Open WeeknightMVP opened 4 years ago
The issue with function pointers is known, CF https://github.com/GaloisInc/crucible/issues/10. I have in mind a fix that would allow us to construct "mux trees" of function pointers that would capture this pattern of function pointer usage, but have not yet had an opportunity to implement it.
The issue with MOD + 1
vs length OPS
appears to be separate problem that we should look into.
While entertaining an effort to verify C code with function pointers (which I suspect cannot be expressed in SAWScript), I encountered some notable behaviors. Consider the following, for which I don't see how SAWScript could verify the
calc
function:Not surprisingly,
llvm_boilerplate
throws an exception when encountering the function pointer array. Uncaught, this exception crashes SAW. Proceeding with a manually generated SAW script:Another crash out of SAW. Undeterred, suppose we continue with an attempt to verify an adaptation of
funpoint.c
, with comments indicating crashes and examples of code variations that SAWScript cannot verify:The altered implementation requires about 27 seconds to verify. If we defer
r = op(a, b)
from each case to after theswitch
statement, the (symbolic) pointer cannot be resolved. If we change thecalc_shim
precondition fromi < (if b == 0 then DVD else MOD + 1)
toi < (if b == 0 then DVD else length OPS)
, SAW fails to convert the Boolean and crashes.I've uploaded example files here: funpoint.zip