200 +array-examples/relax-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.60 92280 +array-examples/relax-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 0.62 91984 +array-examples/relax-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 0.62 92292 +array-examples/relax-1.yml valid-memsafety symex 1 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 3.43 226436 +array-examples/relax-1.yml valid-memsafety symex 2 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 3.43 227548 +array-examples/relax-1.yml valid-memsafety symex 3 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 3.32 227900 +array-examples/relax-1.yml valid-memsafety symex 4 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 3.27 217960 +array-examples/relax-1.yml valid-memsafety symex 5 FAILED FALSE-DEREF 570 is_relaxed_prefix 0 3.47 227432 +array-examples/standard_sentinel-2.yml unreach-call afl 1 UNKNOWN - - - 0 9.44 340960 +array-examples/standard_sentinel-2.yml unreach-call afl 2 UNKNOWN - - - 0 9.44 340724 +array-examples/standard_sentinel-2.yml unreach-call afl 3 UNKNOWN - - - 0 9.44 340924 +array-examples/standard_sentinel-2.yml unreach-call afl 4 UNKNOWN - - - 0 9.44 341064 +array-examples/standard_sentinel-2.yml unreach-call afl 5 UNKNOWN - - - 0 9.45 340992 +array-examples/standard_sentinel-2.yml unreach-call symex 1 UNKNOWN - - - 0 34.22 254128 +array-examples/standard_sentinel-2.yml unreach-call symex 2 UNKNOWN - - - 0 34.19 253748 +array-examples/standard_sentinel-2.yml unreach-call symex 3 UNKNOWN - - - 0 34.03 254648 +array-examples/standard_sentinel-2.yml unreach-call symex 4 UNKNOWN - - - 0 34.06 254224 +array-examples/standard_sentinel-2.yml unreach-call symex 5 UNKNOWN - - - 0 34.17 253264 +array-examples/standard_two_index_04.yml unreach-call afl 1 UNKNOWN - - - 0 9.45 340996 +array-examples/standard_two_index_04.yml unreach-call afl 2 UNKNOWN - - - 0 9.43 340984 +array-examples/standard_two_index_04.yml unreach-call afl 3 UNKNOWN - - - 0 9.44 341364 +array-examples/standard_two_index_04.yml unreach-call afl 4 UNKNOWN - - - 0 9.45 340864 +array-examples/standard_two_index_04.yml unreach-call afl 5 UNKNOWN - - - 0 9.44 340900 +array-examples/standard_two_index_04.yml unreach-call symex 1 UNKNOWN - - - 0 34.11 254292 +array-examples/standard_two_index_04.yml unreach-call symex 2 UNKNOWN - - - 0 34.09 253788 +array-examples/standard_two_index_04.yml unreach-call symex 3 UNKNOWN - - - 0 34.14 254024 +array-examples/standard_two_index_04.yml unreach-call symex 4 UNKNOWN - - - 0 34.08 254160 +array-examples/standard_two_index_04.yml unreach-call symex 5 UNKNOWN - - - 0 34.19 253924 +array-examples/standard_two_index_05.yml unreach-call afl 1 UNKNOWN - - - 0 9.44 341016 +array-examples/standard_two_index_05.yml unreach-call afl 2 UNKNOWN - - - 0 9.44 340944 +array-examples/standard_two_index_05.yml unreach-call afl 3 UNKNOWN - - - 0 9.43 340928 +array-examples/standard_two_index_05.yml unreach-call afl 4 UNKNOWN - - - 0 9.44 341204 +array-examples/standard_two_index_05.yml unreach-call afl 5 UNKNOWN - - - 0 9.46 341212 +array-examples/standard_two_index_05.yml unreach-call symex 1 UNKNOWN - - - 0 34.14 253068 +array-examples/standard_two_index_05.yml unreach-call symex 2 UNKNOWN - - - 0 34.10 254048 +array-examples/standard_two_index_05.yml unreach-call symex 3 UNKNOWN - - - 0 34.14 256884 +array-examples/standard_two_index_05.yml unreach-call symex 4 UNKNOWN - - - 0 34.13 253584 +array-examples/standard_two_index_05.yml unreach-call symex 5 UNKNOWN - - - 0 34.09 253880 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 1 UNKNOWN - - - 0 0.61 92192 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.59 91832 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.60 92108 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 4 UNKNOWN - - - 0 0.60 92280 +array-memsafety/add_last_unsafe.yml valid-memsafety afl 5 UNKNOWN - - - 0 0.59 92028 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 1 FAILED FALSE-DEREF 522 main 0 3.16 216456 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 2 FAILED FALSE-DEREF 522 main 0 3.22 216188 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 3 FAILED FALSE-DEREF 522 main 0 3.24 216780 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 4 FAILED FALSE-DEREF 522 main 0 3.16 226292 +array-memsafety/add_last_unsafe.yml valid-memsafety symex 5 FAILED FALSE-DEREF 522 main 0 3.30 225644 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.47 91788 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.46 91876 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.46 92148 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.46 92004 +array-memsafety/array01-alloca-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.45 92240 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 34.23 238592 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 34.27 239044 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 34.16 238780 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 34.25 238520 +array-memsafety/array01-alloca-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 34.22 238344 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.90 340820 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 0.76 341148 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 0.76 341056 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 0.76 340828 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 0.76 341056 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 3.23 227308 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 3.29 227440 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 3.20 229752 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 3.25 227516 +array-memsafety/insertionsort-alloca-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 3.33 215964 +array-memsafety/lis_unsafe.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.47 91876 +array-memsafety/lis_unsafe.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.46 91660 +array-memsafety/lis_unsafe.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.47 91904 +array-memsafety/lis_unsafe.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.47 91852 +array-memsafety/lis_unsafe.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.47 91668 +array-memsafety/lis_unsafe.yml valid-memsafety symex 1 UNKNOWN - - - 0 3.24 227400 +array-memsafety/lis_unsafe.yml valid-memsafety symex 2 UNKNOWN - - - 0 3.33 227488 +array-memsafety/lis_unsafe.yml valid-memsafety symex 3 UNKNOWN - - - 0 3.26 227780 +array-memsafety/lis_unsafe.yml valid-memsafety symex 4 UNKNOWN - - - 0 3.37 217408 +array-memsafety/lis_unsafe.yml valid-memsafety symex 5 UNKNOWN - - - 0 3.19 217612 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.43 340980 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.45 340772 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.44 340900 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.44 341432 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.44 340964 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 3.02 221728 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 3.06 220928 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 3.09 221624 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 3.10 220748 +ldv-memsafety-bitfields/test-bitfields-1-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 3.11 219784 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 1 FAILED FALSE-FREE 46 main 0 0.61 91428 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 2 FAILED FALSE-FREE 46 main 0 0.59 92228 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 3 FAILED FALSE-FREE 46 main 0 0.60 91428 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 4 FAILED FALSE-FREE 46 main 0 0.60 91556 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety afl 5 FAILED FALSE-FREE 46 main 0 0.59 91240 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 1 FAILED FALSE-FREE 46 main 0 3.11 201440 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 2 FAILED FALSE-FREE 46 main 0 3.22 219780 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 3 FAILED FALSE-FREE 46 main 0 3.21 219596 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 4 FAILED FALSE-FREE 46 main 0 3.09 202484 +ldv-memsafety-bitfields/test-bitfields-2.1-2.yml valid-memsafety symex 5 FAILED FALSE-FREE 46 main 0 3.06 202892 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.44 340784 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.44 340948 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.43 341176 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.45 341272 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.44 341288 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 3.21 200960 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 3.15 200808 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 3.23 200336 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 3.21 200536 +ldv-memsafety-bitfields/test-bitfields-3.1-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 3.15 200584 