Open rasoolmaghareh opened 1 year ago
Is there any special significance of the comment written on this program?
Copied the whole comment below.
/*
* From Avgerinos et al.: Enhancing Symbolic Execution with
* Veritesting, with modifications proposed by Chu Duc Hiep.
*
* In this example, Tracer-X KLEE over-subsumes and not able to
* demonstrate the assertion violation, which can be demonstrated by
* LLBMC. In this version, the variable start is also replaced with 0,
* and the loop iterations reduced to 9.
*
* To run with LLBMC, compile with -DLLBMC, and execute LLBMC with the
* options --ignore-missing-function-bodies -function-name=main
* -no-overflow-checks -max-loop-iterations=0
* -max-function-call-depth=0 -counterexample.
*
* Portions copyright 2017 National University of Singapore
*/
My tests show that deletion can find the bug, while WP can't. Can you please retry? I think TracerX was missing the bug before due to a bug on deletion side and it is passing now since the bug is fixed.
Yes, WP is still missing the bug.
Can you please compare the interpolants to see at which point we have the over subsumption? thanks
Sure.
Initially WP has generated the correct interpolant. First interpolant:
wp interpolant = [(And (Not (Eq 37
(Add w32 (WPVar w32 (counter)) N0:(WPVar w32 (i)))))
(Sle 8 N0))]
but the second interpolant is incorrect and because of this interpolant, assert is getting missed. Second interpolant:
wp interpolant = [(And (Not (Eq 36 (WPVar w32 (counter))))
(Sle 8 (WPVar w32 (i))))]
After generating the above interpolants, TX is switched to the Deletion for rest of the nodes and all the deletion interpolants are correct.
Today when I started debugging this program, unfortunately, I am unable to get the crash by changing counter++
to counter= counter+1
. Interpolants are same for both the versions by WP and Deletion.
The oversubsumption problem is happening for for (int i = 0; i < 5; i++)
and klee_assert(counter != 11);
onwards.
Both WP Interpolation and Deletion interpolation are correctly finding the assertions for
for (int i = 0; i < 4; i++)
and klee_assert(counter != 7);
for (int i = 0; i < 3; i++)
and klee_assert(counter != 4);
for (int i = 0; i < 2; i++)
and klee_assert(counter != 2);
I am trying to find the node with incorrect interpolant leading the oversubsumption.
We are getting incorrect subsumption because only the value of variable 'i'
is stored in the miu part.
Somehow the value of the variable 'counter'
is not stored. And this is causing the problem.
In deletion interpolation, we use coreValues.insert()
to keep record of variables involved in the subsumption of a node.
Later we use theinterpolateValues()
and mark those variables.
Whereas on the wp-side, we are only storing the wp expression.
The variable 'counter' is considered as 'a non-interpolant value'
on the wp-side at Node#6
(from its node->getStoredCoreExpressions).
On the other hand, deletion interpolation is correctly storing the information for the variable as'a left and right interpolant value'.
This is happening because of the update performed for each TxStateValue responsible for the subsumption on the deletion side.
To keep track of the variables present in the wp-interpolant during the subsumption which of the following options is better?
So the summary of the discussion today was that we try to identify the places that .empty()
is checked in the subsumed()
function and ensure in all cases the markings are being passed to the parent nodes.
As I can see that then even after disabling the empty()
function, we are unable to correctly pass the markings.
This is because the deletion interpolation checks for the concretely-addressed store
and symbolically-addressed store
of the present node and based on their values it updates the markings and passes them to the parent node.
However, in our case both Node 7 and Node 8 have empty concretely-addressed store = []
and symbolically-addressed store = []
. So ultimately we are still unable to pass the information to the parent.
Here is the link to the tree for our easy reference.
I think we need to move this to the partitioning
function and perform this action before removing items from concretely-addressed store
and symbolically-addressed store
We can do this information transfer at this function
expr = wp->intersectWPExpr(branchCondition, childWPInterpolant[0],childWPInterpolant[1]);
where we decide to continue with wp-interpolation or switch to the deletion interpolation.
We will do this information transfer only when we are proceeding with the wp-interpolation.
sure, lets see if this fixes the issue.
Arpi tried a few changes and the program doesn't have oversubsumption. But we need to discuss the logic. Logic used:
Is this logic correct?
The logic seems correct, but let's verify it by running on some more tests and make sure that it does not cause over- or under-subsumption.
Note: Since this logic is complex, lets create a new PR for this change.
I have implemented the above logic in this PR (marking_new_WP) a22b8d1.
I think you have pushed the branch and have not created the PR yet. Is that correct?
Sorry. I missed that. Let me create the PR.
In this example, WP misses the error: