Closed yiyuaner closed 3 years ago
One possible explanation is that the rest of checks are not reachable (i.e., dead code) so that the checker never checks them. But it would be helpful if you can share the bitcode so I can double check.
One possible explanation is that the rest of checks are not reachable (i.e., dead code) so that the checker never checks them. But it would be helpful if you can share the bitcode so I can double check.
Here is the bit code. The analysis takes approximately 3 hours to finish. The command I used is
clam git.pp.bc --crab-dom=int --crab-heap-analysis=none --crab-check=assert
One possible explanation is that the rest of checks are not reachable (i.e., dead code) so that the checker never checks them. But it would be helpful if you can share the bitcode so I can double check.
You can use the bc below for a quick verification goaccess_transed.zip
Here is my result:
clam goaccess_transed.bc --crab-dom=int --crab-heap-analysis=none --crab-check=assert
-----------------------------------------------------------------------------------------
************** ANALYSIS RESULTS ****************
7 Number of total safe checks
0 Number of total error checks
9 Number of total warning checks
************** ANALYSIS RESULTS END*************
-----------------------------------------------------------------------------------------
cat goaccess_transed.ll | grep "call void @__CRAB_assert" | wc -l
33
Thanks a lot.
cat goaccess_transed.ll | grep "call void @__CRAB_assert"
:
call void @__CRAB_assert(i32 %0)
call void @__CRAB_assert(i32 12)
call void @__CRAB_assert(i32 %4)
call void @__CRAB_assert(i32 2)
call void @__CRAB_assert(i32 2)
call void @__CRAB_assert(i32 %3)
call void @__CRAB_assert(i32 %8)
call void @__CRAB_assert(i32 %4)
call void @__CRAB_assert(i32 %41)
call void @__CRAB_assert(i32 %3)
call void @__CRAB_assert(i32 2)
call void @__CRAB_assert(i32 %21)
call void @__CRAB_assert(i32 %25)
call void @__CRAB_assert(i32 %spec.select1101)
call void @__CRAB_assert(i32 8)
call void @__CRAB_assert(i32 %align_sz.0.i1084)
call void @__CRAB_assert(i32 2)
call void @__CRAB_assert(i32 2)
call void @__CRAB_assert(i32 %37)
call void @__CRAB_assert(i32 2)
call void @__CRAB_assert(i32 2)
call void @__CRAB_assert(i32 2)
call void @__CRAB_assert(i32 2)
call void @__CRAB_assert(i32 2)
call void @__CRAB_assert(i32 2)
call void @__CRAB_assert(i32 2)
call void @__CRAB_assert(i32 2)
call void @__CRAB_assert(i32 2)
call void @__CRAB_assert(i32 2)
call void @__CRAB_assert(i32 %0)
call void @__CRAB_assert(i32 %10)
call void @__CRAB_assert(i32 %11)
call void @__CRAB_assert(i32 %0)
There are 17 calls to @_CRAB_assert
with a constant argument. The translation from LLVM IR to Crab IR ignores those (https://github.com/seahorn/clam/blob/master/lib/Clam/CfgBuilder.cc#L1403) because the constants are all positive numbers so the assertions trivially hold.
Thanks. Closing then.
Hi, I run clam with the following command:
I have already instrumented
test.bc
with some__CRAB_assert
checks. When the analysis finishes,clam
outputs:It seems that there should be
128+92=220
checking statements intest.bc
. However, I find out there are more (around 700) inserted__CRAB_assert
checks intest.bc
. Why is this happening? Does clam skip the verification for some__CRAB_assert
statements?