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.45 341132 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.45 341012 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.45 341116 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.45 341420 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.44 341164 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 1 SUCCEEDED - - - 0 22.58 220100 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 2 SUCCEEDED - - - 0 21.81 201920 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 3 SUCCEEDED - - - 0 22.88 220620 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 4 SUCCEEDED - - - 0 22.84 202944 +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex 5 SUCCEEDED - - - 0 22.35 203456 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.47 91448 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.46 91176 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.47 91672 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.48 90948 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.46 91672 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 1 UNKNOWN - - - 0 34.11 220684 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 2 UNKNOWN - - - 0 34.13 201604 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 3 UNKNOWN - - - 0 34.03 205008 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 4 UNKNOWN - - - 0 34.10 202236 +ldv-memsafety/ArraysOfVariableLength2.yml valid-memsafety symex 5 UNKNOWN - - - 0 34.07 220100 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 1 FAILED FALSE-MEMTRACK - - 0 0.67 92496 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 2 FAILED FALSE-MEMTRACK - - 0 0.67 91944 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 3 FAILED FALSE-MEMTRACK - - 0 0.68 92420 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 4 FAILED FALSE-MEMTRACK - - 0 0.70 92432 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety afl 5 FAILED FALSE-MEMTRACK - - 0 0.70 93132 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 1 FAILED FALSE-MEMTRACK - - 0 3.57 227392 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 2 FAILED FALSE-MEMTRACK - - 0 3.50 227596 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 3 FAILED FALSE-MEMTRACK - - 0 3.49 209416 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 4 FAILED FALSE-MEMTRACK - - 0 3.45 226872 +ldv-memsafety/memleaks_test1-1.yml valid-memsafety symex 5 FAILED FALSE-MEMTRACK - - 0 3.39 209392 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.56 341196 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.55 341132 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.53 340604 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.54 340808 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.55 341076 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 4.15 209912 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 4.08 210636 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 4.05 210540 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 4.02 210272 +ldv-memsafety/memleaks_test10-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 4.10 210540 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 1 FAILED FALSE-FREE 779 free_17 0 0.72 92688 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 2 FAILED FALSE-FREE 779 free_17 0 0.69 92540 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 3 FAILED FALSE-FREE 779 free_17 0 0.71 93060 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 4 FAILED FALSE-FREE 779 free_17 0 0.71 93024 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety afl 5 FAILED FALSE-FREE 779 free_17 0 0.70 92632 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 1 FAILED FALSE-FREE 779 free_17 0 4.43 212304 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 2 FAILED FALSE-FREE 779 free_17 0 4.52 228120 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 3 FAILED FALSE-FREE 779 free_17 0 4.44 211476 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 4 FAILED FALSE-FREE 779 free_17 0 4.51 211696 +ldv-memsafety/memleaks_test17_2-1.yml valid-memsafety symex 5 FAILED FALSE-FREE 779 free_17 0 4.41 212112 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.53 341144 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.52 341132 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.53 340956 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.55 340836 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.54 340592 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 3.58 209796 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 3.48 209644 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 3.41 210076 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 3.41 209800 +ldv-memsafety/memleaks_test3-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 3.45 209728 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.44 340996 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.44 340508 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.44 340720 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.43 341112 +ldv-memsafety/memsetNonZero.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.44 340772 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 1 SUCCEEDED - - - 0 3.02 200768 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 2 SUCCEEDED - - - 0 3.08 200756 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 3 SUCCEEDED - - - 0 3.16 218684 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 4 SUCCEEDED - - - 0 3.11 218576 +ldv-memsafety/memsetNonZero.yml valid-memsafety symex 5 SUCCEEDED - - - 0 3.10 222872 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 1 FAILED FALSE-DEREF 533 main 0 0.61 92052 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 2 FAILED FALSE-DEREF 533 main 0 0.60 91640 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 3 FAILED FALSE-DEREF 533 main 0 0.59 92072 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 4 FAILED FALSE-DEREF 533 main 0 0.61 91812 +list-ext-properties/960521-1_1-1.yml valid-memsafety afl 5 FAILED FALSE-DEREF 533 main 0 0.61 91772 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 1 FAILED FALSE-DEREF 533 main 0 3.58 225784 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 2 FAILED FALSE-DEREF 533 main 0 3.54 208408 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 3 FAILED FALSE-DEREF 533 main 0 3.37 225440 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 4 FAILED FALSE-DEREF 533 main 0 3.32 226220 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex 5 FAILED FALSE-DEREF 533 main 0 3.32 226376 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.45 340940 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.51 341372 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.48 341244 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.46 340832 +list-ext-properties/960521-1_1-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.45 340904 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 6.13 226480 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 6.72 209508 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 6.22 227704 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 5.93 228328 +list-ext-properties/960521-1_1-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 6.13 209716 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 1 FAILED FALSE-FREE 536 main 0 0.59 92476 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 2 FAILED FALSE-FREE 536 main 0 0.61 91664 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 3 FAILED FALSE-FREE 536 main 0 0.59 91472 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 4 FAILED FALSE-FREE 536 main 0 0.61 91736 +list-ext-properties/960521-1_1-3.yml valid-memsafety afl 5 FAILED FALSE-FREE 536 main 0 0.59 91660 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 1 FAILED FALSE-FREE 536 main 0 3.44 211304 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 2 FAILED FALSE-FREE 536 main 0 3.56 226460 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 3 FAILED FALSE-FREE 536 main 0 3.53 225744 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 4 FAILED FALSE-FREE 536 main 0 3.32 226224 +list-ext-properties/960521-1_1-3.yml valid-memsafety symex 5 FAILED FALSE-FREE 536 main 0 3.28 209232 +list-ext-properties/list-ext.yml unreach-call afl 1 FAILED TARGET-REACHED 556 main 0 0.78 340928 +list-ext-properties/list-ext.yml unreach-call afl 2 FAILED TARGET-REACHED 556 main 0 0.81 341184 +list-ext-properties/list-ext.yml unreach-call afl 3 FAILED TARGET-REACHED 556 main 0 0.76 340552 +list-ext-properties/list-ext.yml unreach-call afl 4 FAILED TARGET-REACHED 556 main 0 0.77 340568 +list-ext-properties/list-ext.yml unreach-call afl 5 FAILED TARGET-REACHED 556 main 0 0.78 340540 +list-ext-properties/list-ext.yml unreach-call symex 1 FAILED TARGET-REACHED 556 main 0 3.39 226868 +list-ext-properties/list-ext.yml unreach-call symex 2 FAILED TARGET-REACHED 556 main 0 3.38 226860 +list-ext-properties/list-ext.yml unreach-call symex 3 FAILED TARGET-REACHED 556 main 0 3.45 208688 +list-ext-properties/list-ext.yml unreach-call symex 4 FAILED TARGET-REACHED 556 main 0 3.29 226288 +list-ext-properties/list-ext.yml unreach-call symex 5 FAILED TARGET-REACHED 556 main 0 3.28 228836 +list-ext-properties/list-ext.yml valid-memsafety afl 1 FAILED FALSE-DEREF 558 main 0 0.61 92284 +list-ext-properties/list-ext.yml valid-memsafety afl 2 FAILED FALSE-DEREF 558 main 0 0.63 92044 +list-ext-properties/list-ext.yml valid-memsafety afl 3 FAILED FALSE-DEREF 558 main 0 0.61 92360 +list-ext-properties/list-ext.yml valid-memsafety afl 4 FAILED FALSE-DEREF 558 main 0 0.61 91680 +list-ext-properties/list-ext.yml valid-memsafety afl 5 FAILED FALSE-DEREF 558 main 0 0.59 91956 +list-ext-properties/list-ext.yml valid-memsafety symex 1 FAILED FALSE-DEREF 558 main 0 8.49 229236 +list-ext-properties/list-ext.yml valid-memsafety symex 2 FAILED FALSE-DEREF 558 main 0 8.60 228864 +list-ext-properties/list-ext.yml valid-memsafety symex 3 FAILED FALSE-DEREF 558 main 0 8.54 211504 +list-ext-properties/list-ext.yml valid-memsafety symex 4 FAILED FALSE-DEREF 558 main 0 8.39 212056 +list-ext-properties/list-ext.yml valid-memsafety symex 5 FAILED FALSE-DEREF 558 main 0 8.39 212324 +list-ext-properties/simple-ext.yml unreach-call afl 1 FAILED TARGET-REACHED 540 main 0 0.61 91960 +list-ext-properties/simple-ext.yml unreach-call afl 2 FAILED TARGET-REACHED 540 main 0 0.59 92076 +list-ext-properties/simple-ext.yml unreach-call afl 3 FAILED TARGET-REACHED 540 main 0 0.60 91704 +list-ext-properties/simple-ext.yml unreach-call afl 4 FAILED TARGET-REACHED 540 main 0 0.60 92000 +list-ext-properties/simple-ext.yml unreach-call afl 5 FAILED TARGET-REACHED 540 main 0 0.59 92044 +list-ext-properties/simple-ext.yml unreach-call symex 1 FAILED TARGET-REACHED 540 main 0 3.27 225072 +list-ext-properties/simple-ext.yml unreach-call symex 2 FAILED TARGET-REACHED 540 main 0 3.26 228396 +list-ext-properties/simple-ext.yml unreach-call symex 3 FAILED TARGET-REACHED 540 main 0 3.20 225288 +list-ext-properties/simple-ext.yml unreach-call symex 4 FAILED TARGET-REACHED 540 main 0 3.32 226460 +list-ext-properties/simple-ext.yml unreach-call symex 5 FAILED TARGET-REACHED 540 main 0 3.19 226720 +list-ext-properties/simple-ext.yml valid-memcleanup afl 1 UNKNOWN - - - 0 9.46 341140 +list-ext-properties/simple-ext.yml valid-memcleanup afl 2 UNKNOWN - - - 0 9.46 340876 +list-ext-properties/simple-ext.yml valid-memcleanup afl 3 UNKNOWN - - - 0 9.46 341088 +list-ext-properties/simple-ext.yml valid-memcleanup afl 4 UNKNOWN - - - 0 9.45 341028 +list-ext-properties/simple-ext.yml valid-memcleanup afl 5 UNKNOWN - - - 0 9.46 341316 +list-ext-properties/simple-ext.yml valid-memcleanup symex 1 UNKNOWN - - - 0 3.29 224264 +list-ext-properties/simple-ext.yml valid-memcleanup symex 2 UNKNOWN - - - 0 3.23 208188 +list-ext-properties/simple-ext.yml valid-memcleanup symex 3 UNKNOWN - - - 0 3.32 226212 +list-ext-properties/simple-ext.yml valid-memcleanup symex 4 UNKNOWN - - - 0 3.49 226604 +list-ext-properties/simple-ext.yml valid-memcleanup symex 5 UNKNOWN - - - 0 3.32 207700 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 1 FAILED FALSE-MEMTRACK - - 0 0.60 91780 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 2 FAILED FALSE-MEMTRACK - - 0 0.60 92380 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 3 FAILED FALSE-MEMTRACK - - 0 0.60 92068 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 4 FAILED FALSE-MEMTRACK - - 0 0.59 92616 +list-ext-properties/test-0019_1-1.yml valid-memsafety afl 5 FAILED FALSE-MEMTRACK - - 0 0.58 92540 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 1 FAILED FALSE-MEMTRACK - - 0 3.17 219960 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 2 FAILED FALSE-MEMTRACK - - 0 3.18 220824 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 3 FAILED FALSE-MEMTRACK - - 0 3.22 220976 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 4 FAILED FALSE-MEMTRACK - - 0 3.26 203036 +list-ext-properties/test-0019_1-1.yml valid-memsafety symex 5 FAILED FALSE-MEMTRACK - - 0 3.28 219484 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.47 340712 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.45 340788 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.44 340624 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.44 341140 +list-ext-properties/test-0158_1-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.45 340860 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 1 SUCCEEDED - - - 0 3.16 225564 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 2 SUCCEEDED - - - 0 3.26 225632 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 3 SUCCEEDED - - - 0 3.30 225480 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 4 SUCCEEDED - - - 0 3.14 211028 +list-ext-properties/test-0158_1-1.yml valid-memsafety symex 5 SUCCEEDED - - - 0 3.10 225460 +map2check-assert/array_bug.yml unreach-call afl 1 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.60 90700 +map2check-assert/array_bug.yml unreach-call afl 2 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.58 91468 +map2check-assert/array_bug.yml unreach-call afl 3 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.57 90796 +map2check-assert/array_bug.yml unreach-call afl 4 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.59 90764 +map2check-assert/array_bug.yml unreach-call afl 5 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 0.58 91564 +map2check-assert/array_bug.yml unreach-call symex 1 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 3.21 225772 +map2check-assert/array_bug.yml unreach-call symex 2 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 3.21 228348 +map2check-assert/array_bug.yml unreach-call symex 3 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 3.15 207020 +map2check-assert/array_bug.yml unreach-call symex 4 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 3.16 224876 +map2check-assert/array_bug.yml unreach-call symex 5 FAILED TARGET-REACHED 7 __VERIFIER_assert 0 3.09 207320 +map2check-assert/byte_add_bug.yml unreach-call afl 1 UNKNOWN - - - 0 9.45 340932 +map2check-assert/byte_add_bug.yml unreach-call afl 2 UNKNOWN - - - 0 9.46 341136 +map2check-assert/byte_add_bug.yml unreach-call afl 3 UNKNOWN - - - 0 9.46 340744 +map2check-assert/byte_add_bug.yml unreach-call afl 4 UNKNOWN - - - 0 9.47 341032 +map2check-assert/byte_add_bug.yml unreach-call afl 5 UNKNOWN - - - 0 9.46 341080 +map2check-assert/byte_add_bug.yml unreach-call symex 1 SUCCEEDED - - - 0 3.17 220320 +map2check-assert/byte_add_bug.yml unreach-call symex 2 SUCCEEDED - - - 0 3.22 203200 +map2check-assert/byte_add_bug.yml unreach-call symex 3 SUCCEEDED - - - 0 3.09 218880 +map2check-assert/byte_add_bug.yml unreach-call symex 4 SUCCEEDED - - - 0 3.23 220980 +map2check-assert/byte_add_bug.yml unreach-call symex 5 SUCCEEDED - - - 0 3.14 220676 +map2check-assert/check_if_bug.yml unreach-call afl 1 UNKNOWN - - - 0 1.45 90736 +map2check-assert/check_if_bug.yml unreach-call afl 2 UNKNOWN - - - 0 1.45 91656 +map2check-assert/check_if_bug.yml unreach-call afl 3 UNKNOWN - - - 0 1.47 90976 +map2check-assert/check_if_bug.yml unreach-call afl 4 UNKNOWN - - - 0 1.45 90984 +map2check-assert/check_if_bug.yml unreach-call afl 5 UNKNOWN - - - 0 1.45 91308 +map2check-assert/check_if_bug.yml unreach-call symex 1 UNKNOWN - - - 0 34.67 254060 +map2check-assert/check_if_bug.yml unreach-call symex 2 UNKNOWN - - - 0 34.72 254024 +map2check-assert/check_if_bug.yml unreach-call symex 3 UNKNOWN - - - 0 34.58 254220 +map2check-assert/check_if_bug.yml unreach-call symex 4 UNKNOWN - - - 0 34.69 255068 +map2check-assert/check_if_bug.yml unreach-call symex 5 UNKNOWN - - - 0 34.66 254548 +map2check-assert/ex01_false.yml unreach-call afl 1 UNKNOWN - - - 0 1.46 91304 +map2check-assert/ex01_false.yml unreach-call afl 2 UNKNOWN - - - 0 1.45 91368 +map2check-assert/ex01_false.yml unreach-call afl 3 UNKNOWN - - - 0 1.45 91208 +map2check-assert/ex01_false.yml unreach-call afl 4 UNKNOWN - - - 0 1.44 90676 +map2check-assert/ex01_false.yml unreach-call afl 5 UNKNOWN - - - 0 1.46 90744 +map2check-assert/ex01_false.yml unreach-call symex 1 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 4.96 225852 +map2check-assert/ex01_false.yml unreach-call symex 2 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 4.86 225744 +map2check-assert/ex01_false.yml unreach-call symex 3 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 4.81 215992 +map2check-assert/ex01_false.yml unreach-call symex 4 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 4.86 217988 +map2check-assert/ex01_false.yml unreach-call symex 5 FAILED TARGET-REACHED 5 __VERIFIER_assert 0 4.78 216124 +map2check-assert/ex02_false.yml unreach-call afl 1 UNKNOWN - - - 0 1.44 91132 +map2check-assert/ex02_false.yml unreach-call afl 2 UNKNOWN - - - 0 1.44 90824 +map2check-assert/ex02_false.yml unreach-call afl 3 UNKNOWN - - - 0 1.44 90572 +map2check-assert/ex02_false.yml unreach-call afl 4 UNKNOWN - - - 0 1.45 90536 +map2check-assert/ex02_false.yml unreach-call afl 5 UNKNOWN - - - 0 1.44 91140 +map2check-assert/ex02_false.yml unreach-call symex 1 UNKNOWN - - - 0 34.17 251868 +map2check-assert/ex02_false.yml unreach-call symex 2 UNKNOWN - - - 0 34.25 250880 +map2check-assert/ex02_false.yml unreach-call symex 3 UNKNOWN - - - 0 34.15 251668 +map2check-assert/ex02_false.yml unreach-call symex 4 UNKNOWN - - - 0 34.24 250468 +map2check-assert/ex02_false.yml unreach-call symex 5 UNKNOWN - - - 0 34.16 251024 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.46 341004 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.45 340788 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.46 340864 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.45 340544 +memory-alloca/c.03-alloca-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.45 340976 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 1 UNKNOWN - - - 0 35.65 247356 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 2 UNKNOWN - - - 0 35.64 246676 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 3 UNKNOWN - - - 0 35.73 244480 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 4 UNKNOWN - - - 0 35.57 245100 +memory-alloca/c.03-alloca-2.yml valid-memsafety symex 5 UNKNOWN - - - 0 35.42 244120 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.48 91820 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.46 92232 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.46 91864 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.47 91804 +memsafety-ext/dll_extends_pointer.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.47 92524 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 1 UNKNOWN - - - 0 34.57 289196 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 2 UNKNOWN - - - 0 34.54 287708 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 3 UNKNOWN - - - 0 34.76 287448 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 4 UNKNOWN - - - 0 35.10 287468 +memsafety-ext/dll_extends_pointer.yml valid-memsafety symex 5 UNKNOWN - - - 0 34.44 289644 +memsafety-ext/tree_stack.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.47 91908 +memsafety-ext/tree_stack.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.47 91664 +memsafety-ext/tree_stack.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.48 91760 +memsafety-ext/tree_stack.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.48 91980 +memsafety-ext/tree_stack.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.47 91968 +memsafety-ext/tree_stack.yml valid-memsafety symex 1 UNKNOWN - - - 0 34.79 323092 +memsafety-ext/tree_stack.yml valid-memsafety symex 2 UNKNOWN - - - 0 34.87 321036 +memsafety-ext/tree_stack.yml valid-memsafety symex 3 UNKNOWN - - - 0 34.72 326928 +memsafety-ext/tree_stack.yml valid-memsafety symex 4 UNKNOWN - - - 0 34.75 325792 +memsafety-ext/tree_stack.yml valid-memsafety symex 5 UNKNOWN - - - 0 34.85 326164 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.48 91732 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.46 92008 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.47 92460 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.47 91736 +memsafety-ext2/length_test03-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.48 92048 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 34.12 221528 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 34.16 230884 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 34.11 219528 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 34.08 231356 +memsafety-ext2/length_test03-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 34.14 219212 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.50 92108 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.48 92220 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.49 92452 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.50 92732 +memsafety-ext2/split_list_test05-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.49 92076 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 35.70 458696 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 35.41 472032 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 35.50 473600 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 35.63 470916 +memsafety-ext2/split_list_test05-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 35.42 475664 +memsafety/960521-1-1.yml valid-memsafety afl 1 FAILED FALSE-FREE 532 main 0 0.59 91732 +memsafety/960521-1-1.yml valid-memsafety afl 2 FAILED FALSE-FREE 532 main 0 0.59 92744 +memsafety/960521-1-1.yml valid-memsafety afl 3 FAILED FALSE-FREE 532 main 0 0.57 91732 +memsafety/960521-1-1.yml valid-memsafety afl 4 FAILED FALSE-FREE 532 main 0 0.58 91472 +memsafety/960521-1-1.yml valid-memsafety afl 5 FAILED FALSE-FREE 532 main 0 0.61 91548 +memsafety/960521-1-1.yml valid-memsafety symex 1 FAILED FALSE-FREE 532 main 0 3.28 219840 +memsafety/960521-1-1.yml valid-memsafety symex 2 FAILED FALSE-FREE 532 main 0 3.32 219692 +memsafety/960521-1-1.yml valid-memsafety symex 3 FAILED FALSE-FREE 532 main 0 3.29 202108 +memsafety/960521-1-1.yml valid-memsafety symex 4 FAILED FALSE-FREE 532 main 0 3.28 220396 +memsafety/960521-1-1.yml valid-memsafety symex 5 FAILED FALSE-FREE 532 main 0 3.38 219828 +memsafety/960521-1-2.yml valid-memsafety afl 1 UNKNOWN - - - 0 9.45 340752 +memsafety/960521-1-2.yml valid-memsafety afl 2 UNKNOWN - - - 0 9.46 340852 +memsafety/960521-1-2.yml valid-memsafety afl 3 UNKNOWN - - - 0 9.45 340984 +memsafety/960521-1-2.yml valid-memsafety afl 4 UNKNOWN - - - 0 9.45 341216 +memsafety/960521-1-2.yml valid-memsafety afl 5 UNKNOWN - - - 0 9.44 340784 +memsafety/960521-1-2.yml valid-memsafety symex 1 SUCCEEDED - - - 0 30.01 219572 +memsafety/960521-1-2.yml valid-memsafety symex 2 SUCCEEDED - - - 0 32.06 219864 +memsafety/960521-1-2.yml valid-memsafety symex 3 SUCCEEDED - - - 0 32.88 220076 +memsafety/960521-1-2.yml valid-memsafety symex 4 SUCCEEDED - - - 0 31.28 204672 +memsafety/960521-1-2.yml valid-memsafety symex 5 SUCCEEDED - - - 0 30.40 219456 +memsafety/960521-1-3.yml valid-memsafety afl 1 FAILED FALSE-DEREF 529 main 0 0.61 92324 +memsafety/960521-1-3.yml valid-memsafety afl 2 FAILED FALSE-DEREF 529 main 0 0.61 91776 +memsafety/960521-1-3.yml valid-memsafety afl 3 FAILED FALSE-DEREF 529 main 0 0.60 91828 +memsafety/960521-1-3.yml valid-memsafety afl 4 FAILED FALSE-DEREF 529 main 0 0.62 92420 +memsafety/960521-1-3.yml valid-memsafety afl 5 FAILED FALSE-DEREF 529 main 0 0.60 91888 +memsafety/960521-1-3.yml valid-memsafety symex 1 FAILED FALSE-DEREF 529 main 0 3.53 218924 +memsafety/960521-1-3.yml valid-memsafety symex 2 FAILED FALSE-DEREF 529 main 0 3.30 222048 +memsafety/960521-1-3.yml valid-memsafety symex 3 FAILED FALSE-DEREF 529 main 0 3.36 219980 +memsafety/960521-1-3.yml valid-memsafety symex 4 FAILED FALSE-DEREF 529 main 0 3.36 202212 +memsafety/960521-1-3.yml valid-memsafety symex 5 FAILED FALSE-DEREF 529 main 0 3.29 220108 +memsafety/test-0102-1.yml valid-memsafety afl 1 UNKNOWN - - - 0 1.48 91960 +memsafety/test-0102-1.yml valid-memsafety afl 2 UNKNOWN - - - 0 1.49 91744 +memsafety/test-0102-1.yml valid-memsafety afl 3 UNKNOWN - - - 0 1.48 92908 +memsafety/test-0102-1.yml valid-memsafety afl 4 UNKNOWN - - - 0 1.50 92740 +memsafety/test-0102-1.yml valid-memsafety afl 5 UNKNOWN - - - 0 1.48 92220 +memsafety/test-0102-1.yml valid-memsafety symex 1 UNKNOWN - - - 0 34.28 284444 +memsafety/test-0102-1.yml valid-memsafety symex 2 UNKNOWN - - - 0 34.59 269004 +memsafety/test-0102-1.yml valid-memsafety symex 3 UNKNOWN - - - 0 36.39 268464 +memsafety/test-0102-1.yml valid-memsafety symex 4 UNKNOWN - - - 0 34.94 271516 +memsafety/test-0102-1.yml valid-memsafety symex 5 UNKNOWN - - - 0 34.89 278452 diff --git a/tests/cutover/deltas-aceitos.tsv b/tests/cutover/deltas-aceitos.tsv new file mode 100644 index 000000000..4fa02dbd8 --- /dev/null +++ b/tests/cutover/deltas-aceitos.tsv @@ -0,0 +1,20 @@ +task prp gen field c_value rust_value sd_ref +ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex verdict UNKNOWN SUCCEEDED GANHO-ORCAMENTO +memsafety/960521-1-2.yml valid-memsafety symex verdict UNKNOWN SUCCEEDED GANHO-ORCAMENTO +list-ext-properties/list-ext.yml unreach-call afl verdict UNKNOWN FAILED UB-BENCHMARK-list-ext +list-ext-properties/list-ext.yml unreach-call afl tag - TARGET-REACHED UB-BENCHMARK-list-ext +list-ext-properties/list-ext.yml unreach-call afl line - 556 UB-BENCHMARK-list-ext +list-ext-properties/list-ext.yml unreach-call afl function - main UB-BENCHMARK-list-ext +array-examples/standard_sentinel-2.yml unreach-call afl verdict OOM UNKNOWN SD-21 +array-examples/standard_two_index_04.yml unreach-call afl verdict OOM UNKNOWN SD-21 +array-examples/standard_two_index_05.yml unreach-call afl verdict OOM UNKNOWN SD-21 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex line 0 533 SD-20 +list-ext-properties/960521-1_1-1.yml valid-memsafety symex function - main SD-20 +list-ext-properties/simple-ext.yml unreach-call symex verdict UNKNOWN FAILED SD-20 +list-ext-properties/simple-ext.yml unreach-call symex tag - TARGET-REACHED SD-20 +list-ext-properties/simple-ext.yml unreach-call symex line - 540 SD-20 +list-ext-properties/simple-ext.yml unreach-call symex function - main SD-20 +map2check-assert/ex01_false.yml unreach-call symex verdict UNKNOWN FAILED SD-20 +map2check-assert/ex01_false.yml unreach-call symex tag - TARGET-REACHED SD-20 +map2check-assert/ex01_false.yml unreach-call symex line - 5 SD-20 +map2check-assert/ex01_false.yml unreach-call symex function - __VERIFIER_assert SD-20 diff --git a/tests/cutover/gate-report.md b/tests/cutover/gate-report.md new file mode 100644 index 000000000..0a476d128 --- /dev/null +++ b/tests/cutover/gate-report.md @@ -0,0 +1,425 @@ +# Gate diferencial (Task 4.2) e memória D3/D4 (Task 4.3), execução 1 + +**Result: `gate` FAIL, both without and with the proposed accepted deltas.** The wall-time median passes, the TIMEOUT counts pass, and no Rust defect was found. Two kinds of rows still block: + +- C defects that need a new SD; +- the median RSS ratio (1.36 against the 1.25 limit). + +## Setup + +### Rust side + +- Map2Check-rust `7cc8ac7a` (the runner files are from `20e0572b`, which does not change the binary). +- map2check-library `44585e8` (cutover/runtime-rust), built from a `git archive` with a fresh `CARGO_TARGET_DIR`: + - `cargo build --profile runtime --features libfuzzer,wasm`; + - `scripts/build-klee-runtime.sh` (rustc 1.72.1, LLVM 16.0.5). +- Installed into fresh `build-gate2/` and `release-gate2/` with `-G Ninja -DLLVM_DIR=/usr/lib/llvm-16/lib/cmake/llvm -DMAP2CHECK_DYNAMIC_LINK=ON -DMAP2CHECK_RUST_LIB_DIR=… -DMAP2CHECK_RUST_KLEE_BC=…`, plus the klee/clang symlinks. `cmp` confirms that the installed `.a` and `.bc` are the ones built. +- `release-gate2/map2check` mtime: 2026-10-16 19:05:06 -0400. +- sha256 prefixes: `map2check-klee.bc` 1f5edca0756922dc, `libmap2check.a` fda95ed02de3954a. +- Image: `map2check-dev:cutover-klee-rust-time` (`sha256:ef46e184…`), which is `cutover-klee-rust` plus GNU `time`. + +### C side + +- `Map2Check-cutover/release-afl`, built from `b3c10cb7` (develop `f01e8c3e` plus the runner commits, which is the base of feat/rust-runtime). Binary mtime: 2026-10-15 19:33:45 -0400. +- Image: `map2check-dev:cutover-f01e8c3e-time` (`sha256:48a8ed09…`), which is `cutover-f01e8c3e` plus GNU `time`. + +### Corpus and settings + +- Corpus: `tests/regression_test/test_cases/sv-benchmarks`, with 41 task×property pairs. +- Settings: `GENS="afl symex" TIMEOUT=45`, REPS=5 for C and Rust, and REPS=3 for C `--btree`. +- The runs were sequential: Rust 19:08–20:12, C 20:12–21:17, C-btree 21:17–21:33. +- Before each run, `free -g` showed 4 GB or more available. + +### Resource caps (the same on both sides) + +- Every container ran with `--memory 3g --memory-swap 3g --cpus 4`. +- **KLEE `--max-memory=2000`:** + - The frontend runs `${MAP2CHECK_PATH}/bin/klee …` and has no option for extra KLEE flags. It also resets `MAP2CHECK_PATH` from `/proc/self/exe`. + - The cap is therefore applied through an overlay install tree, built per container. It contains a copy of `map2check`, symlinks to the rest of the install, and a `bin/klee` wrapper that runs `exec /bin/klee --max-memory=2000 "$@"`. + - The overlay script is `$S/t42b/overlay.sh`. + - The wrapper was confirmed on both sides through a logged argv. +- The caps change the absolute numbers. They do not change the fairness of the comparison. +- **OOM detection:** `run-corpus.sh` (`20e0572b`) compares `oom_kill` in the container's `memory.events` before and after each task. A new kill without a decided verdict is recorded as verdict `OOM`. + +### Runner commits (signed, not pushed) + +- `8cf38ce9`: `EXTRA_FLAGS`. +- `20e0572b`: OOM verdict. + +## compare.py output + +``` +$ python3 scripts/cutover/compare.py tests/cutover/baseline-c-gate.tsv tests/cutover/baseline-rust.tsv --accepted tests/cutover/deltas-aceitos.tsv +median wall ratio: 1.015 median rss ratio: 1.360 + +| key | field | c | rust | +|---|---|---|---| +| array-examples/standard_sentinel-2.yml unreach-call afl | verdict | OOM | UNKNOWN | +| array-examples/standard_two_index_04.yml unreach-call afl | verdict | OOM | UNKNOWN | +| array-examples/standard_two_index_05.yml unreach-call afl | verdict | OOM | UNKNOWN | +| ldv-memsafety/ArraysOfVariableLength.yml valid-memsafety symex | verdict | UNKNOWN | SUCCEEDED | +| list-ext-properties/960521-1_1-1.yml valid-memsafety symex | line | 0 | 533 | +| list-ext-properties/960521-1_1-1.yml valid-memsafety symex | function | - | main | +| list-ext-properties/list-ext.yml unreach-call afl | verdict | UNKNOWN | FAILED | +| list-ext-properties/list-ext.yml unreach-call afl | tag | - | TARGET-REACHED | +| list-ext-properties/list-ext.yml unreach-call afl | line | - | 556 | +| list-ext-properties/list-ext.yml unreach-call afl | function | - | main | +| list-ext-properties/simple-ext.yml unreach-call symex | verdict | UNKNOWN | FAILED | +| list-ext-properties/simple-ext.yml unreach-call symex | tag | - | TARGET-REACHED | +| list-ext-properties/simple-ext.yml unreach-call symex | line | - | 540 | +| list-ext-properties/simple-ext.yml unreach-call symex | function | - | main | +| map2check-assert/ex01_false.yml unreach-call symex | verdict | UNKNOWN | FAILED | +| map2check-assert/ex01_false.yml unreach-call symex | tag | - | TARGET-REACHED | +| map2check-assert/ex01_false.yml unreach-call symex | line | - | 5 | +| map2check-assert/ex01_false.yml unreach-call symex | function | - | __VERIFIER_assert | +| memsafety/960521-1-2.yml valid-memsafety symex | verdict | UNKNOWN | SUCCEEDED | +| all | median rss ratio | <= 1.25 | 1.360 | +``` + +With `--accepted tests/cutover/deltas-aceitos-PROPOSTA.tsv`, the four verdict-gain rows and the four list-ext afl rows drop out. The following still fail: + +- the 3 OOM rows; +- the 2 rows for 960521-1_1-1; +- the 8 rows for simple-ext and ex01_false; +- the RSS median. + +The result is still **FAIL**. + +## Verdict counts (mode of the reps per task) + +| gen | side | FAILED | SUCCEEDED | UNKNOWN | OOM | TIMEOUT | correct vs `expected_verdict` | +|---|---|---|---|---|---|---|---| +| afl | C | 11 | 0 | 27 | 3 | 0 | 11 | +| afl | Rust | 12 | 0 | 29 | 0 | 0 | 12 | +| symex | C | 13 | 8 | 20 | 0 | 0 | 20 | +| symex | Rust | 15 | 10 | 16 | 0 | 0 | 24 | + +- No row went from SUCCEEDED to FAILED or back, and no tag changed between rows that are FAILED on both sides. +- The C reps never disagree on any field (they are fully stable), and the Rust reps don't either. So there are no (d) rows. +- Criterion 4 holds: Rust has 36 correct verdicts against 31 for C. + +## Classification of every failing row + +| # | task / prp / gen | C → Rust | class | diagnosis | proposed | +|---|---|---|---|---|---| +| 1 | ArraysOfVariableLength / memsafety / symex | UNKNOWN → SUCCEEDED (expected true) | **(a)** | C stops on KLEE's 31 s `--max-time` (31.35 s, 5/5). Rust finishes the exploration in 22.6 s, thanks to the 2.7b throughput gain. | GANHO-ORCAMENTO | +| 2 | 960521-1-2 / memsafety / symex | UNKNOWN → SUCCEEDED (expected true) | **(a)** | Same: C at 31.35 s, the budget; Rust at 31.28 s. | GANHO-ORCAMENTO | +| 3 | list-ext / unreach / afl (4 fields) | UNKNOWN → FAILED TARGET-REACHED line 556 main (expected false) | **(b)** | Known UB in the benchmark (task-3.3 "Cause A"). The tail node's `n` is never initialised. In C, glibc reuses a chunk the runtime freed, so the seed crashes on a garbage dereference, the replay misses the target, and the result is UNKNOWN. In Rust the word is 0, and CmpLog finds the target. | UB-BENCHMARK-list-ext | +| 4 | simple-ext / unreach / symex (4 fields) | UNKNOWN → FAILED TARGET-REACHED line 540 main (expected false) | **C defect** (not a/b/c/d) | Reproduced by hand, see "C property-file race" below. C's KLEE does reach `__VERIFIER_error` (line 539, `abort.err`), but `map2check_property` ends up **0 bytes**, so the frontend says UNKNOWN in 0.45 s. This is not a budget effect. | no: needs an SD ("bug do C corrigido") | +| 5 | ex01_false / unreach / symex (4 fields) | UNKNOWN → FAILED TARGET-REACHED line 5 `__VERIFIER_assert` (expected false) | **C defect** | Same race. KLEE `abort.err` at line 4 or 5, 199 ktests, `map2check_property` 0 bytes, UNKNOWN in 2.6 s. | no: needs an SD | +| 6 | 960521-1_1-1 / memsafety / symex (line, function) | `0`/`-` → `533`/`main` | **C defect** | Same race. Both `map2check_property` and `map2check_property_deref` are 0 bytes. The frontend still prints FALSE-DEREF, because the `_deref` file exists, but it parses line 0 and an empty function. C afl on the same task reports `533 main`, the same as Rust. | no: needs an SD | +| 7 | standard_sentinel-2 / unreach / afl | OOM → UNKNOWN (expected true) | **C defect (memory)** | C hits the 3 GB cap in 15 of 15 reps (`oom_kill` seen; maxrss about 3.1 GB). Without the cap, the committed `baseline-c.tsv` shows **12.8 GB**, with UNKNOWN. Rust uses 341 MB. The program reads 100 000 `__VERIFIER_nondet_int`. Hypothesis, not profiled: per-call growth of the C NonDetLog under AFL. | no: needs an SD, or a ruling that a C OOM is equivalent to UNKNOWN | +| 8 | standard_two_index_04 / unreach / afl | OOM → UNKNOWN | C defect (memory) | Same as #7 (`a[100000]`, `b[100000]`). | no | +| 9 | standard_two_index_05 / unreach / afl | OOM → UNKNOWN | C defect (memory) | Same as #7. | no | +| 10 | all / median RSS ratio | 1.360 > 1.25 | D4 (criterion 8) | See "Performance". The excess is a fixed overhead under symex, about +80 MB. | not a delta row | + +- **(c) Rust or pass defects: 0.** +- **(d) C nondeterminism: 0.** + +### C property-file race (rows 4–6) + +How the cases were reproduced: +- `map2check --debug --timeout 45 --nondet-generator symex …` with `release-afl`, under the same caps. +- The kept dirs are in `$S/t42b/repro/{c-simple-ext,c-ex01,c-960}`. + +What the C runtime does: +- `write_property` (`PropertyGenerator.c:50`) does `fopen("map2check_property","w")`, then `fprintf`, then `fclose`. +- Under KLEE with `--external-calls=all`, every state shares the host file. A state that later opens the file with `"w"` (O_TRUNC) truncates the violating state's content. +- `--exit-on-error-type=Abort` then halts KLEE before that state writes anything. + +Evidence: +- `map2check_checked_error` (12 bytes) and `abort.err` are present; +- the property files are 0 bytes. + +This is the same last-writer race the Rust runtime had (task-3.3 "Cause B"). Rust fixed it in `6b49b82` (temp file + `rename`). In this window the C race is deterministic: 5 of 5 reps on each task. + +## Performance (criteria 6–9) + +| gen | n | median wall ratio Rust/C | median RSS ratio | Σ median wall C | Σ median wall Rust | TIMEOUT C | TIMEOUT Rust | +|---|---|---|---|---|---|---|---| +| afl | 41 | 1.003 | 0.987 | 165.1 s | 167.5 s | 0 | 0 | +| symex | 41 | 1.091 | 1.582 | 617.0 s | 599.7 s | 0 | 0 | +| all | 82 | **1.015** | **1.360** | 782.2 s | 767.2 s | 0 | 0 | + +- **Criterion 6 PASSES:** 1.015 ≤ 1.10. symex alone is 1.091. +- **Criterion 7 PASSES:** TIMEOUT is 0 on both sides for each generator. C additionally has 3 afl OOM rows. +- **Criterion 8 FAILS: 1.360 > 1.25.** + - Under symex, Rust uses about 80 MB more than C at the median (about 200–230 MB against 127–170 MB), and the excess is nearly constant across tasks. + - Hypothesis, not profiled: KLEE loads and `--optimize`s a 2.2 MB `map2check-klee.bc`, while the C runtime's `.bc` files total 0.13 MB. + - afl is neutral (0.987). Some afl rows sit at a plateau of about 341 MB on both sides (for example C 960521-1_1-2, test-0158); those are AFL++ process peaks, not runtime state. +- **Criterion 9:** 18 rows have a wall ratio above 1.5. Each needs a profile in `docs/cutover/perf.md`. + - 16 are symex runs where C finishes in under 2 s and Rust takes about 3.1–3.4 s. The median extra is +2.4 s on short symex tasks, which looks like a fixed start-up cost with the same probable cause as the RSS excess. + - The other two are `check_if_bug` and `ex02_false` (afl, 0.33 s → 1.45 s). + - Largest RSS outlier: split_list_test05-1 symex, 243 → 472 MB (1.94). The largest Rust peak in the whole run is 476 MB, and Rust had no OOM. + +## D3 (`--btree`) and D4 (RSS) + +valid-memsafety: 30 tasks × 2 generators. C-array and Rust have 5 reps, C-btree has 3. Peaks are medians. + +**Local corpus note.** No "5 largest MemSafety-Arrays.set tasks" set is available locally. `MemSafety-Arrays.set` (`array-memsafety/*.yml`, `array-examples/*.yml`) matches exactly 5 memsafety tasks in the corpus: relax-1 (621 lines), insertionsort-alloca-1, array01-alloca-2, lis_unsafe and add_last_unsafe. They are included in the 30. + +| gen | median C-array | median C-btree | median Rust | tasks where Rust > C-btree | max Rust/C-btree | median Rust/C-array | +|---|---|---|---|---|---|---| +| afl | 93.5 MB | 94.3 MB | 92.3 MB | 8 / 30 (the 341 MB AFL plateau) | 3.64 | 0.987 | +| symex | 139.6 MB | 136.3 MB | 221.2 MB | 30 / 30 | 3.17 (split_list_test05-1: 149 vs 472 MB) | 1.597 | + +The 5 MemSafety-Arrays tasks, symex (C-array / C-btree / Rust): + +| task | C-array | C-btree | Rust | +|---|---|---|---| +| relax-1 | 178 MB | 151 MB | 227 MB | +| add_last_unsafe | 169 MB | 136 MB | 217 MB | +| array01-alloca-2 | 169 MB | 137 MB | 239 MB | +| insertionsort-alloca-1 | 144 MB | 137 MB | 227 MB | +| lis_unsafe | 170 MB | 140 MB | 227 MB | + +**C `--btree` changes verdicts and is unsound.** Under symex it gives **3 wrong SUCCEEDED results on tasks whose expected verdict is false**: lis_unsafe, memleaks_test1-1 and memleaks_test17_2-1. It also loses list-ext (FAILED → UNKNOWN, on both generators). Correct results: afl 8 vs 9 for C-array; symex 22 correct plus 3 wrong vs 18 correct plus 0 wrong for C-array. Rust: 20 correct, 0 wrong. + +**Recommendation** + +- **D3: do not port `--btree`. Make it a no-op that prints a warning in the Rust frontend.** + - The literal Task 2.6 condition fails: Rust's peak is above C-btree on all 30 symex tasks. But that excess is a fixed overhead of about 80 MB, and the largest peak is 472 MB, far from any limit. + - The C-btree baseline is not a valid target: it is unsound on 3 tasks. + - The maintainer should approve this deviation from the literal condition explicitly. +- **D4: do not approve 1.25 as a median ratio as it stands.** The symex median of 1.58 comes from a constant overhead, not from growth with the program's state. + - Option 1: reduce the overhead first. A smaller or stripped `map2check-klee.bc` would act on start-up and RSS together, and then the gate is re-measured. + - Option 2: write D4 per generator: afl ratio ≤ 1.25, plus an absolute symex bound, for example a median excess of 100 MB or less. + +## Proposal + +- `tests/cutover/deltas-aceitos-PROPOSTA.tsv` covers only classes (a) and (b). +- It must not be merged into `deltas-aceitos.tsv` without the maintainer's approval. +- The C defects in rows 4–9 need new `SD-xx` entries ("bug do C corrigido") in `docs/semantic-deltas.md` before they can be accepted. The reproductions are given above. + +`$S` = `/tmp/claude-1000/-home-rock-Documents-Dev-map2check-library/561b38ab-d0f9-4bb7-a72d-b85b8d5834c3/scratchpad`. It holds the logs, the overlay script, the analysis script (`t42/analyse.py`) and the reproduction dirs. + +## Decisões do mantenedor (2026-10-16) + +1. **Deltas: "Aceitar tudo".** + - As 6 linhas da PROPOSTA (GANHO-ORCAMENTO e UB-BENCHMARK-list-ext) foram aprovadas. + - Foram acrescentadas 13 linhas por bugs do runtime C: + - `C-BUG-property-race` (10 linhas): o arquivo `map2check_property` compartilhado é truncado por outros estados do KLEE, e o frontend do C dá UNKNOWN (simple-ext, ex01_false) ou lê "Line 0"/função vazia (960521-1_1-1). Os campos verdict/tag/line/function de simple-ext e ex01_false e line/function de 960521-1_1-1. + - `C-BUG-oom-afl-nondet` (3 linhas): o C estoura os 3 GB nas três tarefas `standard_*` em afl (Rust, cerca de 341 MB). A causa (crescimento do NonDetLog por chamada) é hipótese, não perfilada. + - Todas as divergências de campo listadas neste relatório ficaram cobertas. Nenhuma ficou sem causa. As entradas correspondentes em `docs/semantic-deltas.md` (map2check-library) ainda precisam ser escritas. + - `deltas-aceitos-PROPOSTA.tsv` foi removido; `deltas-aceitos.tsv` tem 19 linhas de dados. +2. **D3:** `--btree` não é portado; continua um no-op com aviso. O `--btree` do C dá SUCCEEDED errado em lis_unsafe, memleaks_test1-1 e memleaks_test17_2-1, então não é referência válida. O mantenedor aprovou se afastar da condição literal da Task 2.6. +3. **D4:** aceita a razão mediana medida. O limite do critério 8 passa a ser **1,36** (medido 1,36; afl 0,99, symex 1,58). `compare.py` usa `--max-rss` 1.36 por padrão. Causa (KLEE com `.bc` do runtime de 2,2 MB contra 0,13 MB): hipótese, não perfilada. +4. **Critério 9 continua ABERTO:** as 18 linhas com razão de tempo de parede acima de 1,5 ainda precisam de perfil em `docs/cutover/perf.md`. Não foi feito. + +### Novo veredito + +``` +$ python3 scripts/cutover/compare.py tests/cutover/baseline-c-gate.tsv tests/cutover/baseline-rust.tsv --accepted tests/cutover/deltas-aceitos.tsv +median wall ratio: 1.015 median rss ratio: 1.360 + +gate: PASS +``` + +O `gate` (critérios 1–8) passa. O critério 9 segue pendente. `test_compare.py`: 6 de 6 testes passam. + +## Critério 9 — perfis + +Gate run 1 has 18 rows with a wall ratio (Rust/C, medians of 5 reps) above 1.5: **15 symex and 3 afl**. The earlier count of "16 symex + 2 afl" in this report was wrong, because list-ext afl is at 1.56. Every row falls into one of three cause groups. + +### How the profiles were taken + +- **Same images, installs and caps as the gate:** + - `release-gate2` in `cutover-klee-rust-time`; + - `release-afl` in `cutover-f01e8c3e-time`; + - `--memory 3g --memory-swap 3g --cpus 4`, KLEE `--max-memory=2000`; + - `free -g` showed 4 GB or more available before each container. +- **Phase times:** the overlay install wraps every `bin/*` tool (clang, opt, llvm-link, klee) with a timer, and the `--debug` output is timestamped line by line. The AFL++ phases are read from those timestamps. +- **KLEE breakdown:** + - `klee-stats --to-csv` on `klee-out-0`. The `UserTime` of the first `run.stats` row is the CPU spent before the first instruction runs; the final row gives the exploration `WallTime` and `SolverTime`. + - KLEE re-run alone on the kept `-witness-result.bc` with flags removed one at a time. + - Host `perf record -g -p` on KLEE inside the container (run as the host uid), with symbols from the image's `libLLVM-16.so.1` via `--symfs`. +- **Scripts:** `$S/c9/` (`prof.sh`, `kvar2.sh`, `dropbt.sh`, `rssbt.sh`, `perfk.sh`, `ksum.sh`). +- **Kept run directories:** `$S/c9/runs/` and `$S/c9/runs2/`. + +### Group A: KLEE start-up on the 2.3 MB runtime module (15 symex rows) + +**Measured.** +- **What it is:** a fixed cost of about 2.6–2.7 s per KLEE run, before any instruction executes. +- **What it is not:** path count, the solver, or per-path cost in the runtime. +- **The C rows that take longer** (1–2.6 s) show a smaller delta, because Rust's exploration is faster there (the 2.7b gain) and absorbs part of the fixed cost. + +KLEE profiles (`klee` = wall time of the KLEE process; `pre_exec` = `UserTime` before the first instruction): + +| run | side | klee s | pre_exec s | exploration wall s | solver s | instructions | paths | +|---|---|---|---|---|---|---|---| +| byte_add_bug | Rust | 2.93 | 2.63 | 0.11 | 0.00 | 46 186 | 1 | +| byte_add_bug | C | 0.29 | 0.22 | 0.03 | 0.00 | 19 658 | 1 | +| test-bitfields-3.1-2 | Rust | 3.17 | 2.88 | 0.12 | 0.00 | 34 356 | 1 | +| test-bitfields-3.1-2 | C | 0.31 | 0.23 | 0.03 | 0.00 | 30 180 | 1 | +| 960521-1_1-3 | Rust | 3.35 | 2.85 | 0.35 | 0.07 | 471 187 | 15 | +| 960521-1_1-3 | C | 1.67 | 0.23 | 1.40 | 0.09 | 3 457 247 | 19 | +| insertionsort-alloca-1 | Rust | 3.35 | 2.90 | 0.29 | 0.05 | 406 655 | 4 | +| insertionsort-alloca-1 | C | 1.49 | 0.24 | 1.20 | 0.04 | 3 629 574 | 4 | +| ex01_false | Rust | 4.86 | 2.88 | 1.82 | 1.55 | 233 479 | 165 | +| ex01_false | C | 2.55 | 0.22 | 2.28 | 2.00 | 317 741 | 199 | + +**Other pipeline phases:** +- clang, opt and the frontend take under 0.1 s on both sides. +- Rust's single `llvm-link` with `map2check-klee.bc` takes 0.18–0.19 s, against 2 × 0.015 s for C's links of the C `.bc` files. + +**Where the start-up goes** (byte_add_bug, KLEE alone on the kept module, 2 runs each): + +| variant | Rust s | C s | +|---|---|---| +| as in the gate (`--optimize`) | 3.14 | 0.29 | +| without `--optimize` | 1.22 | 0.27 | +| without `--optimize`, `--max-instructions=1` | 1.12 | 0.25 | +| `--optimize`, without `assembly.ll` and `run.istats` | 3.02 | 0.28 | +| `--optimize`, debug info stripped from the whole module | 3.07–3.14 | – | +| `--optimize`, internalize + globaldce (2.05 MB) | 2.95–3.07 | – | +| `--optimize`, **std backtrace symbolizer bodies deleted** (1.44 MB) | **1.47–1.53** | – | +| same, without `--optimize` | 0.75–0.77 | – | + +- **`--optimize` is about 1.9 s.** + - The `perf` profile is 81.5% in `libLLVM-16`. + - The top symbols are LLVM optimization passes: `ScalarEvolution::getRangeRef`, `InstructionCombiningPass::runOnFunction`, `ValueHandleBase::AddToUseList`, `decomposeBitTestICmp` and `FoldingSet`. + - KLEE re-optimizes a runtime that rustc already built at O3 with fat LTO. +- **Loading, linking with uclibc and module preparation are about 0.9 s.** + - Without `--optimize`, 64% of the samples are in `libLLVM-16` (bitcode reader, `TypeFinder`, `IRMover`, `formatted_raw_ostream`) and 29% are in `ld-linux`. +- **What the module holds:** + - The kept `-witness-result.bc` has 583 defined functions, 7 371 branches and an 11 MB `assembly.ll`. C's has 80 functions, 478 branches and 2.2 MB. + - Of the runtime's 125 829 IR instructions, about 60 000 are std's backtrace symbolizer, pulled in by the default panic hook: gimli, addr2line and miniz_oxide (52 806) plus rustc_demangle (7 299). + - The library itself is 30 896 instructions. + - The symbolizer code never runs on a non-panicking path. With its bodies deleted, KLEE's instruction count is unchanged (45 184 against 45 176) and the result is the same. +- **RSS:** the same deletion lowers KLEE's peak RSS from 221 MB to 161 MB (C: 127 MB). That is about 60 of the 94 MB symex excess behind D4. + +**Library defect: reported, not fixed.** See the task-4.3 criterion 9 report in map2check-library for the suggested fix. + +### Group B: C skips AFL++ because its link fails; Rust runs it (2 afl rows) + +**Measured.** Rows: check_if_bug and ex02_false (unreach-call, afl). Both sides say UNKNOWN. + +**C** (0.36 s): +- All three `afl-clang-fast` links fail with `undefined reference to '__VERIFIER_assert'`. The C runtime does not define it. +- The frontend prints "the AFL++ binary is unavailable -- skipping the fuzzer phase" at 0.356 s and reports UNKNOWN. + +**Rust** (1.48 s): +- The three AFL++ binaries build: 0.11 s → 0.45 s. +- `afl-fuzz` then runs for 1.03 s and exits with 256, on "The program took more than 1000 ms to process one of the initial test cases". +- The seed `AAAAAAAA` makes the loop bound `0x41414141`, so the dry run reaches AFL++'s 1 s timeout. + +**Conclusion:** the extra 1.1 s is a fuzzing phase that C never reaches. It is not runtime cost. The C link failure is a C-side defect outside this gate's field comparison, because the verdicts are equal. + +### Group C: a different verdict, from extra work that pays off (1 afl row) + +**Measured.** Row: list-ext (unreach-call, afl): C UNKNOWN 0.53 s, Rust FAILED 0.79 s. This is the accepted `UB-BENCHMARK-list-ext` delta. + +| phase | C | Rust | +|---|---|---| +| AFL++ builds | 0.28 s | 0.34 s | +| `afl-fuzz` | 0.08 s, exit 256 | 0.26 s, exit 0 (finds the target) | +| report | – | witness and replay | + +- The +0.28 s is the work of reaching FAILED TARGET-REACHED. +- The RSS of 340 MB is the AFL++ process plateau already noted above. + +### Per-row table + +R−C is the difference of the median wall times. "profiled" marks a row with its own profile above; the other rows are assigned by the same signature. +- **Group A signature:** Rust at 3.1–3.4 s whatever C's time, and R−C between +1.6 and +2.9 s, falling as C's exploration time grows. +- **Group B signature:** both UNKNOWN, C at about 0.33 s. + +| task | gen | ratio | cause group | evidence | +|---|---|---|---|---| +| ldv-memsafety-bitfields/test-bitfields-3.1-2 (memsafety) | symex | 9.17 | A: KLEE start-up | profiled: pre_exec 2.88 s vs 0.23 s; exploration 0.12 s vs 0.03 s; R−C +2.86 s | +| map2check-assert/byte_add_bug (unreach) | symex | 8.81 | A | profiled: pre_exec 2.63 s vs 0.22 s; 0 queries, 1 path; `perf`, flag ablation and symbolizer deletion done on this row; R−C +2.81 s | +| ldv-memsafety/memsetNonZero (memsafety) | symex | 8.38 | A | R−C +2.73 s; Rust 3.10 s | +| ldv-memsafety-bitfields/test-bitfields-1-1 (memsafety) | symex | 7.36 | A | R−C +2.67 s; Rust 3.09 s | +| list-ext-properties/simple-ext (unreach) | symex | 7.24 | A (verdict differs: C-BUG-property-race) | R−C +2.81 s; Rust 3.26 s; C stops at UNKNOWN in 0.45 s because of the race (SD-20) | +| ldv-memsafety-bitfields/test-bitfields-2.1-2 (memsafety) | symex | 6.62 | A | R−C +2.64 s; Rust 3.11 s | +| list-ext-properties/test-0158_1-1 (memsafety) | symex | 6.20 | A | R−C +2.65 s; Rust 3.16 s | +| list-ext-properties/test-0019_1-1 (memsafety) | symex | 5.46 | A | R−C +2.63 s; Rust 3.22 s | +| check_if_bug (unreach) | afl | 4.39 | B: C skips AFL++ | profiled: C link fails on `__VERIFIER_assert` at 0.36 s; Rust `afl-fuzz` dry-run timeout of 1.03 s; R−C +1.12 s | +| ex02_false (unreach) | afl | 4.24 | B | profiled: same as check_if_bug; R−C +1.10 s | +| list-ext-properties/simple-ext (memcleanup) | symex | 3.46 | A | R−C +2.36 s; Rust 3.32 s | +| memsafety/960521-1-3 (memsafety) | symex | 3.43 | A | R−C +2.38 s; Rust 3.36 s | +| memsafety/960521-1-1 (memsafety) | symex | 3.29 | A | R−C +2.29 s; Rust 3.29 s | +| list-ext-properties/960521-1_1-1 (memsafety) | symex | 2.12 | A | R−C +1.78 s; Rust 3.37 s; same program family as 960521-1_1-3 | +| list-ext-properties/960521-1_1-3 (memsafety) | symex | 2.01 | A | profiled: pre_exec 2.85 s vs 0.23 s; exploration 0.35 s vs 1.40 s (Rust 7× fewer instructions); R−C +1.73 s | +| array-memsafety/insertionsort-alloca-1 (memsafety) | symex | 1.97 | A | profiled: pre_exec 2.90 s vs 0.24 s; exploration 0.29 s vs 1.20 s; R−C +1.60 s | +| map2check-assert/ex01_false (unreach) | symex | 1.88 | A (verdict differs: C-BUG-property-race) | profiled: pre_exec 2.88 s vs 0.22 s; exploration 1.82 s vs 2.28 s, solver 1.55 s vs 2.00 s; R−C +2.27 s | +| list-ext-properties/list-ext (unreach) | afl | 1.56 | C: extra work for a better verdict | profiled: `afl-fuzz` 0.26 s (finds the target) vs 0.08 s; FAILED vs UNKNOWN (UB-BENCHMARK-list-ext); R−C +0.28 s | + +**Totals:** A = 15 rows, B = 2, C = 1. +- No row shows a per-path or per-call cost in the runtime. +- No row shows solver time above C's. +- Every profiled exploration phase is as fast as C's or faster. + +**Criterion 9:** criteria 6 and 7 pass, so none of the 18 rows blocks. All 18 now have a recorded cause. The plan names `docs/cutover/perf.md` as the place for these profiles. That file does not exist yet in either repository, so the profiles are recorded here. + +## Re-execução symex com runtime KLEE reduzido (2026-10-16) + +Only the Rust symex side was re-run. The runtime bitcode is now slimmer (std's backtrace symbolizer stubbed out). The afl rows and the C tables are unchanged. + +### Setup + +- map2check-library `94a17ec` (`ef166d1` + `94a17ec`), built from a `git archive` with a fresh `CARGO_TARGET_DIR`: `cargo build --profile runtime --features libfuzzer,wasm`, and `scripts/build-klee-runtime.sh` (rustc 1.72.1, LLVM 16.0.5) inside `map2check-dev:cutover-klee-rust`. +- Map2Check-rust `33e3b005`, installed into fresh `build-gate3/` and `release-gate3/` with the same CMake flags as `release-gate2`, pointing `MAP2CHECK_RUST_LIB_DIR` and `MAP2CHECK_RUST_KLEE_BC` at the new artifacts. `cmp` confirms the installed `.a` and `.bc` are the ones built. +- Installed `map2check-klee.bc`: 1 241 728 bytes (1.24 MB), against 2 296 020 bytes in `release-gate2`. +- Same image (`cutover-klee-rust-time`), same caps (`--memory 3g --memory-swap 3g --cpus 4`, KLEE `--max-memory=2000` through the overlay `bin/klee` wrapper, confirmed in the process list), `GENS=symex REPS=5 TIMEOUT=45`, and `free -g` showed 4 GB available before the container started. +- Output: `baseline-rust-symex-slim.tsv` (205 rows). `baseline-rust-v2.tsv` is the afl rows of `baseline-rust.tsv` plus these symex rows (410 rows). + +### compare.py (C gate baseline vs v2, with `deltas-aceitos.tsv`) + +``` +median wall ratio: 1.011 median rss ratio: 1.081 + +gate: PASS +``` + +No field divergence outside the accepted deltas. Against the first run, no symex row changed verdict, tag, line, function or witness. + +### Before and after (Rust/C) + +| gen | median wall before → after | median RSS before → after | Σ median wall Rust (C = 617.0 s symex) | rows >1.5 wall | TIMEOUT / OOM | +|---|---|---|---|---|---| +| afl | 1.003 → 1.003 | 0.987 → 0.987 | 167.5 s (unchanged) | 3 → 3 | 0 / 0 | +| symex | 1.091 → 1.035 | 1.582 → 1.224 | 599.7 s → 523.0 s | 15 → 10 | 0 / 0 | +| all | 1.015 → 1.011 | 1.360 → 1.081 | 767.2 s → 690.6 s (C 782.2 s) | 18 → 13 | 0 / 0 | + +- Criterion 6 passes (1.011 ≤ 1.10), criterion 7 passes (0 TIMEOUT, 0 Rust OOM), criterion 8 passes (1.081 ≤ 1.36, and also ≤ 1.25). +- Symex median peak RSS: C 143.7 MB, Rust 225.5 MB → 168.2 MB. Largest Rust peak: 443.6 MB (split_list_test05-1). +- Criterion 9: 13 rows above 1.5 wall (10 symex, 3 afl), all with C under 1 s and Rust 0.8–1.55 s. The symex ones are the short tasks (C 0.35–0.96 s, Rust 1.35–1.55 s), so the fixed start-up cost of about +1 s remains. + +## Gate 2 (Task 5.1, 2026-10-17) + +The second consecutive gate, on the branch as it stands for the merge. Only the Rust side was re-run: the C baseline is still `baseline-c-gate.tsv`, because the merge-base (develop `f01e8c3e`) has not changed (`git merge-base` = `origin/develop` = `f01e8c3e`, so the rebase is a no-op). + +### Setup + +- Map2Check-rust `f7f15e3b` (feat/rust-runtime HEAD, with the M-1 CMake fix and the README/CHANGELOG commits), built from the working tree with no tracked change, into fresh `build-gate5/` and `release-gate5/`, same CMake flags as `release-gate2`. +- Runtime: the `v1.1.0-rc1` release archive of map2check-library (sha256 `dd90e888…209666`, verified), `MAP2CHECK_RUST_LIB_DIR=/lib`. `cmp` confirms the installed `lib/libmap2check.a` is the archive's `libmap2check_runtime.a` (sha256 `872caf5f…`). +- KLEE bitcode: built by the branch's `scripts/runtime/map2check-klee-bc.sh` (tag `v1.1.0-rc1`, commit `49a25e4` checked), 1.2 MB, sha256 `9da42b2c…`; `cmp` confirms it is the installed `map2check-klee.bc`. +- Image `map2check-dev:cutover-klee-rust-time`, `--memory 3g --memory-swap 3g --cpus 4`, KLEE `--max-memory=2000` through the overlay `bin/klee` wrapper (seen in the container's process list), `GENS="afl symex" REPS=5 TIMEOUT=45`, `free -g` ≥ 4 GB before the container started. Run 13:02–14:07. +- Output: `baseline-rust-gate2.tsv` (410 rows). + +### compare.py + +``` +$ python3 scripts/cutover/compare.py tests/cutover/baseline-c-gate.tsv tests/cutover/baseline-rust-gate2.tsv --accepted tests/cutover/deltas-aceitos.tsv +median wall ratio: 1.026 median rss ratio: 1.017 + +gate: PASS +``` + +No new divergence, and `deltas-aceitos.tsv` is unchanged. Against `baseline-rust-v2.tsv` (gate run 1 + slim symex), no row changed the mode of verdict, tag, line, function or witness. + +| gen | median wall Rust/C | median RSS Rust/C | Σ median wall C / Rust | rows >1.5 wall | Rust verdicts (mode) | correct vs `expected_verdict` | +|---|---|---|---|---|---|---| +| afl | 1.009 | 0.983 | 165.1 s / 168.6 s | 3 | 12 FAILED, 29 UNKNOWN | 12 | +| symex | 1.033 | 1.214 | 617.0 s / 534.7 s | 10 | 15 FAILED, 10 SUCCEEDED, 16 UNKNOWN | 24 | +| all | 1.026 | 1.017 | 782.2 s / 703.4 s | 13 | | 36 (C: 31) | + +Criteria 6 (1.026 ≤ 1.10), 7 (no TIMEOUT or OOM verdict in any row's mode) and 8 (1.017 ≤ 1.36) pass. + +### Rep variance (not a field divergence) + +One row has reps that disagree, which gate run 1 never had: `memsafety-ext/tree_stack` valid-memsafety symex gave UNKNOWN ×3 (33–40 s), **SUCCEEDED** (60.44 s) and TIMEOUT (60.12 s, the runner's outer `timeout 60`). The mode is UNKNOWN, as in C and in every earlier Rust run, so `compare.py` passes. One other rep was slow with the same verdict: `memsafety-ext2/length_test03-1` afl rep 1, 53.6 s against a 1.5 s median. + +- A diagnostic re-run of tree_stack symex (5 reps, same install, image and caps) gave UNKNOWN 5/5 at 32.9–33.1 s, so this looks like host contention during the gate (the host was near its memory floor), not the runtime. +- The SUCCEEDED rep is still a concern, and it is in the frontend, not in the runtime. `Caller` counts only exit code 124 of `timeout -k 10 36 klee …` (`result == 31744`) as a timeout. A KLEE that ignores SIGTERM and is SIGKILLed after the grace period exits 137, which is not caught, and `kleeHaltedOnTimer` cannot fire without a final stats row. The verdict then comes from the property file, and no violation means TRUE. Hypothesis, not reproduced. The same code is in develop (`f01e8c3e`, `caller.cpp:854`), so it applies to the C runtime too. diff --git a/tests/cutover/test_rust_runtime_cmake.sh b/tests/cutover/test_rust_runtime_cmake.sh new file mode 100755 index 000000000..820d7b328 --- /dev/null +++ b/tests/cutover/test_rust_runtime_cmake.sh @@ -0,0 +1,146 @@ +#!/usr/bin/env bash +# CMake/install layer of the Rust runtime: only libmap2check.a (and optionally +# map2check-klee.bc) is installed, no C runtime bitcode; configure fails loudly +# without a library or with an unreadable bitcode. +# +# Env: MAP2CHECK_RUST_LIB_DIR directory with the runtime-profile libmap2check.a +# (target/runtime), or the lib/ of the release +# archive (required) +# CMAKE_ARGS extra configure flags (e.g. -G Ninja -DLLVM_DIR=...) +set -euo pipefail +ROOT="$(cd "$(dirname "$0")/../.." && pwd)" +LIB="${MAP2CHECK_RUST_LIB_DIR:?set MAP2CHECK_RUST_LIB_DIR}" +read -r -a EXTRA <<<"${CMAKE_ARGS:-}" +W="$(mktemp -d)" +trap 'rm -rf "$W"' EXIT +fail() { echo "FAIL: $*" >&2; exit 1; } + +install_tree() { # ; prints nothing, installs to $W/-p + local n="$1"; shift + cmake -S "$ROOT" -B "$W/$n-b" "${EXTRA[@]}" -DCMAKE_INSTALL_PREFIX="$W/$n-p" "$@" >/dev/null + cmake --build "$W/$n-b" -j >/dev/null + cmake --install "$W/$n-b" >/dev/null +} + +# 1. Only the Rust static library is installed; no C runtime .bc. +# The runtime build (features libfuzzer,wasm) in $LIB, whatever its layout. +if [ -f "$LIB/libmap2check_runtime.a" ]; then RT="$LIB/libmap2check_runtime.a"; else RT="$LIB/libmap2check.a"; fi +install_tree plain -DMAP2CHECK_RUST_LIB_DIR="$LIB" +P="$W/plain-p" +test -f "$P/lib/libmap2check.a" || fail "libmap2check.a not installed" +if ls "$P"/lib/*.bc 2>/dev/null | grep .; then fail "bitcode installed without MAP2CHECK_RUST_KLEE_BC"; fi +if find "$P" -name '*.bc' | grep -E 'map2check|memtrack|bbtrack|nondet|caller|container|analysis|list|btree|AnalysisMode' ; then + fail "C runtime bitcode still installed" +fi + +# 1b. Release archive layout (lib/ of the map2check-library tarball): the +# runtime build, libmap2check_runtime.a, is the one installed as +# libmap2check.a; the featureless core libmap2check.a next to it is not. +R="$W/release-lib"; mkdir "$R" +cp "$RT" "$R/libmap2check_runtime.a" +echo 'not the runtime' >"$R/libmap2check.a" +install_tree release -DMAP2CHECK_RUST_LIB_DIR="$R" +cmp -s "$W/release-p/lib/libmap2check.a" "$R/libmap2check_runtime.a" || + fail "release layout: libmap2check_runtime.a not installed as libmap2check.a" + +# 1c. Local build layout (target/runtime): only libmap2check.a, and it is the +# runtime build, so it is accepted under the plain name. +T="$W/local-lib"; mkdir "$T" +cp "$RT" "$T/libmap2check.a" +install_tree local -DMAP2CHECK_RUST_LIB_DIR="$T" +cmp -s "$W/local-p/lib/libmap2check.a" "$RT" || + fail "local layout: the runtime-profile libmap2check.a not installed" + +# 1d. A libmap2check.a that is not the runtime build (no +# libmap2check_runtime.a next to it): configure must fail instead of linking +# a runtime without the libfuzzer and/or wasm entry points. +reject_lib_dir() { #